846 files changed, 91459 insertions, 18460 deletions

diff --git a/vendor/github.com/agext/levenshtein/.gitignore b/vendor/github.com/agext/levenshtein/.gitignore
index 404365f..4473da1 100644
--- a/vendor/github.com/agext/levenshtein/.gitignore
+++ b/vendor/github.com/agext/levenshtein/.gitignore
@@ -1,2 +1,53 @@
+# Ignore docs files
+_gh_pages
+_site
+
+# Ignore temporary files
 README.html
 coverage.out
+.tmp
+
+# Numerous always-ignore extensions
+*.diff
+*.err
+*.log
+*.orig
+*.rej
+*.swo
+*.swp
+*.vi
+*.zip
+*~
+
+# OS or Editor folders
+._*
+.cache
+.DS_Store
+.idea
+.project
+.settings
+.tmproj
+*.esproj
+*.sublime-project
+*.sublime-workspace
+nbproject
+Thumbs.db
+
+# Komodo
+.komodotools
+*.komodoproject
+
+# SCSS-Lint
+scss-lint-report.xml
+
+# grunt-contrib-sass cache
+.sass-cache
+
+# Jekyll metadata
+docs/.jekyll-metadata
+
+# Folders to ignore
+.build
+.test
+bower_components
+node_modules
diff --git a/vendor/github.com/agext/levenshtein/.travis.yml b/vendor/github.com/agext/levenshtein/.travis.yml
index 95be94a..a51a144 100644
--- a/vendor/github.com/agext/levenshtein/.travis.yml
+++ b/vendor/github.com/agext/levenshtein/.travis.yml
@@ -1,70 +1,25 @@
 language: go
 sudo: false
-go:
-  - 1.8
-  - 1.7.5
-  - 1.7.4
-  - 1.7.3
-  - 1.7.2
-  - 1.7.1
-  - 1.7
-  - tip
-  - 1.6.4
-  - 1.6.3
-  - 1.6.2
-  - 1.6.1
-  - 1.6
-  - 1.5.4
-  - 1.5.3
-  - 1.5.2
-  - 1.5.1
-  - 1.5
-  - 1.4.3
-  - 1.4.2
-  - 1.4.1
-  - 1.4
-  - 1.3.3
-  - 1.3.2
-  - 1.3.1
-  - 1.3
-  - 1.2.2
-  - 1.2.1
-  - 1.2
-  - 1.1.2
-  - 1.1.1
-  - 1.1
-before_install:
-  - go get github.com/mattn/goveralls
-script:
-  - $HOME/gopath/bin/goveralls -service=travis-ci
-notifications:
-  email:
-    on_success: never
 matrix:
   fast_finish: true
+  include:
+    - go: 1.11.x
+      env: TEST_METHOD=goveralls
+    - go: 1.10.x
+    - go: tip
+    - go: 1.9.x
+    - go: 1.8.x
+    - go: 1.7.x
+    - go: 1.6.x
+    - go: 1.5.x
   allow_failures:
     - go: tip
-    - go: 1.6.4
-    - go: 1.6.3
-    - go: 1.6.2
-    - go: 1.6.1
-    - go: 1.6
-    - go: 1.5.4
-    - go: 1.5.3
-    - go: 1.5.2
-    - go: 1.5.1
-    - go: 1.5
-    - go: 1.4.3
-    - go: 1.4.2
-    - go: 1.4.1
-    - go: 1.4
-    - go: 1.3.3
-    - go: 1.3.2
-    - go: 1.3.1
-    - go: 1.3
-    - go: 1.2.2
-    - go: 1.2.1
-    - go: 1.2
-    - go: 1.1.2
-    - go: 1.1.1
-    - go: 1.1
+    - go: 1.9.x
+    - go: 1.8.x
+    - go: 1.7.x
+    - go: 1.6.x
+    - go: 1.5.x
+script: ./test.sh $TEST_METHOD
+notifications:
+  email:
+    on_success: never
diff --git a/vendor/github.com/agext/levenshtein/README.md b/vendor/github.com/agext/levenshtein/README.md
index 90509c2..9e42558 100644
--- a/vendor/github.com/agext/levenshtein/README.md
+++ b/vendor/github.com/agext/levenshtein/README.md
@@ -11,7 +11,7 @@ This package implements distance and similarity metrics for strings, based on th
 
 ## Project Status
 
-v1.2.1 Stable: Guaranteed no breaking changes to the API in future v1.x releases. Probably safe to use in production, though provided on "AS IS" basis.
+v1.2.2 Stable: Guaranteed no breaking changes to the API in future v1.x releases. Probably safe to use in production, though provided on "AS IS" basis.
 
 This package is being actively maintained. If you encounter any problems or have any suggestions for improvement, please [open an issue](https://github.com/agext/levenshtein/issues). Pull requests are welcome.
 
diff --git a/vendor/github.com/agext/levenshtein/go.mod b/vendor/github.com/agext/levenshtein/go.mod
new file mode 100644
index 0000000..545d432
--- /dev/null
+++ b/vendor/github.com/agext/levenshtein/go.mod
@@ -0,0 +1 @@
+module github.com/agext/levenshtein
diff --git a/vendor/github.com/agext/levenshtein/test.sh b/vendor/github.com/agext/levenshtein/test.sh
new file mode 100644
index 0000000..c5ed724
--- /dev/null
+++ b/vendor/github.com/agext/levenshtein/test.sh
@@ -0,0 +1,10 @@
+set -ev
+
+if [[ "$1" == "goveralls" ]]; then
+        echo "Testing with goveralls..."
+        go get github.com/mattn/goveralls
+        $HOME/gopath/bin/goveralls -service=travis-ci
+else
+        echo "Testing with go test..."
+        go test -v ./...
+fi
diff --git a/vendor/github.com/apparentlymart/go-cidr/cidr/cidr.go b/vendor/github.com/apparentlymart/go-cidr/cidr/cidr.go
index 7534473..c292db0 100644
--- a/vendor/github.com/apparentlymart/go-cidr/cidr/cidr.go
+++ b/vendor/github.com/apparentlymart/go-cidr/cidr/cidr.go
@@ -71,12 +71,12 @@ func Host(base *net.IPNet, num int) (net.IP, error) {
         if numUint64 > maxHostNum {
                 return nil, fmt.Errorf("prefix of %d does not accommodate a host numbered %d", parentLen, num)
         }
-        var bitlength int
-        if ip.To4() != nil {
-              bitlength = 32
-        } else {
-              bitlength = 128
-        }
+        var bitlength int
+        if ip.To4() != nil {
+                bitlength = 32
+        } else {
+                bitlength = 128
+        }
         return insertNumIntoIP(ip, num, bitlength), nil
 }
 
diff --git a/vendor/github.com/armon/go-radix/go.mod b/vendor/github.com/armon/go-radix/go.mod
new file mode 100644
index 0000000..4336aa2
--- /dev/null
+++ b/vendor/github.com/armon/go-radix/go.mod
@@ -0,0 +1 @@
+module github.com/armon/go-radix
diff --git a/vendor/github.com/armon/go-radix/radix.go b/vendor/github.com/armon/go-radix/radix.go
index d2914c1..e2bb22e 100644
--- a/vendor/github.com/armon/go-radix/radix.go
+++ b/vendor/github.com/armon/go-radix/radix.go
@@ -44,13 +44,13 @@ func (n *node) addEdge(e edge) {
         n.edges.Sort()
 }
 
-func (n *node) replaceEdge(e edge) {
+func (n *node) updateEdge(label byte, node *node) {
         num := len(n.edges)
         idx := sort.Search(num, func(i int) bool {
-                return n.edges[i].label >= e.label
+                return n.edges[i].label >= label
         })
-        if idx < num && n.edges[idx].label == e.label {
-                n.edges[idx].node = e.node
+        if idx < num && n.edges[idx].label == label {
+                n.edges[idx].node = node
                 return
         }
         panic("replacing missing edge")
@@ -198,10 +198,7 @@ func (t *Tree) Insert(s string, v interface{}) (interface{}, bool) {
                 child := &node{
                         prefix: search[:commonPrefix],
                 }
-                parent.replaceEdge(edge{
-                        label: search[0],
-                        node:  child,
-                })
+                parent.updateEdge(search[0], child)
 
                 // Restore the existing node
                 child.addEdge(edge{
@@ -292,6 +289,53 @@ DELETE:
         return leaf.val, true
 }
 
+// DeletePrefix is used to delete the subtree under a prefix
+// Returns how many nodes were deleted
+// Use this to delete large subtrees efficiently
+func (t *Tree) DeletePrefix(s string) int {
+        return t.deletePrefix(nil, t.root, s)
+}
+
+// delete does a recursive deletion
+func (t *Tree) deletePrefix(parent, n *node, prefix string) int {
+        // Check for key exhaustion
+        if len(prefix) == 0 {
+                // Remove the leaf node
+                subTreeSize := 0
+                //recursively walk from all edges of the node to be deleted
+                recursiveWalk(n, func(s string, v interface{}) bool {
+                        subTreeSize++
+                        return false
+                })
+                if n.isLeaf() {
+                        n.leaf = nil
+                }
+                n.edges = nil // deletes the entire subtree
+
+                // Check if we should merge the parent's other child
+                if parent != nil && parent != t.root && len(parent.edges) == 1 && !parent.isLeaf() {
+                        parent.mergeChild()
+                }
+                t.size -= subTreeSize
+                return subTreeSize
+        }
+
+        // Look for an edge
+        label := prefix[0]
+        child := n.getEdge(label)
+        if child == nil || (!strings.HasPrefix(child.prefix, prefix) && !strings.HasPrefix(prefix, child.prefix)) {
+                return 0
+        }
+
+        // Consume the search prefix
+        if len(child.prefix) > len(prefix) {
+                prefix = prefix[len(prefix):]
+        } else {
+                prefix = prefix[len(child.prefix):]
+        }
+        return t.deletePrefix(n, child, prefix)
+}
+
 func (n *node) mergeChild() {
         e := n.edges[0]
         child := e.node
diff --git a/vendor/github.com/aws/aws-sdk-go/NOTICE.txt b/vendor/github.com/aws/aws-sdk-go/NOTICE.txt
index 5f14d11..899129e 100644
--- a/vendor/github.com/aws/aws-sdk-go/NOTICE.txt
+++ b/vendor/github.com/aws/aws-sdk-go/NOTICE.txt
@@ -1,3 +1,3 @@
 AWS SDK for Go
-Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved. 
+Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 Copyright 2014-2015 Stripe, Inc.
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go b/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go
index 59fa4a5..142a7a0 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go
@@ -15,7 +15,7 @@ func DeepEqual(a, b interface{}) bool {
         rb := reflect.Indirect(reflect.ValueOf(b))
 
         if raValid, rbValid := ra.IsValid(), rb.IsValid(); !raValid && !rbValid {
-                // If the elements are both nil, and of the same type the are equal
+                // If the elements are both nil, and of the same type they are equal
                 // If they are of different types they are not equal
                 return reflect.TypeOf(a) == reflect.TypeOf(b)
         } else if raValid != rbValid {
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go b/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go
index b6432f1..645df24 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go
@@ -23,28 +23,27 @@ func stringValue(v reflect.Value, indent int, buf *bytes.Buffer) {
         case reflect.Struct:
                 buf.WriteString("{\n")
 
-                names := []string{}
                 for i := 0; i < v.Type().NumField(); i++ {
-                        name := v.Type().Field(i).Name
-                        f := v.Field(i)
-                        if name[0:1] == strings.ToLower(name[0:1]) {
+                        ft := v.Type().Field(i)
+                        fv := v.Field(i)
+
+                        if ft.Name[0:1] == strings.ToLower(ft.Name[0:1]) {
                                 continue // ignore unexported fields
                         }
-                        if (f.Kind() == reflect.Ptr || f.Kind() == reflect.Slice) && f.IsNil() {
+                        if (fv.Kind() == reflect.Ptr || fv.Kind() == reflect.Slice) && fv.IsNil() {
                                 continue // ignore unset fields
                         }
-                        names = append(names, name)
-                }
 
-                for i, n := range names {
-                        val := v.FieldByName(n)
                         buf.WriteString(strings.Repeat(" ", indent+2))
-                        buf.WriteString(n + ": ")
-                        stringValue(val, indent+2, buf)
+                        buf.WriteString(ft.Name + ": ")
 
-                        if i < len(names)-1 {
-                                buf.WriteString(",\n")
+                        if tag := ft.Tag.Get("sensitive"); tag == "true" {
+                                buf.WriteString("<sensitive>")
+                        } else {
+                                stringValue(fv, indent+2, buf)
                         }
+
+                        buf.WriteString(",\n")
                 }
 
                 buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/client/client.go b/vendor/github.com/aws/aws-sdk-go/aws/client/client.go
index 212fe25..7096053 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/client/client.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/client/client.go
@@ -18,7 +18,7 @@ type Config struct {
 
         // States that the signing name did not come from a modeled source but
         // was derived based on other data. Used by service client constructors
-        // to determine if the signin name can be overriden based on metadata the
+        // to determine if the signin name can be overridden based on metadata the
         // service has.
         SigningNameDerived bool
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go b/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go
index ce9fb89..7b5e127 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go
@@ -118,6 +118,12 @@ var LogHTTPResponseHandler = request.NamedHandler{
 func logResponse(r *request.Request) {
         lw := &logWriter{r.Config.Logger, bytes.NewBuffer(nil)}
 
+        if r.HTTPResponse == nil {
+                lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+                        r.ClientInfo.ServiceName, r.Operation.Name, "request's HTTPResponse is nil"))
+                return
+        }
+
         logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)
         if logBody {
                 r.HTTPResponse.Body = &teeReaderCloser{
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/config.go b/vendor/github.com/aws/aws-sdk-go/aws/config.go
index 5421b5d..10634d1 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/config.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/config.go
@@ -18,7 +18,7 @@ const UseServiceDefaultRetries = -1
 type RequestRetryer interface{}
 
 // A Config provides service configuration for service clients. By default,
-// all clients will use the defaults.DefaultConfig tructure.
+// all clients will use the defaults.DefaultConfig structure.
 //
 //     // Create Session with MaxRetry configuration to be shared by multiple
 //     // service clients.
@@ -45,8 +45,8 @@ type Config struct {
         // that overrides the default generated endpoint for a client. Set this
         // to `""` to use the default generated endpoint.
         //
-        // @note You must still provide a `Region` value when specifying an
-        //   endpoint for a client.
+        // Note: You must still provide a `Region` value when specifying an
+        // endpoint for a client.
         Endpoint *string
 
         // The resolver to use for looking up endpoints for AWS service clients
@@ -65,8 +65,8 @@ type Config struct {
         // noted. A full list of regions is found in the "Regions and Endpoints"
         // document.
         //
-        // @see http://docs.aws.amazon.com/general/latest/gr/rande.html
-        //   AWS Regions and Endpoints
+        // See http://docs.aws.amazon.com/general/latest/gr/rande.html for AWS
+        // Regions and Endpoints.
         Region *string
 
         // Set this to `true` to disable SSL when sending requests. Defaults
@@ -120,9 +120,10 @@ type Config struct {
         // will use virtual hosted bucket addressing when possible
         // (`http://BUCKET.s3.amazonaws.com/KEY`).
         //
-        // @note This configuration option is specific to the Amazon S3 service.
-        // @see http://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html
-        //   Amazon S3: Virtual Hosting of Buckets
+        // Note: This configuration option is specific to the Amazon S3 service.
+        //
+        // See http://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html
+        // for Amazon S3: Virtual Hosting of Buckets
         S3ForcePathStyle *bool
 
         // Set this to `true` to disable the SDK adding the `Expect: 100-Continue`
@@ -223,6 +224,28 @@ type Config struct {
         //      Key: aws.String("//foo//bar//moo"),
         //    })
         DisableRestProtocolURICleaning *bool
+
+        // EnableEndpointDiscovery will allow for endpoint discovery on operations that
+        // have the definition in its model. By default, endpoint discovery is off.
+        //
+        // Example:
+        //    sess := session.Must(session.NewSession(&aws.Config{
+        //         EnableEndpointDiscovery: aws.Bool(true),
+        //    }))
+        //
+        //    svc := s3.New(sess)
+        //    out, err := svc.GetObject(&s3.GetObjectInput {
+        //      Bucket: aws.String("bucketname"),
+        //      Key: aws.String("/foo/bar/moo"),
+        //    })
+        EnableEndpointDiscovery *bool
+
+        // DisableEndpointHostPrefix will disable the SDK's behavior of prefixing
+        // request endpoint hosts with modeled information.
+        //
+        // Disabling this feature is useful when you want to use local endpoints
+        // for testing that do not support the modeled host prefix pattern.
+        DisableEndpointHostPrefix *bool
 }
 
 // NewConfig returns a new Config pointer that can be chained with builder
@@ -377,6 +400,19 @@ func (c *Config) WithSleepDelay(fn func(time.Duration)) *Config {
         return c
 }
 
+// WithEndpointDiscovery will set whether or not to use endpoint discovery.
+func (c *Config) WithEndpointDiscovery(t bool) *Config {
+        c.EnableEndpointDiscovery = &t
+        return c
+}
+
+// WithDisableEndpointHostPrefix will set whether or not to use modeled host prefix
+// when making requests.
+func (c *Config) WithDisableEndpointHostPrefix(t bool) *Config {
+        c.DisableEndpointHostPrefix = &t
+        return c
+}
+
 // MergeIn merges the passed in configs into the existing config object.
 func (c *Config) MergeIn(cfgs ...*Config) {
         for _, other := range cfgs {
@@ -476,6 +512,14 @@ func mergeInConfig(dst *Config, other *Config) {
         if other.EnforceShouldRetryCheck != nil {
                 dst.EnforceShouldRetryCheck = other.EnforceShouldRetryCheck
         }
+
+        if other.EnableEndpointDiscovery != nil {
+                dst.EnableEndpointDiscovery = other.EnableEndpointDiscovery
+        }
+
+        if other.DisableEndpointHostPrefix != nil {
+                dst.DisableEndpointHostPrefix = other.DisableEndpointHostPrefix
+        }
 }
 
 // Copy will return a shallow copy of the Config object. If any additional
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/context.go b/vendor/github.com/aws/aws-sdk-go/aws/context_1_5.go
index 79f4268..2866f9a 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/context.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/context_1_5.go
@@ -1,8 +1,8 @@
+// +build !go1.9
+
 package aws
 
-import (
-        "time"
-)
+import "time"
 
 // Context is an copy of the Go v1.7 stdlib's context.Context interface.
 // It is represented as a SDK interface to enable you to use the "WithContext"
@@ -35,37 +35,3 @@ type Context interface {
         // functions.
         Value(key interface{}) interface{}
 }
-
-// BackgroundContext returns a context that will never be canceled, has no
-// values, and no deadline. This context is used by the SDK to provide
-// backwards compatibility with non-context API operations and functionality.
-//
-// Go 1.6 and before:
-// This context function is equivalent to context.Background in the Go stdlib.
-//
-// Go 1.7 and later:
-// The context returned will be the value returned by context.Background()
-//
-// See https://golang.org/pkg/context for more information on Contexts.
-func BackgroundContext() Context {
-        return backgroundCtx
-}
-
-// SleepWithContext will wait for the timer duration to expire, or the context
-// is canceled. Which ever happens first. If the context is canceled the Context's
-// error will be returned.
-//
-// Expects Context to always return a non-nil error if the Done channel is closed.
-func SleepWithContext(ctx Context, dur time.Duration) error {
-        t := time.NewTimer(dur)
-        defer t.Stop()
-
-        select {
-        case <-t.C:
-                break
-        case <-ctx.Done():
-                return ctx.Err()
-        }
-
-        return nil
-}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/context_1_7.go b/vendor/github.com/aws/aws-sdk-go/aws/context_1_7.go
deleted file mode 100644
index 064f75c..0000000
--- a/vendor/github.com/aws/aws-sdk-go/aws/context_1_7.go
+++ /dev/null
@@ -1,9 +0,0 @@
-// +build go1.7
-
-package aws
-
-import "context"
-
-var (
-        backgroundCtx = context.Background()
-)
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/context_1_9.go b/vendor/github.com/aws/aws-sdk-go/aws/context_1_9.go
new file mode 100644
index 0000000..3718b26
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/aws/context_1_9.go
@@ -0,0 +1,11 @@
+// +build go1.9
+
+package aws
+
+import "context"
+
+// Context is an alias of the Go stdlib's context.Context interface.
+// It can be used within the SDK's API operation "WithContext" methods.
+//
+// See https://golang.org/pkg/context on how to use contexts.
+type Context = context.Context
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/context_1_6.go b/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_5.go
index 8fdda53..66c5945 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/context_1_6.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_5.go
@@ -39,3 +39,18 @@ func (e *emptyCtx) String() string {
 var (
         backgroundCtx = new(emptyCtx)
 )
+
+// BackgroundContext returns a context that will never be canceled, has no
+// values, and no deadline. This context is used by the SDK to provide
+// backwards compatibility with non-context API operations and functionality.
+//
+// Go 1.6 and before:
+// This context function is equivalent to context.Background in the Go stdlib.
+//
+// Go 1.7 and later:
+// The context returned will be the value returned by context.Background()
+//
+// See https://golang.org/pkg/context for more information on Contexts.
+func BackgroundContext() Context {
+        return backgroundCtx
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_7.go b/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_7.go
new file mode 100644
index 0000000..9c29f29
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_7.go
@@ -0,0 +1,20 @@
+// +build go1.7
+
+package aws
+
+import "context"
+
+// BackgroundContext returns a context that will never be canceled, has no
+// values, and no deadline. This context is used by the SDK to provide
+// backwards compatibility with non-context API operations and functionality.
+//
+// Go 1.6 and before:
+// This context function is equivalent to context.Background in the Go stdlib.
+//
+// Go 1.7 and later:
+// The context returned will be the value returned by context.Background()
+//
+// See https://golang.org/pkg/context for more information on Contexts.
+func BackgroundContext() Context {
+        return context.Background()
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/context_sleep.go b/vendor/github.com/aws/aws-sdk-go/aws/context_sleep.go
new file mode 100644
index 0000000..304fd15
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/aws/context_sleep.go
@@ -0,0 +1,24 @@
+package aws
+
+import (
+        "time"
+)
+
+// SleepWithContext will wait for the timer duration to expire, or the context
+// is canceled. Which ever happens first. If the context is canceled the Context's
+// error will be returned.
+//
+// Expects Context to always return a non-nil error if the Done channel is closed.
+func SleepWithContext(ctx Context, dur time.Duration) error {
+        t := time.NewTimer(dur)
+        defer t.Stop()
+
+        select {
+        case <-t.C:
+                break
+        case <-ctx.Done():
+                return ctx.Err()
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go b/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go
index cfcddf3..f8853d7 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go
@@ -72,9 +72,9 @@ var ValidateReqSigHandler = request.NamedHandler{
                         signedTime = r.LastSignedAt
                 }
 
-                // 10 minutes to allow for some clock skew/delays in transmission.
+                // 5 minutes to allow for some clock skew/delays in transmission.
                 // Would be improved with aws/aws-sdk-go#423
-                if signedTime.Add(10 * time.Minute).After(time.Now()) {
+                if signedTime.Add(5 * time.Minute).After(time.Now()) {
                         return
                 }
 
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go b/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go
index a15f496..ab69c7a 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go
@@ -17,7 +17,7 @@ var SDKVersionUserAgentHandler = request.NamedHandler{
 }
 
 const execEnvVar = `AWS_EXECUTION_ENV`
-const execEnvUAKey = `exec_env`
+const execEnvUAKey = `exec-env`
 
 // AddHostExecEnvUserAgentHander is a request handler appending the SDK's
 // execution environment to the user agent.
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go b/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go
index f298d65..3ad1e79 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go
@@ -9,9 +9,7 @@ var (
         // providers in the ChainProvider.
         //
         // This has been deprecated. For verbose error messaging set
-        // aws.Config.CredentialsChainVerboseErrors to true
-        //
-        // @readonly
+        // aws.Config.CredentialsChainVerboseErrors to true.
         ErrNoValidProvidersFoundInChain = awserr.New("NoCredentialProviders",
                 `no valid providers in chain. Deprecated.
         For verbose messaging see aws.Config.CredentialsChainVerboseErrors`,
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go b/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go
index ed08699..894bbc7 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go
@@ -49,6 +49,8 @@
 package credentials
 
 import (
+        "fmt"
+        "github.com/aws/aws-sdk-go/aws/awserr"
         "sync"
         "time"
 )
@@ -64,8 +66,6 @@ import (
 //       Credentials: credentials.AnonymousCredentials,
 //     })))
 //     // Access public S3 buckets.
-//
-// @readonly
 var AnonymousCredentials = NewStaticCredentials("", "", "")
 
 // A Value is the AWS credentials value for individual credential fields.
@@ -99,6 +99,14 @@ type Provider interface {
         IsExpired() bool
 }
 
+// An Expirer is an interface that Providers can implement to expose the expiration
+// time, if known.  If the Provider cannot accurately provide this info,
+// it should not implement this interface.
+type Expirer interface {
+        // The time at which the credentials are no longer valid
+        ExpiresAt() time.Time
+}
+
 // An ErrorProvider is a stub credentials provider that always returns an error
 // this is used by the SDK when construction a known provider is not possible
 // due to an error.
@@ -158,13 +166,19 @@ func (e *Expiry) SetExpiration(expiration time.Time, window time.Duration) {
 
 // IsExpired returns if the credentials are expired.
 func (e *Expiry) IsExpired() bool {
-        if e.CurrentTime == nil {
-                e.CurrentTime = time.Now
+        curTime := e.CurrentTime
+        if curTime == nil {
+                curTime = time.Now
         }
-        return e.expiration.Before(e.CurrentTime())
+        return e.expiration.Before(curTime())
 }
 
-// A Credentials provides synchronous safe retrieval of AWS credentials Value.
+// ExpiresAt returns the expiration time of the credential
+func (e *Expiry) ExpiresAt() time.Time {
+        return e.expiration
+}
+
+// A Credentials provides concurrency safe retrieval of AWS credentials Value.
 // Credentials will cache the credentials value until they expire. Once the value
 // expires the next Get will attempt to retrieve valid credentials.
 //
@@ -256,3 +270,23 @@ func (c *Credentials) IsExpired() bool {
 func (c *Credentials) isExpired() bool {
         return c.forceRefresh || c.provider.IsExpired()
 }
+
+// ExpiresAt provides access to the functionality of the Expirer interface of
+// the underlying Provider, if it supports that interface.  Otherwise, it returns
+// an error.
+func (c *Credentials) ExpiresAt() (time.Time, error) {
+        c.m.RLock()
+        defer c.m.RUnlock()
+
+        expirer, ok := c.provider.(Expirer)
+        if !ok {
+                return time.Time{}, awserr.New("ProviderNotExpirer",
+                        fmt.Sprintf("provider %s does not support ExpiresAt()", c.creds.ProviderName),
+                        nil)
+        }
+        if c.forceRefresh {
+                // set expiration time to the distant past
+                return time.Time{}, nil
+        }
+        return expirer.ExpiresAt(), nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/credentials/endpointcreds/provider.go b/vendor/github.com/aws/aws-sdk-go/aws/credentials/endpointcreds/provider.go
index a4cec5c..ace5131 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/credentials/endpointcreds/provider.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/credentials/endpointcreds/provider.go
@@ -65,6 +65,10 @@ type Provider struct {
         //
         // If ExpiryWindow is 0 or less it will be ignored.
         ExpiryWindow time.Duration
+
+        // Optional authorization token value if set will be used as the value of
+        // the Authorization header of the endpoint credential request.
+        AuthorizationToken string
 }
 
 // NewProviderClient returns a credentials Provider for retrieving AWS credentials
@@ -152,6 +156,9 @@ func (p *Provider) getCredentials() (*getCredentialsOutput, error) {
         out := &getCredentialsOutput{}
         req := p.Client.NewRequest(op, nil, out)
         req.HTTPRequest.Header.Set("Accept", "application/json")
+        if authToken := p.AuthorizationToken; len(authToken) != 0 {
+                req.HTTPRequest.Header.Set("Authorization", authToken)
+        }
 
         return out, req.Send()
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go b/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go
index c14231a..54c5cf7 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go
@@ -12,14 +12,10 @@ const EnvProviderName = "EnvProvider"
 var (
         // ErrAccessKeyIDNotFound is returned when the AWS Access Key ID can't be
         // found in the process's environment.
-        //
-        // @readonly
         ErrAccessKeyIDNotFound = awserr.New("EnvAccessKeyNotFound", "AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY not found in environment", nil)
 
         // ErrSecretAccessKeyNotFound is returned when the AWS Secret Access Key
         // can't be found in the process's environment.
-        //
-        // @readonly
         ErrSecretAccessKeyNotFound = awserr.New("EnvSecretNotFound", "AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY not found in environment", nil)
 )
 
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/credentials/processcreds/provider.go b/vendor/github.com/aws/aws-sdk-go/aws/credentials/processcreds/provider.go
new file mode 100644
index 0000000..1980c8c
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/aws/credentials/processcreds/provider.go
@@ -0,0 +1,425 @@
+/*
+Package processcreds is a credential Provider to retrieve `credential_process`
+credentials.
+
+WARNING: The following describes a method of sourcing credentials from an external
+process. This can potentially be dangerous, so proceed with caution. Other
+credential providers should be preferred if at all possible. If using this
+option, you should make sure that the config file is as locked down as possible
+using security best practices for your operating system.
+
+You can use credentials from a `credential_process` in a variety of ways.
+
+One way is to setup your shared config file, located in the default
+location, with the `credential_process` key and the command you want to be
+called. You also need to set the AWS_SDK_LOAD_CONFIG environment variable
+(e.g., `export AWS_SDK_LOAD_CONFIG=1`) to use the shared config file.
+
+    [default]
+    credential_process = /command/to/call
+
+Creating a new session will use the credential process to retrieve credentials.
+NOTE: If there are credentials in the profile you are using, the credential
+process will not be used.
+
+    // Initialize a session to load credentials.
+    sess, _ := session.NewSession(&aws.Config{
+        Region: aws.String("us-east-1")},
+    )
+
+    // Create S3 service client to use the credentials.
+    svc := s3.New(sess)
+
+Another way to use the `credential_process` method is by using
+`credentials.NewCredentials()` and providing a command to be executed to
+retrieve credentials:
+
+    // Create credentials using the ProcessProvider.
+    creds := processcreds.NewCredentials("/path/to/command")
+
+    // Create service client value configured for credentials.
+    svc := s3.New(sess, &aws.Config{Credentials: creds})
+
+You can set a non-default timeout for the `credential_process` with another
+constructor, `credentials.NewCredentialsTimeout()`, providing the timeout. To
+set a one minute timeout:
+
+    // Create credentials using the ProcessProvider.
+    creds := processcreds.NewCredentialsTimeout(
+        "/path/to/command",
+        time.Duration(500) * time.Millisecond)
+
+If you need more control, you can set any configurable options in the
+credentials using one or more option functions. For example, you can set a two
+minute timeout, a credential duration of 60 minutes, and a maximum stdout
+buffer size of 2k.
+
+    creds := processcreds.NewCredentials(
+        "/path/to/command",
+        func(opt *ProcessProvider) {
+            opt.Timeout = time.Duration(2) * time.Minute
+            opt.Duration = time.Duration(60) * time.Minute
+            opt.MaxBufSize = 2048
+        })
+
+You can also use your own `exec.Cmd`:
+
+        // Create an exec.Cmd
+        myCommand := exec.Command("/path/to/command")
+
+        // Create credentials using your exec.Cmd and custom timeout
+        creds := processcreds.NewCredentialsCommand(
+                myCommand,
+                func(opt *processcreds.ProcessProvider) {
+                        opt.Timeout = time.Duration(1) * time.Second
+                })
+*/
+package processcreds
+
+import (
+        "bytes"
+        "encoding/json"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "os"
+        "os/exec"
+        "runtime"
+        "strings"
+        "time"
+
+        "github.com/aws/aws-sdk-go/aws/awserr"
+        "github.com/aws/aws-sdk-go/aws/credentials"
+)
+
+const (
+        // ProviderName is the name this credentials provider will label any
+        // returned credentials Value with.
+        ProviderName = `ProcessProvider`
+
+        // ErrCodeProcessProviderParse error parsing process output
+        ErrCodeProcessProviderParse = "ProcessProviderParseError"
+
+        // ErrCodeProcessProviderVersion version error in output
+        ErrCodeProcessProviderVersion = "ProcessProviderVersionError"
+
+        // ErrCodeProcessProviderRequired required attribute missing in output
+        ErrCodeProcessProviderRequired = "ProcessProviderRequiredError"
+
+        // ErrCodeProcessProviderExecution execution of command failed
+        ErrCodeProcessProviderExecution = "ProcessProviderExecutionError"
+
+        // errMsgProcessProviderTimeout process took longer than allowed
+        errMsgProcessProviderTimeout = "credential process timed out"
+
+        // errMsgProcessProviderProcess process error
+        errMsgProcessProviderProcess = "error in credential_process"
+
+        // errMsgProcessProviderParse problem parsing output
+        errMsgProcessProviderParse = "parse failed of credential_process output"
+
+        // errMsgProcessProviderVersion version error in output
+        errMsgProcessProviderVersion = "wrong version in process output (not 1)"
+
+        // errMsgProcessProviderMissKey missing access key id in output
+        errMsgProcessProviderMissKey = "missing AccessKeyId in process output"
+
+        // errMsgProcessProviderMissSecret missing secret acess key in output
+        errMsgProcessProviderMissSecret = "missing SecretAccessKey in process output"
+
+        // errMsgProcessProviderPrepareCmd prepare of command failed
+        errMsgProcessProviderPrepareCmd = "failed to prepare command"
+
+        // errMsgProcessProviderEmptyCmd command must not be empty
+        errMsgProcessProviderEmptyCmd = "command must not be empty"
+
+        // errMsgProcessProviderPipe failed to initialize pipe
+        errMsgProcessProviderPipe = "failed to initialize pipe"
+
+        // DefaultDuration is the default amount of time in minutes that the
+        // credentials will be valid for.
+        DefaultDuration = time.Duration(15) * time.Minute
+
+        // DefaultBufSize limits buffer size from growing to an enormous
+        // amount due to a faulty process.
+        DefaultBufSize = 1024
+
+        // DefaultTimeout default limit on time a process can run.
+        DefaultTimeout = time.Duration(1) * time.Minute
+)
+
+// ProcessProvider satisfies the credentials.Provider interface, and is a
+// client to retrieve credentials from a process.
+type ProcessProvider struct {
+        staticCreds bool
+        credentials.Expiry
+        originalCommand []string
+
+        // Expiry duration of the credentials. Defaults to 15 minutes if not set.
+        Duration time.Duration
+
+        // ExpiryWindow will allow the credentials to trigger refreshing prior to
+        // the credentials actually expiring. This is beneficial so race conditions
+        // with expiring credentials do not cause request to fail unexpectedly
+        // due to ExpiredTokenException exceptions.
+        //
+        // So a ExpiryWindow of 10s would cause calls to IsExpired() to return true
+        // 10 seconds before the credentials are actually expired.
+        //
+        // If ExpiryWindow is 0 or less it will be ignored.
+        ExpiryWindow time.Duration
+
+        // A string representing an os command that should return a JSON with
+        // credential information.
+        command *exec.Cmd
+
+        // MaxBufSize limits memory usage from growing to an enormous
+        // amount due to a faulty process.
+        MaxBufSize int
+
+        // Timeout limits the time a process can run.
+        Timeout time.Duration
+}
+
+// NewCredentials returns a pointer to a new Credentials object wrapping the
+// ProcessProvider. The credentials will expire every 15 minutes by default.
+func NewCredentials(command string, options ...func(*ProcessProvider)) *credentials.Credentials {
+        p := &ProcessProvider{
+                command:    exec.Command(command),
+                Duration:   DefaultDuration,
+                Timeout:    DefaultTimeout,
+                MaxBufSize: DefaultBufSize,
+        }
+
+        for _, option := range options {
+                option(p)
+        }
+
+        return credentials.NewCredentials(p)
+}
+
+// NewCredentialsTimeout returns a pointer to a new Credentials object with
+// the specified command and timeout, and default duration and max buffer size.
+func NewCredentialsTimeout(command string, timeout time.Duration) *credentials.Credentials {
+        p := NewCredentials(command, func(opt *ProcessProvider) {
+                opt.Timeout = timeout
+        })
+
+        return p
+}
+
+// NewCredentialsCommand returns a pointer to a new Credentials object with
+// the specified command, and default timeout, duration and max buffer size.
+func NewCredentialsCommand(command *exec.Cmd, options ...func(*ProcessProvider)) *credentials.Credentials {
+        p := &ProcessProvider{
+                command:    command,
+                Duration:   DefaultDuration,
+                Timeout:    DefaultTimeout,
+                MaxBufSize: DefaultBufSize,
+        }
+
+        for _, option := range options {
+                option(p)
+        }
+
+        return credentials.NewCredentials(p)
+}
+
+type credentialProcessResponse struct {
+        Version         int
+        AccessKeyID     string `json:"AccessKeyId"`
+        SecretAccessKey string
+        SessionToken    string
+        Expiration      *time.Time
+}
+
+// Retrieve executes the 'credential_process' and returns the credentials.
+func (p *ProcessProvider) Retrieve() (credentials.Value, error) {
+        out, err := p.executeCredentialProcess()
+        if err != nil {
+                return credentials.Value{ProviderName: ProviderName}, err
+        }
+
+        // Serialize and validate response
+        resp := &credentialProcessResponse{}
+        if err = json.Unmarshal(out, resp); err != nil {
+                return credentials.Value{ProviderName: ProviderName}, awserr.New(
+                        ErrCodeProcessProviderParse,
+                        fmt.Sprintf("%s: %s", errMsgProcessProviderParse, string(out)),
+                        err)
+        }
+
+        if resp.Version != 1 {
+                return credentials.Value{ProviderName: ProviderName}, awserr.New(
+                        ErrCodeProcessProviderVersion,
+                        errMsgProcessProviderVersion,
+                        nil)
+        }
+
+        if len(resp.AccessKeyID) == 0 {
+                return credentials.Value{ProviderName: ProviderName}, awserr.New(
+                        ErrCodeProcessProviderRequired,
+                        errMsgProcessProviderMissKey,
+                        nil)
+        }
+
+        if len(resp.SecretAccessKey) == 0 {
+                return credentials.Value{ProviderName: ProviderName}, awserr.New(
+                        ErrCodeProcessProviderRequired,
+                        errMsgProcessProviderMissSecret,
+                        nil)
+        }
+
+        // Handle expiration
+        p.staticCreds = resp.Expiration == nil
+        if resp.Expiration != nil {
+                p.SetExpiration(*resp.Expiration, p.ExpiryWindow)
+        }
+
+        return credentials.Value{
+                ProviderName:    ProviderName,
+                AccessKeyID:     resp.AccessKeyID,
+                SecretAccessKey: resp.SecretAccessKey,
+                SessionToken:    resp.SessionToken,
+        }, nil
+}
+
+// IsExpired returns true if the credentials retrieved are expired, or not yet
+// retrieved.
+func (p *ProcessProvider) IsExpired() bool {
+        if p.staticCreds {
+                return false
+        }
+        return p.Expiry.IsExpired()
+}
+
+// prepareCommand prepares the command to be executed.
+func (p *ProcessProvider) prepareCommand() error {
+
+        var cmdArgs []string
+        if runtime.GOOS == "windows" {
+                cmdArgs = []string{"cmd.exe", "/C"}
+        } else {
+                cmdArgs = []string{"sh", "-c"}
+        }
+
+        if len(p.originalCommand) == 0 {
+                p.originalCommand = make([]string, len(p.command.Args))
+                copy(p.originalCommand, p.command.Args)
+
+                // check for empty command because it succeeds
+                if len(strings.TrimSpace(p.originalCommand[0])) < 1 {
+                        return awserr.New(
+                                ErrCodeProcessProviderExecution,
+                                fmt.Sprintf(
+                                        "%s: %s",
+                                        errMsgProcessProviderPrepareCmd,
+                                        errMsgProcessProviderEmptyCmd),
+                                nil)
+                }
+        }
+
+        cmdArgs = append(cmdArgs, p.originalCommand...)
+        p.command = exec.Command(cmdArgs[0], cmdArgs[1:]...)
+        p.command.Env = os.Environ()
+
+        return nil
+}
+
+// executeCredentialProcess starts the credential process on the OS and
+// returns the results or an error.
+func (p *ProcessProvider) executeCredentialProcess() ([]byte, error) {
+
+        if err := p.prepareCommand(); err != nil {
+                return nil, err
+        }
+
+        // Setup the pipes
+        outReadPipe, outWritePipe, err := os.Pipe()
+        if err != nil {
+                return nil, awserr.New(
+                        ErrCodeProcessProviderExecution,
+                        errMsgProcessProviderPipe,
+                        err)
+        }
+
+        p.command.Stderr = os.Stderr    // display stderr on console for MFA
+        p.command.Stdout = outWritePipe // get creds json on process's stdout
+        p.command.Stdin = os.Stdin      // enable stdin for MFA
+
+        output := bytes.NewBuffer(make([]byte, 0, p.MaxBufSize))
+
+        stdoutCh := make(chan error, 1)
+        go readInput(
+                io.LimitReader(outReadPipe, int64(p.MaxBufSize)),
+                output,
+                stdoutCh)
+
+        execCh := make(chan error, 1)
+        go executeCommand(*p.command, execCh)
+
+        finished := false
+        var errors []error
+        for !finished {
+                select {
+                case readError := <-stdoutCh:
+                        errors = appendError(errors, readError)
+                        finished = true
+                case execError := <-execCh:
+                        err := outWritePipe.Close()
+                        errors = appendError(errors, err)
+                        errors = appendError(errors, execError)
+                        if errors != nil {
+                                return output.Bytes(), awserr.NewBatchError(
+                                        ErrCodeProcessProviderExecution,
+                                        errMsgProcessProviderProcess,
+                                        errors)
+                        }
+                case <-time.After(p.Timeout):
+                        finished = true
+                        return output.Bytes(), awserr.NewBatchError(
+                                ErrCodeProcessProviderExecution,
+                                errMsgProcessProviderTimeout,
+                                errors) // errors can be nil
+                }
+        }
+
+        out := output.Bytes()
+
+        if runtime.GOOS == "windows" {
+                // windows adds slashes to quotes
+                out = []byte(strings.Replace(string(out), `\"`, `"`, -1))
+        }
+
+        return out, nil
+}
+
+// appendError conveniently checks for nil before appending slice
+func appendError(errors []error, err error) []error {
+        if err != nil {
+                return append(errors, err)
+        }
+        return errors
+}
+
+func executeCommand(cmd exec.Cmd, exec chan error) {
+        // Start the command
+        err := cmd.Start()
+        if err == nil {
+                err = cmd.Wait()
+        }
+
+        exec <- err
+}
+
+func readInput(r io.Reader, w io.Writer, read chan error) {
+        tee := io.TeeReader(r, w)
+
+        _, err := ioutil.ReadAll(tee)
+
+        if err == io.EOF {
+                err = nil
+        }
+
+        read <- err // will only arrive here when write end of pipe is closed
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go b/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go
index 51e21e0..e155149 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go
@@ -4,9 +4,8 @@ import (
         "fmt"
         "os"
 
-        "github.com/go-ini/ini"
-
         "github.com/aws/aws-sdk-go/aws/awserr"
+        "github.com/aws/aws-sdk-go/internal/ini"
         "github.com/aws/aws-sdk-go/internal/shareddefaults"
 )
 
@@ -77,36 +76,37 @@ func (p *SharedCredentialsProvider) IsExpired() bool {
 // The credentials retrieved from the profile will be returned or error. Error will be
 // returned if it fails to read from the file, or the data is invalid.
 func loadProfile(filename, profile string) (Value, error) {
-        config, err := ini.Load(filename)
+        config, err := ini.OpenFile(filename)
         if err != nil {
                 return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsLoad", "failed to load shared credentials file", err)
         }
-        iniProfile, err := config.GetSection(profile)
-        if err != nil {
-                return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsLoad", "failed to get profile", err)
+
+        iniProfile, ok := config.GetSection(profile)
+        if !ok {
+                return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsLoad", "failed to get profile", nil)
         }
 
-        id, err := iniProfile.GetKey("aws_access_key_id")
-        if err != nil {
+        id := iniProfile.String("aws_access_key_id")
+        if len(id) == 0 {
                 return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsAccessKey",
                         fmt.Sprintf("shared credentials %s in %s did not contain aws_access_key_id", profile, filename),
-                        err)
+                        nil)
         }
 
-        secret, err := iniProfile.GetKey("aws_secret_access_key")
-        if err != nil {
+        secret := iniProfile.String("aws_secret_access_key")
+        if len(secret) == 0 {
                 return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsSecret",
                         fmt.Sprintf("shared credentials %s in %s did not contain aws_secret_access_key", profile, filename),
                         nil)
         }
 
         // Default to empty string if not found
-        token := iniProfile.Key("aws_session_token")
+        token := iniProfile.String("aws_session_token")
 
         return Value{
-                AccessKeyID:     id.String(),
-                SecretAccessKey: secret.String(),
-                SessionToken:    token.String(),
+                AccessKeyID:     id,
+                SecretAccessKey: secret,
+                SessionToken:    token,
                 ProviderName:    SharedCredsProviderName,
         }, nil
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go b/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go
index 4f5dab3..531139e 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go
@@ -9,8 +9,6 @@ const StaticProviderName = "StaticProvider"
 
 var (
         // ErrStaticCredentialsEmpty is emitted when static credentials are empty.
-        //
-        // @readonly
         ErrStaticCredentialsEmpty = awserr.New("EmptyStaticCreds", "static credentials are empty", nil)
 )
 
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/credentials/stscreds/assume_role_provider.go b/vendor/github.com/aws/aws-sdk-go/aws/credentials/stscreds/assume_role_provider.go
index 4108e43..b6dbfd2 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/credentials/stscreds/assume_role_provider.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/credentials/stscreds/assume_role_provider.go
@@ -80,16 +80,18 @@ package stscreds
 
 import (
         "fmt"
+        "os"
         "time"
 
         "github.com/aws/aws-sdk-go/aws"
         "github.com/aws/aws-sdk-go/aws/awserr"
         "github.com/aws/aws-sdk-go/aws/client"
         "github.com/aws/aws-sdk-go/aws/credentials"
+        "github.com/aws/aws-sdk-go/internal/sdkrand"
         "github.com/aws/aws-sdk-go/service/sts"
 )
 
-// StdinTokenProvider will prompt on stdout and read from stdin for a string value.
+// StdinTokenProvider will prompt on stderr and read from stdin for a string value.
 // An error is returned if reading from stdin fails.
 //
 // Use this function go read MFA tokens from stdin. The function makes no attempt
@@ -102,7 +104,7 @@ import (
 // Will wait forever until something is provided on the stdin.
 func StdinTokenProvider() (string, error) {
         var v string
-        fmt.Printf("Assume Role MFA token code: ")
+        fmt.Fprintf(os.Stderr, "Assume Role MFA token code: ")
         _, err := fmt.Scanln(&v)
 
         return v, err
@@ -193,6 +195,18 @@ type AssumeRoleProvider struct {
         //
         // If ExpiryWindow is 0 or less it will be ignored.
         ExpiryWindow time.Duration
+
+        // MaxJitterFrac reduces the effective Duration of each credential requested
+        // by a random percentage between 0 and MaxJitterFraction. MaxJitterFrac must
+        // have a value between 0 and 1. Any other value may lead to expected behavior.
+        // With a MaxJitterFrac value of 0, default) will no jitter will be used.
+        // 
+        // For example, with a Duration of 30m and a MaxJitterFrac of 0.1, the
+        // AssumeRole call will be made with an arbitrary Duration between 27m and
+        // 30m.
+        //
+        // MaxJitterFrac should not be negative.
+        MaxJitterFrac float64
 }
 
 // NewCredentials returns a pointer to a new Credentials object wrapping the
@@ -254,8 +268,9 @@ func (p *AssumeRoleProvider) Retrieve() (credentials.Value, error) {
                 // Expire as often as AWS permits.
                 p.Duration = DefaultDuration
         }
+        jitter := time.Duration(sdkrand.SeededRand.Float64() * p.MaxJitterFrac * float64(p.Duration))
         input := &sts.AssumeRoleInput{
-                DurationSeconds: aws.Int64(int64(p.Duration / time.Second)),
+                DurationSeconds: aws.Int64(int64((p.Duration - jitter) / time.Second)),
                 RoleArn:         aws.String(p.RoleARN),
                 RoleSessionName: aws.String(p.RoleSessionName),
                 ExternalId:      p.ExternalID,
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/csm/metric.go b/vendor/github.com/aws/aws-sdk-go/aws/csm/metric.go
index 4b0d630..5bacc79 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/csm/metric.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/csm/metric.go
@@ -3,6 +3,8 @@ package csm
 import (
         "strconv"
         "time"
+
+        "github.com/aws/aws-sdk-go/aws"
 )
 
 type metricTime time.Time
@@ -39,6 +41,12 @@ type metric struct {
         SDKException        *string `json:"SdkException,omitempty"`
         SDKExceptionMessage *string `json:"SdkExceptionMessage,omitempty"`
 
+        FinalHTTPStatusCode      *int    `json:"FinalHttpStatusCode,omitempty"`
+        FinalAWSException        *string `json:"FinalAwsException,omitempty"`
+        FinalAWSExceptionMessage *string `json:"FinalAwsExceptionMessage,omitempty"`
+        FinalSDKException        *string `json:"FinalSdkException,omitempty"`
+        FinalSDKExceptionMessage *string `json:"FinalSdkExceptionMessage,omitempty"`
+
         DestinationIP    *string `json:"DestinationIp,omitempty"`
         ConnectionReused *int    `json:"ConnectionReused,omitempty"`
 
@@ -48,4 +56,54 @@ type metric struct {
         DNSLatency               *int `json:"DnsLatency,omitempty"`
         TCPLatency               *int `json:"TcpLatency,omitempty"`
         SSLLatency               *int `json:"SslLatency,omitempty"`
+
+        MaxRetriesExceeded *int `json:"MaxRetriesExceeded,omitempty"`
+}
+
+func (m *metric) TruncateFields() {
+        m.ClientID = truncateString(m.ClientID, 255)
+        m.UserAgent = truncateString(m.UserAgent, 256)
+
+        m.AWSException = truncateString(m.AWSException, 128)
+        m.AWSExceptionMessage = truncateString(m.AWSExceptionMessage, 512)
+
+        m.SDKException = truncateString(m.SDKException, 128)
+        m.SDKExceptionMessage = truncateString(m.SDKExceptionMessage, 512)
+
+        m.FinalAWSException = truncateString(m.FinalAWSException, 128)
+        m.FinalAWSExceptionMessage = truncateString(m.FinalAWSExceptionMessage, 512)
+
+        m.FinalSDKException = truncateString(m.FinalSDKException, 128)
+        m.FinalSDKExceptionMessage = truncateString(m.FinalSDKExceptionMessage, 512)
+}
+
+func truncateString(v *string, l int) *string {
+        if v != nil && len(*v) > l {
+                nv := (*v)[:l]
+                return &nv
+        }
+
+        return v
+}
+
+func (m *metric) SetException(e metricException) {
+        switch te := e.(type) {
+        case awsException:
+                m.AWSException = aws.String(te.exception)
+                m.AWSExceptionMessage = aws.String(te.message)
+        case sdkException:
+                m.SDKException = aws.String(te.exception)
+                m.SDKExceptionMessage = aws.String(te.message)
+        }
+}
+
+func (m *metric) SetFinalException(e metricException) {
+        switch te := e.(type) {
+        case awsException:
+                m.FinalAWSException = aws.String(te.exception)
+                m.FinalAWSExceptionMessage = aws.String(te.message)
+        case sdkException:
+                m.FinalSDKException = aws.String(te.exception)
+                m.FinalSDKExceptionMessage = aws.String(te.message)
+        }
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/csm/metric_exception.go b/vendor/github.com/aws/aws-sdk-go/aws/csm/metric_exception.go
new file mode 100644
index 0000000..54a9928
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/aws/csm/metric_exception.go
@@ -0,0 +1,26 @@
+package csm
+
+type metricException interface {
+        Exception() string
+        Message() string
+}
+
+type requestException struct {
+        exception string
+        message   string
+}
+
+func (e requestException) Exception() string {
+        return e.exception
+}
+func (e requestException) Message() string {
+        return e.message
+}
+
+type awsException struct {
+        requestException
+}
+
+type sdkException struct {
+        requestException
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/csm/reporter.go b/vendor/github.com/aws/aws-sdk-go/aws/csm/reporter.go
index 11082e5..0b5571a 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/csm/reporter.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/csm/reporter.go
@@ -82,14 +82,15 @@ func (rep *Reporter) sendAPICallAttemptMetric(r *request.Request) {
 
         if r.Error != nil {
                 if awserr, ok := r.Error.(awserr.Error); ok {
-                        setError(&m, awserr)
+                        m.SetException(getMetricException(awserr))
                 }
         }
 
+        m.TruncateFields()
         rep.metricsCh.Push(m)
 }
 
-func setError(m *metric, err awserr.Error) {
+func getMetricException(err awserr.Error) metricException {
         msg := err.Error()
         code := err.Code()
 
@@ -97,11 +98,13 @@ func setError(m *metric, err awserr.Error) {
         case "RequestError",
                 "SerializationError",
                 request.CanceledErrorCode:
-                m.SDKException = &code
-                m.SDKExceptionMessage = &msg
+                return sdkException{
+                        requestException{exception: code, message: msg},
+                }
         default:
-                m.AWSException = &code
-                m.AWSExceptionMessage = &msg
+                return awsException{
+                        requestException{exception: code, message: msg},
+                }
         }
 }
 
@@ -112,16 +115,31 @@ func (rep *Reporter) sendAPICallMetric(r *request.Request) {
 
         now := time.Now()
         m := metric{
-                ClientID:      aws.String(rep.clientID),
-                API:           aws.String(r.Operation.Name),
-                Service:       aws.String(r.ClientInfo.ServiceID),
-                Timestamp:     (*metricTime)(&now),
-                Type:          aws.String("ApiCall"),
-                AttemptCount:  aws.Int(r.RetryCount + 1),
-                Latency:       aws.Int(int(time.Now().Sub(r.Time) / time.Millisecond)),
-                XAmzRequestID: aws.String(r.RequestID),
+                ClientID:           aws.String(rep.clientID),
+                API:                aws.String(r.Operation.Name),
+                Service:            aws.String(r.ClientInfo.ServiceID),
+                Timestamp:          (*metricTime)(&now),
+                UserAgent:          aws.String(r.HTTPRequest.Header.Get("User-Agent")),
+                Type:               aws.String("ApiCall"),
+                AttemptCount:       aws.Int(r.RetryCount + 1),
+                Region:             r.Config.Region,
+                Latency:            aws.Int(int(time.Now().Sub(r.Time) / time.Millisecond)),
+                XAmzRequestID:      aws.String(r.RequestID),
+                MaxRetriesExceeded: aws.Int(boolIntValue(r.RetryCount >= r.MaxRetries())),
+        }
+
+        if r.HTTPResponse != nil {
+                m.FinalHTTPStatusCode = aws.Int(r.HTTPResponse.StatusCode)
         }
 
+        if r.Error != nil {
+                if awserr, ok := r.Error.(awserr.Error); ok {
+                        m.SetFinalException(getMetricException(awserr))
+                }
+        }
+
+        m.TruncateFields()
+
         // TODO: Probably want to figure something out for logging dropped
         // metrics
         rep.metricsCh.Push(m)
@@ -221,11 +239,22 @@ func (rep *Reporter) InjectHandlers(handlers *request.Handlers) {
                 return
         }
 
-        apiCallHandler := request.NamedHandler{Name: APICallMetricHandlerName, Fn: rep.sendAPICallMetric}
-        apiCallAttemptHandler := request.NamedHandler{Name: APICallAttemptMetricHandlerName, Fn: rep.sendAPICallAttemptMetric}
+        handlers.Complete.PushFrontNamed(request.NamedHandler{
+                Name: APICallMetricHandlerName,
+                Fn:   rep.sendAPICallMetric,
+        })
 
-        handlers.Complete.PushFrontNamed(apiCallHandler)
-        handlers.Complete.PushFrontNamed(apiCallAttemptHandler)
+        handlers.CompleteAttempt.PushFrontNamed(request.NamedHandler{
+                Name: APICallAttemptMetricHandlerName,
+                Fn:   rep.sendAPICallAttemptMetric,
+        })
+}
+
+// boolIntValue return 1 for true and 0 for false.
+func boolIntValue(b bool) int {
+        if b {
+                return 1
+        }
 
-        handlers.AfterRetry.PushFrontNamed(apiCallAttemptHandler)
+        return 0
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/defaults/defaults.go b/vendor/github.com/aws/aws-sdk-go/aws/defaults/defaults.go
index 5040a2f..23bb639 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/defaults/defaults.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/defaults/defaults.go
@@ -24,6 +24,7 @@ import (
         "github.com/aws/aws-sdk-go/aws/ec2metadata"
         "github.com/aws/aws-sdk-go/aws/endpoints"
         "github.com/aws/aws-sdk-go/aws/request"
+        "github.com/aws/aws-sdk-go/internal/shareddefaults"
 )
 
 // A Defaults provides a collection of default values for SDK clients.
@@ -112,8 +113,8 @@ func CredProviders(cfg *aws.Config, handlers request.Handlers) []credentials.Pro
 }
 
 const (
-        httpProviderEnvVar     = "AWS_CONTAINER_CREDENTIALS_FULL_URI"
-        ecsCredsProviderEnvVar = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
+        httpProviderAuthorizationEnvVar = "AWS_CONTAINER_AUTHORIZATION_TOKEN"
+        httpProviderEnvVar              = "AWS_CONTAINER_CREDENTIALS_FULL_URI"
 )
 
 // RemoteCredProvider returns a credentials provider for the default remote
@@ -123,8 +124,8 @@ func RemoteCredProvider(cfg aws.Config, handlers request.Handlers) credentials.P
                 return localHTTPCredProvider(cfg, handlers, u)
         }
 
-        if uri := os.Getenv(ecsCredsProviderEnvVar); len(uri) > 0 {
-                u := fmt.Sprintf("http://169.254.170.2%s", uri)
+        if uri := os.Getenv(shareddefaults.ECSCredsProviderEnvVar); len(uri) > 0 {
+                u := fmt.Sprintf("%s%s", shareddefaults.ECSContainerCredentialsURI, uri)
                 return httpCredProvider(cfg, handlers, u)
         }
 
@@ -187,6 +188,7 @@ func httpCredProvider(cfg aws.Config, handlers request.Handlers, u string) crede
         return endpointcreds.NewProviderClient(cfg, handlers, u,
                 func(p *endpointcreds.Provider) {
                         p.ExpiryWindow = 5 * time.Minute
+                        p.AuthorizationToken = os.Getenv(httpProviderAuthorizationEnvVar)
                 },
         )
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go b/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go
index c215cd3..d57a1af 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go
@@ -24,8 +24,9 @@ func (c *EC2Metadata) GetMetadata(p string) (string, error) {
 
         output := &metadataOutput{}
         req := c.NewRequest(op, nil, output)
+        err := req.Send()
 
-        return output.Content, req.Send()
+        return output.Content, err
 }
 
 // GetUserData returns the userdata that was configured for the service. If
@@ -45,8 +46,9 @@ func (c *EC2Metadata) GetUserData() (string, error) {
                         r.Error = awserr.New("NotFoundError", "user-data not found", r.Error)
                 }
         })
+        err := req.Send()
 
-        return output.Content, req.Send()
+        return output.Content, err
 }
 
 // GetDynamicData uses the path provided to request information from the EC2
@@ -61,8 +63,9 @@ func (c *EC2Metadata) GetDynamicData(p string) (string, error) {
 
         output := &metadataOutput{}
         req := c.NewRequest(op, nil, output)
+        err := req.Send()
 
-        return output.Content, req.Send()
+        return output.Content, err
 }
 
 // GetInstanceIdentityDocument retrieves an identity document describing an
@@ -118,6 +121,10 @@ func (c *EC2Metadata) Region() (string, error) {
                 return "", err
         }
 
+        if len(resp) == 0 {
+                return "", awserr.New("EC2MetadataError", "invalid Region response", nil)
+        }
+
         // returns region without the suffix. Eg: us-west-2a becomes us-west-2
         return resp[:len(resp)-1], nil
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go b/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go
index ef5f732..f4438ea 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go
@@ -4,7 +4,7 @@
 // This package's client can be disabled completely by setting the environment
 // variable "AWS_EC2_METADATA_DISABLED=true". This environment variable set to
 // true instructs the SDK to disable the EC2 Metadata client. The client cannot
-// be used while the environemnt variable is set to true, (case insensitive).
+// be used while the environment variable is set to true, (case insensitive).
 package ec2metadata
 
 import (
@@ -72,6 +72,7 @@ func NewClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegio
                         cfg,
                         metadata.ClientInfo{
                                 ServiceName: ServiceName,
+                                ServiceID:   ServiceName,
                                 Endpoint:    endpoint,
                                 APIVersion:  "latest",
                         },
@@ -91,6 +92,9 @@ func NewClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegio
                 svc.Handlers.Send.SwapNamed(request.NamedHandler{
                         Name: corehandlers.SendHandler.Name,
                         Fn: func(r *request.Request) {
+                                r.HTTPResponse = &http.Response{
+                                        Header: http.Header{},
+                                }
                                 r.Error = awserr.New(
                                         request.CanceledErrorCode,
                                         "EC2 IMDS access disabled via "+disableServiceEnvVar+" env var",
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go
index 74f72de..87b9ff3 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go
@@ -84,6 +84,8 @@ func decodeV3Endpoints(modelDef modelDefinition, opts DecodeModelOptions) (Resol
                 custAddEC2Metadata(p)
                 custAddS3DualStack(p)
                 custRmIotDataService(p)
+                custFixAppAutoscalingChina(p)
+                custFixAppAutoscalingUsGov(p)
         }
 
         return ps, nil
@@ -94,7 +96,12 @@ func custAddS3DualStack(p *partition) {
                 return
         }
 
-        s, ok := p.Services["s3"]
+        custAddDualstack(p, "s3")
+        custAddDualstack(p, "s3-control")
+}
+
+func custAddDualstack(p *partition, svcName string) {
+        s, ok := p.Services[svcName]
         if !ok {
                 return
         }
@@ -102,7 +109,7 @@ func custAddS3DualStack(p *partition) {
         s.Defaults.HasDualStack = boxedTrue
         s.Defaults.DualStackHostname = "{service}.dualstack.{region}.{dnsSuffix}"
 
-        p.Services["s3"] = s
+        p.Services[svcName] = s
 }
 
 func custAddEC2Metadata(p *partition) {
@@ -122,6 +129,54 @@ func custRmIotDataService(p *partition) {
         delete(p.Services, "data.iot")
 }
 
+func custFixAppAutoscalingChina(p *partition) {
+        if p.ID != "aws-cn" {
+                return
+        }
+
+        const serviceName = "application-autoscaling"
+        s, ok := p.Services[serviceName]
+        if !ok {
+                return
+        }
+
+        const expectHostname = `autoscaling.{region}.amazonaws.com`
+        if e, a := s.Defaults.Hostname, expectHostname; e != a {
+                fmt.Printf("custFixAppAutoscalingChina: ignoring customization, expected %s, got %s\n", e, a)
+                return
+        }
+
+        s.Defaults.Hostname = expectHostname + ".cn"
+        p.Services[serviceName] = s
+}
+
+func custFixAppAutoscalingUsGov(p *partition) {
+        if p.ID != "aws-us-gov" {
+                return
+        }
+
+        const serviceName = "application-autoscaling"
+        s, ok := p.Services[serviceName]
+        if !ok {
+                return
+        }
+
+        if a := s.Defaults.CredentialScope.Service; a != "" {
+                fmt.Printf("custFixAppAutoscalingUsGov: ignoring customization, expected empty credential scope service, got %s\n", a)
+                return
+        }
+
+        if a := s.Defaults.Hostname; a != "" {
+                fmt.Printf("custFixAppAutoscalingUsGov: ignoring customization, expected empty hostname, got %s\n", a)
+                return
+        }
+
+        s.Defaults.CredentialScope.Service = "application-autoscaling"
+        s.Defaults.Hostname = "autoscaling.{region}.amazonaws.com"
+
+        p.Services[serviceName] = s
+}
+
 type decodeModelError struct {
         awsError
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
index 8e823be..50e170e 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
@@ -15,6 +15,7 @@ const (
 
 // AWS Standard partition's regions.
 const (
+        ApEast1RegionID      = "ap-east-1"      // Asia Pacific (Hong Kong).
         ApNortheast1RegionID = "ap-northeast-1" // Asia Pacific (Tokyo).
         ApNortheast2RegionID = "ap-northeast-2" // Asia Pacific (Seoul).
         ApSouth1RegionID     = "ap-south-1"     // Asia Pacific (Mumbai).
@@ -22,6 +23,7 @@ const (
         ApSoutheast2RegionID = "ap-southeast-2" // Asia Pacific (Sydney).
         CaCentral1RegionID   = "ca-central-1"   // Canada (Central).
         EuCentral1RegionID   = "eu-central-1"   // EU (Frankfurt).
+        EuNorth1RegionID     = "eu-north-1"     // EU (Stockholm).
         EuWest1RegionID      = "eu-west-1"      // EU (Ireland).
         EuWest2RegionID      = "eu-west-2"      // EU (London).
         EuWest3RegionID      = "eu-west-3"      // EU (Paris).
@@ -40,140 +42,10 @@ const (
 
 // AWS GovCloud (US) partition's regions.
 const (
+        UsGovEast1RegionID = "us-gov-east-1" // AWS GovCloud (US-East).
         UsGovWest1RegionID = "us-gov-west-1" // AWS GovCloud (US).
 )
 
-// Service identifiers
-const (
-        A4bServiceID                          = "a4b"                          // A4b.
-        AcmServiceID                          = "acm"                          // Acm.
-        AcmPcaServiceID                       = "acm-pca"                      // AcmPca.
-        ApiMediatailorServiceID               = "api.mediatailor"              // ApiMediatailor.
-        ApiPricingServiceID                   = "api.pricing"                  // ApiPricing.
-        ApigatewayServiceID                   = "apigateway"                   // Apigateway.
-        ApplicationAutoscalingServiceID       = "application-autoscaling"      // ApplicationAutoscaling.
-        Appstream2ServiceID                   = "appstream2"                   // Appstream2.
-        AthenaServiceID                       = "athena"                       // Athena.
-        AutoscalingServiceID                  = "autoscaling"                  // Autoscaling.
-        AutoscalingPlansServiceID             = "autoscaling-plans"            // AutoscalingPlans.
-        BatchServiceID                        = "batch"                        // Batch.
-        BudgetsServiceID                      = "budgets"                      // Budgets.
-        CeServiceID                           = "ce"                           // Ce.
-        Cloud9ServiceID                       = "cloud9"                       // Cloud9.
-        ClouddirectoryServiceID               = "clouddirectory"               // Clouddirectory.
-        CloudformationServiceID               = "cloudformation"               // Cloudformation.
-        CloudfrontServiceID                   = "cloudfront"                   // Cloudfront.
-        CloudhsmServiceID                     = "cloudhsm"                     // Cloudhsm.
-        Cloudhsmv2ServiceID                   = "cloudhsmv2"                   // Cloudhsmv2.
-        CloudsearchServiceID                  = "cloudsearch"                  // Cloudsearch.
-        CloudtrailServiceID                   = "cloudtrail"                   // Cloudtrail.
-        CodebuildServiceID                    = "codebuild"                    // Codebuild.
-        CodecommitServiceID                   = "codecommit"                   // Codecommit.
-        CodedeployServiceID                   = "codedeploy"                   // Codedeploy.
-        CodepipelineServiceID                 = "codepipeline"                 // Codepipeline.
-        CodestarServiceID                     = "codestar"                     // Codestar.
-        CognitoIdentityServiceID              = "cognito-identity"             // CognitoIdentity.
-        CognitoIdpServiceID                   = "cognito-idp"                  // CognitoIdp.
-        CognitoSyncServiceID                  = "cognito-sync"                 // CognitoSync.
-        ComprehendServiceID                   = "comprehend"                   // Comprehend.
-        ConfigServiceID                       = "config"                       // Config.
-        CurServiceID                          = "cur"                          // Cur.
-        DatapipelineServiceID                 = "datapipeline"                 // Datapipeline.
-        DaxServiceID                          = "dax"                          // Dax.
-        DevicefarmServiceID                   = "devicefarm"                   // Devicefarm.
-        DirectconnectServiceID                = "directconnect"                // Directconnect.
-        DiscoveryServiceID                    = "discovery"                    // Discovery.
-        DmsServiceID                          = "dms"                          // Dms.
-        DsServiceID                           = "ds"                           // Ds.
-        DynamodbServiceID                     = "dynamodb"                     // Dynamodb.
-        Ec2ServiceID                          = "ec2"                          // Ec2.
-        Ec2metadataServiceID                  = "ec2metadata"                  // Ec2metadata.
-        EcrServiceID                          = "ecr"                          // Ecr.
-        EcsServiceID                          = "ecs"                          // Ecs.
-        ElasticacheServiceID                  = "elasticache"                  // Elasticache.
-        ElasticbeanstalkServiceID             = "elasticbeanstalk"             // Elasticbeanstalk.
-        ElasticfilesystemServiceID            = "elasticfilesystem"            // Elasticfilesystem.
-        ElasticloadbalancingServiceID         = "elasticloadbalancing"         // Elasticloadbalancing.
-        ElasticmapreduceServiceID             = "elasticmapreduce"             // Elasticmapreduce.
-        ElastictranscoderServiceID            = "elastictranscoder"            // Elastictranscoder.
-        EmailServiceID                        = "email"                        // Email.
-        EntitlementMarketplaceServiceID       = "entitlement.marketplace"      // EntitlementMarketplace.
-        EsServiceID                           = "es"                           // Es.
-        EventsServiceID                       = "events"                       // Events.
-        FirehoseServiceID                     = "firehose"                     // Firehose.
-        FmsServiceID                          = "fms"                          // Fms.
-        GameliftServiceID                     = "gamelift"                     // Gamelift.
-        GlacierServiceID                      = "glacier"                      // Glacier.
-        GlueServiceID                         = "glue"                         // Glue.
-        GreengrassServiceID                   = "greengrass"                   // Greengrass.
-        GuarddutyServiceID                    = "guardduty"                    // Guardduty.
-        HealthServiceID                       = "health"                       // Health.
-        IamServiceID                          = "iam"                          // Iam.
-        ImportexportServiceID                 = "importexport"                 // Importexport.
-        InspectorServiceID                    = "inspector"                    // Inspector.
-        IotServiceID                          = "iot"                          // Iot.
-        KinesisServiceID                      = "kinesis"                      // Kinesis.
-        KinesisanalyticsServiceID             = "kinesisanalytics"             // Kinesisanalytics.
-        KinesisvideoServiceID                 = "kinesisvideo"                 // Kinesisvideo.
-        KmsServiceID                          = "kms"                          // Kms.
-        LambdaServiceID                       = "lambda"                       // Lambda.
-        LightsailServiceID                    = "lightsail"                    // Lightsail.
-        LogsServiceID                         = "logs"                         // Logs.
-        MachinelearningServiceID              = "machinelearning"              // Machinelearning.
-        MarketplacecommerceanalyticsServiceID = "marketplacecommerceanalytics" // Marketplacecommerceanalytics.
-        MediaconvertServiceID                 = "mediaconvert"                 // Mediaconvert.
-        MedialiveServiceID                    = "medialive"                    // Medialive.
-        MediapackageServiceID                 = "mediapackage"                 // Mediapackage.
-        MediastoreServiceID                   = "mediastore"                   // Mediastore.
-        MeteringMarketplaceServiceID          = "metering.marketplace"         // MeteringMarketplace.
-        MghServiceID                          = "mgh"                          // Mgh.
-        MobileanalyticsServiceID              = "mobileanalytics"              // Mobileanalytics.
-        ModelsLexServiceID                    = "models.lex"                   // ModelsLex.
-        MonitoringServiceID                   = "monitoring"                   // Monitoring.
-        MturkRequesterServiceID               = "mturk-requester"              // MturkRequester.
-        NeptuneServiceID                      = "neptune"                      // Neptune.
-        OpsworksServiceID                     = "opsworks"                     // Opsworks.
-        OpsworksCmServiceID                   = "opsworks-cm"                  // OpsworksCm.
-        OrganizationsServiceID                = "organizations"                // Organizations.
-        PinpointServiceID                     = "pinpoint"                     // Pinpoint.
-        PollyServiceID                        = "polly"                        // Polly.
-        RdsServiceID                          = "rds"                          // Rds.
-        RedshiftServiceID                     = "redshift"                     // Redshift.
-        RekognitionServiceID                  = "rekognition"                  // Rekognition.
-        ResourceGroupsServiceID               = "resource-groups"              // ResourceGroups.
-        Route53ServiceID                      = "route53"                      // Route53.
-        Route53domainsServiceID               = "route53domains"               // Route53domains.
-        RuntimeLexServiceID                   = "runtime.lex"                  // RuntimeLex.
-        RuntimeSagemakerServiceID             = "runtime.sagemaker"            // RuntimeSagemaker.
-        S3ServiceID                           = "s3"                           // S3.
-        SagemakerServiceID                    = "sagemaker"                    // Sagemaker.
-        SdbServiceID                          = "sdb"                          // Sdb.
-        SecretsmanagerServiceID               = "secretsmanager"               // Secretsmanager.
-        ServerlessrepoServiceID               = "serverlessrepo"               // Serverlessrepo.
-        ServicecatalogServiceID               = "servicecatalog"               // Servicecatalog.
-        ServicediscoveryServiceID             = "servicediscovery"             // Servicediscovery.
-        ShieldServiceID                       = "shield"                       // Shield.
-        SmsServiceID                          = "sms"                          // Sms.
-        SnowballServiceID                     = "snowball"                     // Snowball.
-        SnsServiceID                          = "sns"                          // Sns.
-        SqsServiceID                          = "sqs"                          // Sqs.
-        SsmServiceID                          = "ssm"                          // Ssm.
-        StatesServiceID                       = "states"                       // States.
-        StoragegatewayServiceID               = "storagegateway"               // Storagegateway.
-        StreamsDynamodbServiceID              = "streams.dynamodb"             // StreamsDynamodb.
-        StsServiceID                          = "sts"                          // Sts.
-        SupportServiceID                      = "support"                      // Support.
-        SwfServiceID                          = "swf"                          // Swf.
-        TaggingServiceID                      = "tagging"                      // Tagging.
-        TranslateServiceID                    = "translate"                    // Translate.
-        WafServiceID                          = "waf"                          // Waf.
-        WafRegionalServiceID                  = "waf-regional"                 // WafRegional.
-        WorkdocsServiceID                     = "workdocs"                     // Workdocs.
-        WorkmailServiceID                     = "workmail"                     // Workmail.
-        WorkspacesServiceID                   = "workspaces"                   // Workspaces.
-        XrayServiceID                         = "xray"                         // Xray.
-)
-
 // DefaultResolver returns an Endpoint resolver that will be able
 // to resolve endpoints for: AWS Standard, AWS China, and AWS GovCloud (US).
 //
@@ -220,6 +92,9 @@ var awsPartition = partition{
                 SignatureVersions: []string{"v4"},
         },
         Regions: regions{
+                "ap-east-1": region{
+                        Description: "Asia Pacific (Hong Kong)",
+                },
                 "ap-northeast-1": region{
                         Description: "Asia Pacific (Tokyo)",
                 },
@@ -241,6 +116,9 @@ var awsPartition = partition{
                 "eu-central-1": region{
                         Description: "EU (Frankfurt)",
                 },
+                "eu-north-1": region{
+                        Description: "EU (Stockholm)",
+                },
                 "eu-west-1": region{
                         Description: "EU (Ireland)",
                 },
@@ -276,6 +154,7 @@ var awsPartition = partition{
                 "acm": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -283,6 +162,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -299,16 +179,129 @@ var awsPartition = partition{
                         },
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
                                 "us-west-2":      endpoint{},
                         },
                 },
+                "api.ecr": service{
+
+                        Endpoints: endpoints{
+                                "ap-east-1": endpoint{
+                                        Hostname: "api.ecr.ap-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-east-1",
+                                        },
+                                },
+                                "ap-northeast-1": endpoint{
+                                        Hostname: "api.ecr.ap-northeast-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-northeast-1",
+                                        },
+                                },
+                                "ap-northeast-2": endpoint{
+                                        Hostname: "api.ecr.ap-northeast-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-northeast-2",
+                                        },
+                                },
+                                "ap-south-1": endpoint{
+                                        Hostname: "api.ecr.ap-south-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-south-1",
+                                        },
+                                },
+                                "ap-southeast-1": endpoint{
+                                        Hostname: "api.ecr.ap-southeast-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-southeast-1",
+                                        },
+                                },
+                                "ap-southeast-2": endpoint{
+                                        Hostname: "api.ecr.ap-southeast-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-southeast-2",
+                                        },
+                                },
+                                "ca-central-1": endpoint{
+                                        Hostname: "api.ecr.ca-central-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ca-central-1",
+                                        },
+                                },
+                                "eu-central-1": endpoint{
+                                        Hostname: "api.ecr.eu-central-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-central-1",
+                                        },
+                                },
+                                "eu-north-1": endpoint{
+                                        Hostname: "api.ecr.eu-north-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-north-1",
+                                        },
+                                },
+                                "eu-west-1": endpoint{
+                                        Hostname: "api.ecr.eu-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-west-1",
+                                        },
+                                },
+                                "eu-west-2": endpoint{
+                                        Hostname: "api.ecr.eu-west-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-west-2",
+                                        },
+                                },
+                                "eu-west-3": endpoint{
+                                        Hostname: "api.ecr.eu-west-3.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-west-3",
+                                        },
+                                },
+                                "sa-east-1": endpoint{
+                                        Hostname: "api.ecr.sa-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "sa-east-1",
+                                        },
+                                },
+                                "us-east-1": endpoint{
+                                        Hostname: "api.ecr.us-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
+                                "us-east-2": endpoint{
+                                        Hostname: "api.ecr.us-east-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-2",
+                                        },
+                                },
+                                "us-west-1": endpoint{
+                                        Hostname: "api.ecr.us-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-1",
+                                        },
+                                },
+                                "us-west-2": endpoint{
+                                        Hostname: "api.ecr.us-west-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-2",
+                                        },
+                                },
+                        },
+                },
                 "api.mediatailor": service{
 
                         Endpoints: endpoints{
@@ -317,6 +310,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "us-east-1":      endpoint{},
+                                "us-west-2":      endpoint{},
                         },
                 },
                 "api.pricing": service{
@@ -330,9 +324,52 @@ var awsPartition = partition{
                                 "us-east-1":  endpoint{},
                         },
                 },
+                "api.sagemaker": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-1-fips": endpoint{
+                                        Hostname: "api-fips.sagemaker.us-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
+                                "us-east-2": endpoint{},
+                                "us-east-2-fips": endpoint{
+                                        Hostname: "api-fips.sagemaker.us-east-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-2",
+                                        },
+                                },
+                                "us-west-1": endpoint{},
+                                "us-west-1-fips": endpoint{
+                                        Hostname: "api-fips.sagemaker.us-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-1",
+                                        },
+                                },
+                                "us-west-2": endpoint{},
+                                "us-west-2-fips": endpoint{
+                                        Hostname: "api-fips.sagemaker.us-west-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-2",
+                                        },
+                                },
+                        },
+                },
                 "apigateway": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -340,6 +377,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -359,6 +397,7 @@ var awsPartition = partition{
                                 },
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -366,6 +405,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -385,19 +425,43 @@ var awsPartition = partition{
                         },
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-west-2":      endpoint{},
                         },
                 },
+                "appsync": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
                 "athena": service{
 
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
                                 "us-west-2":      endpoint{},
@@ -408,6 +472,7 @@ var awsPartition = partition{
                                 Protocols: []string{"http", "https"},
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -415,6 +480,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -434,10 +500,18 @@ var awsPartition = partition{
                                 },
                         },
                         Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
+                                "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
                                 "us-west-2":      endpoint{},
                         },
                 },
@@ -451,8 +525,11 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
+                                "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
                                 "us-west-1":      endpoint{},
@@ -485,9 +562,27 @@ var awsPartition = partition{
                                 },
                         },
                 },
+                "chime": service{
+                        PartitionEndpoint: "aws-global",
+                        IsRegionalized:    boxedFalse,
+                        Defaults: endpoint{
+                                SSLCommonName: "service.chime.aws.amazon.com",
+                                Protocols:     []string{"https"},
+                        },
+                        Endpoints: endpoints{
+                                "aws-global": endpoint{
+                                        Hostname:  "service.chime.aws.amazon.com",
+                                        Protocols: []string{"https"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
+                        },
+                },
                 "cloud9": service{
 
                         Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "us-east-1":      endpoint{},
@@ -500,6 +595,7 @@ var awsPartition = partition{
                         Endpoints: endpoints{
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
@@ -511,6 +607,7 @@ var awsPartition = partition{
                 "cloudformation": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -518,6 +615,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -565,13 +663,16 @@ var awsPartition = partition{
                         },
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
                                 "us-west-1":      endpoint{},
@@ -596,6 +697,7 @@ var awsPartition = partition{
                 "cloudtrail": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -603,6 +705,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -670,11 +773,17 @@ var awsPartition = partition{
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
-                                "sa-east-1":      endpoint{},
-                                "us-east-1":      endpoint{},
-                                "us-east-2":      endpoint{},
-                                "us-west-1":      endpoint{},
-                                "us-west-2":      endpoint{},
+                                "fips": endpoint{
+                                        Hostname: "codecommit-fips.ca-central-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ca-central-1",
+                                        },
+                                },
+                                "sa-east-1": endpoint{},
+                                "us-east-1": endpoint{},
+                                "us-east-2": endpoint{},
+                                "us-west-1": endpoint{},
+                                "us-west-2": endpoint{},
                         },
                 },
                 "codedeploy": service{
@@ -687,14 +796,39 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
                                 "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
-                                "us-east-2":      endpoint{},
-                                "us-west-1":      endpoint{},
-                                "us-west-2":      endpoint{},
+                                "us-east-1-fips": endpoint{
+                                        Hostname: "codedeploy-fips.us-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
+                                "us-east-2": endpoint{},
+                                "us-east-2-fips": endpoint{
+                                        Hostname: "codedeploy-fips.us-east-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-2",
+                                        },
+                                },
+                                "us-west-1": endpoint{},
+                                "us-west-1-fips": endpoint{
+                                        Hostname: "codedeploy-fips.us-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-1",
+                                        },
+                                },
+                                "us-west-2": endpoint{},
+                                "us-west-2-fips": endpoint{
+                                        Hostname: "codedeploy-fips.us-west-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-2",
+                                        },
+                                },
                         },
                 },
                 "codepipeline": service{
@@ -742,6 +876,7 @@ var awsPartition = partition{
                                 "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
@@ -758,6 +893,7 @@ var awsPartition = partition{
                                 "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
@@ -787,6 +923,20 @@ var awsPartition = partition{
                                 Protocols: []string{"https"},
                         },
                         Endpoints: endpoints{
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
+                "comprehendmedical": service{
+
+                        Endpoints: endpoints{
                                 "eu-west-1": endpoint{},
                                 "us-east-1": endpoint{},
                                 "us-east-2": endpoint{},
@@ -796,6 +946,7 @@ var awsPartition = partition{
                 "config": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -803,6 +954,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -829,6 +981,21 @@ var awsPartition = partition{
                                 "us-west-2":      endpoint{},
                         },
                 },
+                "datasync": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
                 "dax": service{
 
                         Endpoints: endpoints{
@@ -836,6 +1003,7 @@ var awsPartition = partition{
                                 "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
@@ -860,6 +1028,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -879,6 +1048,7 @@ var awsPartition = partition{
                 "dms": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -886,6 +1056,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -896,6 +1067,41 @@ var awsPartition = partition{
                                 "us-west-2":      endpoint{},
                         },
                 },
+                "docdb": service{
+
+                        Endpoints: endpoints{
+                                "eu-central-1": endpoint{
+                                        Hostname: "rds.eu-central-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-central-1",
+                                        },
+                                },
+                                "eu-west-1": endpoint{
+                                        Hostname: "rds.eu-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-west-1",
+                                        },
+                                },
+                                "us-east-1": endpoint{
+                                        Hostname: "rds.us-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
+                                "us-east-2": endpoint{
+                                        Hostname: "rds.us-east-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-2",
+                                        },
+                                },
+                                "us-west-2": endpoint{
+                                        Hostname: "rds.us-west-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-2",
+                                        },
+                                },
+                        },
+                },
                 "ds": service{
 
                         Endpoints: endpoints{
@@ -920,6 +1126,7 @@ var awsPartition = partition{
                                 Protocols: []string{"http", "https"},
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -927,6 +1134,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -949,6 +1157,7 @@ var awsPartition = partition{
                                 Protocols: []string{"http", "https"},
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -956,6 +1165,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -977,29 +1187,10 @@ var awsPartition = partition{
                                 },
                         },
                 },
-                "ecr": service{
-
-                        Endpoints: endpoints{
-                                "ap-northeast-1": endpoint{},
-                                "ap-northeast-2": endpoint{},
-                                "ap-south-1":     endpoint{},
-                                "ap-southeast-1": endpoint{},
-                                "ap-southeast-2": endpoint{},
-                                "ca-central-1":   endpoint{},
-                                "eu-central-1":   endpoint{},
-                                "eu-west-1":      endpoint{},
-                                "eu-west-2":      endpoint{},
-                                "eu-west-3":      endpoint{},
-                                "sa-east-1":      endpoint{},
-                                "us-east-1":      endpoint{},
-                                "us-east-2":      endpoint{},
-                                "us-west-1":      endpoint{},
-                                "us-west-2":      endpoint{},
-                        },
-                },
                 "ecs": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1007,6 +1198,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1020,6 +1212,7 @@ var awsPartition = partition{
                 "elasticache": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1027,14 +1220,21 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
-                                "sa-east-1":      endpoint{},
-                                "us-east-1":      endpoint{},
-                                "us-east-2":      endpoint{},
-                                "us-west-1":      endpoint{},
-                                "us-west-2":      endpoint{},
+                                "fips": endpoint{
+                                        Hostname: "elasticache-fips.us-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-1",
+                                        },
+                                },
+                                "sa-east-1": endpoint{},
+                                "us-east-1": endpoint{},
+                                "us-east-2": endpoint{},
+                                "us-west-1": endpoint{},
+                                "us-west-2": endpoint{},
                         },
                 },
                 "elasticbeanstalk": service{
@@ -1047,6 +1247,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1060,10 +1261,13 @@ var awsPartition = partition{
                 "elasticfilesystem": service{
 
                         Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
+                                "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
                                 "us-west-1":      endpoint{},
@@ -1075,6 +1279,7 @@ var awsPartition = partition{
                                 Protocols: []string{"https"},
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1082,6 +1287,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1095,9 +1301,10 @@ var awsPartition = partition{
                 "elasticmapreduce": service{
                         Defaults: endpoint{
                                 SSLCommonName: "{region}.{service}.{dnsSuffix}",
-                                Protocols:     []string{"http", "https"},
+                                Protocols:     []string{"https"},
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1107,10 +1314,11 @@ var awsPartition = partition{
                                 "eu-central-1": endpoint{
                                         SSLCommonName: "{service}.{region}.{dnsSuffix}",
                                 },
-                                "eu-west-1": endpoint{},
-                                "eu-west-2": endpoint{},
-                                "eu-west-3": endpoint{},
-                                "sa-east-1": endpoint{},
+                                "eu-north-1": endpoint{},
+                                "eu-west-1":  endpoint{},
+                                "eu-west-2":  endpoint{},
+                                "eu-west-3":  endpoint{},
+                                "sa-east-1":  endpoint{},
                                 "us-east-1": endpoint{
                                         SSLCommonName: "{service}.{region}.{dnsSuffix}",
                                 },
@@ -1135,9 +1343,10 @@ var awsPartition = partition{
                 "email": service{
 
                         Endpoints: endpoints{
-                                "eu-west-1": endpoint{},
-                                "us-east-1": endpoint{},
-                                "us-west-2": endpoint{},
+                                "eu-central-1": endpoint{},
+                                "eu-west-1":    endpoint{},
+                                "us-east-1":    endpoint{},
+                                "us-west-2":    endpoint{},
                         },
                 },
                 "entitlement.marketplace": service{
@@ -1153,6 +1362,7 @@ var awsPartition = partition{
                 "es": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1160,19 +1370,27 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
-                                "sa-east-1":      endpoint{},
-                                "us-east-1":      endpoint{},
-                                "us-east-2":      endpoint{},
-                                "us-west-1":      endpoint{},
-                                "us-west-2":      endpoint{},
+                                "fips": endpoint{
+                                        Hostname: "es-fips.us-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-1",
+                                        },
+                                },
+                                "sa-east-1": endpoint{},
+                                "us-east-1": endpoint{},
+                                "us-east-2": endpoint{},
+                                "us-west-1": endpoint{},
+                                "us-west-2": endpoint{},
                         },
                 },
                 "events": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1180,6 +1398,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1195,11 +1414,15 @@ var awsPartition = partition{
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
+                                "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
                                 "us-west-1":      endpoint{},
@@ -1211,9 +1434,24 @@ var awsPartition = partition{
                                 Protocols: []string{"https"},
                         },
                         Endpoints: endpoints{
-                                "eu-west-1": endpoint{},
-                                "us-east-1": endpoint{},
-                                "us-west-2": endpoint{},
+                                "ap-northeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
+                "fsx": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-2":      endpoint{},
                         },
                 },
                 "gamelift": service{
@@ -1240,6 +1478,7 @@ var awsPartition = partition{
                                 Protocols: []string{"http", "https"},
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1247,9 +1486,11 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
+                                "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
                                 "us-west-1":      endpoint{},
@@ -1264,11 +1505,14 @@ var awsPartition = partition{
                                 "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
                                 "us-west-2":      endpoint{},
                         },
                 },
@@ -1281,6 +1525,7 @@ var awsPartition = partition{
                                 "ap-northeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-west-2":      endpoint{},
                         },
@@ -1377,9 +1622,21 @@ var awsPartition = partition{
                                 "us-west-2":      endpoint{},
                         },
                 },
+                "iotanalytics": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
                 "kinesis": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1387,6 +1644,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1400,15 +1658,18 @@ var awsPartition = partition{
                 "kinesisanalytics": service{
 
                         Endpoints: endpoints{
-                                "eu-west-1": endpoint{},
-                                "us-east-1": endpoint{},
-                                "us-west-2": endpoint{},
+                                "eu-central-1": endpoint{},
+                                "eu-west-1":    endpoint{},
+                                "us-east-1":    endpoint{},
+                                "us-east-2":    endpoint{},
+                                "us-west-2":    endpoint{},
                         },
                 },
                 "kinesisvideo": service{
 
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "us-east-1":      endpoint{},
@@ -1418,6 +1679,13 @@ var awsPartition = partition{
                 "kms": service{
 
                         Endpoints: endpoints{
+                                "ProdFips": endpoint{
+                                        Hostname: "kms-fips.ca-central-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ca-central-1",
+                                        },
+                                },
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1425,6 +1693,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1438,6 +1707,7 @@ var awsPartition = partition{
                 "lambda": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1445,6 +1715,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1455,6 +1726,22 @@ var awsPartition = partition{
                                 "us-west-2":      endpoint{},
                         },
                 },
+                "license-manager": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
                 "lightsail": service{
 
                         Endpoints: endpoints{
@@ -1476,6 +1763,7 @@ var awsPartition = partition{
                 "logs": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1483,6 +1771,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1506,6 +1795,25 @@ var awsPartition = partition{
                                 "us-east-1": endpoint{},
                         },
                 },
+                "mediaconnect": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
+                                "sa-east-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
                 "mediaconvert": service{
 
                         Endpoints: endpoints{
@@ -1518,6 +1826,7 @@ var awsPartition = partition{
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
                                 "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
@@ -1530,6 +1839,7 @@ var awsPartition = partition{
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "eu-central-1":   endpoint{},
@@ -1544,6 +1854,7 @@ var awsPartition = partition{
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "eu-central-1":   endpoint{},
@@ -1551,6 +1862,7 @@ var awsPartition = partition{
                                 "eu-west-3":      endpoint{},
                                 "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
+                                "us-west-1":      endpoint{},
                                 "us-west-2":      endpoint{},
                         },
                 },
@@ -1558,6 +1870,7 @@ var awsPartition = partition{
 
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
@@ -1572,6 +1885,7 @@ var awsPartition = partition{
                                 },
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1579,6 +1893,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1618,6 +1933,7 @@ var awsPartition = partition{
                                 Protocols: []string{"http", "https"},
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1625,6 +1941,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1635,6 +1952,22 @@ var awsPartition = partition{
                                 "us-west-2":      endpoint{},
                         },
                 },
+                "mq": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
                 "mturk-requester": service{
                         IsRegionalized: boxedFalse,
 
@@ -1648,12 +1981,48 @@ var awsPartition = partition{
                 "neptune": service{
 
                         Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{
+                                        Hostname: "rds.ap-northeast-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-northeast-1",
+                                        },
+                                },
+                                "ap-south-1": endpoint{
+                                        Hostname: "rds.ap-south-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-south-1",
+                                        },
+                                },
+                                "ap-southeast-1": endpoint{
+                                        Hostname: "rds.ap-southeast-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-southeast-1",
+                                        },
+                                },
+                                "ap-southeast-2": endpoint{
+                                        Hostname: "rds.ap-southeast-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-southeast-2",
+                                        },
+                                },
+                                "eu-central-1": endpoint{
+                                        Hostname: "rds.eu-central-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-central-1",
+                                        },
+                                },
                                 "eu-west-1": endpoint{
                                         Hostname: "rds.eu-west-1.amazonaws.com",
                                         CredentialScope: credentialScope{
                                                 Region: "eu-west-1",
                                         },
                                 },
+                                "eu-west-2": endpoint{
+                                        Hostname: "rds.eu-west-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-west-2",
+                                        },
+                                },
                                 "us-east-1": endpoint{
                                         Hostname: "rds.us-east-1.amazonaws.com",
                                         CredentialScope: credentialScope{
@@ -1728,7 +2097,12 @@ var awsPartition = partition{
                                 },
                         },
                         Endpoints: endpoints{
-                                "us-east-1": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-west-2":      endpoint{},
                         },
                 },
                 "polly": service{
@@ -1741,6 +2115,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1754,6 +2129,7 @@ var awsPartition = partition{
                 "rds": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1761,6 +2137,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1776,6 +2153,7 @@ var awsPartition = partition{
                 "redshift": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1783,6 +2161,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -1797,6 +2176,8 @@ var awsPartition = partition{
 
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "us-east-1":      endpoint{},
@@ -1807,6 +2188,7 @@ var awsPartition = partition{
                 "resource-groups": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -1814,8 +2196,10 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
                                 "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
@@ -1823,6 +2207,15 @@ var awsPartition = partition{
                                 "us-west-2":      endpoint{},
                         },
                 },
+                "robomaker": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
                 "route53": service{
                         PartitionEndpoint: "aws-global",
                         IsRegionalized:    boxedFalse,
@@ -1842,6 +2235,27 @@ var awsPartition = partition{
                                 "us-east-1": endpoint{},
                         },
                 },
+                "route53resolver": service{
+                        Defaults: endpoint{
+                                Protocols: []string{"https"},
+                        },
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
                 "runtime.lex": service{
                         Defaults: endpoint{
                                 CredentialScope: credentialScope{
@@ -1858,9 +2272,17 @@ var awsPartition = partition{
 
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
+                                "eu-central-1":   endpoint{},
                                 "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
                                 "us-west-2":      endpoint{},
                         },
                 },
@@ -1875,6 +2297,7 @@ var awsPartition = partition{
                                 DualStackHostname: "{service}.dualstack.{region}.{dnsSuffix}",
                         },
                         Endpoints: endpoints{
+                                "ap-east-1": endpoint{},
                                 "ap-northeast-1": endpoint{
                                         Hostname:          "s3.ap-northeast-1.amazonaws.com",
                                         SignatureVersions: []string{"s3", "s3v4"},
@@ -1891,6 +2314,7 @@ var awsPartition = partition{
                                 },
                                 "ca-central-1": endpoint{},
                                 "eu-central-1": endpoint{},
+                                "eu-north-1":   endpoint{},
                                 "eu-west-1": endpoint{
                                         Hostname:          "s3.eu-west-1.amazonaws.com",
                                         SignatureVersions: []string{"s3", "s3v4"},
@@ -1923,15 +2347,155 @@ var awsPartition = partition{
                                 },
                         },
                 },
-                "sagemaker": service{
+                "s3-control": service{
+                        Defaults: endpoint{
+                                Protocols:         []string{"https"},
+                                SignatureVersions: []string{"s3v4"},
 
+                                HasDualStack:      boxedTrue,
+                                DualStackHostname: "{service}.dualstack.{region}.{dnsSuffix}",
+                        },
                         Endpoints: endpoints{
-                                "ap-northeast-1": endpoint{},
-                                "ap-northeast-2": endpoint{},
-                                "eu-west-1":      endpoint{},
-                                "us-east-1":      endpoint{},
-                                "us-east-2":      endpoint{},
-                                "us-west-2":      endpoint{},
+                                "ap-northeast-1": endpoint{
+                                        Hostname:          "s3-control.ap-northeast-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-northeast-1",
+                                        },
+                                },
+                                "ap-northeast-2": endpoint{
+                                        Hostname:          "s3-control.ap-northeast-2.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-northeast-2",
+                                        },
+                                },
+                                "ap-south-1": endpoint{
+                                        Hostname:          "s3-control.ap-south-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-south-1",
+                                        },
+                                },
+                                "ap-southeast-1": endpoint{
+                                        Hostname:          "s3-control.ap-southeast-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-southeast-1",
+                                        },
+                                },
+                                "ap-southeast-2": endpoint{
+                                        Hostname:          "s3-control.ap-southeast-2.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-southeast-2",
+                                        },
+                                },
+                                "ca-central-1": endpoint{
+                                        Hostname:          "s3-control.ca-central-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "ca-central-1",
+                                        },
+                                },
+                                "eu-central-1": endpoint{
+                                        Hostname:          "s3-control.eu-central-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-central-1",
+                                        },
+                                },
+                                "eu-north-1": endpoint{
+                                        Hostname:          "s3-control.eu-north-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-north-1",
+                                        },
+                                },
+                                "eu-west-1": endpoint{
+                                        Hostname:          "s3-control.eu-west-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-west-1",
+                                        },
+                                },
+                                "eu-west-2": endpoint{
+                                        Hostname:          "s3-control.eu-west-2.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-west-2",
+                                        },
+                                },
+                                "eu-west-3": endpoint{
+                                        Hostname:          "s3-control.eu-west-3.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "eu-west-3",
+                                        },
+                                },
+                                "sa-east-1": endpoint{
+                                        Hostname:          "s3-control.sa-east-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "sa-east-1",
+                                        },
+                                },
+                                "us-east-1": endpoint{
+                                        Hostname:          "s3-control.us-east-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
+                                "us-east-1-fips": endpoint{
+                                        Hostname:          "s3-control-fips.us-east-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
+                                "us-east-2": endpoint{
+                                        Hostname:          "s3-control.us-east-2.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-2",
+                                        },
+                                },
+                                "us-east-2-fips": endpoint{
+                                        Hostname:          "s3-control-fips.us-east-2.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-2",
+                                        },
+                                },
+                                "us-west-1": endpoint{
+                                        Hostname:          "s3-control.us-west-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-1",
+                                        },
+                                },
+                                "us-west-1-fips": endpoint{
+                                        Hostname:          "s3-control-fips.us-west-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-1",
+                                        },
+                                },
+                                "us-west-2": endpoint{
+                                        Hostname:          "s3-control.us-west-2.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-2",
+                                        },
+                                },
+                                "us-west-2-fips": endpoint{
+                                        Hostname:          "s3-control-fips.us-west-2.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-2",
+                                        },
+                                },
                         },
                 },
                 "sdb": service{
@@ -1962,8 +2526,54 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
+                                "sa-east-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-1-fips": endpoint{
+                                        Hostname: "secretsmanager-fips.us-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
+                                "us-east-2": endpoint{},
+                                "us-east-2-fips": endpoint{
+                                        Hostname: "secretsmanager-fips.us-east-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-2",
+                                        },
+                                },
+                                "us-west-1": endpoint{},
+                                "us-west-1-fips": endpoint{
+                                        Hostname: "secretsmanager-fips.us-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-1",
+                                        },
+                                },
+                                "us-west-2": endpoint{},
+                                "us-west-2-fips": endpoint{
+                                        Hostname: "secretsmanager-fips.us-west-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-2",
+                                        },
+                                },
+                        },
+                },
+                "securityhub": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
                                 "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
@@ -1997,12 +2607,18 @@ var awsPartition = partition{
                                 "eu-central-1": endpoint{
                                         Protocols: []string{"https"},
                                 },
+                                "eu-north-1": endpoint{
+                                        Protocols: []string{"https"},
+                                },
                                 "eu-west-1": endpoint{
                                         Protocols: []string{"https"},
                                 },
                                 "eu-west-2": endpoint{
                                         Protocols: []string{"https"},
                                 },
+                                "eu-west-3": endpoint{
+                                        Protocols: []string{"https"},
+                                },
                                 "sa-east-1": endpoint{
                                         Protocols: []string{"https"},
                                 },
@@ -2030,30 +2646,65 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
                                 "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
-                                "us-east-2":      endpoint{},
-                                "us-west-1":      endpoint{},
-                                "us-west-2":      endpoint{},
+                                "us-east-1-fips": endpoint{
+                                        Hostname: "servicecatalog-fips.us-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
+                                "us-east-2": endpoint{},
+                                "us-east-2-fips": endpoint{
+                                        Hostname: "servicecatalog-fips.us-east-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-2",
+                                        },
+                                },
+                                "us-west-1": endpoint{},
+                                "us-west-1-fips": endpoint{
+                                        Hostname: "servicecatalog-fips.us-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-1",
+                                        },
+                                },
+                                "us-west-2": endpoint{},
+                                "us-west-2-fips": endpoint{
+                                        Hostname: "servicecatalog-fips.us-west-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-2",
+                                        },
+                                },
                         },
                 },
                 "servicediscovery": service{
 
                         Endpoints: endpoints{
-                                "eu-west-1": endpoint{},
-                                "us-east-1": endpoint{},
-                                "us-east-2": endpoint{},
-                                "us-west-1": endpoint{},
-                                "us-west-2": endpoint{},
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
+                                "sa-east-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
+                                "us-west-2":      endpoint{},
                         },
                 },
                 "shield": service{
                         IsRegionalized: boxedFalse,
                         Defaults: endpoint{
-                                SSLCommonName: "Shield.us-east-1.amazonaws.com",
+                                SSLCommonName: "shield.us-east-1.amazonaws.com",
                                 Protocols:     []string{"https"},
                         },
                         Endpoints: endpoints{
@@ -2070,6 +2721,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -2104,6 +2756,7 @@ var awsPartition = partition{
                                 Protocols: []string{"http", "https"},
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -2111,6 +2764,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -2127,6 +2781,7 @@ var awsPartition = partition{
                                 Protocols:     []string{"http", "https"},
                         },
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -2134,6 +2789,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -2173,6 +2829,7 @@ var awsPartition = partition{
                 "ssm": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -2180,6 +2837,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -2193,14 +2851,19 @@ var awsPartition = partition{
                 "states": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
                                 "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
+                                "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
                                 "us-west-1":      endpoint{},
@@ -2217,6 +2880,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -2242,6 +2906,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -2268,6 +2933,12 @@ var awsPartition = partition{
                                 },
                         },
                         Endpoints: endpoints{
+                                "ap-east-1": endpoint{
+                                        Hostname: "sts.ap-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "ap-east-1",
+                                        },
+                                },
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{
                                         Hostname: "sts.ap-northeast-2.amazonaws.com",
@@ -2281,6 +2952,7 @@ var awsPartition = partition{
                                 "aws-global":     endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -2324,6 +2996,7 @@ var awsPartition = partition{
                 "swf": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -2331,6 +3004,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -2344,6 +3018,7 @@ var awsPartition = partition{
                 "tagging": service{
 
                         Endpoints: endpoints{
+                                "ap-east-1":      endpoint{},
                                 "ap-northeast-1": endpoint{},
                                 "ap-northeast-2": endpoint{},
                                 "ap-south-1":     endpoint{},
@@ -2351,6 +3026,7 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
                                 "eu-west-3":      endpoint{},
@@ -2361,15 +3037,54 @@ var awsPartition = partition{
                                 "us-west-2":      endpoint{},
                         },
                 },
+                "transfer": service{
+
+                        Endpoints: endpoints{
+                                "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-south-1":     endpoint{},
+                                "ap-southeast-1": endpoint{},
+                                "ap-southeast-2": endpoint{},
+                                "ca-central-1":   endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-2":      endpoint{},
+                                "us-west-1":      endpoint{},
+                                "us-west-2":      endpoint{},
+                        },
+                },
                 "translate": service{
                         Defaults: endpoint{
                                 Protocols: []string{"https"},
                         },
                         Endpoints: endpoints{
-                                "eu-west-1": endpoint{},
-                                "us-east-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "eu-central-1":   endpoint{},
+                                "eu-west-1":      endpoint{},
+                                "us-east-1":      endpoint{},
+                                "us-east-1-fips": endpoint{
+                                        Hostname: "translate-fips.us-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-1",
+                                        },
+                                },
                                 "us-east-2": endpoint{},
+                                "us-east-2-fips": endpoint{
+                                        Hostname: "translate-fips.us-east-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-east-2",
+                                        },
+                                },
                                 "us-west-2": endpoint{},
+                                "us-west-2-fips": endpoint{
+                                        Hostname: "translate-fips.us-west-2.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-west-2",
+                                        },
+                                },
                         },
                 },
                 "waf": service{
@@ -2389,9 +3104,13 @@ var awsPartition = partition{
 
                         Endpoints: endpoints{
                                 "ap-northeast-1": endpoint{},
+                                "ap-northeast-2": endpoint{},
+                                "ap-southeast-1": endpoint{},
                                 "ap-southeast-2": endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
+                                "eu-west-2":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
                                 "us-west-1":      endpoint{},
@@ -2445,8 +3164,10 @@ var awsPartition = partition{
                                 "ap-southeast-2": endpoint{},
                                 "ca-central-1":   endpoint{},
                                 "eu-central-1":   endpoint{},
+                                "eu-north-1":     endpoint{},
                                 "eu-west-1":      endpoint{},
                                 "eu-west-2":      endpoint{},
+                                "eu-west-3":      endpoint{},
                                 "sa-east-1":      endpoint{},
                                 "us-east-1":      endpoint{},
                                 "us-east-2":      endpoint{},
@@ -2486,6 +3207,23 @@ var awscnPartition = partition{
                 },
         },
         Services: services{
+                "api.ecr": service{
+
+                        Endpoints: endpoints{
+                                "cn-north-1": endpoint{
+                                        Hostname: "api.ecr.cn-north-1.amazonaws.com.cn",
+                                        CredentialScope: credentialScope{
+                                                Region: "cn-north-1",
+                                        },
+                                },
+                                "cn-northwest-1": endpoint{
+                                        Hostname: "api.ecr.cn-northwest-1.amazonaws.com.cn",
+                                        CredentialScope: credentialScope{
+                                                Region: "cn-northwest-1",
+                                        },
+                                },
+                        },
+                },
                 "apigateway": service{
 
                         Endpoints: endpoints{
@@ -2495,7 +3233,7 @@ var awscnPartition = partition{
                 },
                 "application-autoscaling": service{
                         Defaults: endpoint{
-                                Hostname:  "autoscaling.{region}.amazonaws.com",
+                                Hostname:  "autoscaling.{region}.amazonaws.com.cn",
                                 Protocols: []string{"http", "https"},
                                 CredentialScope: credentialScope{
                                         Service: "application-autoscaling",
@@ -2522,6 +3260,20 @@ var awscnPartition = partition{
                                 "cn-northwest-1": endpoint{},
                         },
                 },
+                "cloudfront": service{
+                        PartitionEndpoint: "aws-cn-global",
+                        IsRegionalized:    boxedFalse,
+
+                        Endpoints: endpoints{
+                                "aws-cn-global": endpoint{
+                                        Hostname:  "cloudfront.cn-northwest-1.amazonaws.com.cn",
+                                        Protocols: []string{"http", "https"},
+                                        CredentialScope: credentialScope{
+                                                Region: "cn-northwest-1",
+                                        },
+                                },
+                        },
+                },
                 "cloudtrail": service{
 
                         Endpoints: endpoints{
@@ -2529,6 +3281,13 @@ var awscnPartition = partition{
                                 "cn-northwest-1": endpoint{},
                         },
                 },
+                "codebuild": service{
+
+                        Endpoints: endpoints{
+                                "cn-north-1":     endpoint{},
+                                "cn-northwest-1": endpoint{},
+                        },
+                },
                 "codedeploy": service{
 
                         Endpoints: endpoints{
@@ -2556,6 +3315,13 @@ var awscnPartition = partition{
                                 "cn-northwest-1": endpoint{},
                         },
                 },
+                "dms": service{
+
+                        Endpoints: endpoints{
+                                "cn-north-1":     endpoint{},
+                                "cn-northwest-1": endpoint{},
+                        },
+                },
                 "ds": service{
 
                         Endpoints: endpoints{
@@ -2592,13 +3358,6 @@ var awscnPartition = partition{
                                 },
                         },
                 },
-                "ecr": service{
-
-                        Endpoints: endpoints{
-                                "cn-north-1":     endpoint{},
-                                "cn-northwest-1": endpoint{},
-                        },
-                },
                 "ecs": service{
 
                         Endpoints: endpoints{
@@ -2631,7 +3390,7 @@ var awscnPartition = partition{
                 },
                 "elasticmapreduce": service{
                         Defaults: endpoint{
-                                Protocols: []string{"http", "https"},
+                                Protocols: []string{"https"},
                         },
                         Endpoints: endpoints{
                                 "cn-north-1":     endpoint{},
@@ -2641,6 +3400,7 @@ var awscnPartition = partition{
                 "es": service{
 
                         Endpoints: endpoints{
+                                "cn-north-1":     endpoint{},
                                 "cn-northwest-1": endpoint{},
                         },
                 },
@@ -2651,6 +3411,19 @@ var awscnPartition = partition{
                                 "cn-northwest-1": endpoint{},
                         },
                 },
+                "firehose": service{
+
+                        Endpoints: endpoints{
+                                "cn-north-1":     endpoint{},
+                                "cn-northwest-1": endpoint{},
+                        },
+                },
+                "gamelift": service{
+
+                        Endpoints: endpoints{
+                                "cn-north-1": endpoint{},
+                        },
+                },
                 "glacier": service{
                         Defaults: endpoint{
                                 Protocols: []string{"http", "https"},
@@ -2704,6 +3477,12 @@ var awscnPartition = partition{
                                 "cn-northwest-1": endpoint{},
                         },
                 },
+                "mediaconvert": service{
+
+                        Endpoints: endpoints{
+                                "cn-northwest-1": endpoint{},
+                        },
+                },
                 "monitoring": service{
                         Defaults: endpoint{
                                 Protocols: []string{"http", "https"},
@@ -2713,6 +3492,12 @@ var awscnPartition = partition{
                                 "cn-northwest-1": endpoint{},
                         },
                 },
+                "polly": service{
+
+                        Endpoints: endpoints{
+                                "cn-northwest-1": endpoint{},
+                        },
+                },
                 "rds": service{
 
                         Endpoints: endpoints{
@@ -2737,6 +3522,28 @@ var awscnPartition = partition{
                                 "cn-northwest-1": endpoint{},
                         },
                 },
+                "s3-control": service{
+                        Defaults: endpoint{
+                                Protocols:         []string{"https"},
+                                SignatureVersions: []string{"s3v4"},
+                        },
+                        Endpoints: endpoints{
+                                "cn-north-1": endpoint{
+                                        Hostname:          "s3-control.cn-north-1.amazonaws.com.cn",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "cn-north-1",
+                                        },
+                                },
+                                "cn-northwest-1": endpoint{
+                                        Hostname:          "s3-control.cn-northwest-1.amazonaws.com.cn",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "cn-northwest-1",
+                                        },
+                                },
+                        },
+                },
                 "sms": service{
 
                         Endpoints: endpoints{
@@ -2776,6 +3583,13 @@ var awscnPartition = partition{
                                 "cn-northwest-1": endpoint{},
                         },
                 },
+                "states": service{
+
+                        Endpoints: endpoints{
+                                "cn-north-1":     endpoint{},
+                                "cn-northwest-1": endpoint{},
+                        },
+                },
                 "storagegateway": service{
 
                         Endpoints: endpoints{
@@ -2839,6 +3653,9 @@ var awsusgovPartition = partition{
                 SignatureVersions: []string{"v4"},
         },
         Regions: regions{
+                "us-gov-east-1": region{
+                        Description: "AWS GovCloud (US-East)",
+                },
                 "us-gov-west-1": region{
                         Description: "AWS GovCloud (US)",
                 },
@@ -2847,26 +3664,77 @@ var awsusgovPartition = partition{
                 "acm": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "api.ecr": service{
+
+                        Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{
+                                        Hostname: "api.ecr.us-gov-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-east-1",
+                                        },
+                                },
+                                "us-gov-west-1": endpoint{
+                                        Hostname: "api.ecr.us-gov-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-west-1",
+                                        },
+                                },
+                        },
+                },
+                "api.sagemaker": service{
+
+                        Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "apigateway": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "application-autoscaling": service{
+                        Defaults: endpoint{
+                                Hostname: "autoscaling.{region}.amazonaws.com",
+                                CredentialScope: credentialScope{
+                                        Service: "application-autoscaling",
+                                },
+                        },
+                        Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "athena": service{
+
+                        Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "autoscaling": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{
                                         Protocols: []string{"http", "https"},
                                 },
                         },
                 },
+                "clouddirectory": service{
+
+                        Endpoints: endpoints{
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
                 "cloudformation": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
@@ -2883,42 +3751,81 @@ var awsusgovPartition = partition{
                                 },
                         },
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "cloudtrail": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "codecommit": service{
+
+                        Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "codedeploy": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-east-1-fips": endpoint{
+                                        Hostname: "codedeploy-fips.us-gov-east-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-east-1",
+                                        },
+                                },
+                                "us-gov-west-1": endpoint{},
+                                "us-gov-west-1-fips": endpoint{
+                                        Hostname: "codedeploy-fips.us-gov-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-west-1",
+                                        },
+                                },
+                        },
+                },
+                "comprehend": service{
+                        Defaults: endpoint{
+                                Protocols: []string{"https"},
+                        },
+                        Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "config": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "directconnect": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "dms": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "ds": service{
+
+                        Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "dynamodb": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                                 "us-gov-west-1-fips": endpoint{
                                         Hostname: "dynamodb.us-gov-west-1.amazonaws.com",
@@ -2931,6 +3838,7 @@ var awsusgovPartition = partition{
                 "ec2": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
@@ -2945,25 +3853,34 @@ var awsusgovPartition = partition{
                                 },
                         },
                 },
-                "ecr": service{
+                "ecs": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
-                "ecs": service{
+                "elasticache": service{
 
                         Endpoints: endpoints{
+                                "fips": endpoint{
+                                        Hostname: "elasticache-fips.us-gov-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-west-1",
+                                        },
+                                },
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
-                "elasticache": service{
+                "elasticbeanstalk": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
-                "elasticbeanstalk": service{
+                "elasticfilesystem": service{
 
                         Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
@@ -2972,6 +3889,7 @@ var awsusgovPartition = partition{
                 "elasticloadbalancing": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{
                                         Protocols: []string{"http", "https"},
                                 },
@@ -2980,31 +3898,62 @@ var awsusgovPartition = partition{
                 "elasticmapreduce": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{
-                                        Protocols: []string{"http", "https"},
+                                        Protocols: []string{"https"},
                                 },
                         },
                 },
                 "es": service{
 
                         Endpoints: endpoints{
+                                "fips": endpoint{
+                                        Hostname: "es-fips.us-gov-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-west-1",
+                                        },
+                                },
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "events": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "firehose": service{
+
+                        Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "glacier": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{
                                         Protocols: []string{"http", "https"},
                                 },
                         },
                 },
+                "glue": service{
+
+                        Endpoints: endpoints{
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "guardduty": service{
+                        IsRegionalized: boxedTrue,
+                        Defaults: endpoint{
+                                Protocols: []string{"https"},
+                        },
+                        Endpoints: endpoints{
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
                 "iam": service{
                         PartitionEndpoint: "aws-us-gov-global",
                         IsRegionalized:    boxedFalse,
@@ -3021,30 +3970,64 @@ var awsusgovPartition = partition{
                 "inspector": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "iot": service{
+                        Defaults: endpoint{
+                                CredentialScope: credentialScope{
+                                        Service: "execute-api",
+                                },
+                        },
+                        Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "kinesis": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "kms": service{
 
                         Endpoints: endpoints{
+                                "ProdFips": endpoint{
+                                        Hostname: "kms-fips.us-gov-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-west-1",
+                                        },
+                                },
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "lambda": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "license-manager": service{
+
+                        Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "logs": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "mediaconvert": service{
+
+                        Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
                         },
                 },
@@ -3061,6 +4044,7 @@ var awsusgovPartition = partition{
                 "monitoring": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
@@ -3073,12 +4057,14 @@ var awsusgovPartition = partition{
                 "rds": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "redshift": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
@@ -3088,6 +4074,12 @@ var awsusgovPartition = partition{
                                 "us-gov-west-1": endpoint{},
                         },
                 },
+                "runtime.sagemaker": service{
+
+                        Endpoints: endpoints{
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
                 "s3": service{
                         Defaults: endpoint{
                                 SignatureVersions: []string{"s3", "s3v4"},
@@ -3099,27 +4091,70 @@ var awsusgovPartition = partition{
                                                 Region: "us-gov-west-1",
                                         },
                                 },
+                                "us-gov-east-1": endpoint{
+                                        Hostname:  "s3.us-gov-east-1.amazonaws.com",
+                                        Protocols: []string{"http", "https"},
+                                },
                                 "us-gov-west-1": endpoint{
                                         Hostname:  "s3.us-gov-west-1.amazonaws.com",
                                         Protocols: []string{"http", "https"},
                                 },
                         },
                 },
+                "s3-control": service{
+                        Defaults: endpoint{
+                                Protocols:         []string{"https"},
+                                SignatureVersions: []string{"s3v4"},
+                        },
+                        Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{
+                                        Hostname:          "s3-control.us-gov-east-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-east-1",
+                                        },
+                                },
+                                "us-gov-east-1-fips": endpoint{
+                                        Hostname:          "s3-control-fips.us-gov-east-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-east-1",
+                                        },
+                                },
+                                "us-gov-west-1": endpoint{
+                                        Hostname:          "s3-control.us-gov-west-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-west-1",
+                                        },
+                                },
+                                "us-gov-west-1-fips": endpoint{
+                                        Hostname:          "s3-control-fips.us-gov-west-1.amazonaws.com",
+                                        SignatureVersions: []string{"s3v4"},
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-west-1",
+                                        },
+                                },
+                        },
+                },
                 "sms": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "snowball": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "sns": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{
                                         Protocols: []string{"http", "https"},
                                 },
@@ -3128,6 +4163,7 @@ var awsusgovPartition = partition{
                 "sqs": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{
                                         SSLCommonName: "{region}.queue.{dnsSuffix}",
                                         Protocols:     []string{"http", "https"},
@@ -3137,6 +4173,14 @@ var awsusgovPartition = partition{
                 "ssm": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "states": service{
+
+                        Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
@@ -3153,6 +4197,7 @@ var awsusgovPartition = partition{
                                 },
                         },
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                                 "us-gov-west-1-fips": endpoint{
                                         Hostname: "dynamodb.us-gov-west-1.amazonaws.com",
@@ -3165,18 +4210,21 @@ var awsusgovPartition = partition{
                 "sts": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "swf": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
                 "tagging": service{
 
                         Endpoints: endpoints{
+                                "us-gov-east-1": endpoint{},
                                 "us-gov-west-1": endpoint{},
                         },
                 },
@@ -3186,6 +4234,24 @@ var awsusgovPartition = partition{
                         },
                         Endpoints: endpoints{
                                 "us-gov-west-1": endpoint{},
+                                "us-gov-west-1-fips": endpoint{
+                                        Hostname: "translate-fips.us-gov-west-1.amazonaws.com",
+                                        CredentialScope: credentialScope{
+                                                Region: "us-gov-west-1",
+                                        },
+                                },
+                        },
+                },
+                "waf-regional": service{
+
+                        Endpoints: endpoints{
+                                "us-gov-west-1": endpoint{},
+                        },
+                },
+                "workspaces": service{
+
+                        Endpoints: endpoints{
+                                "us-gov-west-1": endpoint{},
                         },
                 },
         },
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go
new file mode 100644
index 0000000..000dd79
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go
@@ -0,0 +1,141 @@
+package endpoints
+
+// Service identifiers
+//
+// Deprecated: Use client package's EndpointID value instead of these
+// ServiceIDs. These IDs are not maintained, and are out of date.
+const (
+        A4bServiceID                          = "a4b"                          // A4b.
+        AcmServiceID                          = "acm"                          // Acm.
+        AcmPcaServiceID                       = "acm-pca"                      // AcmPca.
+        ApiMediatailorServiceID               = "api.mediatailor"              // ApiMediatailor.
+        ApiPricingServiceID                   = "api.pricing"                  // ApiPricing.
+        ApiSagemakerServiceID                 = "api.sagemaker"                // ApiSagemaker.
+        ApigatewayServiceID                   = "apigateway"                   // Apigateway.
+        ApplicationAutoscalingServiceID       = "application-autoscaling"      // ApplicationAutoscaling.
+        Appstream2ServiceID                   = "appstream2"                   // Appstream2.
+        AppsyncServiceID                      = "appsync"                      // Appsync.
+        AthenaServiceID                       = "athena"                       // Athena.
+        AutoscalingServiceID                  = "autoscaling"                  // Autoscaling.
+        AutoscalingPlansServiceID             = "autoscaling-plans"            // AutoscalingPlans.
+        BatchServiceID                        = "batch"                        // Batch.
+        BudgetsServiceID                      = "budgets"                      // Budgets.
+        CeServiceID                           = "ce"                           // Ce.
+        ChimeServiceID                        = "chime"                        // Chime.
+        Cloud9ServiceID                       = "cloud9"                       // Cloud9.
+        ClouddirectoryServiceID               = "clouddirectory"               // Clouddirectory.
+        CloudformationServiceID               = "cloudformation"               // Cloudformation.
+        CloudfrontServiceID                   = "cloudfront"                   // Cloudfront.
+        CloudhsmServiceID                     = "cloudhsm"                     // Cloudhsm.
+        Cloudhsmv2ServiceID                   = "cloudhsmv2"                   // Cloudhsmv2.
+        CloudsearchServiceID                  = "cloudsearch"                  // Cloudsearch.
+        CloudtrailServiceID                   = "cloudtrail"                   // Cloudtrail.
+        CodebuildServiceID                    = "codebuild"                    // Codebuild.
+        CodecommitServiceID                   = "codecommit"                   // Codecommit.
+        CodedeployServiceID                   = "codedeploy"                   // Codedeploy.
+        CodepipelineServiceID                 = "codepipeline"                 // Codepipeline.
+        CodestarServiceID                     = "codestar"                     // Codestar.
+        CognitoIdentityServiceID              = "cognito-identity"             // CognitoIdentity.
+        CognitoIdpServiceID                   = "cognito-idp"                  // CognitoIdp.
+        CognitoSyncServiceID                  = "cognito-sync"                 // CognitoSync.
+        ComprehendServiceID                   = "comprehend"                   // Comprehend.
+        ConfigServiceID                       = "config"                       // Config.
+        CurServiceID                          = "cur"                          // Cur.
+        DatapipelineServiceID                 = "datapipeline"                 // Datapipeline.
+        DaxServiceID                          = "dax"                          // Dax.
+        DevicefarmServiceID                   = "devicefarm"                   // Devicefarm.
+        DirectconnectServiceID                = "directconnect"                // Directconnect.
+        DiscoveryServiceID                    = "discovery"                    // Discovery.
+        DmsServiceID                          = "dms"                          // Dms.
+        DsServiceID                           = "ds"                           // Ds.
+        DynamodbServiceID                     = "dynamodb"                     // Dynamodb.
+        Ec2ServiceID                          = "ec2"                          // Ec2.
+        Ec2metadataServiceID                  = "ec2metadata"                  // Ec2metadata.
+        EcrServiceID                          = "ecr"                          // Ecr.
+        EcsServiceID                          = "ecs"                          // Ecs.
+        ElasticacheServiceID                  = "elasticache"                  // Elasticache.
+        ElasticbeanstalkServiceID             = "elasticbeanstalk"             // Elasticbeanstalk.
+        ElasticfilesystemServiceID            = "elasticfilesystem"            // Elasticfilesystem.
+        ElasticloadbalancingServiceID         = "elasticloadbalancing"         // Elasticloadbalancing.
+        ElasticmapreduceServiceID             = "elasticmapreduce"             // Elasticmapreduce.
+        ElastictranscoderServiceID            = "elastictranscoder"            // Elastictranscoder.
+        EmailServiceID                        = "email"                        // Email.
+        EntitlementMarketplaceServiceID       = "entitlement.marketplace"      // EntitlementMarketplace.
+        EsServiceID                           = "es"                           // Es.
+        EventsServiceID                       = "events"                       // Events.
+        FirehoseServiceID                     = "firehose"                     // Firehose.
+        FmsServiceID                          = "fms"                          // Fms.
+        GameliftServiceID                     = "gamelift"                     // Gamelift.
+        GlacierServiceID                      = "glacier"                      // Glacier.
+        GlueServiceID                         = "glue"                         // Glue.
+        GreengrassServiceID                   = "greengrass"                   // Greengrass.
+        GuarddutyServiceID                    = "guardduty"                    // Guardduty.
+        HealthServiceID                       = "health"                       // Health.
+        IamServiceID                          = "iam"                          // Iam.
+        ImportexportServiceID                 = "importexport"                 // Importexport.
+        InspectorServiceID                    = "inspector"                    // Inspector.
+        IotServiceID                          = "iot"                          // Iot.
+        IotanalyticsServiceID                 = "iotanalytics"                 // Iotanalytics.
+        KinesisServiceID                      = "kinesis"                      // Kinesis.
+        KinesisanalyticsServiceID             = "kinesisanalytics"             // Kinesisanalytics.
+        KinesisvideoServiceID                 = "kinesisvideo"                 // Kinesisvideo.
+        KmsServiceID                          = "kms"                          // Kms.
+        LambdaServiceID                       = "lambda"                       // Lambda.
+        LightsailServiceID                    = "lightsail"                    // Lightsail.
+        LogsServiceID                         = "logs"                         // Logs.
+        MachinelearningServiceID              = "machinelearning"              // Machinelearning.
+        MarketplacecommerceanalyticsServiceID = "marketplacecommerceanalytics" // Marketplacecommerceanalytics.
+        MediaconvertServiceID                 = "mediaconvert"                 // Mediaconvert.
+        MedialiveServiceID                    = "medialive"                    // Medialive.
+        MediapackageServiceID                 = "mediapackage"                 // Mediapackage.
+        MediastoreServiceID                   = "mediastore"                   // Mediastore.
+        MeteringMarketplaceServiceID          = "metering.marketplace"         // MeteringMarketplace.
+        MghServiceID                          = "mgh"                          // Mgh.
+        MobileanalyticsServiceID              = "mobileanalytics"              // Mobileanalytics.
+        ModelsLexServiceID                    = "models.lex"                   // ModelsLex.
+        MonitoringServiceID                   = "monitoring"                   // Monitoring.
+        MturkRequesterServiceID               = "mturk-requester"              // MturkRequester.
+        NeptuneServiceID                      = "neptune"                      // Neptune.
+        OpsworksServiceID                     = "opsworks"                     // Opsworks.
+        OpsworksCmServiceID                   = "opsworks-cm"                  // OpsworksCm.
+        OrganizationsServiceID                = "organizations"                // Organizations.
+        PinpointServiceID                     = "pinpoint"                     // Pinpoint.
+        PollyServiceID                        = "polly"                        // Polly.
+        RdsServiceID                          = "rds"                          // Rds.
+        RedshiftServiceID                     = "redshift"                     // Redshift.
+        RekognitionServiceID                  = "rekognition"                  // Rekognition.
+        ResourceGroupsServiceID               = "resource-groups"              // ResourceGroups.
+        Route53ServiceID                      = "route53"                      // Route53.
+        Route53domainsServiceID               = "route53domains"               // Route53domains.
+        RuntimeLexServiceID                   = "runtime.lex"                  // RuntimeLex.
+        RuntimeSagemakerServiceID             = "runtime.sagemaker"            // RuntimeSagemaker.
+        S3ServiceID                           = "s3"                           // S3.
+        S3ControlServiceID                    = "s3-control"                   // S3Control.
+        SagemakerServiceID                    = "api.sagemaker"                // Sagemaker.
+        SdbServiceID                          = "sdb"                          // Sdb.
+        SecretsmanagerServiceID               = "secretsmanager"               // Secretsmanager.
+        ServerlessrepoServiceID               = "serverlessrepo"               // Serverlessrepo.
+        ServicecatalogServiceID               = "servicecatalog"               // Servicecatalog.
+        ServicediscoveryServiceID             = "servicediscovery"             // Servicediscovery.
+        ShieldServiceID                       = "shield"                       // Shield.
+        SmsServiceID                          = "sms"                          // Sms.
+        SnowballServiceID                     = "snowball"                     // Snowball.
+        SnsServiceID                          = "sns"                          // Sns.
+        SqsServiceID                          = "sqs"                          // Sqs.
+        SsmServiceID                          = "ssm"                          // Ssm.
+        StatesServiceID                       = "states"                       // States.
+        StoragegatewayServiceID               = "storagegateway"               // Storagegateway.
+        StreamsDynamodbServiceID              = "streams.dynamodb"             // StreamsDynamodb.
+        StsServiceID                          = "sts"                          // Sts.
+        SupportServiceID                      = "support"                      // Support.
+        SwfServiceID                          = "swf"                          // Swf.
+        TaggingServiceID                      = "tagging"                      // Tagging.
+        TransferServiceID                     = "transfer"                     // Transfer.
+        TranslateServiceID                    = "translate"                    // Translate.
+        WafServiceID                          = "waf"                          // Waf.
+        WafRegionalServiceID                  = "waf-regional"                 // WafRegional.
+        WorkdocsServiceID                     = "workdocs"                     // Workdocs.
+        WorkmailServiceID                     = "workmail"                     // Workmail.
+        WorkspacesServiceID                   = "workspaces"                   // Workspaces.
+        XrayServiceID                         = "xray"                         // Xray.
+)
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go
index e29c095..f82babf 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go
@@ -35,7 +35,7 @@ type Options struct {
         //
         // If resolving an endpoint on the partition list the provided region will
         // be used to determine which partition's domain name pattern to the service
-        // endpoint ID with. If both the service and region are unkonwn and resolving
+        // endpoint ID with. If both the service and region are unknown and resolving
         // the endpoint on partition list an UnknownEndpointError error will be returned.
         //
         // If resolving and endpoint on a partition specific resolver that partition's
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go
index 05e92df..0fdfcc5 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go
@@ -16,6 +16,10 @@ import (
 type CodeGenOptions struct {
         // Options for how the model will be decoded.
         DecodeModelOptions DecodeModelOptions
+
+        // Disables code generation of the service endpoint prefix IDs defined in
+        // the model.
+        DisableGenerateServiceIDs bool
 }
 
 // Set combines all of the option functions together
@@ -39,8 +43,16 @@ func CodeGenModel(modelFile io.Reader, outFile io.Writer, optFns ...func(*CodeGe
                 return err
         }
 
+        v := struct {
+                Resolver
+                CodeGenOptions
+        }{
+                Resolver:       resolver,
+                CodeGenOptions: opts,
+        }
+
         tmpl := template.Must(template.New("tmpl").Funcs(funcMap).Parse(v3Tmpl))
-        if err := tmpl.ExecuteTemplate(outFile, "defaults", resolver); err != nil {
+        if err := tmpl.ExecuteTemplate(outFile, "defaults", v); err != nil {
                 return fmt.Errorf("failed to execute template, %v", err)
         }
 
@@ -166,15 +178,17 @@ import (
         "regexp"
 )
 
-        {{ template "partition consts" . }}
+        {{ template "partition consts" $.Resolver }}
 
-        {{ range $_, $partition := . }}
+        {{ range $_, $partition := $.Resolver }}
                 {{ template "partition region consts" $partition }}
         {{ end }}
 
-        {{ template "service consts" . }}
+        {{ if not $.DisableGenerateServiceIDs -}}
+        {{ template "service consts" $.Resolver }}
+        {{- end }}
         
-        {{ template "endpoint resolvers" . }}
+        {{ template "endpoint resolvers" $.Resolver }}
 {{- end }}
 
 {{ define "partition consts" }}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/errors.go b/vendor/github.com/aws/aws-sdk-go/aws/errors.go
index 5766361..fa06f7a 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/errors.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/errors.go
@@ -5,13 +5,9 @@ import "github.com/aws/aws-sdk-go/aws/awserr"
 var (
         // ErrMissingRegion is an error that is returned if region configuration is
         // not found.
-        //
-        // @readonly
         ErrMissingRegion = awserr.New("MissingRegion", "could not find region configuration", nil)
 
         // ErrMissingEndpoint is an error that is returned if an endpoint cannot be
         // resolved for a service.
-        //
-        // @readonly
         ErrMissingEndpoint = awserr.New("MissingEndpoint", "'Endpoint' configuration is required for this service", nil)
 )
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go b/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go
index 605a72d..8ef8548 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go
@@ -19,6 +19,7 @@ type Handlers struct {
         UnmarshalError   HandlerList
         Retry            HandlerList
         AfterRetry       HandlerList
+        CompleteAttempt  HandlerList
         Complete         HandlerList
 }
 
@@ -36,6 +37,7 @@ func (h *Handlers) Copy() Handlers {
                 UnmarshalMeta:    h.UnmarshalMeta.copy(),
                 Retry:            h.Retry.copy(),
                 AfterRetry:       h.AfterRetry.copy(),
+                CompleteAttempt:  h.CompleteAttempt.copy(),
                 Complete:         h.Complete.copy(),
         }
 }
@@ -53,6 +55,7 @@ func (h *Handlers) Clear() {
         h.ValidateResponse.Clear()
         h.Retry.Clear()
         h.AfterRetry.Clear()
+        h.CompleteAttempt.Clear()
         h.Complete.Clear()
 }
 
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/request/request.go b/vendor/github.com/aws/aws-sdk-go/aws/request/request.go
index 75f0fe0..8f2eb3e 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/request/request.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/request/request.go
@@ -4,7 +4,6 @@ import (
         "bytes"
         "fmt"
         "io"
-        "net"
         "net/http"
         "net/url"
         "reflect"
@@ -122,7 +121,6 @@ func New(cfg aws.Config, clientInfo metadata.ClientInfo, handlers Handlers,
                 Handlers:   handlers.Copy(),
 
                 Retryer:     retryer,
-                AttemptTime: time.Now(),
                 Time:        time.Now(),
                 ExpireTime:  0,
                 Operation:   operation,
@@ -266,7 +264,9 @@ func (r *Request) SetReaderBody(reader io.ReadSeeker) {
 }
 
 // Presign returns the request's signed URL. Error will be returned
-// if the signing fails.
+// if the signing fails. The expire parameter is only used for presigned Amazon
+// S3 API requests. All other AWS services will use a fixed expiration
+// time of 15 minutes.
 //
 // It is invalid to create a presigned URL with a expire duration 0 or less. An
 // error is returned if expire duration is 0 or less.
@@ -283,7 +283,9 @@ func (r *Request) Presign(expire time.Duration) (string, error) {
 }
 
 // PresignRequest behaves just like presign, with the addition of returning a
-// set of headers that were signed.
+// set of headers that were signed. The expire parameter is only used for
+// presigned Amazon S3 API requests. All other AWS services will use a fixed
+// expiration time of 15 minutes.
 //
 // It is invalid to create a presigned URL with a expire duration 0 or less. An
 // error is returned if expire duration is 0 or less.
@@ -462,80 +464,78 @@ func (r *Request) Send() error {
                 r.Handlers.Complete.Run(r)
         }()
 
+        if err := r.Error; err != nil {
+                return err
+        }
+
         for {
+                r.Error = nil
                 r.AttemptTime = time.Now()
-                if aws.BoolValue(r.Retryable) {
-                        if r.Config.LogLevel.Matches(aws.LogDebugWithRequestRetries) {
-                                r.Config.Logger.Log(fmt.Sprintf("DEBUG: Retrying Request %s/%s, attempt %d",
-                                        r.ClientInfo.ServiceName, r.Operation.Name, r.RetryCount))
-                        }
-
-                        // The previous http.Request will have a reference to the r.Body
-                        // and the HTTP Client's Transport may still be reading from
-                        // the request's body even though the Client's Do returned.
-                        r.HTTPRequest = copyHTTPRequest(r.HTTPRequest, nil)
-                        r.ResetBody()
-
-                        // Closing response body to ensure that no response body is leaked
-                        // between retry attempts.
-                        if r.HTTPResponse != nil && r.HTTPResponse.Body != nil {
-                                r.HTTPResponse.Body.Close()
-                        }
-                }
 
-                r.Sign()
-                if r.Error != nil {
-                        return r.Error
+                if err := r.Sign(); err != nil {
+                        debugLogReqError(r, "Sign Request", false, err)
+                        return err
                 }
 
-                r.Retryable = nil
-
-                r.Handlers.Send.Run(r)
-                if r.Error != nil {
-                        if !shouldRetryCancel(r) {
-                                return r.Error
-                        }
-
-                        err := r.Error
+                if err := r.sendRequest(); err == nil {
+                        return nil
+                } else if !shouldRetryCancel(r.Error) {
+                        return err
+                } else {
                         r.Handlers.Retry.Run(r)
                         r.Handlers.AfterRetry.Run(r)
-                        if r.Error != nil {
-                                debugLogReqError(r, "Send Request", false, err)
-                                return r.Error
-                        }
-                        debugLogReqError(r, "Send Request", true, err)
-                        continue
-                }
-                r.Handlers.UnmarshalMeta.Run(r)
-                r.Handlers.ValidateResponse.Run(r)
-                if r.Error != nil {
-                        r.Handlers.UnmarshalError.Run(r)
-                        err := r.Error
 
-                        r.Handlers.Retry.Run(r)
-                        r.Handlers.AfterRetry.Run(r)
-                        if r.Error != nil {
-                                debugLogReqError(r, "Validate Response", false, err)
+                        if r.Error != nil || !aws.BoolValue(r.Retryable) {
                                 return r.Error
                         }
-                        debugLogReqError(r, "Validate Response", true, err)
-                        continue
-                }
 
-                r.Handlers.Unmarshal.Run(r)
-                if r.Error != nil {
-                        err := r.Error
-                        r.Handlers.Retry.Run(r)
-                        r.Handlers.AfterRetry.Run(r)
-                        if r.Error != nil {
-                                debugLogReqError(r, "Unmarshal Response", false, err)
-                                return r.Error
-                        }
-                        debugLogReqError(r, "Unmarshal Response", true, err)
+                        r.prepareRetry()
                         continue
                 }
+        }
+}
+
+func (r *Request) prepareRetry() {
+        if r.Config.LogLevel.Matches(aws.LogDebugWithRequestRetries) {
+                r.Config.Logger.Log(fmt.Sprintf("DEBUG: Retrying Request %s/%s, attempt %d",
+                        r.ClientInfo.ServiceName, r.Operation.Name, r.RetryCount))
+        }
+
+        // The previous http.Request will have a reference to the r.Body
+        // and the HTTP Client's Transport may still be reading from
+        // the request's body even though the Client's Do returned.
+        r.HTTPRequest = copyHTTPRequest(r.HTTPRequest, nil)
+        r.ResetBody()
+
+        // Closing response body to ensure that no response body is leaked
+        // between retry attempts.
+        if r.HTTPResponse != nil && r.HTTPResponse.Body != nil {
+                r.HTTPResponse.Body.Close()
+        }
+}
+
+func (r *Request) sendRequest() (sendErr error) {
+        defer r.Handlers.CompleteAttempt.Run(r)
+
+        r.Retryable = nil
+        r.Handlers.Send.Run(r)
+        if r.Error != nil {
+                debugLogReqError(r, "Send Request", r.WillRetry(), r.Error)
+                return r.Error
+        }
 
-                break
+        r.Handlers.UnmarshalMeta.Run(r)
+        r.Handlers.ValidateResponse.Run(r)
+        if r.Error != nil {
+                r.Handlers.UnmarshalError.Run(r)
+                debugLogReqError(r, "Validate Response", r.WillRetry(), r.Error)
+                return r.Error
+        }
+
+        r.Handlers.Unmarshal.Run(r)
+        if r.Error != nil {
+                debugLogReqError(r, "Unmarshal Response", r.WillRetry(), r.Error)
+                return r.Error
         }
 
         return nil
@@ -561,30 +561,46 @@ func AddToUserAgent(r *Request, s string) {
         r.HTTPRequest.Header.Set("User-Agent", s)
 }
 
-func shouldRetryCancel(r *Request) bool {
-        awsErr, ok := r.Error.(awserr.Error)
-        timeoutErr := false
-        errStr := r.Error.Error()
-        if ok {
-                if awsErr.Code() == CanceledErrorCode {
+type temporary interface {
+        Temporary() bool
+}
+
+func shouldRetryCancel(err error) bool {
+        switch err := err.(type) {
+        case awserr.Error:
+                if err.Code() == CanceledErrorCode {
                         return false
                 }
-                err := awsErr.OrigErr()
-                netErr, netOK := err.(net.Error)
-                timeoutErr = netOK && netErr.Temporary()
-                if urlErr, ok := err.(*url.Error); !timeoutErr && ok {
-                        errStr = urlErr.Err.Error()
+                return shouldRetryCancel(err.OrigErr())
+        case *url.Error:
+                if strings.Contains(err.Error(), "connection refused") {
+                        // Refused connections should be retried as the service may not yet
+                        // be running on the port. Go TCP dial considers refused
+                        // connections as not temporary.
+                        return true
+                }
+                // *url.Error only implements Temporary after golang 1.6 but since
+                // url.Error only wraps the error:
+                return shouldRetryCancel(err.Err)
+        case temporary:
+                // If the error is temporary, we want to allow continuation of the
+                // retry process
+                return err.Temporary()
+        case nil:
+                // `awserr.Error.OrigErr()` can be nil, meaning there was an error but
+                // because we don't know the cause, it is marked as retriable. See
+                // TestRequest4xxUnretryable for an example.
+                return true
+        default:
+                switch err.Error() {
+                case "net/http: request canceled",
+                        "net/http: request canceled while waiting for connection":
+                        // known 1.5 error case when an http request is cancelled
+                        return false
                 }
+                // here we don't know the error; so we allow a retry.
+                return true
         }
-
-        // There can be two types of canceled errors here.
-        // The first being a net.Error and the other being an error.
-        // If the request was timed out, we want to continue the retry
-        // process. Otherwise, return the canceled error.
-        return timeoutErr ||
-                (errStr != "net/http: request canceled" &&
-                        errStr != "net/http: request canceled while waiting for connection")
-
 }
 
 // SanitizeHostForHeader removes default port from host and updates request.Host
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go b/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go
index 7d52702..d0aa54c 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go
@@ -38,8 +38,10 @@ var throttleCodes = map[string]struct{}{
         "ThrottlingException":                    {},
         "RequestLimitExceeded":                   {},
         "RequestThrottled":                       {},
+        "RequestThrottledException":              {},
         "TooManyRequestsException":               {}, // Lambda functions
         "PriorRequestNotComplete":                {}, // Route53
+        "TransactionInProgressException":         {},
 }
 
 // credsExpiredCodes is a collection of error codes which signify the credentials
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go b/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go
index 4012462..8630683 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go
@@ -17,6 +17,12 @@ const (
         ParamMinValueErrCode = "ParamMinValueError"
         // ParamMinLenErrCode is the error code for fields without enough elements.
         ParamMinLenErrCode = "ParamMinLenError"
+        // ParamMaxLenErrCode is the error code for value being too long.
+        ParamMaxLenErrCode = "ParamMaxLenError"
+
+        // ParamFormatErrCode is the error code for a field with invalid
+        // format or characters.
+        ParamFormatErrCode = "ParamFormatInvalidError"
 )
 
 // Validator provides a way for types to perform validation logic on their
@@ -232,3 +238,49 @@ func NewErrParamMinLen(field string, min int) *ErrParamMinLen {
 func (e *ErrParamMinLen) MinLen() int {
         return e.min
 }
+
+// An ErrParamMaxLen represents a maximum length parameter error.
+type ErrParamMaxLen struct {
+        errInvalidParam
+        max int
+}
+
+// NewErrParamMaxLen creates a new maximum length parameter error.
+func NewErrParamMaxLen(field string, max int, value string) *ErrParamMaxLen {
+        return &ErrParamMaxLen{
+                errInvalidParam: errInvalidParam{
+                        code:  ParamMaxLenErrCode,
+                        field: field,
+                        msg:   fmt.Sprintf("maximum size of %v, %v", max, value),
+                },
+                max: max,
+        }
+}
+
+// MaxLen returns the field's required minimum length.
+func (e *ErrParamMaxLen) MaxLen() int {
+        return e.max
+}
+
+// An ErrParamFormat represents a invalid format parameter error.
+type ErrParamFormat struct {
+        errInvalidParam
+        format string
+}
+
+// NewErrParamFormat creates a new invalid format parameter error.
+func NewErrParamFormat(field string, format, value string) *ErrParamFormat {
+        return &ErrParamFormat{
+                errInvalidParam: errInvalidParam{
+                        code:  ParamFormatErrCode,
+                        field: field,
+                        msg:   fmt.Sprintf("format %v, %v", format, value),
+                },
+                format: format,
+        }
+}
+
+// Format returns the field's required format.
+func (e *ErrParamFormat) Format() string {
+        return e.format
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/session/cabundle_transport.go b/vendor/github.com/aws/aws-sdk-go/aws/session/cabundle_transport.go
new file mode 100644
index 0000000..ea9ebb6
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/aws/session/cabundle_transport.go
@@ -0,0 +1,26 @@
+// +build go1.7
+
+package session
+
+import (
+        "net"
+        "net/http"
+        "time"
+)
+
+// Transport that should be used when a custom CA bundle is specified with the
+// SDK.
+func getCABundleTransport() *http.Transport {
+        return &http.Transport{
+                Proxy: http.ProxyFromEnvironment,
+                DialContext: (&net.Dialer{
+                        Timeout:   30 * time.Second,
+                        KeepAlive: 30 * time.Second,
+                        DualStack: true,
+                }).DialContext,
+                MaxIdleConns:          100,
+                IdleConnTimeout:       90 * time.Second,
+                TLSHandshakeTimeout:   10 * time.Second,
+                ExpectContinueTimeout: 1 * time.Second,
+        }
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/session/cabundle_transport_1_5.go b/vendor/github.com/aws/aws-sdk-go/aws/session/cabundle_transport_1_5.go
new file mode 100644
index 0000000..fec39df
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/aws/session/cabundle_transport_1_5.go
@@ -0,0 +1,22 @@
+// +build !go1.6,go1.5
+
+package session
+
+import (
+        "net"
+        "net/http"
+        "time"
+)
+
+// Transport that should be used when a custom CA bundle is specified with the
+// SDK.
+func getCABundleTransport() *http.Transport {
+        return &http.Transport{
+                Proxy: http.ProxyFromEnvironment,
+                Dial: (&net.Dialer{
+                        Timeout:   30 * time.Second,
+                        KeepAlive: 30 * time.Second,
+                }).Dial,
+                TLSHandshakeTimeout: 10 * time.Second,
+        }
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/session/cabundle_transport_1_6.go b/vendor/github.com/aws/aws-sdk-go/aws/session/cabundle_transport_1_6.go
new file mode 100644
index 0000000..1c5a539
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/aws/session/cabundle_transport_1_6.go
@@ -0,0 +1,23 @@
+// +build !go1.7,go1.6
+
+package session
+
+import (
+        "net"
+        "net/http"
+        "time"
+)
+
+// Transport that should be used when a custom CA bundle is specified with the
+// SDK.
+func getCABundleTransport() *http.Transport {
+        return &http.Transport{
+                Proxy: http.ProxyFromEnvironment,
+                Dial: (&net.Dialer{
+                        Timeout:   30 * time.Second,
+                        KeepAlive: 30 * time.Second,
+                }).Dial,
+                TLSHandshakeTimeout:   10 * time.Second,
+                ExpectContinueTimeout: 1 * time.Second,
+        }
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/session/doc.go b/vendor/github.com/aws/aws-sdk-go/aws/session/doc.go
index 98d420f..38a7b05 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/session/doc.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/session/doc.go
@@ -99,7 +99,7 @@ handler logs every request and its payload made by a service client:
 
         sess.Handlers.Send.PushFront(func(r *request.Request) {
                 // Log every request made and its payload
-                logger.Println("Request: %s/%s, Payload: %s",
+                logger.Printf("Request: %s/%s, Payload: %s",
                         r.ClientInfo.ServiceName, r.Operation, r.Params)
         })
 
@@ -183,7 +183,7 @@ be returned when creating the session.
     // from assumed role.
     svc := s3.New(sess)
 
-To setup assume role outside of a session see the stscrds.AssumeRoleProvider
+To setup assume role outside of a session see the stscreds.AssumeRoleProvider
 documentation.
 
 Environment Variables
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/session/env_config.go b/vendor/github.com/aws/aws-sdk-go/aws/session/env_config.go
index 82e04d7..e3959b9 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/session/env_config.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/session/env_config.go
@@ -4,6 +4,7 @@ import (
         "os"
         "strconv"
 
+        "github.com/aws/aws-sdk-go/aws"
         "github.com/aws/aws-sdk-go/aws/credentials"
         "github.com/aws/aws-sdk-go/aws/defaults"
 )
@@ -79,7 +80,7 @@ type envConfig struct {
         //      AWS_CONFIG_FILE=$HOME/my_shared_config
         SharedConfigFile string
 
-        // Sets the path to a custom Credentials Authroity (CA) Bundle PEM file
+        // Sets the path to a custom Credentials Authority (CA) Bundle PEM file
         // that the SDK will use instead of the system's root CA bundle.
         // Only use this if you want to configure the SDK to use a custom set
         // of CAs.
@@ -101,6 +102,12 @@ type envConfig struct {
         CSMEnabled  bool
         CSMPort     string
         CSMClientID string
+
+        enableEndpointDiscovery string
+        // Enables endpoint discovery via environment variables.
+        //
+        //      AWS_ENABLE_ENDPOINT_DISCOVERY=true
+        EnableEndpointDiscovery *bool
 }
 
 var (
@@ -125,6 +132,10 @@ var (
                 "AWS_SESSION_TOKEN",
         }
 
+        enableEndpointDiscoveryEnvKey = []string{
+                "AWS_ENABLE_ENDPOINT_DISCOVERY",
+        }
+
         regionEnvKeys = []string{
                 "AWS_REGION",
                 "AWS_DEFAULT_REGION", // Only read if AWS_SDK_LOAD_CONFIG is also set
@@ -194,6 +205,12 @@ func envConfigLoad(enableSharedConfig bool) envConfig {
         setFromEnvVal(&cfg.Region, regionKeys)
         setFromEnvVal(&cfg.Profile, profileKeys)
 
+        // endpoint discovery is in reference to it being enabled.
+        setFromEnvVal(&cfg.enableEndpointDiscovery, enableEndpointDiscoveryEnvKey)
+        if len(cfg.enableEndpointDiscovery) > 0 {
+                cfg.EnableEndpointDiscovery = aws.Bool(cfg.enableEndpointDiscovery != "false")
+        }
+
         setFromEnvVal(&cfg.SharedCredentialsFile, sharedCredsFileEnvKey)
         setFromEnvVal(&cfg.SharedConfigFile, sharedConfigFileEnvKey)
 
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/session/session.go b/vendor/github.com/aws/aws-sdk-go/aws/session/session.go
index 51f3055..be4b5f0 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/session/session.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/session/session.go
@@ -14,13 +14,32 @@ import (
         "github.com/aws/aws-sdk-go/aws/client"
         "github.com/aws/aws-sdk-go/aws/corehandlers"
         "github.com/aws/aws-sdk-go/aws/credentials"
+        "github.com/aws/aws-sdk-go/aws/credentials/processcreds"
         "github.com/aws/aws-sdk-go/aws/credentials/stscreds"
         "github.com/aws/aws-sdk-go/aws/csm"
         "github.com/aws/aws-sdk-go/aws/defaults"
         "github.com/aws/aws-sdk-go/aws/endpoints"
         "github.com/aws/aws-sdk-go/aws/request"
+        "github.com/aws/aws-sdk-go/internal/shareddefaults"
 )
 
+const (
+        // ErrCodeSharedConfig represents an error that occurs in the shared
+        // configuration logic
+        ErrCodeSharedConfig = "SharedConfigErr"
+)
+
+// ErrSharedConfigSourceCollision will be returned if a section contains both
+// source_profile and credential_source
+var ErrSharedConfigSourceCollision = awserr.New(ErrCodeSharedConfig, "only source profile or credential source can be specified, not both", nil)
+
+// ErrSharedConfigECSContainerEnvVarEmpty will be returned if the environment
+// variables are empty and Environment was set as the credential source
+var ErrSharedConfigECSContainerEnvVarEmpty = awserr.New(ErrCodeSharedConfig, "EcsContainer was specified as the credential_source, but 'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI' was not set", nil)
+
+// ErrSharedConfigInvalidCredSource will be returned if an invalid credential source was provided
+var ErrSharedConfigInvalidCredSource = awserr.New(ErrCodeSharedConfig, "credential source values must be EcsContainer, Ec2InstanceMetadata, or Environment", nil)
+
 // A Session provides a central location to create service clients from and
 // store configurations and request handlers for those services.
 //
@@ -388,7 +407,10 @@ func loadCustomCABundle(s *Session, bundle io.Reader) error {
                 }
         }
         if t == nil {
-                t = &http.Transport{}
+                // Nil transport implies `http.DefaultTransport` should be used. Since
+                // the SDK cannot modify, nor copy the `DefaultTransport` specifying
+                // the values the next closest behavior.
+                t = getCABundleTransport()
         }
 
         p, err := loadCertPool(bundle)
@@ -434,8 +456,67 @@ func mergeConfigSrcs(cfg, userCfg *aws.Config, envCfg envConfig, sharedCfg share
                 }
         }
 
+        if cfg.EnableEndpointDiscovery == nil {
+                if envCfg.EnableEndpointDiscovery != nil {
+                        cfg.WithEndpointDiscovery(*envCfg.EnableEndpointDiscovery)
+                } else if envCfg.EnableSharedConfig && sharedCfg.EnableEndpointDiscovery != nil {
+                        cfg.WithEndpointDiscovery(*sharedCfg.EnableEndpointDiscovery)
+                }
+        }
+
         // Configure credentials if not already set
         if cfg.Credentials == credentials.AnonymousCredentials && userCfg.Credentials == nil {
+
+                // inspect the profile to see if a credential source has been specified.
+                if envCfg.EnableSharedConfig && len(sharedCfg.AssumeRole.CredentialSource) > 0 {
+
+                        // if both credential_source and source_profile have been set, return an error
+                        // as this is undefined behavior.
+                        if len(sharedCfg.AssumeRole.SourceProfile) > 0 {
+                                return ErrSharedConfigSourceCollision
+                        }
+
+                        // valid credential source values
+                        const (
+                                credSourceEc2Metadata  = "Ec2InstanceMetadata"
+                                credSourceEnvironment  = "Environment"
+                                credSourceECSContainer = "EcsContainer"
+                        )
+
+                        switch sharedCfg.AssumeRole.CredentialSource {
+                        case credSourceEc2Metadata:
+                                cfgCp := *cfg
+                                p := defaults.RemoteCredProvider(cfgCp, handlers)
+                                cfgCp.Credentials = credentials.NewCredentials(p)
+
+                                if len(sharedCfg.AssumeRole.MFASerial) > 0 && sessOpts.AssumeRoleTokenProvider == nil {
+                                        // AssumeRole Token provider is required if doing Assume Role
+                                        // with MFA.
+                                        return AssumeRoleTokenProviderNotSetError{}
+                                }
+
+                                cfg.Credentials = assumeRoleCredentials(cfgCp, handlers, sharedCfg, sessOpts)
+                        case credSourceEnvironment:
+                                cfg.Credentials = credentials.NewStaticCredentialsFromCreds(
+                                        envCfg.Creds,
+                                )
+                        case credSourceECSContainer:
+                                if len(os.Getenv(shareddefaults.ECSCredsProviderEnvVar)) == 0 {
+                                        return ErrSharedConfigECSContainerEnvVarEmpty
+                                }
+
+                                cfgCp := *cfg
+                                p := defaults.RemoteCredProvider(cfgCp, handlers)
+                                creds := credentials.NewCredentials(p)
+
+                                cfg.Credentials = creds
+                        default:
+                                return ErrSharedConfigInvalidCredSource
+                        }
+
+                        return nil
+                }
+
                 if len(envCfg.Creds.AccessKeyID) > 0 {
                         cfg.Credentials = credentials.NewStaticCredentialsFromCreds(
                                 envCfg.Creds,
@@ -445,36 +526,22 @@ func mergeConfigSrcs(cfg, userCfg *aws.Config, envCfg envConfig, sharedCfg share
                         cfgCp.Credentials = credentials.NewStaticCredentialsFromCreds(
                                 sharedCfg.AssumeRoleSource.Creds,
                         )
+
                         if len(sharedCfg.AssumeRole.MFASerial) > 0 && sessOpts.AssumeRoleTokenProvider == nil {
                                 // AssumeRole Token provider is required if doing Assume Role
                                 // with MFA.
                                 return AssumeRoleTokenProviderNotSetError{}
                         }
-                        cfg.Credentials = stscreds.NewCredentials(
-                                &Session{
-                                        Config:   &cfgCp,
-                                        Handlers: handlers.Copy(),
-                                },
-                                sharedCfg.AssumeRole.RoleARN,
-                                func(opt *stscreds.AssumeRoleProvider) {
-                                        opt.RoleSessionName = sharedCfg.AssumeRole.RoleSessionName
-
-                                        // Assume role with external ID
-                                        if len(sharedCfg.AssumeRole.ExternalID) > 0 {
-                                                opt.ExternalID = aws.String(sharedCfg.AssumeRole.ExternalID)
-                                        }
-
-                                        // Assume role with MFA
-                                        if len(sharedCfg.AssumeRole.MFASerial) > 0 {
-                                                opt.SerialNumber = aws.String(sharedCfg.AssumeRole.MFASerial)
-                                                opt.TokenProvider = sessOpts.AssumeRoleTokenProvider
-                                        }
-                                },
-                        )
+
+                        cfg.Credentials = assumeRoleCredentials(cfgCp, handlers, sharedCfg, sessOpts)
                 } else if len(sharedCfg.Creds.AccessKeyID) > 0 {
                         cfg.Credentials = credentials.NewStaticCredentialsFromCreds(
                                 sharedCfg.Creds,
                         )
+                } else if len(sharedCfg.CredentialProcess) > 0 {
+                        cfg.Credentials = processcreds.NewCredentials(
+                                sharedCfg.CredentialProcess,
+                        )
                 } else {
                         // Fallback to default credentials provider, include mock errors
                         // for the credential chain so user can identify why credentials
@@ -493,6 +560,30 @@ func mergeConfigSrcs(cfg, userCfg *aws.Config, envCfg envConfig, sharedCfg share
         return nil
 }
 
+func assumeRoleCredentials(cfg aws.Config, handlers request.Handlers, sharedCfg sharedConfig, sessOpts Options) *credentials.Credentials {
+        return stscreds.NewCredentials(
+                &Session{
+                        Config:   &cfg,
+                        Handlers: handlers.Copy(),
+                },
+                sharedCfg.AssumeRole.RoleARN,
+                func(opt *stscreds.AssumeRoleProvider) {
+                        opt.RoleSessionName = sharedCfg.AssumeRole.RoleSessionName
+
+                        // Assume role with external ID
+                        if len(sharedCfg.AssumeRole.ExternalID) > 0 {
+                                opt.ExternalID = aws.String(sharedCfg.AssumeRole.ExternalID)
+                        }
+
+                        // Assume role with MFA
+                        if len(sharedCfg.AssumeRole.MFASerial) > 0 {
+                                opt.SerialNumber = aws.String(sharedCfg.AssumeRole.MFASerial)
+                                opt.TokenProvider = sessOpts.AssumeRoleTokenProvider
+                        }
+                },
+        )
+}
+
 // AssumeRoleTokenProviderNotSetError is an error returned when creating a session when the
 // MFAToken option is not set when shared config is configured load assume a
 // role with an MFA token.
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go b/vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go
index 09c8e5b..7cb4402 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go
@@ -2,11 +2,11 @@ package session
 
 import (
         "fmt"
-        "io/ioutil"
 
         "github.com/aws/aws-sdk-go/aws/awserr"
         "github.com/aws/aws-sdk-go/aws/credentials"
-        "github.com/go-ini/ini"
+
+        "github.com/aws/aws-sdk-go/internal/ini"
 )
 
 const (
@@ -16,15 +16,21 @@ const (
         sessionTokenKey = `aws_session_token`     // optional
 
         // Assume Role Credentials group
-        roleArnKey         = `role_arn`          // group required
-        sourceProfileKey   = `source_profile`    // group required
-        externalIDKey      = `external_id`       // optional
-        mfaSerialKey       = `mfa_serial`        // optional
-        roleSessionNameKey = `role_session_name` // optional
+        roleArnKey          = `role_arn`          // group required
+        sourceProfileKey    = `source_profile`    // group required (or credential_source)
+        credentialSourceKey = `credential_source` // group required (or source_profile)
+        externalIDKey       = `external_id`       // optional
+        mfaSerialKey        = `mfa_serial`        // optional
+        roleSessionNameKey  = `role_session_name` // optional
 
         // Additional Config fields
         regionKey = `region`
 
+        // endpoint discovery group
+        enableEndpointDiscoveryKey = `endpoint_discovery_enabled` // optional
+        // External Credential Process
+        credentialProcessKey = `credential_process`
+
         // DefaultSharedConfigProfile is the default profile to be used when
         // loading configuration from the config files if another profile name
         // is not provided.
@@ -32,11 +38,12 @@ const (
 )
 
 type assumeRoleConfig struct {
-        RoleARN         string
-        SourceProfile   string
-        ExternalID      string
-        MFASerial       string
-        RoleSessionName string
+        RoleARN          string
+        SourceProfile    string
+        CredentialSource string
+        ExternalID       string
+        MFASerial        string
+        RoleSessionName  string
 }
 
 // sharedConfig represents the configuration fields of the SDK config files.
@@ -55,16 +62,25 @@ type sharedConfig struct {
         AssumeRole       assumeRoleConfig
         AssumeRoleSource *sharedConfig
 
+        // An external process to request credentials
+        CredentialProcess string
+
         // Region is the region the SDK should use for looking up AWS service endpoints
         // and signing requests.
         //
         //      region
         Region string
+
+        // EnableEndpointDiscovery can be enabled in the shared config by setting
+        // endpoint_discovery_enabled to true
+        //
+        //      endpoint_discovery_enabled = true
+        EnableEndpointDiscovery *bool
 }
 
 type sharedConfigFile struct {
         Filename string
-        IniData  *ini.File
+        IniData  ini.Sections
 }
 
 // loadSharedConfig retrieves the configuration from the list of files
@@ -105,19 +121,16 @@ func loadSharedConfigIniFiles(filenames []string) ([]sharedConfigFile, error) {
         files := make([]sharedConfigFile, 0, len(filenames))
 
         for _, filename := range filenames {
-                b, err := ioutil.ReadFile(filename)
-                if err != nil {
+                sections, err := ini.OpenFile(filename)
+                if aerr, ok := err.(awserr.Error); ok && aerr.Code() == ini.ErrCodeUnableToReadFile {
                         // Skip files which can't be opened and read for whatever reason
                         continue
-                }
-
-                f, err := ini.Load(b)
-                if err != nil {
+                } else if err != nil {
                         return nil, SharedConfigLoadError{Filename: filename, Err: err}
                 }
 
                 files = append(files, sharedConfigFile{
-                        Filename: filename, IniData: f,
+                        Filename: filename, IniData: sections,
                 })
         }
 
@@ -127,6 +140,13 @@ func loadSharedConfigIniFiles(filenames []string) ([]sharedConfigFile, error) {
 func (cfg *sharedConfig) setAssumeRoleSource(origProfile string, files []sharedConfigFile) error {
         var assumeRoleSrc sharedConfig
 
+        if len(cfg.AssumeRole.CredentialSource) > 0 {
+                // setAssumeRoleSource is only called when source_profile is found.
+                // If both source_profile and credential_source are set, then
+                // ErrSharedConfigSourceCollision will be returned
+                return ErrSharedConfigSourceCollision
+        }
+
         // Multiple level assume role chains are not support
         if cfg.AssumeRole.SourceProfile == origProfile {
                 assumeRoleSrc = *cfg
@@ -171,45 +191,59 @@ func (cfg *sharedConfig) setFromIniFiles(profile string, files []sharedConfigFil
 // if a config file only includes aws_access_key_id but no aws_secret_access_key
 // the aws_access_key_id will be ignored.
 func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile) error {
-        section, err := file.IniData.GetSection(profile)
-        if err != nil {
+        section, ok := file.IniData.GetSection(profile)
+        if !ok {
                 // Fallback to to alternate profile name: profile <name>
-                section, err = file.IniData.GetSection(fmt.Sprintf("profile %s", profile))
-                if err != nil {
-                        return SharedConfigProfileNotExistsError{Profile: profile, Err: err}
+                section, ok = file.IniData.GetSection(fmt.Sprintf("profile %s", profile))
+                if !ok {
+                        return SharedConfigProfileNotExistsError{Profile: profile, Err: nil}
                 }
         }
 
         // Shared Credentials
-        akid := section.Key(accessKeyIDKey).String()
-        secret := section.Key(secretAccessKey).String()
+        akid := section.String(accessKeyIDKey)
+        secret := section.String(secretAccessKey)
         if len(akid) > 0 && len(secret) > 0 {
                 cfg.Creds = credentials.Value{
                         AccessKeyID:     akid,
                         SecretAccessKey: secret,
-                        SessionToken:    section.Key(sessionTokenKey).String(),
+                        SessionToken:    section.String(sessionTokenKey),
                         ProviderName:    fmt.Sprintf("SharedConfigCredentials: %s", file.Filename),
                 }
         }
 
         // Assume Role
-        roleArn := section.Key(roleArnKey).String()
-        srcProfile := section.Key(sourceProfileKey).String()
-        if len(roleArn) > 0 && len(srcProfile) > 0 {
+        roleArn := section.String(roleArnKey)
+        srcProfile := section.String(sourceProfileKey)
+        credentialSource := section.String(credentialSourceKey)
+        hasSource := len(srcProfile) > 0 || len(credentialSource) > 0
+        if len(roleArn) > 0 && hasSource {
                 cfg.AssumeRole = assumeRoleConfig{
-                        RoleARN:         roleArn,
-                        SourceProfile:   srcProfile,
-                        ExternalID:      section.Key(externalIDKey).String(),
-                        MFASerial:       section.Key(mfaSerialKey).String(),
-                        RoleSessionName: section.Key(roleSessionNameKey).String(),
+                        RoleARN:          roleArn,
+                        SourceProfile:    srcProfile,
+                        CredentialSource: credentialSource,
+                        ExternalID:       section.String(externalIDKey),
+                        MFASerial:        section.String(mfaSerialKey),
+                        RoleSessionName:  section.String(roleSessionNameKey),
                 }
         }
 
+        // `credential_process`
+        if credProc := section.String(credentialProcessKey); len(credProc) > 0 {
+                cfg.CredentialProcess = credProc
+        }
+
         // Region
-        if v := section.Key(regionKey).String(); len(v) > 0 {
+        if v := section.String(regionKey); len(v) > 0 {
                 cfg.Region = v
         }
 
+        // Endpoint discovery
+        if section.Has(enableEndpointDiscoveryKey) {
+                v := section.Bool(enableEndpointDiscoveryKey)
+                cfg.EnableEndpointDiscovery = &v
+        }
+
         return nil
 }
 
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/signer/v4/v4.go b/vendor/github.com/aws/aws-sdk-go/aws/signer/v4/v4.go
index 8aa0681..523db79 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/signer/v4/v4.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/signer/v4/v4.go
@@ -134,6 +134,7 @@ var requiredSignedHeaders = rules{
                         "X-Amz-Server-Side-Encryption-Customer-Key":                   struct{}{},
                         "X-Amz-Server-Side-Encryption-Customer-Key-Md5":               struct{}{},
                         "X-Amz-Storage-Class":                                         struct{}{},
+                        "X-Amz-Tagging":                                               struct{}{},
                         "X-Amz-Website-Redirect-Location":                             struct{}{},
                         "X-Amz-Content-Sha256":                                        struct{}{},
                 },
@@ -181,7 +182,7 @@ type Signer struct {
         // http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
         DisableURIPathEscaping bool
 
-        // Disales the automatical setting of the HTTP request's Body field with the
+        // Disables the automatical setting of the HTTP request's Body field with the
         // io.ReadSeeker passed in to the signer. This is useful if you're using a
         // custom wrapper around the body for the io.ReadSeeker and want to preserve
         // the Body value on the Request.Body.
@@ -421,7 +422,7 @@ var SignRequestHandler = request.NamedHandler{
 // If the credentials of the request's config are set to
 // credentials.AnonymousCredentials the request will not be signed.
 func SignSDKRequest(req *request.Request) {
-        signSDKRequestWithCurrTime(req, time.Now)
+        SignSDKRequestWithCurrentTime(req, time.Now)
 }
 
 // BuildNamedHandler will build a generic handler for signing.
@@ -429,12 +430,15 @@ func BuildNamedHandler(name string, opts ...func(*Signer)) request.NamedHandler
         return request.NamedHandler{
                 Name: name,
                 Fn: func(req *request.Request) {
-                        signSDKRequestWithCurrTime(req, time.Now, opts...)
+                        SignSDKRequestWithCurrentTime(req, time.Now, opts...)
                 },
         }
 }
 
-func signSDKRequestWithCurrTime(req *request.Request, curTimeFn func() time.Time, opts ...func(*Signer)) {
+// SignSDKRequestWithCurrentTime will sign the SDK's request using the time
+// function passed in. Behaves the same as SignSDKRequest with the exception
+// the request is signed with the value returned by the current time function.
+func SignSDKRequestWithCurrentTime(req *request.Request, curTimeFn func() time.Time, opts ...func(*Signer)) {
         // If the request does not need to be signed ignore the signing of the
         // request if the AnonymousCredentials object is used.
         if req.Config.Credentials == credentials.AnonymousCredentials {
@@ -470,13 +474,9 @@ func signSDKRequestWithCurrTime(req *request.Request, curTimeFn func() time.Time
                 opt(v4)
         }
 
-        signingTime := req.Time
-        if !req.LastSignedAt.IsZero() {
-                signingTime = req.LastSignedAt
-        }
-
+        curTime := curTimeFn()
         signedHeaders, err := v4.signWithBody(req.HTTPRequest, req.GetBody(),
-                name, region, req.ExpireTime, req.ExpireTime > 0, signingTime,
+                name, region, req.ExpireTime, req.ExpireTime > 0, curTime,
         )
         if err != nil {
                 req.Error = err
@@ -485,7 +485,7 @@ func signSDKRequestWithCurrTime(req *request.Request, curTimeFn func() time.Time
         }
 
         req.SignedHeaderVals = signedHeaders
-        req.LastSignedAt = curTimeFn()
+        req.LastSignedAt = curTime
 }
 
 const logSignInfoMsg = `DEBUG: Request Signature:
@@ -739,14 +739,22 @@ func makeSha256Reader(reader io.ReadSeeker) []byte {
         start, _ := reader.Seek(0, sdkio.SeekCurrent)
         defer reader.Seek(start, sdkio.SeekStart)
 
-        io.Copy(hash, reader)
+        // Use CopyN to avoid allocating the 32KB buffer in io.Copy for bodies
+        // smaller than 32KB. Fall back to io.Copy if we fail to determine the size.
+        size, err := aws.SeekerLen(reader)
+        if err != nil {
+                io.Copy(hash, reader)
+        } else {
+                io.CopyN(hash, reader, size)
+        }
+
         return hash.Sum(nil)
 }
 
 const doubleSpace = "  "
 
 // stripExcessSpaces will rewrite the passed in slice's string values to not
-// contain muliple side-by-side spaces.
+// contain multiple side-by-side spaces.
 func stripExcessSpaces(vals []string) {
         var j, k, l, m, spaces int
         for i, str := range vals {
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/version.go b/vendor/github.com/aws/aws-sdk-go/aws/version.go
index c4d155c..15ad9cf 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/version.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/version.go
@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.14.31"
+const SDKVersion = "1.19.18"
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/ast.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/ast.go
new file mode 100644
index 0000000..e83a998
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/ast.go
@@ -0,0 +1,120 @@
+package ini
+
+// ASTKind represents different states in the parse table
+// and the type of AST that is being constructed
+type ASTKind int
+
+// ASTKind* is used in the parse table to transition between
+// the different states
+const (
+        ASTKindNone = ASTKind(iota)
+        ASTKindStart
+        ASTKindExpr
+        ASTKindEqualExpr
+        ASTKindStatement
+        ASTKindSkipStatement
+        ASTKindExprStatement
+        ASTKindSectionStatement
+        ASTKindNestedSectionStatement
+        ASTKindCompletedNestedSectionStatement
+        ASTKindCommentStatement
+        ASTKindCompletedSectionStatement
+)
+
+func (k ASTKind) String() string {
+        switch k {
+        case ASTKindNone:
+                return "none"
+        case ASTKindStart:
+                return "start"
+        case ASTKindExpr:
+                return "expr"
+        case ASTKindStatement:
+                return "stmt"
+        case ASTKindSectionStatement:
+                return "section_stmt"
+        case ASTKindExprStatement:
+                return "expr_stmt"
+        case ASTKindCommentStatement:
+                return "comment"
+        case ASTKindNestedSectionStatement:
+                return "nested_section_stmt"
+        case ASTKindCompletedSectionStatement:
+                return "completed_stmt"
+        case ASTKindSkipStatement:
+                return "skip"
+        default:
+                return ""
+        }
+}
+
+// AST interface allows us to determine what kind of node we
+// are on and casting may not need to be necessary.
+//
+// The root is always the first node in Children
+type AST struct {
+        Kind      ASTKind
+        Root      Token
+        RootToken bool
+        Children  []AST
+}
+
+func newAST(kind ASTKind, root AST, children ...AST) AST {
+        return AST{
+                Kind:     kind,
+                Children: append([]AST{root}, children...),
+        }
+}
+
+func newASTWithRootToken(kind ASTKind, root Token, children ...AST) AST {
+        return AST{
+                Kind:      kind,
+                Root:      root,
+                RootToken: true,
+                Children:  children,
+        }
+}
+
+// AppendChild will append to the list of children an AST has.
+func (a *AST) AppendChild(child AST) {
+        a.Children = append(a.Children, child)
+}
+
+// GetRoot will return the root AST which can be the first entry
+// in the children list or a token.
+func (a *AST) GetRoot() AST {
+        if a.RootToken {
+                return *a
+        }
+
+        if len(a.Children) == 0 {
+                return AST{}
+        }
+
+        return a.Children[0]
+}
+
+// GetChildren will return the current AST's list of children
+func (a *AST) GetChildren() []AST {
+        if len(a.Children) == 0 {
+                return []AST{}
+        }
+
+        if a.RootToken {
+                return a.Children
+        }
+
+        return a.Children[1:]
+}
+
+// SetChildren will set and override all children of the AST.
+func (a *AST) SetChildren(children []AST) {
+        if a.RootToken {
+                a.Children = children
+        } else {
+                a.Children = append(a.Children[:1], children...)
+        }
+}
+
+// Start is used to indicate the starting state of the parse table.
+var Start = newAST(ASTKindStart, AST{})
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/comma_token.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/comma_token.go
new file mode 100644
index 0000000..0895d53
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/comma_token.go
@@ -0,0 +1,11 @@
+package ini
+
+var commaRunes = []rune(",")
+
+func isComma(b rune) bool {
+        return b == ','
+}
+
+func newCommaToken() Token {
+        return newToken(TokenComma, commaRunes, NoneType)
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/comment_token.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/comment_token.go
new file mode 100644
index 0000000..0b76999
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/comment_token.go
@@ -0,0 +1,35 @@
+package ini
+
+// isComment will return whether or not the next byte(s) is a
+// comment.
+func isComment(b []rune) bool {
+        if len(b) == 0 {
+                return false
+        }
+
+        switch b[0] {
+        case ';':
+                return true
+        case '#':
+                return true
+        }
+
+        return false
+}
+
+// newCommentToken will create a comment token and
+// return how many bytes were read.
+func newCommentToken(b []rune) (Token, int, error) {
+        i := 0
+        for ; i < len(b); i++ {
+                if b[i] == '\n' {
+                        break
+                }
+
+                if len(b)-i > 2 && b[i] == '\r' && b[i+1] == '\n' {
+                        break
+                }
+        }
+
+        return newToken(TokenComment, b[:i], NoneType), i, nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go
new file mode 100644
index 0000000..25ce0fe
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go
@@ -0,0 +1,29 @@
+// Package ini is an LL(1) parser for configuration files.
+//
+//      Example:
+//      sections, err := ini.OpenFile("/path/to/file")
+//      if err != nil {
+//              panic(err)
+//      }
+//
+//      profile := "foo"
+//      section, ok := sections.GetSection(profile)
+//      if !ok {
+//              fmt.Printf("section %q could not be found", profile)
+//      }
+//
+// Below is the BNF that describes this parser
+//      Grammar:
+//      stmt -> value stmt'
+//      stmt' -> epsilon | op stmt
+//      value -> number | string | boolean | quoted_string
+//
+//      section -> [ section'
+//      section' -> value section_close
+//      section_close -> ]
+//
+//      SkipState will skip (NL WS)+
+//
+//      comment -> # comment' | ; comment'
+//      comment' -> epsilon | value
+package ini
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/empty_token.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/empty_token.go
new file mode 100644
index 0000000..04345a5
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/empty_token.go
@@ -0,0 +1,4 @@
+package ini
+
+// emptyToken is used to satisfy the Token interface
+var emptyToken = newToken(TokenNone, []rune{}, NoneType)
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/expression.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/expression.go
new file mode 100644
index 0000000..91ba2a5
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/expression.go
@@ -0,0 +1,24 @@
+package ini
+
+// newExpression will return an expression AST.
+// Expr represents an expression
+//
+//      grammar:
+//      expr -> string | number
+func newExpression(tok Token) AST {
+        return newASTWithRootToken(ASTKindExpr, tok)
+}
+
+func newEqualExpr(left AST, tok Token) AST {
+        return newASTWithRootToken(ASTKindEqualExpr, tok, left)
+}
+
+// EqualExprKey will return a LHS value in the equal expr
+func EqualExprKey(ast AST) string {
+        children := ast.GetChildren()
+        if len(children) == 0 || ast.Kind != ASTKindEqualExpr {
+                return ""
+        }
+
+        return string(children[0].Root.Raw())
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/fuzz.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/fuzz.go
new file mode 100644
index 0000000..8d462f7
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/fuzz.go
@@ -0,0 +1,17 @@
+// +build gofuzz
+
+package ini
+
+import (
+        "bytes"
+)
+
+func Fuzz(data []byte) int {
+        b := bytes.NewReader(data)
+
+        if _, err := Parse(b); err != nil {
+                return 0
+        }
+
+        return 1
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/ini.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/ini.go
new file mode 100644
index 0000000..3b0ca7a
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/ini.go
@@ -0,0 +1,51 @@
+package ini
+
+import (
+        "io"
+        "os"
+
+        "github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// OpenFile takes a path to a given file, and will open  and parse
+// that file.
+func OpenFile(path string) (Sections, error) {
+        f, err := os.Open(path)
+        if err != nil {
+                return Sections{}, awserr.New(ErrCodeUnableToReadFile, "unable to open file", err)
+        }
+        defer f.Close()
+
+        return Parse(f)
+}
+
+// Parse will parse the given file using the shared config
+// visitor.
+func Parse(f io.Reader) (Sections, error) {
+        tree, err := ParseAST(f)
+        if err != nil {
+                return Sections{}, err
+        }
+
+        v := NewDefaultVisitor()
+        if err = Walk(tree, v); err != nil {
+                return Sections{}, err
+        }
+
+        return v.Sections, nil
+}
+
+// ParseBytes will parse the given bytes and return the parsed sections.
+func ParseBytes(b []byte) (Sections, error) {
+        tree, err := ParseASTBytes(b)
+        if err != nil {
+                return Sections{}, err
+        }
+
+        v := NewDefaultVisitor()
+        if err = Walk(tree, v); err != nil {
+                return Sections{}, err
+        }
+
+        return v.Sections, nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_lexer.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_lexer.go
new file mode 100644
index 0000000..582c024
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_lexer.go
@@ -0,0 +1,165 @@
+package ini
+
+import (
+        "bytes"
+        "io"
+        "io/ioutil"
+
+        "github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+const (
+        // ErrCodeUnableToReadFile is used when a file is failed to be
+        // opened or read from.
+        ErrCodeUnableToReadFile = "FailedRead"
+)
+
+// TokenType represents the various different tokens types
+type TokenType int
+
+func (t TokenType) String() string {
+        switch t {
+        case TokenNone:
+                return "none"
+        case TokenLit:
+                return "literal"
+        case TokenSep:
+                return "sep"
+        case TokenOp:
+                return "op"
+        case TokenWS:
+                return "ws"
+        case TokenNL:
+                return "newline"
+        case TokenComment:
+                return "comment"
+        case TokenComma:
+                return "comma"
+        default:
+                return ""
+        }
+}
+
+// TokenType enums
+const (
+        TokenNone = TokenType(iota)
+        TokenLit
+        TokenSep
+        TokenComma
+        TokenOp
+        TokenWS
+        TokenNL
+        TokenComment
+)
+
+type iniLexer struct{}
+
+// Tokenize will return a list of tokens during lexical analysis of the
+// io.Reader.
+func (l *iniLexer) Tokenize(r io.Reader) ([]Token, error) {
+        b, err := ioutil.ReadAll(r)
+        if err != nil {
+                return nil, awserr.New(ErrCodeUnableToReadFile, "unable to read file", err)
+        }
+
+        return l.tokenize(b)
+}
+
+func (l *iniLexer) tokenize(b []byte) ([]Token, error) {
+        runes := bytes.Runes(b)
+        var err error
+        n := 0
+        tokenAmount := countTokens(runes)
+        tokens := make([]Token, tokenAmount)
+        count := 0
+
+        for len(runes) > 0 && count < tokenAmount {
+                switch {
+                case isWhitespace(runes[0]):
+                        tokens[count], n, err = newWSToken(runes)
+                case isComma(runes[0]):
+                        tokens[count], n = newCommaToken(), 1
+                case isComment(runes):
+                        tokens[count], n, err = newCommentToken(runes)
+                case isNewline(runes):
+                        tokens[count], n, err = newNewlineToken(runes)
+                case isSep(runes):
+                        tokens[count], n, err = newSepToken(runes)
+                case isOp(runes):
+                        tokens[count], n, err = newOpToken(runes)
+                default:
+                        tokens[count], n, err = newLitToken(runes)
+                }
+
+                if err != nil {
+                        return nil, err
+                }
+
+                count++
+
+                runes = runes[n:]
+        }
+
+        return tokens[:count], nil
+}
+
+func countTokens(runes []rune) int {
+        count, n := 0, 0
+        var err error
+
+        for len(runes) > 0 {
+                switch {
+                case isWhitespace(runes[0]):
+                        _, n, err = newWSToken(runes)
+                case isComma(runes[0]):
+                        _, n = newCommaToken(), 1
+                case isComment(runes):
+                        _, n, err = newCommentToken(runes)
+                case isNewline(runes):
+                        _, n, err = newNewlineToken(runes)
+                case isSep(runes):
+                        _, n, err = newSepToken(runes)
+                case isOp(runes):
+                        _, n, err = newOpToken(runes)
+                default:
+                        _, n, err = newLitToken(runes)
+                }
+
+                if err != nil {
+                        return 0
+                }
+
+                count++
+                runes = runes[n:]
+        }
+
+        return count + 1
+}
+
+// Token indicates a metadata about a given value.
+type Token struct {
+        t         TokenType
+        ValueType ValueType
+        base      int
+        raw       []rune
+}
+
+var emptyValue = Value{}
+
+func newToken(t TokenType, raw []rune, v ValueType) Token {
+        return Token{
+                t:         t,
+                raw:       raw,
+                ValueType: v,
+        }
+}
+
+// Raw return the raw runes that were consumed
+func (tok Token) Raw() []rune {
+        return tok.raw
+}
+
+// Type returns the token type
+func (tok Token) Type() TokenType {
+        return tok.t
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go
new file mode 100644
index 0000000..f997033
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go
@@ -0,0 +1,347 @@
+package ini
+
+import (
+        "fmt"
+        "io"
+)
+
+// State enums for the parse table
+const (
+        InvalidState = iota
+        // stmt -> value stmt'
+        StatementState
+        // stmt' -> MarkComplete | op stmt
+        StatementPrimeState
+        // value -> number | string | boolean | quoted_string
+        ValueState
+        // section -> [ section'
+        OpenScopeState
+        // section' -> value section_close
+        SectionState
+        // section_close -> ]
+        CloseScopeState
+        // SkipState will skip (NL WS)+
+        SkipState
+        // SkipTokenState will skip any token and push the previous
+        // state onto the stack.
+        SkipTokenState
+        // comment -> # comment' | ; comment'
+        // comment' -> MarkComplete | value
+        CommentState
+        // MarkComplete state will complete statements and move that
+        // to the completed AST list
+        MarkCompleteState
+        // TerminalState signifies that the tokens have been fully parsed
+        TerminalState
+)
+
+// parseTable is a state machine to dictate the grammar above.
+var parseTable = map[ASTKind]map[TokenType]int{
+        ASTKindStart: map[TokenType]int{
+                TokenLit:     StatementState,
+                TokenSep:     OpenScopeState,
+                TokenWS:      SkipTokenState,
+                TokenNL:      SkipTokenState,
+                TokenComment: CommentState,
+                TokenNone:    TerminalState,
+        },
+        ASTKindCommentStatement: map[TokenType]int{
+                TokenLit:     StatementState,
+                TokenSep:     OpenScopeState,
+                TokenWS:      SkipTokenState,
+                TokenNL:      SkipTokenState,
+                TokenComment: CommentState,
+                TokenNone:    MarkCompleteState,
+        },
+        ASTKindExpr: map[TokenType]int{
+                TokenOp:      StatementPrimeState,
+                TokenLit:     ValueState,
+                TokenSep:     OpenScopeState,
+                TokenWS:      ValueState,
+                TokenNL:      SkipState,
+                TokenComment: CommentState,
+                TokenNone:    MarkCompleteState,
+        },
+        ASTKindEqualExpr: map[TokenType]int{
+                TokenLit: ValueState,
+                TokenWS:  SkipTokenState,
+                TokenNL:  SkipState,
+        },
+        ASTKindStatement: map[TokenType]int{
+                TokenLit:     SectionState,
+                TokenSep:     CloseScopeState,
+                TokenWS:      SkipTokenState,
+                TokenNL:      SkipTokenState,
+                TokenComment: CommentState,
+                TokenNone:    MarkCompleteState,
+        },
+        ASTKindExprStatement: map[TokenType]int{
+                TokenLit:     ValueState,
+                TokenSep:     OpenScopeState,
+                TokenOp:      ValueState,
+                TokenWS:      ValueState,
+                TokenNL:      MarkCompleteState,
+                TokenComment: CommentState,
+                TokenNone:    TerminalState,
+                TokenComma:   SkipState,
+        },
+        ASTKindSectionStatement: map[TokenType]int{
+                TokenLit: SectionState,
+                TokenOp:  SectionState,
+                TokenSep: CloseScopeState,
+                TokenWS:  SectionState,
+                TokenNL:  SkipTokenState,
+        },
+        ASTKindCompletedSectionStatement: map[TokenType]int{
+                TokenWS:      SkipTokenState,
+                TokenNL:      SkipTokenState,
+                TokenLit:     StatementState,
+                TokenSep:     OpenScopeState,
+                TokenComment: CommentState,
+                TokenNone:    MarkCompleteState,
+        },
+        ASTKindSkipStatement: map[TokenType]int{
+                TokenLit:     StatementState,
+                TokenSep:     OpenScopeState,
+                TokenWS:      SkipTokenState,
+                TokenNL:      SkipTokenState,
+                TokenComment: CommentState,
+                TokenNone:    TerminalState,
+        },
+}
+
+// ParseAST will parse input from an io.Reader using
+// an LL(1) parser.
+func ParseAST(r io.Reader) ([]AST, error) {
+        lexer := iniLexer{}
+        tokens, err := lexer.Tokenize(r)
+        if err != nil {
+                return []AST{}, err
+        }
+
+        return parse(tokens)
+}
+
+// ParseASTBytes will parse input from a byte slice using
+// an LL(1) parser.
+func ParseASTBytes(b []byte) ([]AST, error) {
+        lexer := iniLexer{}
+        tokens, err := lexer.tokenize(b)
+        if err != nil {
+                return []AST{}, err
+        }
+
+        return parse(tokens)
+}
+
+func parse(tokens []Token) ([]AST, error) {
+        start := Start
+        stack := newParseStack(3, len(tokens))
+
+        stack.Push(start)
+        s := newSkipper()
+
+loop:
+        for stack.Len() > 0 {
+                k := stack.Pop()
+
+                var tok Token
+                if len(tokens) == 0 {
+                        // this occurs when all the tokens have been processed
+                        // but reduction of what's left on the stack needs to
+                        // occur.
+                        tok = emptyToken
+                } else {
+                        tok = tokens[0]
+                }
+
+                step := parseTable[k.Kind][tok.Type()]
+                if s.ShouldSkip(tok) {
+                        // being in a skip state with no tokens will break out of
+                        // the parse loop since there is nothing left to process.
+                        if len(tokens) == 0 {
+                                break loop
+                        }
+
+                        step = SkipTokenState
+                }
+
+                switch step {
+                case TerminalState:
+                        // Finished parsing. Push what should be the last
+                        // statement to the stack. If there is anything left
+                        // on the stack, an error in parsing has occurred.
+                        if k.Kind != ASTKindStart {
+                                stack.MarkComplete(k)
+                        }
+                        break loop
+                case SkipTokenState:
+                        // When skipping a token, the previous state was popped off the stack.
+                        // To maintain the correct state, the previous state will be pushed
+                        // onto the stack.
+                        stack.Push(k)
+                case StatementState:
+                        if k.Kind != ASTKindStart {
+                                stack.MarkComplete(k)
+                        }
+                        expr := newExpression(tok)
+                        stack.Push(expr)
+                case StatementPrimeState:
+                        if tok.Type() != TokenOp {
+                                stack.MarkComplete(k)
+                                continue
+                        }
+
+                        if k.Kind != ASTKindExpr {
+                                return nil, NewParseError(
+                                        fmt.Sprintf("invalid expression: expected Expr type, but found %T type", k),
+                                )
+                        }
+
+                        k = trimSpaces(k)
+                        expr := newEqualExpr(k, tok)
+                        stack.Push(expr)
+                case ValueState:
+                        // ValueState requires the previous state to either be an equal expression
+                        // or an expression statement.
+                        //
+                        // This grammar occurs when the RHS is a number, word, or quoted string.
+                        // equal_expr -> lit op equal_expr'
+                        // equal_expr' -> number | string | quoted_string
+                        // quoted_string -> " quoted_string'
+                        // quoted_string' -> string quoted_string_end
+                        // quoted_string_end -> "
+                        //
+                        // otherwise
+                        // expr_stmt -> equal_expr (expr_stmt')*
+                        // expr_stmt' -> ws S | op S | MarkComplete
+                        // S -> equal_expr' expr_stmt'
+                        switch k.Kind {
+                        case ASTKindEqualExpr:
+                                // assiging a value to some key
+                                k.AppendChild(newExpression(tok))
+                                stack.Push(newExprStatement(k))
+                        case ASTKindExpr:
+                                k.Root.raw = append(k.Root.raw, tok.Raw()...)
+                                stack.Push(k)
+                        case ASTKindExprStatement:
+                                root := k.GetRoot()
+                                children := root.GetChildren()
+                                if len(children) == 0 {
+                                        return nil, NewParseError(
+                                                fmt.Sprintf("invalid expression: AST contains no children %s", k.Kind),
+                                        )
+                                }
+
+                                rhs := children[len(children)-1]
+
+                                if rhs.Root.ValueType != QuotedStringType {
+                                        rhs.Root.ValueType = StringType
+                                        rhs.Root.raw = append(rhs.Root.raw, tok.Raw()...)
+
+                                }
+
+                                children[len(children)-1] = rhs
+                                k.SetChildren(children)
+
+                                stack.Push(k)
+                        }
+                case OpenScopeState:
+                        if !runeCompare(tok.Raw(), openBrace) {
+                                return nil, NewParseError("expected '['")
+                        }
+
+                        stmt := newStatement()
+                        stack.Push(stmt)
+                case CloseScopeState:
+                        if !runeCompare(tok.Raw(), closeBrace) {
+                                return nil, NewParseError("expected ']'")
+                        }
+
+                        k = trimSpaces(k)
+                        stack.Push(newCompletedSectionStatement(k))
+                case SectionState:
+                        var stmt AST
+
+                        switch k.Kind {
+                        case ASTKindStatement:
+                                // If there are multiple literals inside of a scope declaration,
+                                // then the current token's raw value will be appended to the Name.
+                                //
+                                // This handles cases like [ profile default ]
+                                //
+                                // k will represent a SectionStatement with the children representing
+                                // the label of the section
+                                stmt = newSectionStatement(tok)
+                        case ASTKindSectionStatement:
+                                k.Root.raw = append(k.Root.raw, tok.Raw()...)
+                                stmt = k
+                        default:
+                                return nil, NewParseError(
+                                        fmt.Sprintf("invalid statement: expected statement: %v", k.Kind),
+                                )
+                        }
+
+                        stack.Push(stmt)
+                case MarkCompleteState:
+                        if k.Kind != ASTKindStart {
+                                stack.MarkComplete(k)
+                        }
+
+                        if stack.Len() == 0 {
+                                stack.Push(start)
+                        }
+                case SkipState:
+                        stack.Push(newSkipStatement(k))
+                        s.Skip()
+                case CommentState:
+                        if k.Kind == ASTKindStart {
+                                stack.Push(k)
+                        } else {
+                                stack.MarkComplete(k)
+                        }
+
+                        stmt := newCommentStatement(tok)
+                        stack.Push(stmt)
+                default:
+                        return nil, NewParseError(fmt.Sprintf("invalid state with ASTKind %v and TokenType %v", k, tok))
+                }
+
+                if len(tokens) > 0 {
+                        tokens = tokens[1:]
+                }
+        }
+
+        // this occurs when a statement has not been completed
+        if stack.top > 1 {
+                return nil, NewParseError(fmt.Sprintf("incomplete expression: %v", stack.container))
+        }
+
+        // returns a sublist which excludes the start symbol
+        return stack.List(), nil
+}
+
+// trimSpaces will trim spaces on the left and right hand side of
+// the literal.
+func trimSpaces(k AST) AST {
+        // trim left hand side of spaces
+        for i := 0; i < len(k.Root.raw); i++ {
+                if !isWhitespace(k.Root.raw[i]) {
+                        break
+                }
+
+                k.Root.raw = k.Root.raw[1:]
+                i--
+        }
+
+        // trim right hand side of spaces
+        for i := len(k.Root.raw) - 1; i >= 0; i-- {
+                if !isWhitespace(k.Root.raw[i]) {
+                        break
+                }
+
+                k.Root.raw = k.Root.raw[:len(k.Root.raw)-1]
+        }
+
+        return k
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/literal_tokens.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/literal_tokens.go
new file mode 100644
index 0000000..24df543
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/literal_tokens.go
@@ -0,0 +1,324 @@
+package ini
+
+import (
+        "fmt"
+        "strconv"
+        "strings"
+)
+
+var (
+        runesTrue  = []rune("true")
+        runesFalse = []rune("false")
+)
+
+var literalValues = [][]rune{
+        runesTrue,
+        runesFalse,
+}
+
+func isBoolValue(b []rune) bool {
+        for _, lv := range literalValues {
+                if isLitValue(lv, b) {
+                        return true
+                }
+        }
+        return false
+}
+
+func isLitValue(want, have []rune) bool {
+        if len(have) < len(want) {
+                return false
+        }
+
+        for i := 0; i < len(want); i++ {
+                if want[i] != have[i] {
+                        return false
+                }
+        }
+
+        return true
+}
+
+// isNumberValue will return whether not the leading characters in
+// a byte slice is a number. A number is delimited by whitespace or
+// the newline token.
+//
+// A number is defined to be in a binary, octal, decimal (int | float), hex format,
+// or in scientific notation.
+func isNumberValue(b []rune) bool {
+        negativeIndex := 0
+        helper := numberHelper{}
+        needDigit := false
+
+        for i := 0; i < len(b); i++ {
+                negativeIndex++
+
+                switch b[i] {
+                case '-':
+                        if helper.IsNegative() || negativeIndex != 1 {
+                                return false
+                        }
+                        helper.Determine(b[i])
+                        needDigit = true
+                        continue
+                case 'e', 'E':
+                        if err := helper.Determine(b[i]); err != nil {
+                                return false
+                        }
+                        negativeIndex = 0
+                        needDigit = true
+                        continue
+                case 'b':
+                        if helper.numberFormat == hex {
+                                break
+                        }
+                        fallthrough
+                case 'o', 'x':
+                        needDigit = true
+                        if i == 0 {
+                                return false
+                        }
+
+                        fallthrough
+                case '.':
+                        if err := helper.Determine(b[i]); err != nil {
+                                return false
+                        }
+                        needDigit = true
+                        continue
+                }
+
+                if i > 0 && (isNewline(b[i:]) || isWhitespace(b[i])) {
+                        return !needDigit
+                }
+
+                if !helper.CorrectByte(b[i]) {
+                        return false
+                }
+                needDigit = false
+        }
+
+        return !needDigit
+}
+
+func isValid(b []rune) (bool, int, error) {
+        if len(b) == 0 {
+                // TODO: should probably return an error
+                return false, 0, nil
+        }
+
+        return isValidRune(b[0]), 1, nil
+}
+
+func isValidRune(r rune) bool {
+        return r != ':' && r != '=' && r != '[' && r != ']' && r != ' ' && r != '\n'
+}
+
+// ValueType is an enum that will signify what type
+// the Value is
+type ValueType int
+
+func (v ValueType) String() string {
+        switch v {
+        case NoneType:
+                return "NONE"
+        case DecimalType:
+                return "FLOAT"
+        case IntegerType:
+                return "INT"
+        case StringType:
+                return "STRING"
+        case BoolType:
+                return "BOOL"
+        }
+
+        return ""
+}
+
+// ValueType enums
+const (
+        NoneType = ValueType(iota)
+        DecimalType
+        IntegerType
+        StringType
+        QuotedStringType
+        BoolType
+)
+
+// Value is a union container
+type Value struct {
+        Type ValueType
+        raw  []rune
+
+        integer int64
+        decimal float64
+        boolean bool
+        str     string
+}
+
+func newValue(t ValueType, base int, raw []rune) (Value, error) {
+        v := Value{
+                Type: t,
+                raw:  raw,
+        }
+        var err error
+
+        switch t {
+        case DecimalType:
+                v.decimal, err = strconv.ParseFloat(string(raw), 64)
+        case IntegerType:
+                if base != 10 {
+                        raw = raw[2:]
+                }
+
+                v.integer, err = strconv.ParseInt(string(raw), base, 64)
+        case StringType:
+                v.str = string(raw)
+        case QuotedStringType:
+                v.str = string(raw[1 : len(raw)-1])
+        case BoolType:
+                v.boolean = runeCompare(v.raw, runesTrue)
+        }
+
+        // issue 2253
+        //
+        // if the value trying to be parsed is too large, then we will use
+        // the 'StringType' and raw value instead.
+        if nerr, ok := err.(*strconv.NumError); ok && nerr.Err == strconv.ErrRange {
+                v.Type = StringType
+                v.str = string(raw)
+                err = nil
+        }
+
+        return v, err
+}
+
+// Append will append values and change the type to a string
+// type.
+func (v *Value) Append(tok Token) {
+        r := tok.Raw()
+        if v.Type != QuotedStringType {
+                v.Type = StringType
+                r = tok.raw[1 : len(tok.raw)-1]
+        }
+        if tok.Type() != TokenLit {
+                v.raw = append(v.raw, tok.Raw()...)
+        } else {
+                v.raw = append(v.raw, r...)
+        }
+}
+
+func (v Value) String() string {
+        switch v.Type {
+        case DecimalType:
+                return fmt.Sprintf("decimal: %f", v.decimal)
+        case IntegerType:
+                return fmt.Sprintf("integer: %d", v.integer)
+        case StringType:
+                return fmt.Sprintf("string: %s", string(v.raw))
+        case QuotedStringType:
+                return fmt.Sprintf("quoted string: %s", string(v.raw))
+        case BoolType:
+                return fmt.Sprintf("bool: %t", v.boolean)
+        default:
+                return "union not set"
+        }
+}
+
+func newLitToken(b []rune) (Token, int, error) {
+        n := 0
+        var err error
+
+        token := Token{}
+        if b[0] == '"' {
+                n, err = getStringValue(b)
+                if err != nil {
+                        return token, n, err
+                }
+
+                token = newToken(TokenLit, b[:n], QuotedStringType)
+        } else if isNumberValue(b) {
+                var base int
+                base, n, err = getNumericalValue(b)
+                if err != nil {
+                        return token, 0, err
+                }
+
+                value := b[:n]
+                vType := IntegerType
+                if contains(value, '.') || hasExponent(value) {
+                        vType = DecimalType
+                }
+                token = newToken(TokenLit, value, vType)
+                token.base = base
+        } else if isBoolValue(b) {
+                n, err = getBoolValue(b)
+
+                token = newToken(TokenLit, b[:n], BoolType)
+        } else {
+                n, err = getValue(b)
+                token = newToken(TokenLit, b[:n], StringType)
+        }
+
+        return token, n, err
+}
+
+// IntValue returns an integer value
+func (v Value) IntValue() int64 {
+        return v.integer
+}
+
+// FloatValue returns a float value
+func (v Value) FloatValue() float64 {
+        return v.decimal
+}
+
+// BoolValue returns a bool value
+func (v Value) BoolValue() bool {
+        return v.boolean
+}
+
+func isTrimmable(r rune) bool {
+        switch r {
+        case '\n', ' ':
+                return true
+        }
+        return false
+}
+
+// StringValue returns the string value
+func (v Value) StringValue() string {
+        switch v.Type {
+        case StringType:
+                return strings.TrimFunc(string(v.raw), isTrimmable)
+        case QuotedStringType:
+                // preserve all characters in the quotes
+                return string(removeEscapedCharacters(v.raw[1 : len(v.raw)-1]))
+        default:
+                return strings.TrimFunc(string(v.raw), isTrimmable)
+        }
+}
+
+func contains(runes []rune, c rune) bool {
+        for i := 0; i < len(runes); i++ {
+                if runes[i] == c {
+                        return true
+                }
+        }
+
+        return false
+}
+
+func runeCompare(v1 []rune, v2 []rune) bool {
+        if len(v1) != len(v2) {
+                return false
+        }
+
+        for i := 0; i < len(v1); i++ {
+                if v1[i] != v2[i] {
+                        return false
+                }
+        }
+
+        return true
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/newline_token.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/newline_token.go
new file mode 100644
index 0000000..e52ac39
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/newline_token.go
@@ -0,0 +1,30 @@
+package ini
+
+func isNewline(b []rune) bool {
+        if len(b) == 0 {
+                return false
+        }
+
+        if b[0] == '\n' {
+                return true
+        }
+
+        if len(b) < 2 {
+                return false
+        }
+
+        return b[0] == '\r' && b[1] == '\n'
+}
+
+func newNewlineToken(b []rune) (Token, int, error) {
+        i := 1
+        if b[0] == '\r' && isNewline(b[1:]) {
+                i++
+        }
+
+        if !isNewline([]rune(b[:i])) {
+                return emptyToken, 0, NewParseError("invalid new line token")
+        }
+
+        return newToken(TokenNL, b[:i], NoneType), i, nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/number_helper.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/number_helper.go
new file mode 100644
index 0000000..a45c0bc
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/number_helper.go
@@ -0,0 +1,152 @@
+package ini
+
+import (
+        "bytes"
+        "fmt"
+        "strconv"
+)
+
+const (
+        none = numberFormat(iota)
+        binary
+        octal
+        decimal
+        hex
+        exponent
+)
+
+type numberFormat int
+
+// numberHelper is used to dictate what format a number is in
+// and what to do for negative values. Since -1e-4 is a valid
+// number, we cannot just simply check for duplicate negatives.
+type numberHelper struct {
+        numberFormat numberFormat
+
+        negative         bool
+        negativeExponent bool
+}
+
+func (b numberHelper) Exists() bool {
+        return b.numberFormat != none
+}
+
+func (b numberHelper) IsNegative() bool {
+        return b.negative || b.negativeExponent
+}
+
+func (b *numberHelper) Determine(c rune) error {
+        if b.Exists() {
+                return NewParseError(fmt.Sprintf("multiple number formats: 0%v", string(c)))
+        }
+
+        switch c {
+        case 'b':
+                b.numberFormat = binary
+        case 'o':
+                b.numberFormat = octal
+        case 'x':
+                b.numberFormat = hex
+        case 'e', 'E':
+                b.numberFormat = exponent
+        case '-':
+                if b.numberFormat != exponent {
+                        b.negative = true
+                } else {
+                        b.negativeExponent = true
+                }
+        case '.':
+                b.numberFormat = decimal
+        default:
+                return NewParseError(fmt.Sprintf("invalid number character: %v", string(c)))
+        }
+
+        return nil
+}
+
+func (b numberHelper) CorrectByte(c rune) bool {
+        switch {
+        case b.numberFormat == binary:
+                if !isBinaryByte(c) {
+                        return false
+                }
+        case b.numberFormat == octal:
+                if !isOctalByte(c) {
+                        return false
+                }
+        case b.numberFormat == hex:
+                if !isHexByte(c) {
+                        return false
+                }
+        case b.numberFormat == decimal:
+                if !isDigit(c) {
+                        return false
+                }
+        case b.numberFormat == exponent:
+                if !isDigit(c) {
+                        return false
+                }
+        case b.negativeExponent:
+                if !isDigit(c) {
+                        return false
+                }
+        case b.negative:
+                if !isDigit(c) {
+                        return false
+                }
+        default:
+                if !isDigit(c) {
+                        return false
+                }
+        }
+
+        return true
+}
+
+func (b numberHelper) Base() int {
+        switch b.numberFormat {
+        case binary:
+                return 2
+        case octal:
+                return 8
+        case hex:
+                return 16
+        default:
+                return 10
+        }
+}
+
+func (b numberHelper) String() string {
+        buf := bytes.Buffer{}
+        i := 0
+
+        switch b.numberFormat {
+        case binary:
+                i++
+                buf.WriteString(strconv.Itoa(i) + ": binary format\n")
+        case octal:
+                i++
+                buf.WriteString(strconv.Itoa(i) + ": octal format\n")
+        case hex:
+                i++
+                buf.WriteString(strconv.Itoa(i) + ": hex format\n")
+        case exponent:
+                i++
+                buf.WriteString(strconv.Itoa(i) + ": exponent format\n")
+        default:
+                i++
+                buf.WriteString(strconv.Itoa(i) + ": integer format\n")
+        }
+
+        if b.negative {
+                i++
+                buf.WriteString(strconv.Itoa(i) + ": negative format\n")
+        }
+
+        if b.negativeExponent {
+                i++
+                buf.WriteString(strconv.Itoa(i) + ": negative exponent format\n")
+        }
+
+        return buf.String()
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/op_tokens.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/op_tokens.go
new file mode 100644
index 0000000..8a84c7c
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/op_tokens.go
@@ -0,0 +1,39 @@
+package ini
+
+import (
+        "fmt"
+)
+
+var (
+        equalOp      = []rune("=")
+        equalColonOp = []rune(":")
+)
+
+func isOp(b []rune) bool {
+        if len(b) == 0 {
+                return false
+        }
+
+        switch b[0] {
+        case '=':
+                return true
+        case ':':
+                return true
+        default:
+                return false
+        }
+}
+
+func newOpToken(b []rune) (Token, int, error) {
+        tok := Token{}
+
+        switch b[0] {
+        case '=':
+                tok = newToken(TokenOp, equalOp, NoneType)
+        case ':':
+                tok = newToken(TokenOp, equalColonOp, NoneType)
+        default:
+                return tok, 0, NewParseError(fmt.Sprintf("unexpected op type, %v", b[0]))
+        }
+        return tok, 1, nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_error.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_error.go
new file mode 100644
index 0000000..4572870
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_error.go
@@ -0,0 +1,43 @@
+package ini
+
+import "fmt"
+
+const (
+        // ErrCodeParseError is returned when a parsing error
+        // has occurred.
+        ErrCodeParseError = "INIParseError"
+)
+
+// ParseError is an error which is returned during any part of
+// the parsing process.
+type ParseError struct {
+        msg string
+}
+
+// NewParseError will return a new ParseError where message
+// is the description of the error.
+func NewParseError(message string) *ParseError {
+        return &ParseError{
+                msg: message,
+        }
+}
+
+// Code will return the ErrCodeParseError
+func (err *ParseError) Code() string {
+        return ErrCodeParseError
+}
+
+// Message returns the error's message
+func (err *ParseError) Message() string {
+        return err.msg
+}
+
+// OrigError return nothing since there will never be any
+// original error.
+func (err *ParseError) OrigError() error {
+        return nil
+}
+
+func (err *ParseError) Error() string {
+        return fmt.Sprintf("%s: %s", err.Code(), err.Message())
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_stack.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_stack.go
new file mode 100644
index 0000000..7f01cf7
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_stack.go
@@ -0,0 +1,60 @@
+package ini
+
+import (
+        "bytes"
+        "fmt"
+)
+
+// ParseStack is a stack that contains a container, the stack portion,
+// and the list which is the list of ASTs that have been successfully
+// parsed.
+type ParseStack struct {
+        top       int
+        container []AST
+        list      []AST
+        index     int
+}
+
+func newParseStack(sizeContainer, sizeList int) ParseStack {
+        return ParseStack{
+                container: make([]AST, sizeContainer),
+                list:      make([]AST, sizeList),
+        }
+}
+
+// Pop will return and truncate the last container element.
+func (s *ParseStack) Pop() AST {
+        s.top--
+        return s.container[s.top]
+}
+
+// Push will add the new AST to the container
+func (s *ParseStack) Push(ast AST) {
+        s.container[s.top] = ast
+        s.top++
+}
+
+// MarkComplete will append the AST to the list of completed statements
+func (s *ParseStack) MarkComplete(ast AST) {
+        s.list[s.index] = ast
+        s.index++
+}
+
+// List will return the completed statements
+func (s ParseStack) List() []AST {
+        return s.list[:s.index]
+}
+
+// Len will return the length of the container
+func (s *ParseStack) Len() int {
+        return s.top
+}
+
+func (s ParseStack) String() string {
+        buf := bytes.Buffer{}
+        for i, node := range s.list {
+                buf.WriteString(fmt.Sprintf("%d: %v\n", i+1, node))
+        }
+
+        return buf.String()
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/sep_tokens.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/sep_tokens.go
new file mode 100644
index 0000000..f82095b
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/sep_tokens.go
@@ -0,0 +1,41 @@
+package ini
+
+import (
+        "fmt"
+)
+
+var (
+        emptyRunes = []rune{}
+)
+
+func isSep(b []rune) bool {
+        if len(b) == 0 {
+                return false
+        }
+
+        switch b[0] {
+        case '[', ']':
+                return true
+        default:
+                return false
+        }
+}
+
+var (
+        openBrace  = []rune("[")
+        closeBrace = []rune("]")
+)
+
+func newSepToken(b []rune) (Token, int, error) {
+        tok := Token{}
+
+        switch b[0] {
+        case '[':
+                tok = newToken(TokenSep, openBrace, NoneType)
+        case ']':
+                tok = newToken(TokenSep, closeBrace, NoneType)
+        default:
+                return tok, 0, NewParseError(fmt.Sprintf("unexpected sep type, %v", b[0]))
+        }
+        return tok, 1, nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/skipper.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/skipper.go
new file mode 100644
index 0000000..6bb6964
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/skipper.go
@@ -0,0 +1,45 @@
+package ini
+
+// skipper is used to skip certain blocks of an ini file.
+// Currently skipper is used to skip nested blocks of ini
+// files. See example below
+//
+//      [ foo ]
+//      nested = ; this section will be skipped
+//              a=b
+//              c=d
+//      bar=baz ; this will be included
+type skipper struct {
+        shouldSkip bool
+        TokenSet   bool
+        prevTok    Token
+}
+
+func newSkipper() skipper {
+        return skipper{
+                prevTok: emptyToken,
+        }
+}
+
+func (s *skipper) ShouldSkip(tok Token) bool {
+        if s.shouldSkip &&
+                s.prevTok.Type() == TokenNL &&
+                tok.Type() != TokenWS {
+
+                s.Continue()
+                return false
+        }
+        s.prevTok = tok
+
+        return s.shouldSkip
+}
+
+func (s *skipper) Skip() {
+        s.shouldSkip = true
+        s.prevTok = emptyToken
+}
+
+func (s *skipper) Continue() {
+        s.shouldSkip = false
+        s.prevTok = emptyToken
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/statement.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/statement.go
new file mode 100644
index 0000000..18f3fe8
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/statement.go
@@ -0,0 +1,35 @@
+package ini
+
+// Statement is an empty AST mostly used for transitioning states.
+func newStatement() AST {
+        return newAST(ASTKindStatement, AST{})
+}
+
+// SectionStatement represents a section AST
+func newSectionStatement(tok Token) AST {
+        return newASTWithRootToken(ASTKindSectionStatement, tok)
+}
+
+// ExprStatement represents a completed expression AST
+func newExprStatement(ast AST) AST {
+        return newAST(ASTKindExprStatement, ast)
+}
+
+// CommentStatement represents a comment in the ini definition.
+//
+//      grammar:
+//      comment -> #comment' | ;comment'
+//      comment' -> epsilon | value
+func newCommentStatement(tok Token) AST {
+        return newAST(ASTKindCommentStatement, newExpression(tok))
+}
+
+// CompletedSectionStatement represents a completed section
+func newCompletedSectionStatement(ast AST) AST {
+        return newAST(ASTKindCompletedSectionStatement, ast)
+}
+
+// SkipStatement is used to skip whole statements
+func newSkipStatement(ast AST) AST {
+        return newAST(ASTKindSkipStatement, ast)
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/value_util.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/value_util.go
new file mode 100644
index 0000000..305999d
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/value_util.go
@@ -0,0 +1,284 @@
+package ini
+
+import (
+        "fmt"
+)
+
+// getStringValue will return a quoted string and the amount
+// of bytes read
+//
+// an error will be returned if the string is not properly formatted
+func getStringValue(b []rune) (int, error) {
+        if b[0] != '"' {
+                return 0, NewParseError("strings must start with '\"'")
+        }
+
+        endQuote := false
+        i := 1
+
+        for ; i < len(b) && !endQuote; i++ {
+                if escaped := isEscaped(b[:i], b[i]); b[i] == '"' && !escaped {
+                        endQuote = true
+                        break
+                } else if escaped {
+                        /*c, err := getEscapedByte(b[i])
+                        if err != nil {
+                                return 0, err
+                        }
+
+                        b[i-1] = c
+                        b = append(b[:i], b[i+1:]...)
+                        i--*/
+
+                        continue
+                }
+        }
+
+        if !endQuote {
+                return 0, NewParseError("missing '\"' in string value")
+        }
+
+        return i + 1, nil
+}
+
+// getBoolValue will return a boolean and the amount
+// of bytes read
+//
+// an error will be returned if the boolean is not of a correct
+// value
+func getBoolValue(b []rune) (int, error) {
+        if len(b) < 4 {
+                return 0, NewParseError("invalid boolean value")
+        }
+
+        n := 0
+        for _, lv := range literalValues {
+                if len(lv) > len(b) {
+                        continue
+                }
+
+                if isLitValue(lv, b) {
+                        n = len(lv)
+                }
+        }
+
+        if n == 0 {
+                return 0, NewParseError("invalid boolean value")
+        }
+
+        return n, nil
+}
+
+// getNumericalValue will return a numerical string, the amount
+// of bytes read, and the base of the number
+//
+// an error will be returned if the number is not of a correct
+// value
+func getNumericalValue(b []rune) (int, int, error) {
+        if !isDigit(b[0]) {
+                return 0, 0, NewParseError("invalid digit value")
+        }
+
+        i := 0
+        helper := numberHelper{}
+
+loop:
+        for negativeIndex := 0; i < len(b); i++ {
+                negativeIndex++
+
+                if !isDigit(b[i]) {
+                        switch b[i] {
+                        case '-':
+                                if helper.IsNegative() || negativeIndex != 1 {
+                                        return 0, 0, NewParseError("parse error '-'")
+                                }
+
+                                n := getNegativeNumber(b[i:])
+                                i += (n - 1)
+                                helper.Determine(b[i])
+                                continue
+                        case '.':
+                                if err := helper.Determine(b[i]); err != nil {
+                                        return 0, 0, err
+                                }
+                        case 'e', 'E':
+                                if err := helper.Determine(b[i]); err != nil {
+                                        return 0, 0, err
+                                }
+
+                                negativeIndex = 0
+                        case 'b':
+                                if helper.numberFormat == hex {
+                                        break
+                                }
+                                fallthrough
+                        case 'o', 'x':
+                                if i == 0 && b[i] != '0' {
+                                        return 0, 0, NewParseError("incorrect base format, expected leading '0'")
+                                }
+
+                                if i != 1 {
+                                        return 0, 0, NewParseError(fmt.Sprintf("incorrect base format found %s at %d index", string(b[i]), i))
+                                }
+
+                                if err := helper.Determine(b[i]); err != nil {
+                                        return 0, 0, err
+                                }
+                        default:
+                                if isWhitespace(b[i]) {
+                                        break loop
+                                }
+
+                                if isNewline(b[i:]) {
+                                        break loop
+                                }
+
+                                if !(helper.numberFormat == hex && isHexByte(b[i])) {
+                                        if i+2 < len(b) && !isNewline(b[i:i+2]) {
+                                                return 0, 0, NewParseError("invalid numerical character")
+                                        } else if !isNewline([]rune{b[i]}) {
+                                                return 0, 0, NewParseError("invalid numerical character")
+                                        }
+
+                                        break loop
+                                }
+                        }
+                }
+        }
+
+        return helper.Base(), i, nil
+}
+
+// isDigit will return whether or not something is an integer
+func isDigit(b rune) bool {
+        return b >= '0' && b <= '9'
+}
+
+func hasExponent(v []rune) bool {
+        return contains(v, 'e') || contains(v, 'E')
+}
+
+func isBinaryByte(b rune) bool {
+        switch b {
+        case '0', '1':
+                return true
+        default:
+                return false
+        }
+}
+
+func isOctalByte(b rune) bool {
+        switch b {
+        case '0', '1', '2', '3', '4', '5', '6', '7':
+                return true
+        default:
+                return false
+        }
+}
+
+func isHexByte(b rune) bool {
+        if isDigit(b) {
+                return true
+        }
+        return (b >= 'A' && b <= 'F') ||
+                (b >= 'a' && b <= 'f')
+}
+
+func getValue(b []rune) (int, error) {
+        i := 0
+
+        for i < len(b) {
+                if isNewline(b[i:]) {
+                        break
+                }
+
+                if isOp(b[i:]) {
+                        break
+                }
+
+                valid, n, err := isValid(b[i:])
+                if err != nil {
+                        return 0, err
+                }
+
+                if !valid {
+                        break
+                }
+
+                i += n
+        }
+
+        return i, nil
+}
+
+// getNegativeNumber will return a negative number from a
+// byte slice. This will iterate through all characters until
+// a non-digit has been found.
+func getNegativeNumber(b []rune) int {
+        if b[0] != '-' {
+                return 0
+        }
+
+        i := 1
+        for ; i < len(b); i++ {
+                if !isDigit(b[i]) {
+                        return i
+                }
+        }
+
+        return i
+}
+
+// isEscaped will return whether or not the character is an escaped
+// character.
+func isEscaped(value []rune, b rune) bool {
+        if len(value) == 0 {
+                return false
+        }
+
+        switch b {
+        case '\'': // single quote
+        case '"': // quote
+        case 'n': // newline
+        case 't': // tab
+        case '\\': // backslash
+        default:
+                return false
+        }
+
+        return value[len(value)-1] == '\\'
+}
+
+func getEscapedByte(b rune) (rune, error) {
+        switch b {
+        case '\'': // single quote
+                return '\'', nil
+        case '"': // quote
+                return '"', nil
+        case 'n': // newline
+                return '\n', nil
+        case 't': // table
+                return '\t', nil
+        case '\\': // backslash
+                return '\\', nil
+        default:
+                return b, NewParseError(fmt.Sprintf("invalid escaped character %c", b))
+        }
+}
+
+func removeEscapedCharacters(b []rune) []rune {
+        for i := 0; i < len(b); i++ {
+                if isEscaped(b[:i], b[i]) {
+                        c, err := getEscapedByte(b[i])
+                        if err != nil {
+                                return b
+                        }
+
+                        b[i-1] = c
+                        b = append(b[:i], b[i+1:]...)
+                        i--
+                }
+        }
+
+        return b
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go
new file mode 100644
index 0000000..94841c3
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go
@@ -0,0 +1,166 @@
+package ini
+
+import (
+        "fmt"
+        "sort"
+)
+
+// Visitor is an interface used by walkers that will
+// traverse an array of ASTs.
+type Visitor interface {
+        VisitExpr(AST) error
+        VisitStatement(AST) error
+}
+
+// DefaultVisitor is used to visit statements and expressions
+// and ensure that they are both of the correct format.
+// In addition, upon visiting this will build sections and populate
+// the Sections field which can be used to retrieve profile
+// configuration.
+type DefaultVisitor struct {
+        scope    string
+        Sections Sections
+}
+
+// NewDefaultVisitor return a DefaultVisitor
+func NewDefaultVisitor() *DefaultVisitor {
+        return &DefaultVisitor{
+                Sections: Sections{
+                        container: map[string]Section{},
+                },
+        }
+}
+
+// VisitExpr visits expressions...
+func (v *DefaultVisitor) VisitExpr(expr AST) error {
+        t := v.Sections.container[v.scope]
+        if t.values == nil {
+                t.values = values{}
+        }
+
+        switch expr.Kind {
+        case ASTKindExprStatement:
+                opExpr := expr.GetRoot()
+                switch opExpr.Kind {
+                case ASTKindEqualExpr:
+                        children := opExpr.GetChildren()
+                        if len(children) <= 1 {
+                                return NewParseError("unexpected token type")
+                        }
+
+                        rhs := children[1]
+
+                        if rhs.Root.Type() != TokenLit {
+                                return NewParseError("unexpected token type")
+                        }
+
+                        key := EqualExprKey(opExpr)
+                        v, err := newValue(rhs.Root.ValueType, rhs.Root.base, rhs.Root.Raw())
+                        if err != nil {
+                                return err
+                        }
+
+                        t.values[key] = v
+                default:
+                        return NewParseError(fmt.Sprintf("unsupported expression %v", expr))
+                }
+        default:
+                return NewParseError(fmt.Sprintf("unsupported expression %v", expr))
+        }
+
+        v.Sections.container[v.scope] = t
+        return nil
+}
+
+// VisitStatement visits statements...
+func (v *DefaultVisitor) VisitStatement(stmt AST) error {
+        switch stmt.Kind {
+        case ASTKindCompletedSectionStatement:
+                child := stmt.GetRoot()
+                if child.Kind != ASTKindSectionStatement {
+                        return NewParseError(fmt.Sprintf("unsupported child statement: %T", child))
+                }
+
+                name := string(child.Root.Raw())
+                v.Sections.container[name] = Section{}
+                v.scope = name
+        default:
+                return NewParseError(fmt.Sprintf("unsupported statement: %s", stmt.Kind))
+        }
+
+        return nil
+}
+
+// Sections is a map of Section structures that represent
+// a configuration.
+type Sections struct {
+        container map[string]Section
+}
+
+// GetSection will return section p. If section p does not exist,
+// false will be returned in the second parameter.
+func (t Sections) GetSection(p string) (Section, bool) {
+        v, ok := t.container[p]
+        return v, ok
+}
+
+// values represents a map of union values.
+type values map[string]Value
+
+// List will return a list of all sections that were successfully
+// parsed.
+func (t Sections) List() []string {
+        keys := make([]string, len(t.container))
+        i := 0
+        for k := range t.container {
+                keys[i] = k
+                i++
+        }
+
+        sort.Strings(keys)
+        return keys
+}
+
+// Section contains a name and values. This represent
+// a sectioned entry in a configuration file.
+type Section struct {
+        Name   string
+        values values
+}
+
+// Has will return whether or not an entry exists in a given section
+func (t Section) Has(k string) bool {
+        _, ok := t.values[k]
+        return ok
+}
+
+// ValueType will returned what type the union is set to. If
+// k was not found, the NoneType will be returned.
+func (t Section) ValueType(k string) (ValueType, bool) {
+        v, ok := t.values[k]
+        return v.Type, ok
+}
+
+// Bool returns a bool value at k
+func (t Section) Bool(k string) bool {
+        return t.values[k].BoolValue()
+}
+
+// Int returns an integer value at k
+func (t Section) Int(k string) int64 {
+        return t.values[k].IntValue()
+}
+
+// Float64 returns a float value at k
+func (t Section) Float64(k string) float64 {
+        return t.values[k].FloatValue()
+}
+
+// String returns the string value at k
+func (t Section) String(k string) string {
+        _, ok := t.values[k]
+        if !ok {
+                return ""
+        }
+        return t.values[k].StringValue()
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/walker.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/walker.go
new file mode 100644
index 0000000..99915f7
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/walker.go
@@ -0,0 +1,25 @@
+package ini
+
+// Walk will traverse the AST using the v, the Visitor.
+func Walk(tree []AST, v Visitor) error {
+        for _, node := range tree {
+                switch node.Kind {
+                case ASTKindExpr,
+                        ASTKindExprStatement:
+
+                        if err := v.VisitExpr(node); err != nil {
+                                return err
+                        }
+                case ASTKindStatement,
+                        ASTKindCompletedSectionStatement,
+                        ASTKindNestedSectionStatement,
+                        ASTKindCompletedNestedSectionStatement:
+
+                        if err := v.VisitStatement(node); err != nil {
+                                return err
+                        }
+                }
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/ini/ws_token.go b/vendor/github.com/aws/aws-sdk-go/internal/ini/ws_token.go
new file mode 100644
index 0000000..7ffb4ae
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/ini/ws_token.go
@@ -0,0 +1,24 @@
+package ini
+
+import (
+        "unicode"
+)
+
+// isWhitespace will return whether or not the character is
+// a whitespace character.
+//
+// Whitespace is defined as a space or tab.
+func isWhitespace(c rune) bool {
+        return unicode.IsSpace(c) && c != '\n' && c != '\r'
+}
+
+func newWSToken(b []rune) (Token, int, error) {
+        i := 0
+        for ; i < len(b); i++ {
+                if !isWhitespace(b[i]) {
+                        break
+                }
+        }
+
+        return newToken(TokenWS, b[:i], NoneType), i, nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/s3err/error.go b/vendor/github.com/aws/aws-sdk-go/internal/s3err/error.go
new file mode 100644
index 0000000..0b9b0df
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/s3err/error.go
@@ -0,0 +1,57 @@
+package s3err
+
+import (
+        "fmt"
+
+        "github.com/aws/aws-sdk-go/aws/awserr"
+        "github.com/aws/aws-sdk-go/aws/request"
+)
+
+// RequestFailure provides additional S3 specific metadata for the request
+// failure.
+type RequestFailure struct {
+        awserr.RequestFailure
+
+        hostID string
+}
+
+// NewRequestFailure returns a request failure error decordated with S3
+// specific metadata.
+func NewRequestFailure(err awserr.RequestFailure, hostID string) *RequestFailure {
+        return &RequestFailure{RequestFailure: err, hostID: hostID}
+}
+
+func (r RequestFailure) Error() string {
+        extra := fmt.Sprintf("status code: %d, request id: %s, host id: %s",
+                r.StatusCode(), r.RequestID(), r.hostID)
+        return awserr.SprintError(r.Code(), r.Message(), extra, r.OrigErr())
+}
+func (r RequestFailure) String() string {
+        return r.Error()
+}
+
+// HostID returns the HostID request response value.
+func (r RequestFailure) HostID() string {
+        return r.hostID
+}
+
+// RequestFailureWrapperHandler returns a handler to rap an
+// awserr.RequestFailure with the  S3 request ID 2 from the response.
+func RequestFailureWrapperHandler() request.NamedHandler {
+        return request.NamedHandler{
+                Name: "awssdk.s3.errorHandler",
+                Fn: func(req *request.Request) {
+                        reqErr, ok := req.Error.(awserr.RequestFailure)
+                        if !ok || reqErr == nil {
+                                return
+                        }
+
+                        hostID := req.HTTPResponse.Header.Get("X-Amz-Id-2")
+                        if req.Error == nil {
+                                return
+                        }
+
+                        req.Error = NewRequestFailure(reqErr, hostID)
+                },
+        }
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/ecs_container.go b/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/ecs_container.go
new file mode 100644
index 0000000..7da8a49
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/ecs_container.go
@@ -0,0 +1,12 @@
+package shareddefaults
+
+const (
+        // ECSCredsProviderEnvVar is an environmental variable key used to
+        // determine which path needs to be hit.
+        ECSCredsProviderEnvVar = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
+)
+
+// ECSContainerCredentialsURI is the endpoint to retrieve container
+// credentials. This can be overridden to test to ensure the credential process
+// is behaving correctly.
+var ECSContainerCredentialsURI = "http://169.254.170.2"
diff --git a/vendor/github.com/aws/aws-sdk-go/private/protocol/host.go b/vendor/github.com/aws/aws-sdk-go/private/protocol/host.go
new file mode 100644
index 0000000..d7d42db
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/private/protocol/host.go
@@ -0,0 +1,68 @@
+package protocol
+
+import (
+        "strings"
+
+        "github.com/aws/aws-sdk-go/aws/request"
+)
+
+// ValidateEndpointHostHandler is a request handler that will validate the
+// request endpoint's hosts is a valid RFC 3986 host.
+var ValidateEndpointHostHandler = request.NamedHandler{
+        Name: "awssdk.protocol.ValidateEndpointHostHandler",
+        Fn: func(r *request.Request) {
+                err := ValidateEndpointHost(r.Operation.Name, r.HTTPRequest.URL.Host)
+                if err != nil {
+                        r.Error = err
+                }
+        },
+}
+
+// ValidateEndpointHost validates that the host string passed in is a valid RFC
+// 3986 host. Returns error if the host is not valid.
+func ValidateEndpointHost(opName, host string) error {
+        paramErrs := request.ErrInvalidParams{Context: opName}
+        labels := strings.Split(host, ".")
+
+        for i, label := range labels {
+                if i == len(labels)-1 && len(label) == 0 {
+                        // Allow trailing dot for FQDN hosts.
+                        continue
+                }
+
+                if !ValidHostLabel(label) {
+                        paramErrs.Add(request.NewErrParamFormat(
+                                "endpoint host label", "[a-zA-Z0-9-]{1,63}", label))
+                }
+        }
+
+        if len(host) > 255 {
+                paramErrs.Add(request.NewErrParamMaxLen(
+                        "endpoint host", 255, host,
+                ))
+        }
+
+        if paramErrs.Len() > 0 {
+                return paramErrs
+        }
+        return nil
+}
+
+// ValidHostLabel returns if the label is a valid RFC 3986 host label.
+func ValidHostLabel(label string) bool {
+        if l := len(label); l == 0 || l > 63 {
+                return false
+        }
+        for _, r := range label {
+                switch {
+                case r >= '0' && r <= '9':
+                case r >= 'A' && r <= 'Z':
+                case r >= 'a' && r <= 'z':
+                case r == '-':
+                default:
+                        return false
+                }
+        }
+
+        return true
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/private/protocol/host_prefix.go b/vendor/github.com/aws/aws-sdk-go/private/protocol/host_prefix.go
new file mode 100644
index 0000000..915b0fc
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go/private/protocol/host_prefix.go
@@ -0,0 +1,54 @@
+package protocol
+
+import (
+        "strings"
+
+        "github.com/aws/aws-sdk-go/aws"
+        "github.com/aws/aws-sdk-go/aws/request"
+)
+
+// HostPrefixHandlerName is the handler name for the host prefix request
+// handler.
+const HostPrefixHandlerName = "awssdk.endpoint.HostPrefixHandler"
+
+// NewHostPrefixHandler constructs a build handler
+func NewHostPrefixHandler(prefix string, labelsFn func() map[string]string) request.NamedHandler {
+        builder := HostPrefixBuilder{
+                Prefix:   prefix,
+                LabelsFn: labelsFn,
+        }
+
+        return request.NamedHandler{
+                Name: HostPrefixHandlerName,
+                Fn:   builder.Build,
+        }
+}
+
+// HostPrefixBuilder provides the request handler to expand and prepend
+// the host prefix into the operation's request endpoint host.
+type HostPrefixBuilder struct {
+        Prefix   string
+        LabelsFn func() map[string]string
+}
+
+// Build updates the passed in Request with the HostPrefix template expanded.
+func (h HostPrefixBuilder) Build(r *request.Request) {
+        if aws.BoolValue(r.Config.DisableEndpointHostPrefix) {
+                return
+        }
+
+        var labels map[string]string
+        if h.LabelsFn != nil {
+                labels = h.LabelsFn()
+        }
+
+        prefix := h.Prefix
+        for name, value := range labels {
+                prefix = strings.Replace(prefix, "{"+name+"}", value, -1)
+        }
+
+        r.HTTPRequest.URL.Host = prefix + r.HTTPRequest.URL.Host
+        if len(r.HTTPRequest.Host) > 0 {
+                r.HTTPRequest.Host = prefix + r.HTTPRequest.Host
+        }
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/private/protocol/query/unmarshal.go b/vendor/github.com/aws/aws-sdk-go/private/protocol/query/unmarshal.go
index e0f4d5a..3495c73 100644
--- a/vendor/github.com/aws/aws-sdk-go/private/protocol/query/unmarshal.go
+++ b/vendor/github.com/aws/aws-sdk-go/private/protocol/query/unmarshal.go
@@ -23,7 +23,11 @@ func Unmarshal(r *request.Request) {
                 decoder := xml.NewDecoder(r.HTTPResponse.Body)
                 err := xmlutil.UnmarshalXML(r.Data, decoder, r.Operation.Name+"Result")
                 if err != nil {
-                        r.Error = awserr.New("SerializationError", "failed decoding Query response", err)
+                        r.Error = awserr.NewRequestFailure(
+                                awserr.New("SerializationError", "failed decoding Query response", err),
+                                r.HTTPResponse.StatusCode,
+                                r.RequestID,
+                        )
                         return
                 }
         }
diff --git a/vendor/github.com/aws/aws-sdk-go/private/protocol/query/unmarshal_error.go b/vendor/github.com/aws/aws-sdk-go/private/protocol/query/unmarshal_error.go
index f214296..46d354e 100644
--- a/vendor/github.com/aws/aws-sdk-go/private/protocol/query/unmarshal_error.go
+++ b/vendor/github.com/aws/aws-sdk-go/private/protocol/query/unmarshal_error.go
@@ -28,7 +28,11 @@ func UnmarshalError(r *request.Request) {
 
         bodyBytes, err := ioutil.ReadAll(r.HTTPResponse.Body)
         if err != nil {
-                r.Error = awserr.New("SerializationError", "failed to read from query HTTP response body", err)
+                r.Error = awserr.NewRequestFailure(
+                        awserr.New("SerializationError", "failed to read from query HTTP response body", err),
+                        r.HTTPResponse.StatusCode,
+                        r.RequestID,
+                )
                 return
         }
 
@@ -61,6 +65,10 @@ func UnmarshalError(r *request.Request) {
         }
 
         // Failed to retrieve any error message from the response body
-        r.Error = awserr.New("SerializationError",
-                "failed to decode query XML error response", decodeErr)
+        r.Error = awserr.NewRequestFailure(
+                awserr.New("SerializationError",
+                        "failed to decode query XML error response", decodeErr),
+                r.HTTPResponse.StatusCode,
+                r.RequestID,
+        )
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/private/protocol/rest/build.go b/vendor/github.com/aws/aws-sdk-go/private/protocol/rest/build.go
index b34f525..b80f84f 100644
--- a/vendor/github.com/aws/aws-sdk-go/private/protocol/rest/build.go
+++ b/vendor/github.com/aws/aws-sdk-go/private/protocol/rest/build.go
@@ -155,6 +155,9 @@ func buildHeader(header *http.Header, v reflect.Value, name string, tag reflect.
                 return awserr.New("SerializationError", "failed to encode REST request", err)
         }
 
+        name = strings.TrimSpace(name)
+        str = strings.TrimSpace(str)
+
         header.Add(name, str)
 
         return nil
@@ -170,8 +173,10 @@ func buildHeaderMap(header *http.Header, v reflect.Value, tag reflect.StructTag)
                         return awserr.New("SerializationError", "failed to encode REST request", err)
 
                 }
+                keyStr := strings.TrimSpace(key.String())
+                str = strings.TrimSpace(str)
 
-                header.Add(prefix+key.String(), str)
+                header.Add(prefix+keyStr, str)
         }
         return nil
 }
diff --git a/vendor/github.com/aws/aws-sdk-go/private/protocol/restxml/restxml.go b/vendor/github.com/aws/aws-sdk-go/private/protocol/restxml/restxml.go
index 7bdf4c8..b0f4e24 100644
--- a/vendor/github.com/aws/aws-sdk-go/private/protocol/restxml/restxml.go
+++ b/vendor/github.com/aws/aws-sdk-go/private/protocol/restxml/restxml.go
@@ -36,7 +36,11 @@ func Build(r *request.Request) {
                 var buf bytes.Buffer
                 err := xmlutil.BuildXML(r.Params, xml.NewEncoder(&buf))
                 if err != nil {
-                        r.Error = awserr.New("SerializationError", "failed to encode rest XML request", err)
+                        r.Error = awserr.NewRequestFailure(
+                                awserr.New("SerializationError", "failed to encode rest XML request", err),
+                                r.HTTPResponse.StatusCode,
+                                r.RequestID,
+                        )
                         return
                 }
                 r.SetBufferBody(buf.Bytes())
@@ -50,7 +54,11 @@ func Unmarshal(r *request.Request) {
                 decoder := xml.NewDecoder(r.HTTPResponse.Body)
                 err := xmlutil.UnmarshalXML(r.Data, decoder, "")
                 if err != nil {
-                        r.Error = awserr.New("SerializationError", "failed to decode REST XML response", err)
+                        r.Error = awserr.NewRequestFailure(
+                                awserr.New("SerializationError", "failed to decode REST XML response", err),
+                                r.HTTPResponse.StatusCode,
+                                r.RequestID,
+                        )
                         return
                 }
         } else {
diff --git a/vendor/github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil/build.go b/vendor/github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil/build.go
index 07764c8..cf981fe 100644
--- a/vendor/github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil/build.go
+++ b/vendor/github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil/build.go
@@ -87,15 +87,13 @@ func (b *xmlBuilder) buildValue(value reflect.Value, current *XMLNode, tag refle
         }
 }
 
-// buildStruct adds a struct and its fields to the current XMLNode. All fields any any nested
+// buildStruct adds a struct and its fields to the current XMLNode. All fields and any nested
 // types are converted to XMLNodes also.
 func (b *xmlBuilder) buildStruct(value reflect.Value, current *XMLNode, tag reflect.StructTag) error {
         if !value.IsValid() {
                 return nil
         }
 
-        fieldAdded := false
-
         // unwrap payloads
         if payload := tag.Get("payload"); payload != "" {
                 field, _ := value.Type().FieldByName(payload)
@@ -123,6 +121,8 @@ func (b *xmlBuilder) buildStruct(value reflect.Value, current *XMLNode, tag refl
                 child.Attr = append(child.Attr, ns)
         }
 
+        var payloadFields, nonPayloadFields int
+
         t := value.Type()
         for i := 0; i < value.NumField(); i++ {
                 member := elemOf(value.Field(i))
@@ -137,8 +137,10 @@ func (b *xmlBuilder) buildStruct(value reflect.Value, current *XMLNode, tag refl
 
                 mTag := field.Tag
                 if mTag.Get("location") != "" { // skip non-body members
+                        nonPayloadFields++
                         continue
                 }
+                payloadFields++
 
                 if protocol.CanSetIdempotencyToken(value.Field(i), field) {
                         token := protocol.GetIdempotencyToken()
@@ -153,11 +155,11 @@ func (b *xmlBuilder) buildStruct(value reflect.Value, current *XMLNode, tag refl
                 if err := b.buildValue(member, child, mTag); err != nil {
                         return err
                 }
-
-                fieldAdded = true
         }
 
-        if fieldAdded { // only append this child if we have one ore more valid members
+        // Only case where the child shape is not added is if the shape only contains
+        // non-payload fields, e.g headers/query.
+        if !(payloadFields == 0 && nonPayloadFields > 0) {
                 current.AddChild(child)
         }
 
diff --git a/vendor/github.com/aws/aws-sdk-go/service/s3/api.go b/vendor/github.com/aws/aws-sdk-go/service/s3/api.go
index 0e999ca..83a42d2 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/s3/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/s3/api.go
@@ -27,7 +27,7 @@ const opAbortMultipartUpload = "AbortMultipartUpload"
 // AbortMultipartUploadRequest generates a "aws/request.Request" representing the
 // client's request for the AbortMultipartUpload operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -110,7 +110,7 @@ const opCompleteMultipartUpload = "CompleteMultipartUpload"
 // CompleteMultipartUploadRequest generates a "aws/request.Request" representing the
 // client's request for the CompleteMultipartUpload operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -184,7 +184,7 @@ const opCopyObject = "CopyObject"
 // CopyObjectRequest generates a "aws/request.Request" representing the
 // client's request for the CopyObject operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -264,7 +264,7 @@ const opCreateBucket = "CreateBucket"
 // CreateBucketRequest generates a "aws/request.Request" representing the
 // client's request for the CreateBucket operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -346,7 +346,7 @@ const opCreateMultipartUpload = "CreateMultipartUpload"
 // CreateMultipartUploadRequest generates a "aws/request.Request" representing the
 // client's request for the CreateMultipartUpload operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -426,7 +426,7 @@ const opDeleteBucket = "DeleteBucket"
 // DeleteBucketRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucket operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -460,8 +460,7 @@ func (c *S3) DeleteBucketRequest(input *DeleteBucketInput) (req *request.Request
 
         output = &DeleteBucketOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -503,7 +502,7 @@ const opDeleteBucketAnalyticsConfiguration = "DeleteBucketAnalyticsConfiguration
 // DeleteBucketAnalyticsConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketAnalyticsConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -537,8 +536,7 @@ func (c *S3) DeleteBucketAnalyticsConfigurationRequest(input *DeleteBucketAnalyt
 
         output = &DeleteBucketAnalyticsConfigurationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -580,7 +578,7 @@ const opDeleteBucketCors = "DeleteBucketCors"
 // DeleteBucketCorsRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketCors operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -614,14 +612,13 @@ func (c *S3) DeleteBucketCorsRequest(input *DeleteBucketCorsInput) (req *request
 
         output = &DeleteBucketCorsOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
 // DeleteBucketCors API operation for Amazon Simple Storage Service.
 //
-// Deletes the cors configuration information set for the bucket.
+// Deletes the CORS configuration information set for the bucket.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -656,7 +653,7 @@ const opDeleteBucketEncryption = "DeleteBucketEncryption"
 // DeleteBucketEncryptionRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketEncryption operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -690,8 +687,7 @@ func (c *S3) DeleteBucketEncryptionRequest(input *DeleteBucketEncryptionInput) (
 
         output = &DeleteBucketEncryptionOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -732,7 +728,7 @@ const opDeleteBucketInventoryConfiguration = "DeleteBucketInventoryConfiguration
 // DeleteBucketInventoryConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketInventoryConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -766,8 +762,7 @@ func (c *S3) DeleteBucketInventoryConfigurationRequest(input *DeleteBucketInvent
 
         output = &DeleteBucketInventoryConfigurationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -809,7 +804,7 @@ const opDeleteBucketLifecycle = "DeleteBucketLifecycle"
 // DeleteBucketLifecycleRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketLifecycle operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -843,8 +838,7 @@ func (c *S3) DeleteBucketLifecycleRequest(input *DeleteBucketLifecycleInput) (re
 
         output = &DeleteBucketLifecycleOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -885,7 +879,7 @@ const opDeleteBucketMetricsConfiguration = "DeleteBucketMetricsConfiguration"
 // DeleteBucketMetricsConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketMetricsConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -919,8 +913,7 @@ func (c *S3) DeleteBucketMetricsConfigurationRequest(input *DeleteBucketMetricsC
 
         output = &DeleteBucketMetricsConfigurationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -962,7 +955,7 @@ const opDeleteBucketPolicy = "DeleteBucketPolicy"
 // DeleteBucketPolicyRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketPolicy operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -996,8 +989,7 @@ func (c *S3) DeleteBucketPolicyRequest(input *DeleteBucketPolicyInput) (req *req
 
         output = &DeleteBucketPolicyOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -1038,7 +1030,7 @@ const opDeleteBucketReplication = "DeleteBucketReplication"
 // DeleteBucketReplicationRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketReplication operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1072,14 +1064,15 @@ func (c *S3) DeleteBucketReplicationRequest(input *DeleteBucketReplicationInput)
 
         output = &DeleteBucketReplicationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
 // DeleteBucketReplication API operation for Amazon Simple Storage Service.
 //
-// Deletes the replication configuration from the bucket.
+// Deletes the replication configuration from the bucket. For information about
+// replication configuration, see Cross-Region Replication (CRR) ( https://docs.aws.amazon.com/AmazonS3/latest/dev/crr.html)
+// in the Amazon S3 Developer Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -1114,7 +1107,7 @@ const opDeleteBucketTagging = "DeleteBucketTagging"
 // DeleteBucketTaggingRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketTagging operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1148,8 +1141,7 @@ func (c *S3) DeleteBucketTaggingRequest(input *DeleteBucketTaggingInput) (req *r
 
         output = &DeleteBucketTaggingOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -1190,7 +1182,7 @@ const opDeleteBucketWebsite = "DeleteBucketWebsite"
 // DeleteBucketWebsiteRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteBucketWebsite operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1224,8 +1216,7 @@ func (c *S3) DeleteBucketWebsiteRequest(input *DeleteBucketWebsiteInput) (req *r
 
         output = &DeleteBucketWebsiteOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -1266,7 +1257,7 @@ const opDeleteObject = "DeleteObject"
 // DeleteObjectRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteObject operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1342,7 +1333,7 @@ const opDeleteObjectTagging = "DeleteObjectTagging"
 // DeleteObjectTaggingRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteObjectTagging operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1416,7 +1407,7 @@ const opDeleteObjects = "DeleteObjects"
 // DeleteObjectsRequest generates a "aws/request.Request" representing the
 // client's request for the DeleteObjects operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1486,12 +1477,87 @@ func (c *S3) DeleteObjectsWithContext(ctx aws.Context, input *DeleteObjectsInput
         return out, req.Send()
 }
 
+const opDeletePublicAccessBlock = "DeletePublicAccessBlock"
+
+// DeletePublicAccessBlockRequest generates a "aws/request.Request" representing the
+// client's request for the DeletePublicAccessBlock operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See DeletePublicAccessBlock for more information on using the DeletePublicAccessBlock
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the DeletePublicAccessBlockRequest method.
+//    req, resp := client.DeletePublicAccessBlockRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/DeletePublicAccessBlock
+func (c *S3) DeletePublicAccessBlockRequest(input *DeletePublicAccessBlockInput) (req *request.Request, output *DeletePublicAccessBlockOutput) {
+        op := &request.Operation{
+                Name:       opDeletePublicAccessBlock,
+                HTTPMethod: "DELETE",
+                HTTPPath:   "/{Bucket}?publicAccessBlock",
+        }
+
+        if input == nil {
+                input = &DeletePublicAccessBlockInput{}
+        }
+
+        output = &DeletePublicAccessBlockOutput{}
+        req = c.newRequest(op, input, output)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
+        return
+}
+
+// DeletePublicAccessBlock API operation for Amazon Simple Storage Service.
+//
+// Removes the PublicAccessBlock configuration from an Amazon S3 bucket.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation DeletePublicAccessBlock for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/DeletePublicAccessBlock
+func (c *S3) DeletePublicAccessBlock(input *DeletePublicAccessBlockInput) (*DeletePublicAccessBlockOutput, error) {
+        req, out := c.DeletePublicAccessBlockRequest(input)
+        return out, req.Send()
+}
+
+// DeletePublicAccessBlockWithContext is the same as DeletePublicAccessBlock with the addition of
+// the ability to pass a context and additional request options.
+//
+// See DeletePublicAccessBlock for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) DeletePublicAccessBlockWithContext(ctx aws.Context, input *DeletePublicAccessBlockInput, opts ...request.Option) (*DeletePublicAccessBlockOutput, error) {
+        req, out := c.DeletePublicAccessBlockRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
 const opGetBucketAccelerateConfiguration = "GetBucketAccelerateConfiguration"
 
 // GetBucketAccelerateConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketAccelerateConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1565,7 +1631,7 @@ const opGetBucketAcl = "GetBucketAcl"
 // GetBucketAclRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketAcl operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1639,7 +1705,7 @@ const opGetBucketAnalyticsConfiguration = "GetBucketAnalyticsConfiguration"
 // GetBucketAnalyticsConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketAnalyticsConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1714,7 +1780,7 @@ const opGetBucketCors = "GetBucketCors"
 // GetBucketCorsRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketCors operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1753,7 +1819,7 @@ func (c *S3) GetBucketCorsRequest(input *GetBucketCorsInput) (req *request.Reque
 
 // GetBucketCors API operation for Amazon Simple Storage Service.
 //
-// Returns the cors configuration for the bucket.
+// Returns the CORS configuration for the bucket.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -1788,7 +1854,7 @@ const opGetBucketEncryption = "GetBucketEncryption"
 // GetBucketEncryptionRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketEncryption operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1862,7 +1928,7 @@ const opGetBucketInventoryConfiguration = "GetBucketInventoryConfiguration"
 // GetBucketInventoryConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketInventoryConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1937,7 +2003,7 @@ const opGetBucketLifecycle = "GetBucketLifecycle"
 // GetBucketLifecycleRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketLifecycle operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -1958,6 +2024,8 @@ const opGetBucketLifecycle = "GetBucketLifecycle"
 //    }
 //
 // See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetBucketLifecycle
+//
+// Deprecated: GetBucketLifecycle has been deprecated
 func (c *S3) GetBucketLifecycleRequest(input *GetBucketLifecycleInput) (req *request.Request, output *GetBucketLifecycleOutput) {
         if c.Client.Config.Logger != nil {
                 c.Client.Config.Logger.Log("This operation, GetBucketLifecycle, has been deprecated")
@@ -1979,7 +2047,7 @@ func (c *S3) GetBucketLifecycleRequest(input *GetBucketLifecycleInput) (req *req
 
 // GetBucketLifecycle API operation for Amazon Simple Storage Service.
 //
-// Deprecated, see the GetBucketLifecycleConfiguration operation.
+// No longer used, see the GetBucketLifecycleConfiguration operation.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -1988,6 +2056,8 @@ func (c *S3) GetBucketLifecycleRequest(input *GetBucketLifecycleInput) (req *req
 // See the AWS API reference guide for Amazon Simple Storage Service's
 // API operation GetBucketLifecycle for usage and error information.
 // See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetBucketLifecycle
+//
+// Deprecated: GetBucketLifecycle has been deprecated
 func (c *S3) GetBucketLifecycle(input *GetBucketLifecycleInput) (*GetBucketLifecycleOutput, error) {
         req, out := c.GetBucketLifecycleRequest(input)
         return out, req.Send()
@@ -2002,6 +2072,8 @@ func (c *S3) GetBucketLifecycle(input *GetBucketLifecycleInput) (*GetBucketLifec
 // the context is nil a panic will occur. In the future the SDK may create
 // sub-contexts for http.Requests. See https://golang.org/pkg/context/
 // for more information on using Contexts.
+//
+// Deprecated: GetBucketLifecycleWithContext has been deprecated
 func (c *S3) GetBucketLifecycleWithContext(ctx aws.Context, input *GetBucketLifecycleInput, opts ...request.Option) (*GetBucketLifecycleOutput, error) {
         req, out := c.GetBucketLifecycleRequest(input)
         req.SetContext(ctx)
@@ -2014,7 +2086,7 @@ const opGetBucketLifecycleConfiguration = "GetBucketLifecycleConfiguration"
 // GetBucketLifecycleConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketLifecycleConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2088,7 +2160,7 @@ const opGetBucketLocation = "GetBucketLocation"
 // GetBucketLocationRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketLocation operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2162,7 +2234,7 @@ const opGetBucketLogging = "GetBucketLogging"
 // GetBucketLoggingRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketLogging operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2237,7 +2309,7 @@ const opGetBucketMetricsConfiguration = "GetBucketMetricsConfiguration"
 // GetBucketMetricsConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketMetricsConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2312,7 +2384,7 @@ const opGetBucketNotification = "GetBucketNotification"
 // GetBucketNotificationRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketNotification operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2333,6 +2405,8 @@ const opGetBucketNotification = "GetBucketNotification"
 //    }
 //
 // See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetBucketNotification
+//
+// Deprecated: GetBucketNotification has been deprecated
 func (c *S3) GetBucketNotificationRequest(input *GetBucketNotificationConfigurationRequest) (req *request.Request, output *NotificationConfigurationDeprecated) {
         if c.Client.Config.Logger != nil {
                 c.Client.Config.Logger.Log("This operation, GetBucketNotification, has been deprecated")
@@ -2354,7 +2428,7 @@ func (c *S3) GetBucketNotificationRequest(input *GetBucketNotificationConfigurat
 
 // GetBucketNotification API operation for Amazon Simple Storage Service.
 //
-// Deprecated, see the GetBucketNotificationConfiguration operation.
+// No longer used, see the GetBucketNotificationConfiguration operation.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -2363,6 +2437,8 @@ func (c *S3) GetBucketNotificationRequest(input *GetBucketNotificationConfigurat
 // See the AWS API reference guide for Amazon Simple Storage Service's
 // API operation GetBucketNotification for usage and error information.
 // See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetBucketNotification
+//
+// Deprecated: GetBucketNotification has been deprecated
 func (c *S3) GetBucketNotification(input *GetBucketNotificationConfigurationRequest) (*NotificationConfigurationDeprecated, error) {
         req, out := c.GetBucketNotificationRequest(input)
         return out, req.Send()
@@ -2377,6 +2453,8 @@ func (c *S3) GetBucketNotification(input *GetBucketNotificationConfigurationRequ
 // the context is nil a panic will occur. In the future the SDK may create
 // sub-contexts for http.Requests. See https://golang.org/pkg/context/
 // for more information on using Contexts.
+//
+// Deprecated: GetBucketNotificationWithContext has been deprecated
 func (c *S3) GetBucketNotificationWithContext(ctx aws.Context, input *GetBucketNotificationConfigurationRequest, opts ...request.Option) (*NotificationConfigurationDeprecated, error) {
         req, out := c.GetBucketNotificationRequest(input)
         req.SetContext(ctx)
@@ -2389,7 +2467,7 @@ const opGetBucketNotificationConfiguration = "GetBucketNotificationConfiguration
 // GetBucketNotificationConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketNotificationConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2463,7 +2541,7 @@ const opGetBucketPolicy = "GetBucketPolicy"
 // GetBucketPolicyRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketPolicy operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2532,12 +2610,87 @@ func (c *S3) GetBucketPolicyWithContext(ctx aws.Context, input *GetBucketPolicyI
         return out, req.Send()
 }
 
+const opGetBucketPolicyStatus = "GetBucketPolicyStatus"
+
+// GetBucketPolicyStatusRequest generates a "aws/request.Request" representing the
+// client's request for the GetBucketPolicyStatus operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See GetBucketPolicyStatus for more information on using the GetBucketPolicyStatus
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the GetBucketPolicyStatusRequest method.
+//    req, resp := client.GetBucketPolicyStatusRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetBucketPolicyStatus
+func (c *S3) GetBucketPolicyStatusRequest(input *GetBucketPolicyStatusInput) (req *request.Request, output *GetBucketPolicyStatusOutput) {
+        op := &request.Operation{
+                Name:       opGetBucketPolicyStatus,
+                HTTPMethod: "GET",
+                HTTPPath:   "/{Bucket}?policyStatus",
+        }
+
+        if input == nil {
+                input = &GetBucketPolicyStatusInput{}
+        }
+
+        output = &GetBucketPolicyStatusOutput{}
+        req = c.newRequest(op, input, output)
+        return
+}
+
+// GetBucketPolicyStatus API operation for Amazon Simple Storage Service.
+//
+// Retrieves the policy status for an Amazon S3 bucket, indicating whether the
+// bucket is public.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation GetBucketPolicyStatus for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetBucketPolicyStatus
+func (c *S3) GetBucketPolicyStatus(input *GetBucketPolicyStatusInput) (*GetBucketPolicyStatusOutput, error) {
+        req, out := c.GetBucketPolicyStatusRequest(input)
+        return out, req.Send()
+}
+
+// GetBucketPolicyStatusWithContext is the same as GetBucketPolicyStatus with the addition of
+// the ability to pass a context and additional request options.
+//
+// See GetBucketPolicyStatus for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) GetBucketPolicyStatusWithContext(ctx aws.Context, input *GetBucketPolicyStatusInput, opts ...request.Option) (*GetBucketPolicyStatusOutput, error) {
+        req, out := c.GetBucketPolicyStatusRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
 const opGetBucketReplication = "GetBucketReplication"
 
 // GetBucketReplicationRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketReplication operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2578,6 +2731,10 @@ func (c *S3) GetBucketReplicationRequest(input *GetBucketReplicationInput) (req
 //
 // Returns the replication configuration of a bucket.
 //
+// It can take a while to propagate the put or delete a replication configuration
+// to all Amazon S3 systems. Therefore, a get request soon after put or delete
+// can return a wrong result.
+//
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
 // the error.
@@ -2611,7 +2768,7 @@ const opGetBucketRequestPayment = "GetBucketRequestPayment"
 // GetBucketRequestPaymentRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketRequestPayment operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2685,7 +2842,7 @@ const opGetBucketTagging = "GetBucketTagging"
 // GetBucketTaggingRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketTagging operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2759,7 +2916,7 @@ const opGetBucketVersioning = "GetBucketVersioning"
 // GetBucketVersioningRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketVersioning operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2833,7 +2990,7 @@ const opGetBucketWebsite = "GetBucketWebsite"
 // GetBucketWebsiteRequest generates a "aws/request.Request" representing the
 // client's request for the GetBucketWebsite operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2907,7 +3064,7 @@ const opGetObject = "GetObject"
 // GetObjectRequest generates a "aws/request.Request" representing the
 // client's request for the GetObject operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -2986,7 +3143,7 @@ const opGetObjectAcl = "GetObjectAcl"
 // GetObjectAclRequest generates a "aws/request.Request" representing the
 // client's request for the GetObjectAcl operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3060,12 +3217,236 @@ func (c *S3) GetObjectAclWithContext(ctx aws.Context, input *GetObjectAclInput,
         return out, req.Send()
 }
 
+const opGetObjectLegalHold = "GetObjectLegalHold"
+
+// GetObjectLegalHoldRequest generates a "aws/request.Request" representing the
+// client's request for the GetObjectLegalHold operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See GetObjectLegalHold for more information on using the GetObjectLegalHold
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the GetObjectLegalHoldRequest method.
+//    req, resp := client.GetObjectLegalHoldRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetObjectLegalHold
+func (c *S3) GetObjectLegalHoldRequest(input *GetObjectLegalHoldInput) (req *request.Request, output *GetObjectLegalHoldOutput) {
+        op := &request.Operation{
+                Name:       opGetObjectLegalHold,
+                HTTPMethod: "GET",
+                HTTPPath:   "/{Bucket}/{Key+}?legal-hold",
+        }
+
+        if input == nil {
+                input = &GetObjectLegalHoldInput{}
+        }
+
+        output = &GetObjectLegalHoldOutput{}
+        req = c.newRequest(op, input, output)
+        return
+}
+
+// GetObjectLegalHold API operation for Amazon Simple Storage Service.
+//
+// Gets an object's current Legal Hold status.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation GetObjectLegalHold for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetObjectLegalHold
+func (c *S3) GetObjectLegalHold(input *GetObjectLegalHoldInput) (*GetObjectLegalHoldOutput, error) {
+        req, out := c.GetObjectLegalHoldRequest(input)
+        return out, req.Send()
+}
+
+// GetObjectLegalHoldWithContext is the same as GetObjectLegalHold with the addition of
+// the ability to pass a context and additional request options.
+//
+// See GetObjectLegalHold for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) GetObjectLegalHoldWithContext(ctx aws.Context, input *GetObjectLegalHoldInput, opts ...request.Option) (*GetObjectLegalHoldOutput, error) {
+        req, out := c.GetObjectLegalHoldRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
+const opGetObjectLockConfiguration = "GetObjectLockConfiguration"
+
+// GetObjectLockConfigurationRequest generates a "aws/request.Request" representing the
+// client's request for the GetObjectLockConfiguration operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See GetObjectLockConfiguration for more information on using the GetObjectLockConfiguration
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the GetObjectLockConfigurationRequest method.
+//    req, resp := client.GetObjectLockConfigurationRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetObjectLockConfiguration
+func (c *S3) GetObjectLockConfigurationRequest(input *GetObjectLockConfigurationInput) (req *request.Request, output *GetObjectLockConfigurationOutput) {
+        op := &request.Operation{
+                Name:       opGetObjectLockConfiguration,
+                HTTPMethod: "GET",
+                HTTPPath:   "/{Bucket}?object-lock",
+        }
+
+        if input == nil {
+                input = &GetObjectLockConfigurationInput{}
+        }
+
+        output = &GetObjectLockConfigurationOutput{}
+        req = c.newRequest(op, input, output)
+        return
+}
+
+// GetObjectLockConfiguration API operation for Amazon Simple Storage Service.
+//
+// Gets the Object Lock configuration for a bucket. The rule specified in the
+// Object Lock configuration will be applied by default to every new object
+// placed in the specified bucket.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation GetObjectLockConfiguration for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetObjectLockConfiguration
+func (c *S3) GetObjectLockConfiguration(input *GetObjectLockConfigurationInput) (*GetObjectLockConfigurationOutput, error) {
+        req, out := c.GetObjectLockConfigurationRequest(input)
+        return out, req.Send()
+}
+
+// GetObjectLockConfigurationWithContext is the same as GetObjectLockConfiguration with the addition of
+// the ability to pass a context and additional request options.
+//
+// See GetObjectLockConfiguration for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) GetObjectLockConfigurationWithContext(ctx aws.Context, input *GetObjectLockConfigurationInput, opts ...request.Option) (*GetObjectLockConfigurationOutput, error) {
+        req, out := c.GetObjectLockConfigurationRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
+const opGetObjectRetention = "GetObjectRetention"
+
+// GetObjectRetentionRequest generates a "aws/request.Request" representing the
+// client's request for the GetObjectRetention operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See GetObjectRetention for more information on using the GetObjectRetention
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the GetObjectRetentionRequest method.
+//    req, resp := client.GetObjectRetentionRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetObjectRetention
+func (c *S3) GetObjectRetentionRequest(input *GetObjectRetentionInput) (req *request.Request, output *GetObjectRetentionOutput) {
+        op := &request.Operation{
+                Name:       opGetObjectRetention,
+                HTTPMethod: "GET",
+                HTTPPath:   "/{Bucket}/{Key+}?retention",
+        }
+
+        if input == nil {
+                input = &GetObjectRetentionInput{}
+        }
+
+        output = &GetObjectRetentionOutput{}
+        req = c.newRequest(op, input, output)
+        return
+}
+
+// GetObjectRetention API operation for Amazon Simple Storage Service.
+//
+// Retrieves an object's retention settings.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation GetObjectRetention for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetObjectRetention
+func (c *S3) GetObjectRetention(input *GetObjectRetentionInput) (*GetObjectRetentionOutput, error) {
+        req, out := c.GetObjectRetentionRequest(input)
+        return out, req.Send()
+}
+
+// GetObjectRetentionWithContext is the same as GetObjectRetention with the addition of
+// the ability to pass a context and additional request options.
+//
+// See GetObjectRetention for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) GetObjectRetentionWithContext(ctx aws.Context, input *GetObjectRetentionInput, opts ...request.Option) (*GetObjectRetentionOutput, error) {
+        req, out := c.GetObjectRetentionRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
 const opGetObjectTagging = "GetObjectTagging"
 
 // GetObjectTaggingRequest generates a "aws/request.Request" representing the
 // client's request for the GetObjectTagging operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3139,7 +3520,7 @@ const opGetObjectTorrent = "GetObjectTorrent"
 // GetObjectTorrentRequest generates a "aws/request.Request" representing the
 // client's request for the GetObjectTorrent operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3208,12 +3589,86 @@ func (c *S3) GetObjectTorrentWithContext(ctx aws.Context, input *GetObjectTorren
         return out, req.Send()
 }
 
+const opGetPublicAccessBlock = "GetPublicAccessBlock"
+
+// GetPublicAccessBlockRequest generates a "aws/request.Request" representing the
+// client's request for the GetPublicAccessBlock operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See GetPublicAccessBlock for more information on using the GetPublicAccessBlock
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the GetPublicAccessBlockRequest method.
+//    req, resp := client.GetPublicAccessBlockRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetPublicAccessBlock
+func (c *S3) GetPublicAccessBlockRequest(input *GetPublicAccessBlockInput) (req *request.Request, output *GetPublicAccessBlockOutput) {
+        op := &request.Operation{
+                Name:       opGetPublicAccessBlock,
+                HTTPMethod: "GET",
+                HTTPPath:   "/{Bucket}?publicAccessBlock",
+        }
+
+        if input == nil {
+                input = &GetPublicAccessBlockInput{}
+        }
+
+        output = &GetPublicAccessBlockOutput{}
+        req = c.newRequest(op, input, output)
+        return
+}
+
+// GetPublicAccessBlock API operation for Amazon Simple Storage Service.
+//
+// Retrieves the PublicAccessBlock configuration for an Amazon S3 bucket.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation GetPublicAccessBlock for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/GetPublicAccessBlock
+func (c *S3) GetPublicAccessBlock(input *GetPublicAccessBlockInput) (*GetPublicAccessBlockOutput, error) {
+        req, out := c.GetPublicAccessBlockRequest(input)
+        return out, req.Send()
+}
+
+// GetPublicAccessBlockWithContext is the same as GetPublicAccessBlock with the addition of
+// the ability to pass a context and additional request options.
+//
+// See GetPublicAccessBlock for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) GetPublicAccessBlockWithContext(ctx aws.Context, input *GetPublicAccessBlockInput, opts ...request.Option) (*GetPublicAccessBlockOutput, error) {
+        req, out := c.GetPublicAccessBlockRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
 const opHeadBucket = "HeadBucket"
 
 // HeadBucketRequest generates a "aws/request.Request" representing the
 // client's request for the HeadBucket operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3247,8 +3702,7 @@ func (c *S3) HeadBucketRequest(input *HeadBucketInput) (req *request.Request, ou
 
         output = &HeadBucketOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -3295,7 +3749,7 @@ const opHeadObject = "HeadObject"
 // HeadObjectRequest generates a "aws/request.Request" representing the
 // client's request for the HeadObject operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3374,7 +3828,7 @@ const opListBucketAnalyticsConfigurations = "ListBucketAnalyticsConfigurations"
 // ListBucketAnalyticsConfigurationsRequest generates a "aws/request.Request" representing the
 // client's request for the ListBucketAnalyticsConfigurations operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3448,7 +3902,7 @@ const opListBucketInventoryConfigurations = "ListBucketInventoryConfigurations"
 // ListBucketInventoryConfigurationsRequest generates a "aws/request.Request" representing the
 // client's request for the ListBucketInventoryConfigurations operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3522,7 +3976,7 @@ const opListBucketMetricsConfigurations = "ListBucketMetricsConfigurations"
 // ListBucketMetricsConfigurationsRequest generates a "aws/request.Request" representing the
 // client's request for the ListBucketMetricsConfigurations operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3596,7 +4050,7 @@ const opListBuckets = "ListBuckets"
 // ListBucketsRequest generates a "aws/request.Request" representing the
 // client's request for the ListBuckets operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3670,7 +4124,7 @@ const opListMultipartUploads = "ListMultipartUploads"
 // ListMultipartUploadsRequest generates a "aws/request.Request" representing the
 // client's request for the ListMultipartUploads operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3800,7 +4254,7 @@ const opListObjectVersions = "ListObjectVersions"
 // ListObjectVersionsRequest generates a "aws/request.Request" representing the
 // client's request for the ListObjectVersions operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -3930,7 +4384,7 @@ const opListObjects = "ListObjects"
 // ListObjectsRequest generates a "aws/request.Request" representing the
 // client's request for the ListObjects operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4067,7 +4521,7 @@ const opListObjectsV2 = "ListObjectsV2"
 // ListObjectsV2Request generates a "aws/request.Request" representing the
 // client's request for the ListObjectsV2 operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4205,7 +4659,7 @@ const opListParts = "ListParts"
 // ListPartsRequest generates a "aws/request.Request" representing the
 // client's request for the ListParts operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4335,7 +4789,7 @@ const opPutBucketAccelerateConfiguration = "PutBucketAccelerateConfiguration"
 // PutBucketAccelerateConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketAccelerateConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4369,8 +4823,7 @@ func (c *S3) PutBucketAccelerateConfigurationRequest(input *PutBucketAccelerateC
 
         output = &PutBucketAccelerateConfigurationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -4411,7 +4864,7 @@ const opPutBucketAcl = "PutBucketAcl"
 // PutBucketAclRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketAcl operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4445,8 +4898,7 @@ func (c *S3) PutBucketAclRequest(input *PutBucketAclInput) (req *request.Request
 
         output = &PutBucketAclOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -4487,7 +4939,7 @@ const opPutBucketAnalyticsConfiguration = "PutBucketAnalyticsConfiguration"
 // PutBucketAnalyticsConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketAnalyticsConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4521,8 +4973,7 @@ func (c *S3) PutBucketAnalyticsConfigurationRequest(input *PutBucketAnalyticsCon
 
         output = &PutBucketAnalyticsConfigurationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -4564,7 +5015,7 @@ const opPutBucketCors = "PutBucketCors"
 // PutBucketCorsRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketCors operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4598,14 +5049,13 @@ func (c *S3) PutBucketCorsRequest(input *PutBucketCorsInput) (req *request.Reque
 
         output = &PutBucketCorsOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
 // PutBucketCors API operation for Amazon Simple Storage Service.
 //
-// Sets the cors configuration for a bucket.
+// Sets the CORS configuration for a bucket.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -4640,7 +5090,7 @@ const opPutBucketEncryption = "PutBucketEncryption"
 // PutBucketEncryptionRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketEncryption operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4674,8 +5124,7 @@ func (c *S3) PutBucketEncryptionRequest(input *PutBucketEncryptionInput) (req *r
 
         output = &PutBucketEncryptionOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -4717,7 +5166,7 @@ const opPutBucketInventoryConfiguration = "PutBucketInventoryConfiguration"
 // PutBucketInventoryConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketInventoryConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4751,8 +5200,7 @@ func (c *S3) PutBucketInventoryConfigurationRequest(input *PutBucketInventoryCon
 
         output = &PutBucketInventoryConfigurationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -4794,7 +5242,7 @@ const opPutBucketLifecycle = "PutBucketLifecycle"
 // PutBucketLifecycleRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketLifecycle operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4815,6 +5263,8 @@ const opPutBucketLifecycle = "PutBucketLifecycle"
 //    }
 //
 // See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutBucketLifecycle
+//
+// Deprecated: PutBucketLifecycle has been deprecated
 func (c *S3) PutBucketLifecycleRequest(input *PutBucketLifecycleInput) (req *request.Request, output *PutBucketLifecycleOutput) {
         if c.Client.Config.Logger != nil {
                 c.Client.Config.Logger.Log("This operation, PutBucketLifecycle, has been deprecated")
@@ -4831,14 +5281,13 @@ func (c *S3) PutBucketLifecycleRequest(input *PutBucketLifecycleInput) (req *req
 
         output = &PutBucketLifecycleOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
 // PutBucketLifecycle API operation for Amazon Simple Storage Service.
 //
-// Deprecated, see the PutBucketLifecycleConfiguration operation.
+// No longer used, see the PutBucketLifecycleConfiguration operation.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -4847,6 +5296,8 @@ func (c *S3) PutBucketLifecycleRequest(input *PutBucketLifecycleInput) (req *req
 // See the AWS API reference guide for Amazon Simple Storage Service's
 // API operation PutBucketLifecycle for usage and error information.
 // See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutBucketLifecycle
+//
+// Deprecated: PutBucketLifecycle has been deprecated
 func (c *S3) PutBucketLifecycle(input *PutBucketLifecycleInput) (*PutBucketLifecycleOutput, error) {
         req, out := c.PutBucketLifecycleRequest(input)
         return out, req.Send()
@@ -4861,6 +5312,8 @@ func (c *S3) PutBucketLifecycle(input *PutBucketLifecycleInput) (*PutBucketLifec
 // the context is nil a panic will occur. In the future the SDK may create
 // sub-contexts for http.Requests. See https://golang.org/pkg/context/
 // for more information on using Contexts.
+//
+// Deprecated: PutBucketLifecycleWithContext has been deprecated
 func (c *S3) PutBucketLifecycleWithContext(ctx aws.Context, input *PutBucketLifecycleInput, opts ...request.Option) (*PutBucketLifecycleOutput, error) {
         req, out := c.PutBucketLifecycleRequest(input)
         req.SetContext(ctx)
@@ -4873,7 +5326,7 @@ const opPutBucketLifecycleConfiguration = "PutBucketLifecycleConfiguration"
 // PutBucketLifecycleConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketLifecycleConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4907,8 +5360,7 @@ func (c *S3) PutBucketLifecycleConfigurationRequest(input *PutBucketLifecycleCon
 
         output = &PutBucketLifecycleConfigurationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -4950,7 +5402,7 @@ const opPutBucketLogging = "PutBucketLogging"
 // PutBucketLoggingRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketLogging operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -4984,8 +5436,7 @@ func (c *S3) PutBucketLoggingRequest(input *PutBucketLoggingInput) (req *request
 
         output = &PutBucketLoggingOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -5028,7 +5479,7 @@ const opPutBucketMetricsConfiguration = "PutBucketMetricsConfiguration"
 // PutBucketMetricsConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketMetricsConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5062,8 +5513,7 @@ func (c *S3) PutBucketMetricsConfigurationRequest(input *PutBucketMetricsConfigu
 
         output = &PutBucketMetricsConfigurationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -5105,7 +5555,7 @@ const opPutBucketNotification = "PutBucketNotification"
 // PutBucketNotificationRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketNotification operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5126,6 +5576,8 @@ const opPutBucketNotification = "PutBucketNotification"
 //    }
 //
 // See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutBucketNotification
+//
+// Deprecated: PutBucketNotification has been deprecated
 func (c *S3) PutBucketNotificationRequest(input *PutBucketNotificationInput) (req *request.Request, output *PutBucketNotificationOutput) {
         if c.Client.Config.Logger != nil {
                 c.Client.Config.Logger.Log("This operation, PutBucketNotification, has been deprecated")
@@ -5142,14 +5594,13 @@ func (c *S3) PutBucketNotificationRequest(input *PutBucketNotificationInput) (re
 
         output = &PutBucketNotificationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
 // PutBucketNotification API operation for Amazon Simple Storage Service.
 //
-// Deprecated, see the PutBucketNotificationConfiguraiton operation.
+// No longer used, see the PutBucketNotificationConfiguration operation.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -5158,6 +5609,8 @@ func (c *S3) PutBucketNotificationRequest(input *PutBucketNotificationInput) (re
 // See the AWS API reference guide for Amazon Simple Storage Service's
 // API operation PutBucketNotification for usage and error information.
 // See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutBucketNotification
+//
+// Deprecated: PutBucketNotification has been deprecated
 func (c *S3) PutBucketNotification(input *PutBucketNotificationInput) (*PutBucketNotificationOutput, error) {
         req, out := c.PutBucketNotificationRequest(input)
         return out, req.Send()
@@ -5172,6 +5625,8 @@ func (c *S3) PutBucketNotification(input *PutBucketNotificationInput) (*PutBucke
 // the context is nil a panic will occur. In the future the SDK may create
 // sub-contexts for http.Requests. See https://golang.org/pkg/context/
 // for more information on using Contexts.
+//
+// Deprecated: PutBucketNotificationWithContext has been deprecated
 func (c *S3) PutBucketNotificationWithContext(ctx aws.Context, input *PutBucketNotificationInput, opts ...request.Option) (*PutBucketNotificationOutput, error) {
         req, out := c.PutBucketNotificationRequest(input)
         req.SetContext(ctx)
@@ -5184,7 +5639,7 @@ const opPutBucketNotificationConfiguration = "PutBucketNotificationConfiguration
 // PutBucketNotificationConfigurationRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketNotificationConfiguration operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5218,8 +5673,7 @@ func (c *S3) PutBucketNotificationConfigurationRequest(input *PutBucketNotificat
 
         output = &PutBucketNotificationConfigurationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -5260,7 +5714,7 @@ const opPutBucketPolicy = "PutBucketPolicy"
 // PutBucketPolicyRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketPolicy operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5294,8 +5748,7 @@ func (c *S3) PutBucketPolicyRequest(input *PutBucketPolicyInput) (req *request.R
 
         output = &PutBucketPolicyOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -5337,7 +5790,7 @@ const opPutBucketReplication = "PutBucketReplication"
 // PutBucketReplicationRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketReplication operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5371,15 +5824,15 @@ func (c *S3) PutBucketReplicationRequest(input *PutBucketReplicationInput) (req
 
         output = &PutBucketReplicationOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
 // PutBucketReplication API operation for Amazon Simple Storage Service.
 //
-// Creates a new replication configuration (or replaces an existing one, if
-// present).
+// Creates a replication configuration or replaces an existing one. For more
+// information, see Cross-Region Replication (CRR) ( https://docs.aws.amazon.com/AmazonS3/latest/dev/crr.html)
+// in the Amazon S3 Developer Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -5414,7 +5867,7 @@ const opPutBucketRequestPayment = "PutBucketRequestPayment"
 // PutBucketRequestPaymentRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketRequestPayment operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5448,8 +5901,7 @@ func (c *S3) PutBucketRequestPaymentRequest(input *PutBucketRequestPaymentInput)
 
         output = &PutBucketRequestPaymentOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -5494,7 +5946,7 @@ const opPutBucketTagging = "PutBucketTagging"
 // PutBucketTaggingRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketTagging operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5528,8 +5980,7 @@ func (c *S3) PutBucketTaggingRequest(input *PutBucketTaggingInput) (req *request
 
         output = &PutBucketTaggingOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -5570,7 +6021,7 @@ const opPutBucketVersioning = "PutBucketVersioning"
 // PutBucketVersioningRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketVersioning operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5604,8 +6055,7 @@ func (c *S3) PutBucketVersioningRequest(input *PutBucketVersioningInput) (req *r
 
         output = &PutBucketVersioningOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -5647,7 +6097,7 @@ const opPutBucketWebsite = "PutBucketWebsite"
 // PutBucketWebsiteRequest generates a "aws/request.Request" representing the
 // client's request for the PutBucketWebsite operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5681,8 +6131,7 @@ func (c *S3) PutBucketWebsiteRequest(input *PutBucketWebsiteInput) (req *request
 
         output = &PutBucketWebsiteOutput{}
         req = c.newRequest(op, input, output)
-        req.Handlers.Unmarshal.Remove(restxml.UnmarshalHandler)
-        req.Handlers.Unmarshal.PushBackNamed(protocol.UnmarshalDiscardBodyHandler)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
         return
 }
 
@@ -5723,7 +6172,7 @@ const opPutObject = "PutObject"
 // PutObjectRequest generates a "aws/request.Request" representing the
 // client's request for the PutObject operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5797,7 +6246,7 @@ const opPutObjectAcl = "PutObjectAcl"
 // PutObjectAclRequest generates a "aws/request.Request" representing the
 // client's request for the PutObjectAcl operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5872,12 +6321,236 @@ func (c *S3) PutObjectAclWithContext(ctx aws.Context, input *PutObjectAclInput,
         return out, req.Send()
 }
 
+const opPutObjectLegalHold = "PutObjectLegalHold"
+
+// PutObjectLegalHoldRequest generates a "aws/request.Request" representing the
+// client's request for the PutObjectLegalHold operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See PutObjectLegalHold for more information on using the PutObjectLegalHold
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the PutObjectLegalHoldRequest method.
+//    req, resp := client.PutObjectLegalHoldRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutObjectLegalHold
+func (c *S3) PutObjectLegalHoldRequest(input *PutObjectLegalHoldInput) (req *request.Request, output *PutObjectLegalHoldOutput) {
+        op := &request.Operation{
+                Name:       opPutObjectLegalHold,
+                HTTPMethod: "PUT",
+                HTTPPath:   "/{Bucket}/{Key+}?legal-hold",
+        }
+
+        if input == nil {
+                input = &PutObjectLegalHoldInput{}
+        }
+
+        output = &PutObjectLegalHoldOutput{}
+        req = c.newRequest(op, input, output)
+        return
+}
+
+// PutObjectLegalHold API operation for Amazon Simple Storage Service.
+//
+// Applies a Legal Hold configuration to the specified object.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation PutObjectLegalHold for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutObjectLegalHold
+func (c *S3) PutObjectLegalHold(input *PutObjectLegalHoldInput) (*PutObjectLegalHoldOutput, error) {
+        req, out := c.PutObjectLegalHoldRequest(input)
+        return out, req.Send()
+}
+
+// PutObjectLegalHoldWithContext is the same as PutObjectLegalHold with the addition of
+// the ability to pass a context and additional request options.
+//
+// See PutObjectLegalHold for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) PutObjectLegalHoldWithContext(ctx aws.Context, input *PutObjectLegalHoldInput, opts ...request.Option) (*PutObjectLegalHoldOutput, error) {
+        req, out := c.PutObjectLegalHoldRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
+const opPutObjectLockConfiguration = "PutObjectLockConfiguration"
+
+// PutObjectLockConfigurationRequest generates a "aws/request.Request" representing the
+// client's request for the PutObjectLockConfiguration operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See PutObjectLockConfiguration for more information on using the PutObjectLockConfiguration
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the PutObjectLockConfigurationRequest method.
+//    req, resp := client.PutObjectLockConfigurationRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutObjectLockConfiguration
+func (c *S3) PutObjectLockConfigurationRequest(input *PutObjectLockConfigurationInput) (req *request.Request, output *PutObjectLockConfigurationOutput) {
+        op := &request.Operation{
+                Name:       opPutObjectLockConfiguration,
+                HTTPMethod: "PUT",
+                HTTPPath:   "/{Bucket}?object-lock",
+        }
+
+        if input == nil {
+                input = &PutObjectLockConfigurationInput{}
+        }
+
+        output = &PutObjectLockConfigurationOutput{}
+        req = c.newRequest(op, input, output)
+        return
+}
+
+// PutObjectLockConfiguration API operation for Amazon Simple Storage Service.
+//
+// Places an Object Lock configuration on the specified bucket. The rule specified
+// in the Object Lock configuration will be applied by default to every new
+// object placed in the specified bucket.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation PutObjectLockConfiguration for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutObjectLockConfiguration
+func (c *S3) PutObjectLockConfiguration(input *PutObjectLockConfigurationInput) (*PutObjectLockConfigurationOutput, error) {
+        req, out := c.PutObjectLockConfigurationRequest(input)
+        return out, req.Send()
+}
+
+// PutObjectLockConfigurationWithContext is the same as PutObjectLockConfiguration with the addition of
+// the ability to pass a context and additional request options.
+//
+// See PutObjectLockConfiguration for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) PutObjectLockConfigurationWithContext(ctx aws.Context, input *PutObjectLockConfigurationInput, opts ...request.Option) (*PutObjectLockConfigurationOutput, error) {
+        req, out := c.PutObjectLockConfigurationRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
+const opPutObjectRetention = "PutObjectRetention"
+
+// PutObjectRetentionRequest generates a "aws/request.Request" representing the
+// client's request for the PutObjectRetention operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See PutObjectRetention for more information on using the PutObjectRetention
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the PutObjectRetentionRequest method.
+//    req, resp := client.PutObjectRetentionRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutObjectRetention
+func (c *S3) PutObjectRetentionRequest(input *PutObjectRetentionInput) (req *request.Request, output *PutObjectRetentionOutput) {
+        op := &request.Operation{
+                Name:       opPutObjectRetention,
+                HTTPMethod: "PUT",
+                HTTPPath:   "/{Bucket}/{Key+}?retention",
+        }
+
+        if input == nil {
+                input = &PutObjectRetentionInput{}
+        }
+
+        output = &PutObjectRetentionOutput{}
+        req = c.newRequest(op, input, output)
+        return
+}
+
+// PutObjectRetention API operation for Amazon Simple Storage Service.
+//
+// Places an Object Retention configuration on an object.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation PutObjectRetention for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutObjectRetention
+func (c *S3) PutObjectRetention(input *PutObjectRetentionInput) (*PutObjectRetentionOutput, error) {
+        req, out := c.PutObjectRetentionRequest(input)
+        return out, req.Send()
+}
+
+// PutObjectRetentionWithContext is the same as PutObjectRetention with the addition of
+// the ability to pass a context and additional request options.
+//
+// See PutObjectRetention for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) PutObjectRetentionWithContext(ctx aws.Context, input *PutObjectRetentionInput, opts ...request.Option) (*PutObjectRetentionOutput, error) {
+        req, out := c.PutObjectRetentionRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
 const opPutObjectTagging = "PutObjectTagging"
 
 // PutObjectTaggingRequest generates a "aws/request.Request" representing the
 // client's request for the PutObjectTagging operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -5946,12 +6619,88 @@ func (c *S3) PutObjectTaggingWithContext(ctx aws.Context, input *PutObjectTaggin
         return out, req.Send()
 }
 
+const opPutPublicAccessBlock = "PutPublicAccessBlock"
+
+// PutPublicAccessBlockRequest generates a "aws/request.Request" representing the
+// client's request for the PutPublicAccessBlock operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See PutPublicAccessBlock for more information on using the PutPublicAccessBlock
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the PutPublicAccessBlockRequest method.
+//    req, resp := client.PutPublicAccessBlockRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutPublicAccessBlock
+func (c *S3) PutPublicAccessBlockRequest(input *PutPublicAccessBlockInput) (req *request.Request, output *PutPublicAccessBlockOutput) {
+        op := &request.Operation{
+                Name:       opPutPublicAccessBlock,
+                HTTPMethod: "PUT",
+                HTTPPath:   "/{Bucket}?publicAccessBlock",
+        }
+
+        if input == nil {
+                input = &PutPublicAccessBlockInput{}
+        }
+
+        output = &PutPublicAccessBlockOutput{}
+        req = c.newRequest(op, input, output)
+        req.Handlers.Unmarshal.Swap(restxml.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
+        return
+}
+
+// PutPublicAccessBlock API operation for Amazon Simple Storage Service.
+//
+// Creates or modifies the PublicAccessBlock configuration for an Amazon S3
+// bucket.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for Amazon Simple Storage Service's
+// API operation PutPublicAccessBlock for usage and error information.
+// See also, https://docs.aws.amazon.com/goto/WebAPI/s3-2006-03-01/PutPublicAccessBlock
+func (c *S3) PutPublicAccessBlock(input *PutPublicAccessBlockInput) (*PutPublicAccessBlockOutput, error) {
+        req, out := c.PutPublicAccessBlockRequest(input)
+        return out, req.Send()
+}
+
+// PutPublicAccessBlockWithContext is the same as PutPublicAccessBlock with the addition of
+// the ability to pass a context and additional request options.
+//
+// See PutPublicAccessBlock for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *S3) PutPublicAccessBlockWithContext(ctx aws.Context, input *PutPublicAccessBlockInput, opts ...request.Option) (*PutPublicAccessBlockOutput, error) {
+        req, out := c.PutPublicAccessBlockRequest(input)
+        req.SetContext(ctx)
+        req.ApplyOptions(opts...)
+        return out, req.Send()
+}
+
 const opRestoreObject = "RestoreObject"
 
 // RestoreObjectRequest generates a "aws/request.Request" representing the
 // client's request for the RestoreObject operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -6030,7 +6779,7 @@ const opSelectObjectContent = "SelectObjectContent"
 // SelectObjectContentRequest generates a "aws/request.Request" representing the
 // client's request for the SelectObjectContent operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -6112,7 +6861,7 @@ const opUploadPart = "UploadPart"
 // UploadPartRequest generates a "aws/request.Request" representing the
 // client's request for the UploadPart operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -6192,7 +6941,7 @@ const opUploadPartCopy = "UploadPartCopy"
 // UploadPartCopyRequest generates a "aws/request.Request" representing the
 // client's request for the UploadPartCopy operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -6322,6 +7071,9 @@ func (s *AbortMultipartUploadInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -6467,7 +7219,7 @@ func (s *AccessControlPolicy) SetOwner(v *Owner) *AccessControlPolicy {
         return s
 }
 
-// Container for information regarding the access control for replicas.
+// A container for information about access control for replicas.
 type AccessControlTranslation struct {
         _ struct{} `type:"structure"`
 
@@ -7072,11 +7824,11 @@ type CSVInput struct {
         // to TRUE may lower performance.
         AllowQuotedRecordDelimiter *bool `type:"boolean"`
 
-        // Single character used to indicate a row should be ignored when present at
-        // the start of a row.
+        // The single character used to indicate a row should be ignored when present
+        // at the start of a row.
         Comments *string `type:"string"`
 
-        // Value used to separate individual fields in a record.
+        // The value used to separate individual fields in a record.
         FieldDelimiter *string `type:"string"`
 
         // Describes the first line of input. Valid values: None, Ignore, Use.
@@ -7085,11 +7837,11 @@ type CSVInput struct {
         // Value used for escaping where the field delimiter is part of the value.
         QuoteCharacter *string `type:"string"`
 
-        // Single character used for escaping the quote character inside an already
+        // The single character used for escaping the quote character inside an already
         // escaped value.
         QuoteEscapeCharacter *string `type:"string"`
 
-        // Value used to separate individual records.
+        // The value used to separate individual records.
         RecordDelimiter *string `type:"string"`
 }
 
@@ -7149,20 +7901,20 @@ func (s *CSVInput) SetRecordDelimiter(v string) *CSVInput {
 type CSVOutput struct {
         _ struct{} `type:"structure"`
 
-        // Value used to separate individual fields in a record.
+        // The value used to separate individual fields in a record.
         FieldDelimiter *string `type:"string"`
 
-        // Value used for escaping where the field delimiter is part of the value.
+        // The value used for escaping where the field delimiter is part of the value.
         QuoteCharacter *string `type:"string"`
 
-        // Single character used for escaping the quote character inside an already
+        // Th single character used for escaping the quote character inside an already
         // escaped value.
         QuoteEscapeCharacter *string `type:"string"`
 
         // Indicates whether or not all output fields should be quoted.
         QuoteFields *string `type:"string" enum:"QuoteFields"`
 
-        // Value used to separate individual records.
+        // The value used to separate individual records.
         RecordDelimiter *string `type:"string"`
 }
 
@@ -7211,12 +7963,14 @@ type CloudFunctionConfiguration struct {
 
         CloudFunction *string `type:"string"`
 
-        // Bucket event for which to send notifications.
+        // The bucket event for which to send notifications.
+        //
+        // Deprecated: Event has been deprecated
         Event *string `deprecated:"true" type:"string" enum:"Event"`
 
         Events []*string `locationName:"Event" type:"list" flattened:"true"`
 
-        // Optional unique identifier for configurations in a notification configuration.
+        // An optional unique identifier for configurations in a notification configuration.
         // If you don't provide one, Amazon S3 will assign an ID.
         Id *string `type:"string"`
 
@@ -7322,6 +8076,9 @@ func (s *CompleteMultipartUploadInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -7397,7 +8154,7 @@ type CompleteMultipartUploadOutput struct {
 
         // If present, specifies the ID of the AWS Key Management Service (KMS) master
         // encryption key that was used for the object.
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -7652,7 +8409,7 @@ type CopyObjectInput struct {
         // Specifies the customer-provided encryption key for Amazon S3 to use to decrypt
         // the source object. The encryption key provided in this header must be one
         // that was used when the source object was created.
-        CopySourceSSECustomerKey *string `location:"header" locationName:"x-amz-copy-source-server-side-encryption-customer-key" type:"string"`
+        CopySourceSSECustomerKey *string `location:"header" locationName:"x-amz-copy-source-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
         // Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
         // Amazon S3 uses this header for a message integrity check to ensure the encryption
@@ -7684,6 +8441,15 @@ type CopyObjectInput struct {
         // with metadata provided in the request.
         MetadataDirective *string `location:"header" locationName:"x-amz-metadata-directive" type:"string" enum:"MetadataDirective"`
 
+        // Specifies whether you want to apply a Legal Hold to the copied object.
+        ObjectLockLegalHoldStatus *string `location:"header" locationName:"x-amz-object-lock-legal-hold" type:"string" enum:"ObjectLockLegalHoldStatus"`
+
+        // The Object Lock mode that you want to apply to the copied object.
+        ObjectLockMode *string `location:"header" locationName:"x-amz-object-lock-mode" type:"string" enum:"ObjectLockMode"`
+
+        // The date and time when you want the copied object's Object Lock to expire.
+        ObjectLockRetainUntilDate *time.Time `location:"header" locationName:"x-amz-object-lock-retain-until-date" type:"timestamp" timestampFormat:"iso8601"`
+
         // Confirms that the requester knows that she or he will be charged for the
         // request. Bucket owners need not specify this parameter in their requests.
         // Documentation on downloading objects from requester pays buckets can be found
@@ -7698,7 +8464,7 @@ type CopyObjectInput struct {
         // does not store the encryption key. The key must be appropriate for use with
         // the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm
         // header.
-        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string"`
+        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
         // Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
         // Amazon S3 uses this header for a message integrity check to ensure the encryption
@@ -7709,7 +8475,7 @@ type CopyObjectInput struct {
         // requests for an object protected by AWS KMS will fail if not made via SSL
         // or using SigV4. Documentation on configuring any of the officially supported
         // AWS SDKs and CLI can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#specify-signature-version
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -7749,6 +8515,9 @@ func (s *CopyObjectInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.CopySource == nil {
                 invalidParams.Add(request.NewErrParamRequired("CopySource"))
         }
@@ -7917,6 +8686,24 @@ func (s *CopyObjectInput) SetMetadataDirective(v string) *CopyObjectInput {
         return s
 }
 
+// SetObjectLockLegalHoldStatus sets the ObjectLockLegalHoldStatus field's value.
+func (s *CopyObjectInput) SetObjectLockLegalHoldStatus(v string) *CopyObjectInput {
+        s.ObjectLockLegalHoldStatus = &v
+        return s
+}
+
+// SetObjectLockMode sets the ObjectLockMode field's value.
+func (s *CopyObjectInput) SetObjectLockMode(v string) *CopyObjectInput {
+        s.ObjectLockMode = &v
+        return s
+}
+
+// SetObjectLockRetainUntilDate sets the ObjectLockRetainUntilDate field's value.
+func (s *CopyObjectInput) SetObjectLockRetainUntilDate(v time.Time) *CopyObjectInput {
+        s.ObjectLockRetainUntilDate = &v
+        return s
+}
+
 // SetRequestPayer sets the RequestPayer field's value.
 func (s *CopyObjectInput) SetRequestPayer(v string) *CopyObjectInput {
         s.RequestPayer = &v
@@ -8010,7 +8797,7 @@ type CopyObjectOutput struct {
 
         // If present, specifies the ID of the AWS Key Management Service (KMS) master
         // encryption key that was used for the object.
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -8150,7 +8937,7 @@ type CreateBucketConfiguration struct {
         _ struct{} `type:"structure"`
 
         // Specifies the region where the bucket will be created. If you don't specify
-        // a region, the bucket will be created in US Standard.
+        // a region, the bucket is created in US East (N. Virginia) Region (us-east-1).
         LocationConstraint *string `type:"string" enum:"BucketLocationConstraint"`
 }
 
@@ -8196,6 +8983,9 @@ type CreateBucketInput struct {
 
         // Allows grantee to write the ACL for the applicable bucket.
         GrantWriteACP *string `location:"header" locationName:"x-amz-grant-write-acp" type:"string"`
+
+        // Specifies whether you want S3 Object Lock to be enabled for the new bucket.
+        ObjectLockEnabledForBucket *bool `location:"header" locationName:"x-amz-bucket-object-lock-enabled" type:"boolean"`
 }
 
 // String returns the string representation
@@ -8214,6 +9004,9 @@ func (s *CreateBucketInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -8276,6 +9069,12 @@ func (s *CreateBucketInput) SetGrantWriteACP(v string) *CreateBucketInput {
         return s
 }
 
+// SetObjectLockEnabledForBucket sets the ObjectLockEnabledForBucket field's value.
+func (s *CreateBucketInput) SetObjectLockEnabledForBucket(v bool) *CreateBucketInput {
+        s.ObjectLockEnabledForBucket = &v
+        return s
+}
+
 type CreateBucketOutput struct {
         _ struct{} `type:"structure"`
 
@@ -8345,6 +9144,15 @@ type CreateMultipartUploadInput struct {
         // A map of metadata to store with the object in S3.
         Metadata map[string]*string `location:"headers" locationName:"x-amz-meta-" type:"map"`
 
+        // Specifies whether you want to apply a Legal Hold to the uploaded object.
+        ObjectLockLegalHoldStatus *string `location:"header" locationName:"x-amz-object-lock-legal-hold" type:"string" enum:"ObjectLockLegalHoldStatus"`
+
+        // Specifies the Object Lock mode that you want to apply to the uploaded object.
+        ObjectLockMode *string `location:"header" locationName:"x-amz-object-lock-mode" type:"string" enum:"ObjectLockMode"`
+
+        // Specifies the date and time when you want the Object Lock to expire.
+        ObjectLockRetainUntilDate *time.Time `location:"header" locationName:"x-amz-object-lock-retain-until-date" type:"timestamp" timestampFormat:"iso8601"`
+
         // Confirms that the requester knows that she or he will be charged for the
         // request. Bucket owners need not specify this parameter in their requests.
         // Documentation on downloading objects from requester pays buckets can be found
@@ -8359,7 +9167,7 @@ type CreateMultipartUploadInput struct {
         // does not store the encryption key. The key must be appropriate for use with
         // the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm
         // header.
-        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string"`
+        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
         // Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
         // Amazon S3 uses this header for a message integrity check to ensure the encryption
@@ -8370,7 +9178,7 @@ type CreateMultipartUploadInput struct {
         // requests for an object protected by AWS KMS will fail if not made via SSL
         // or using SigV4. Documentation on configuring any of the officially supported
         // AWS SDKs and CLI can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#specify-signature-version
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -8404,6 +9212,9 @@ func (s *CreateMultipartUploadInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -8508,6 +9319,24 @@ func (s *CreateMultipartUploadInput) SetMetadata(v map[string]*string) *CreateMu
         return s
 }
 
+// SetObjectLockLegalHoldStatus sets the ObjectLockLegalHoldStatus field's value.
+func (s *CreateMultipartUploadInput) SetObjectLockLegalHoldStatus(v string) *CreateMultipartUploadInput {
+        s.ObjectLockLegalHoldStatus = &v
+        return s
+}
+
+// SetObjectLockMode sets the ObjectLockMode field's value.
+func (s *CreateMultipartUploadInput) SetObjectLockMode(v string) *CreateMultipartUploadInput {
+        s.ObjectLockMode = &v
+        return s
+}
+
+// SetObjectLockRetainUntilDate sets the ObjectLockRetainUntilDate field's value.
+func (s *CreateMultipartUploadInput) SetObjectLockRetainUntilDate(v time.Time) *CreateMultipartUploadInput {
+        s.ObjectLockRetainUntilDate = &v
+        return s
+}
+
 // SetRequestPayer sets the RequestPayer field's value.
 func (s *CreateMultipartUploadInput) SetRequestPayer(v string) *CreateMultipartUploadInput {
         s.RequestPayer = &v
@@ -8601,7 +9430,7 @@ type CreateMultipartUploadOutput struct {
 
         // If present, specifies the ID of the AWS Key Management Service (KMS) master
         // encryption key that was used for the object.
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -8688,6 +9517,50 @@ func (s *CreateMultipartUploadOutput) SetUploadId(v string) *CreateMultipartUplo
         return s
 }
 
+// The container element for specifying the default Object Lock retention settings
+// for new objects placed in the specified bucket.
+type DefaultRetention struct {
+        _ struct{} `type:"structure"`
+
+        // The number of days that you want to specify for the default retention period.
+        Days *int64 `type:"integer"`
+
+        // The default Object Lock retention mode you want to apply to new objects placed
+        // in the specified bucket.
+        Mode *string `type:"string" enum:"ObjectLockRetentionMode"`
+
+        // The number of years that you want to specify for the default retention period.
+        Years *int64 `type:"integer"`
+}
+
+// String returns the string representation
+func (s DefaultRetention) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s DefaultRetention) GoString() string {
+        return s.String()
+}
+
+// SetDays sets the Days field's value.
+func (s *DefaultRetention) SetDays(v int64) *DefaultRetention {
+        s.Days = &v
+        return s
+}
+
+// SetMode sets the Mode field's value.
+func (s *DefaultRetention) SetMode(v string) *DefaultRetention {
+        s.Mode = &v
+        return s
+}
+
+// SetYears sets the Years field's value.
+func (s *DefaultRetention) SetYears(v int64) *DefaultRetention {
+        s.Years = &v
+        return s
+}
+
 type Delete struct {
         _ struct{} `type:"structure"`
 
@@ -8774,6 +9647,9 @@ func (s *DeleteBucketAnalyticsConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Id == nil {
                 invalidParams.Add(request.NewErrParamRequired("Id"))
         }
@@ -8840,6 +9716,9 @@ func (s *DeleteBucketCorsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -8900,6 +9779,9 @@ func (s *DeleteBucketEncryptionInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -8957,6 +9839,9 @@ func (s *DeleteBucketInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -9007,6 +9892,9 @@ func (s *DeleteBucketInventoryConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Id == nil {
                 invalidParams.Add(request.NewErrParamRequired("Id"))
         }
@@ -9073,6 +9961,9 @@ func (s *DeleteBucketLifecycleInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -9137,6 +10028,9 @@ func (s *DeleteBucketMetricsConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Id == nil {
                 invalidParams.Add(request.NewErrParamRequired("Id"))
         }
@@ -9217,6 +10111,9 @@ func (s *DeleteBucketPolicyInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -9254,6 +10151,11 @@ func (s DeleteBucketPolicyOutput) GoString() string {
 type DeleteBucketReplicationInput struct {
         _ struct{} `type:"structure"`
 
+        // The bucket name.
+        //
+        // It can take a while to propagate the deletion of a replication configuration
+        // to all Amazon S3 systems.
+        //
         // Bucket is a required field
         Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
 }
@@ -9274,6 +10176,9 @@ func (s *DeleteBucketReplicationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -9331,6 +10236,9 @@ func (s *DeleteBucketTaggingInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -9388,6 +10296,9 @@ func (s *DeleteBucketWebsiteInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -9481,12 +10392,43 @@ func (s *DeleteMarkerEntry) SetVersionId(v string) *DeleteMarkerEntry {
         return s
 }
 
+// Specifies whether Amazon S3 should replicate delete makers.
+type DeleteMarkerReplication struct {
+        _ struct{} `type:"structure"`
+
+        // The status of the delete marker replication.
+        //
+        // In the current implementation, Amazon S3 doesn't replicate the delete markers.
+        // The status must be Disabled.
+        Status *string `type:"string" enum:"DeleteMarkerReplicationStatus"`
+}
+
+// String returns the string representation
+func (s DeleteMarkerReplication) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s DeleteMarkerReplication) GoString() string {
+        return s.String()
+}
+
+// SetStatus sets the Status field's value.
+func (s *DeleteMarkerReplication) SetStatus(v string) *DeleteMarkerReplication {
+        s.Status = &v
+        return s
+}
+
 type DeleteObjectInput struct {
         _ struct{} `type:"structure"`
 
         // Bucket is a required field
         Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
 
+        // Indicates whether S3 Object Lock should bypass Governance-mode restrictions
+        // to process this operation.
+        BypassGovernanceRetention *bool `location:"header" locationName:"x-amz-bypass-governance-retention" type:"boolean"`
+
         // Key is a required field
         Key *string `location:"uri" locationName:"Key" min:"1" type:"string" required:"true"`
 
@@ -9520,6 +10462,9 @@ func (s *DeleteObjectInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -9546,6 +10491,12 @@ func (s *DeleteObjectInput) getBucket() (v string) {
         return *s.Bucket
 }
 
+// SetBypassGovernanceRetention sets the BypassGovernanceRetention field's value.
+func (s *DeleteObjectInput) SetBypassGovernanceRetention(v bool) *DeleteObjectInput {
+        s.BypassGovernanceRetention = &v
+        return s
+}
+
 // SetKey sets the Key field's value.
 func (s *DeleteObjectInput) SetKey(v string) *DeleteObjectInput {
         s.Key = &v
@@ -9643,6 +10594,9 @@ func (s *DeleteObjectTaggingInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -9710,6 +10664,11 @@ type DeleteObjectsInput struct {
         // Bucket is a required field
         Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
 
+        // Specifies whether you want to delete this object even if it has a Governance-type
+        // Object Lock in place. You must have sufficient permissions to perform this
+        // operation.
+        BypassGovernanceRetention *bool `location:"header" locationName:"x-amz-bypass-governance-retention" type:"boolean"`
+
         // Delete is a required field
         Delete *Delete `locationName:"Delete" type:"structure" required:"true" xmlURI:"http://s3.amazonaws.com/doc/2006-03-01/"`
 
@@ -9740,6 +10699,9 @@ func (s *DeleteObjectsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Delete == nil {
                 invalidParams.Add(request.NewErrParamRequired("Delete"))
         }
@@ -9768,6 +10730,12 @@ func (s *DeleteObjectsInput) getBucket() (v string) {
         return *s.Bucket
 }
 
+// SetBypassGovernanceRetention sets the BypassGovernanceRetention field's value.
+func (s *DeleteObjectsInput) SetBypassGovernanceRetention(v bool) *DeleteObjectsInput {
+        s.BypassGovernanceRetention = &v
+        return s
+}
+
 // SetDelete sets the Delete field's value.
 func (s *DeleteObjectsInput) SetDelete(v *Delete) *DeleteObjectsInput {
         s.Delete = v
@@ -9826,6 +10794,68 @@ func (s *DeleteObjectsOutput) SetRequestCharged(v string) *DeleteObjectsOutput {
         return s
 }
 
+type DeletePublicAccessBlockInput struct {
+        _ struct{} `type:"structure"`
+
+        // The Amazon S3 bucket whose PublicAccessBlock configuration you want to delete.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+}
+
+// String returns the string representation
+func (s DeletePublicAccessBlockInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s DeletePublicAccessBlockInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *DeletePublicAccessBlockInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "DeletePublicAccessBlockInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *DeletePublicAccessBlockInput) SetBucket(v string) *DeletePublicAccessBlockInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *DeletePublicAccessBlockInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+type DeletePublicAccessBlockOutput struct {
+        _ struct{} `type:"structure"`
+}
+
+// String returns the string representation
+func (s DeletePublicAccessBlockOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s DeletePublicAccessBlockOutput) GoString() string {
+        return s.String()
+}
+
 type DeletedObject struct {
         _ struct{} `type:"structure"`
 
@@ -9872,27 +10902,43 @@ func (s *DeletedObject) SetVersionId(v string) *DeletedObject {
         return s
 }
 
-// Container for replication destination information.
+// A container for information about the replication destination.
 type Destination struct {
         _ struct{} `type:"structure"`
 
-        // Container for information regarding the access control for replicas.
+        // A container for information about access control for replicas.
+        //
+        // Use this element only in a cross-account scenario where source and destination
+        // bucket owners are not the same to change replica ownership to the AWS account
+        // that owns the destination bucket. If you don't add this element to the replication
+        // configuration, the replicas are owned by same AWS account that owns the source
+        // object.
         AccessControlTranslation *AccessControlTranslation `type:"structure"`
 
-        // Account ID of the destination bucket. Currently this is only being verified
-        // if Access Control Translation is enabled
+        // The account ID of the destination bucket. Currently, Amazon S3 verifies this
+        // value only if Access Control Translation is enabled.
+        //
+        // In a cross-account scenario, if you change replica ownership to the AWS account
+        // that owns the destination bucket by adding the AccessControlTranslation element,
+        // this is the account ID of the owner of the destination bucket.
         Account *string `type:"string"`
 
-        // Amazon resource name (ARN) of the bucket where you want Amazon S3 to store
-        // replicas of the object identified by the rule.
+        // The Amazon Resource Name (ARN) of the bucket where you want Amazon S3 to
+        // store replicas of the object identified by the rule.
+        //
+        // If there are multiple rules in your replication configuration, all rules
+        // must specify the same bucket as the destination. A replication configuration
+        // can replicate objects to only one destination bucket.
         //
         // Bucket is a required field
         Bucket *string `type:"string" required:"true"`
 
-        // Container for information regarding encryption based configuration for replicas.
+        // A container that provides information about encryption. If SourceSelectionCriteria
+        // is specified, you must specify this element.
         EncryptionConfiguration *EncryptionConfiguration `type:"structure"`
 
-        // The class of storage used to store the object.
+        // The class of storage used to store the object. By default Amazon S3 uses
+        // storage class of the source object when creating a replica.
         StorageClass *string `type:"string" enum:"StorageClass"`
 }
 
@@ -9978,7 +11024,7 @@ type Encryption struct {
 
         // If the encryption type is aws:kms, this optional value specifies the AWS
         // KMS key ID to use for encryption of job results.
-        KMSKeyId *string `type:"string"`
+        KMSKeyId *string `type:"string" sensitive:"true"`
 }
 
 // String returns the string representation
@@ -10022,11 +11068,13 @@ func (s *Encryption) SetKMSKeyId(v string) *Encryption {
         return s
 }
 
-// Container for information regarding encryption based configuration for replicas.
+// A container for information about the encryption-based configuration for
+// replicas.
 type EncryptionConfiguration struct {
         _ struct{} `type:"structure"`
 
-        // The id of the KMS key used to encrypt the replica object.
+        // The ID of the AWS KMS key for the AWS Region where the destination bucket
+        // resides. Amazon S3 uses this key to encrypt the replica object.
         ReplicaKmsKeyID *string `type:"string"`
 }
 
@@ -10159,14 +11207,15 @@ func (s *ErrorDocument) SetKey(v string) *ErrorDocument {
         return s
 }
 
-// Container for key value pair that defines the criteria for the filter rule.
+// A container for a key value pair that defines the criteria for the filter
+// rule.
 type FilterRule struct {
         _ struct{} `type:"structure"`
 
-        // Object key name prefix or suffix identifying one or more objects to which
-        // the filtering rule applies. Maximum prefix length can be up to 1,024 characters.
+        // The object key name prefix or suffix identifying one or more objects to which
+        // the filtering rule applies. The maximum prefix length is 1,024 characters.
         // Overlapping prefixes and suffixes are not supported. For more information,
-        // go to Configuring Event Notifications (http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
+        // see Configuring Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
         // in the Amazon Simple Storage Service Developer Guide.
         Name *string `type:"string" enum:"FilterRuleName"`
 
@@ -10220,6 +11269,9 @@ func (s *GetBucketAccelerateConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -10286,6 +11338,9 @@ func (s *GetBucketAclInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -10367,6 +11422,9 @@ func (s *GetBucketAnalyticsConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Id == nil {
                 invalidParams.Add(request.NewErrParamRequired("Id"))
         }
@@ -10442,6 +11500,9 @@ func (s *GetBucketCorsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -10510,6 +11571,9 @@ func (s *GetBucketEncryptionInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -10584,6 +11648,9 @@ func (s *GetBucketInventoryConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Id == nil {
                 invalidParams.Add(request.NewErrParamRequired("Id"))
         }
@@ -10659,6 +11726,9 @@ func (s *GetBucketLifecycleConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -10724,6 +11794,9 @@ func (s *GetBucketLifecycleInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -10789,6 +11862,9 @@ func (s *GetBucketLocationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -10854,6 +11930,9 @@ func (s *GetBucketLoggingInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -10929,6 +12008,9 @@ func (s *GetBucketMetricsConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Id == nil {
                 invalidParams.Add(request.NewErrParamRequired("Id"))
         }
@@ -11006,6 +12088,9 @@ func (s *GetBucketNotificationConfigurationRequest) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -11049,6 +12134,9 @@ func (s *GetBucketPolicyInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -11092,6 +12180,77 @@ func (s *GetBucketPolicyOutput) SetPolicy(v string) *GetBucketPolicyOutput {
         return s
 }
 
+type GetBucketPolicyStatusInput struct {
+        _ struct{} `type:"structure"`
+
+        // The name of the Amazon S3 bucket whose policy status you want to retrieve.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+}
+
+// String returns the string representation
+func (s GetBucketPolicyStatusInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetBucketPolicyStatusInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *GetBucketPolicyStatusInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "GetBucketPolicyStatusInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *GetBucketPolicyStatusInput) SetBucket(v string) *GetBucketPolicyStatusInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *GetBucketPolicyStatusInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+type GetBucketPolicyStatusOutput struct {
+        _ struct{} `type:"structure" payload:"PolicyStatus"`
+
+        // The policy status for the specified bucket.
+        PolicyStatus *PolicyStatus `type:"structure"`
+}
+
+// String returns the string representation
+func (s GetBucketPolicyStatusOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetBucketPolicyStatusOutput) GoString() string {
+        return s.String()
+}
+
+// SetPolicyStatus sets the PolicyStatus field's value.
+func (s *GetBucketPolicyStatusOutput) SetPolicyStatus(v *PolicyStatus) *GetBucketPolicyStatusOutput {
+        s.PolicyStatus = v
+        return s
+}
+
 type GetBucketReplicationInput struct {
         _ struct{} `type:"structure"`
 
@@ -11115,6 +12274,9 @@ func (s *GetBucketReplicationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -11138,8 +12300,8 @@ func (s *GetBucketReplicationInput) getBucket() (v string) {
 type GetBucketReplicationOutput struct {
         _ struct{} `type:"structure" payload:"ReplicationConfiguration"`
 
-        // Container for replication rules. You can add as many as 1,000 rules. Total
-        // replication configuration size can be up to 2 MB.
+        // A container for replication rules. You can add up to 1,000 rules. The maximum
+        // size of a replication configuration is 2 MB.
         ReplicationConfiguration *ReplicationConfiguration `type:"structure"`
 }
 
@@ -11182,6 +12344,9 @@ func (s *GetBucketRequestPaymentInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -11248,6 +12413,9 @@ func (s *GetBucketTaggingInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -11314,6 +12482,9 @@ func (s *GetBucketVersioningInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -11391,6 +12562,9 @@ func (s *GetBucketWebsiteInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -11492,6 +12666,9 @@ func (s *GetObjectAclInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -11643,7 +12820,7 @@ type GetObjectInput struct {
         // does not store the encryption key. The key must be appropriate for use with
         // the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm
         // header.
-        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string"`
+        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
         // Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
         // Amazon S3 uses this header for a message integrity check to ensure the encryption
@@ -11670,6 +12847,9 @@ func (s *GetObjectInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -11811,6 +12991,186 @@ func (s *GetObjectInput) SetVersionId(v string) *GetObjectInput {
         return s
 }
 
+type GetObjectLegalHoldInput struct {
+        _ struct{} `type:"structure"`
+
+        // The bucket containing the object whose Legal Hold status you want to retrieve.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+
+        // The key name for the object whose Legal Hold status you want to retrieve.
+        //
+        // Key is a required field
+        Key *string `location:"uri" locationName:"Key" min:"1" type:"string" required:"true"`
+
+        // Confirms that the requester knows that she or he will be charged for the
+        // request. Bucket owners need not specify this parameter in their requests.
+        // Documentation on downloading objects from requester pays buckets can be found
+        // at http://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
+        RequestPayer *string `location:"header" locationName:"x-amz-request-payer" type:"string" enum:"RequestPayer"`
+
+        // The version ID of the object whose Legal Hold status you want to retrieve.
+        VersionId *string `location:"querystring" locationName:"versionId" type:"string"`
+}
+
+// String returns the string representation
+func (s GetObjectLegalHoldInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetObjectLegalHoldInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *GetObjectLegalHoldInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "GetObjectLegalHoldInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+        if s.Key == nil {
+                invalidParams.Add(request.NewErrParamRequired("Key"))
+        }
+        if s.Key != nil && len(*s.Key) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Key", 1))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *GetObjectLegalHoldInput) SetBucket(v string) *GetObjectLegalHoldInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *GetObjectLegalHoldInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+// SetKey sets the Key field's value.
+func (s *GetObjectLegalHoldInput) SetKey(v string) *GetObjectLegalHoldInput {
+        s.Key = &v
+        return s
+}
+
+// SetRequestPayer sets the RequestPayer field's value.
+func (s *GetObjectLegalHoldInput) SetRequestPayer(v string) *GetObjectLegalHoldInput {
+        s.RequestPayer = &v
+        return s
+}
+
+// SetVersionId sets the VersionId field's value.
+func (s *GetObjectLegalHoldInput) SetVersionId(v string) *GetObjectLegalHoldInput {
+        s.VersionId = &v
+        return s
+}
+
+type GetObjectLegalHoldOutput struct {
+        _ struct{} `type:"structure" payload:"LegalHold"`
+
+        // The current Legal Hold status for the specified object.
+        LegalHold *ObjectLockLegalHold `type:"structure"`
+}
+
+// String returns the string representation
+func (s GetObjectLegalHoldOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetObjectLegalHoldOutput) GoString() string {
+        return s.String()
+}
+
+// SetLegalHold sets the LegalHold field's value.
+func (s *GetObjectLegalHoldOutput) SetLegalHold(v *ObjectLockLegalHold) *GetObjectLegalHoldOutput {
+        s.LegalHold = v
+        return s
+}
+
+type GetObjectLockConfigurationInput struct {
+        _ struct{} `type:"structure"`
+
+        // The bucket whose Object Lock configuration you want to retrieve.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+}
+
+// String returns the string representation
+func (s GetObjectLockConfigurationInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetObjectLockConfigurationInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *GetObjectLockConfigurationInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "GetObjectLockConfigurationInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *GetObjectLockConfigurationInput) SetBucket(v string) *GetObjectLockConfigurationInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *GetObjectLockConfigurationInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+type GetObjectLockConfigurationOutput struct {
+        _ struct{} `type:"structure" payload:"ObjectLockConfiguration"`
+
+        // The specified bucket's Object Lock configuration.
+        ObjectLockConfiguration *ObjectLockConfiguration `type:"structure"`
+}
+
+// String returns the string representation
+func (s GetObjectLockConfigurationOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetObjectLockConfigurationOutput) GoString() string {
+        return s.String()
+}
+
+// SetObjectLockConfiguration sets the ObjectLockConfiguration field's value.
+func (s *GetObjectLockConfigurationOutput) SetObjectLockConfiguration(v *ObjectLockConfiguration) *GetObjectLockConfigurationOutput {
+        s.ObjectLockConfiguration = v
+        return s
+}
+
 type GetObjectOutput struct {
         _ struct{} `type:"structure" payload:"Body"`
 
@@ -11871,6 +13231,16 @@ type GetObjectOutput struct {
         // you can create metadata whose values are not legal HTTP headers.
         MissingMeta *int64 `location:"header" locationName:"x-amz-missing-meta" type:"integer"`
 
+        // Indicates whether this object has an active legal hold. This field is only
+        // returned if you have permission to view an object's legal hold status.
+        ObjectLockLegalHoldStatus *string `location:"header" locationName:"x-amz-object-lock-legal-hold" type:"string" enum:"ObjectLockLegalHoldStatus"`
+
+        // The Object Lock mode currently in place for this object.
+        ObjectLockMode *string `location:"header" locationName:"x-amz-object-lock-mode" type:"string" enum:"ObjectLockMode"`
+
+        // The date and time when this object's Object Lock will expire.
+        ObjectLockRetainUntilDate *time.Time `location:"header" locationName:"x-amz-object-lock-retain-until-date" type:"timestamp" timestampFormat:"iso8601"`
+
         // The count of parts this object has.
         PartsCount *int64 `location:"header" locationName:"x-amz-mp-parts-count" type:"integer"`
 
@@ -11896,7 +13266,7 @@ type GetObjectOutput struct {
 
         // If present, specifies the ID of the AWS Key Management Service (KMS) master
         // encryption key that was used for the object.
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -12022,6 +13392,24 @@ func (s *GetObjectOutput) SetMissingMeta(v int64) *GetObjectOutput {
         return s
 }
 
+// SetObjectLockLegalHoldStatus sets the ObjectLockLegalHoldStatus field's value.
+func (s *GetObjectOutput) SetObjectLockLegalHoldStatus(v string) *GetObjectOutput {
+        s.ObjectLockLegalHoldStatus = &v
+        return s
+}
+
+// SetObjectLockMode sets the ObjectLockMode field's value.
+func (s *GetObjectOutput) SetObjectLockMode(v string) *GetObjectOutput {
+        s.ObjectLockMode = &v
+        return s
+}
+
+// SetObjectLockRetainUntilDate sets the ObjectLockRetainUntilDate field's value.
+func (s *GetObjectOutput) SetObjectLockRetainUntilDate(v time.Time) *GetObjectOutput {
+        s.ObjectLockRetainUntilDate = &v
+        return s
+}
+
 // SetPartsCount sets the PartsCount field's value.
 func (s *GetObjectOutput) SetPartsCount(v int64) *GetObjectOutput {
         s.PartsCount = &v
@@ -12094,6 +13482,115 @@ func (s *GetObjectOutput) SetWebsiteRedirectLocation(v string) *GetObjectOutput
         return s
 }
 
+type GetObjectRetentionInput struct {
+        _ struct{} `type:"structure"`
+
+        // The bucket containing the object whose retention settings you want to retrieve.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+
+        // The key name for the object whose retention settings you want to retrieve.
+        //
+        // Key is a required field
+        Key *string `location:"uri" locationName:"Key" min:"1" type:"string" required:"true"`
+
+        // Confirms that the requester knows that she or he will be charged for the
+        // request. Bucket owners need not specify this parameter in their requests.
+        // Documentation on downloading objects from requester pays buckets can be found
+        // at http://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
+        RequestPayer *string `location:"header" locationName:"x-amz-request-payer" type:"string" enum:"RequestPayer"`
+
+        // The version ID for the object whose retention settings you want to retrieve.
+        VersionId *string `location:"querystring" locationName:"versionId" type:"string"`
+}
+
+// String returns the string representation
+func (s GetObjectRetentionInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetObjectRetentionInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *GetObjectRetentionInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "GetObjectRetentionInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+        if s.Key == nil {
+                invalidParams.Add(request.NewErrParamRequired("Key"))
+        }
+        if s.Key != nil && len(*s.Key) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Key", 1))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *GetObjectRetentionInput) SetBucket(v string) *GetObjectRetentionInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *GetObjectRetentionInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+// SetKey sets the Key field's value.
+func (s *GetObjectRetentionInput) SetKey(v string) *GetObjectRetentionInput {
+        s.Key = &v
+        return s
+}
+
+// SetRequestPayer sets the RequestPayer field's value.
+func (s *GetObjectRetentionInput) SetRequestPayer(v string) *GetObjectRetentionInput {
+        s.RequestPayer = &v
+        return s
+}
+
+// SetVersionId sets the VersionId field's value.
+func (s *GetObjectRetentionInput) SetVersionId(v string) *GetObjectRetentionInput {
+        s.VersionId = &v
+        return s
+}
+
+type GetObjectRetentionOutput struct {
+        _ struct{} `type:"structure" payload:"Retention"`
+
+        // The container element for an object's retention settings.
+        Retention *ObjectLockRetention `type:"structure"`
+}
+
+// String returns the string representation
+func (s GetObjectRetentionOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetObjectRetentionOutput) GoString() string {
+        return s.String()
+}
+
+// SetRetention sets the Retention field's value.
+func (s *GetObjectRetentionOutput) SetRetention(v *ObjectLockRetention) *GetObjectRetentionOutput {
+        s.Retention = v
+        return s
+}
+
 type GetObjectTaggingInput struct {
         _ struct{} `type:"structure"`
 
@@ -12122,6 +13619,9 @@ func (s *GetObjectTaggingInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -12223,6 +13723,9 @@ func (s *GetObjectTorrentInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -12293,6 +13796,79 @@ func (s *GetObjectTorrentOutput) SetRequestCharged(v string) *GetObjectTorrentOu
         return s
 }
 
+type GetPublicAccessBlockInput struct {
+        _ struct{} `type:"structure"`
+
+        // The name of the Amazon S3 bucket whose PublicAccessBlock configuration you
+        // want to retrieve.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+}
+
+// String returns the string representation
+func (s GetPublicAccessBlockInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetPublicAccessBlockInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *GetPublicAccessBlockInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "GetPublicAccessBlockInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *GetPublicAccessBlockInput) SetBucket(v string) *GetPublicAccessBlockInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *GetPublicAccessBlockInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+type GetPublicAccessBlockOutput struct {
+        _ struct{} `type:"structure" payload:"PublicAccessBlockConfiguration"`
+
+        // The PublicAccessBlock configuration currently in effect for this Amazon S3
+        // bucket.
+        PublicAccessBlockConfiguration *PublicAccessBlockConfiguration `type:"structure"`
+}
+
+// String returns the string representation
+func (s GetPublicAccessBlockOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetPublicAccessBlockOutput) GoString() string {
+        return s.String()
+}
+
+// SetPublicAccessBlockConfiguration sets the PublicAccessBlockConfiguration field's value.
+func (s *GetPublicAccessBlockOutput) SetPublicAccessBlockConfiguration(v *PublicAccessBlockConfiguration) *GetPublicAccessBlockOutput {
+        s.PublicAccessBlockConfiguration = v
+        return s
+}
+
 type GlacierJobParameters struct {
         _ struct{} `type:"structure"`
 
@@ -12474,6 +14050,9 @@ func (s *HeadBucketInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -12557,7 +14136,7 @@ type HeadObjectInput struct {
         // does not store the encryption key. The key must be appropriate for use with
         // the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm
         // header.
-        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string"`
+        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
         // Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
         // Amazon S3 uses this header for a message integrity check to ensure the encryption
@@ -12584,6 +14163,9 @@ func (s *HeadObjectInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -12743,6 +14325,15 @@ type HeadObjectOutput struct {
         // you can create metadata whose values are not legal HTTP headers.
         MissingMeta *int64 `location:"header" locationName:"x-amz-missing-meta" type:"integer"`
 
+        // The Legal Hold status for the specified object.
+        ObjectLockLegalHoldStatus *string `location:"header" locationName:"x-amz-object-lock-legal-hold" type:"string" enum:"ObjectLockLegalHoldStatus"`
+
+        // The Object Lock mode currently in place for this object.
+        ObjectLockMode *string `location:"header" locationName:"x-amz-object-lock-mode" type:"string" enum:"ObjectLockMode"`
+
+        // The date and time when this object's Object Lock will expire.
+        ObjectLockRetainUntilDate *time.Time `location:"header" locationName:"x-amz-object-lock-retain-until-date" type:"timestamp" timestampFormat:"iso8601"`
+
         // The count of parts this object has.
         PartsCount *int64 `location:"header" locationName:"x-amz-mp-parts-count" type:"integer"`
 
@@ -12768,7 +14359,7 @@ type HeadObjectOutput struct {
 
         // If present, specifies the ID of the AWS Key Management Service (KMS) master
         // encryption key that was used for the object.
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -12879,6 +14470,24 @@ func (s *HeadObjectOutput) SetMissingMeta(v int64) *HeadObjectOutput {
         return s
 }
 
+// SetObjectLockLegalHoldStatus sets the ObjectLockLegalHoldStatus field's value.
+func (s *HeadObjectOutput) SetObjectLockLegalHoldStatus(v string) *HeadObjectOutput {
+        s.ObjectLockLegalHoldStatus = &v
+        return s
+}
+
+// SetObjectLockMode sets the ObjectLockMode field's value.
+func (s *HeadObjectOutput) SetObjectLockMode(v string) *HeadObjectOutput {
+        s.ObjectLockMode = &v
+        return s
+}
+
+// SetObjectLockRetainUntilDate sets the ObjectLockRetainUntilDate field's value.
+func (s *HeadObjectOutput) SetObjectLockRetainUntilDate(v time.Time) *HeadObjectOutput {
+        s.ObjectLockRetainUntilDate = &v
+        return s
+}
+
 // SetPartsCount sets the PartsCount field's value.
 func (s *HeadObjectOutput) SetPartsCount(v int64) *HeadObjectOutput {
         s.PartsCount = &v
@@ -13032,6 +14641,9 @@ type InputSerialization struct {
 
         // Specifies JSON as object's input serialization format.
         JSON *JSONInput `type:"structure"`
+
+        // Specifies Parquet as object's input serialization format.
+        Parquet *ParquetInput `type:"structure"`
 }
 
 // String returns the string representation
@@ -13062,6 +14674,12 @@ func (s *InputSerialization) SetJSON(v *JSONInput) *InputSerialization {
         return s
 }
 
+// SetParquet sets the Parquet field's value.
+func (s *InputSerialization) SetParquet(v *ParquetInput) *InputSerialization {
+        s.Parquet = v
+        return s
+}
+
 type InventoryConfiguration struct {
         _ struct{} `type:"structure"`
 
@@ -13239,10 +14857,10 @@ func (s *InventoryDestination) SetS3BucketDestination(v *InventoryS3BucketDestin
 type InventoryEncryption struct {
         _ struct{} `type:"structure"`
 
-        // Specifies the use of SSE-KMS to encrypt delievered Inventory reports.
+        // Specifies the use of SSE-KMS to encrypt delivered Inventory reports.
         SSEKMS *SSEKMS `locationName:"SSE-KMS" type:"structure"`
 
-        // Specifies the use of SSE-S3 to encrypt delievered Inventory reports.
+        // Specifies the use of SSE-S3 to encrypt delivered Inventory reports.
         SSES3 *SSES3 `locationName:"SSE-S3" type:"structure"`
 }
 
@@ -13498,12 +15116,12 @@ func (s *JSONOutput) SetRecordDelimiter(v string) *JSONOutput {
         return s
 }
 
-// Container for object key name prefix and suffix filtering rules.
+// A container for object key name prefix and suffix filtering rules.
 type KeyFilter struct {
         _ struct{} `type:"structure"`
 
-        // A list of containers for key value pair that defines the criteria for the
-        // filter rule.
+        // A list of containers for the key value pair that defines the criteria for
+        // the filter rule.
         FilterRules []*FilterRule `locationName:"FilterRule" type:"list" flattened:"true"`
 }
 
@@ -13523,24 +15141,24 @@ func (s *KeyFilter) SetFilterRules(v []*FilterRule) *KeyFilter {
         return s
 }
 
-// Container for specifying the AWS Lambda notification configuration.
+// A container for specifying the configuration for AWS Lambda notifications.
 type LambdaFunctionConfiguration struct {
         _ struct{} `type:"structure"`
 
         // Events is a required field
         Events []*string `locationName:"Event" type:"list" flattened:"true" required:"true"`
 
-        // Container for object key name filtering rules. For information about key
-        // name filtering, go to Configuring Event Notifications (http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
+        // A container for object key name filtering rules. For information about key
+        // name filtering, see Configuring Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
         // in the Amazon Simple Storage Service Developer Guide.
         Filter *NotificationConfigurationFilter `type:"structure"`
 
-        // Optional unique identifier for configurations in a notification configuration.
+        // An optional unique identifier for configurations in a notification configuration.
         // If you don't provide one, Amazon S3 will assign an ID.
         Id *string `type:"string"`
 
-        // Lambda cloud function ARN that Amazon S3 can invoke when it detects events
-        // of the specified type.
+        // The Amazon Resource Name (ARN) of the Lambda cloud function that Amazon S3
+        // can invoke when it detects events of the specified type.
         //
         // LambdaFunctionArn is a required field
         LambdaFunctionArn *string `locationName:"CloudFunction" type:"string" required:"true"`
@@ -13714,7 +15332,9 @@ type LifecycleRule struct {
         NoncurrentVersionTransitions []*NoncurrentVersionTransition `locationName:"NoncurrentVersionTransition" type:"list" flattened:"true"`
 
         // Prefix identifying one or more objects to which the rule applies. This is
-        // deprecated; use Filter instead.
+        // No longer used; use Filter instead.
+        //
+        // Deprecated: Prefix has been deprecated
         Prefix *string `deprecated:"true" type:"string"`
 
         // If 'Enabled', the rule is currently being applied. If 'Disabled', the rule
@@ -13957,6 +15577,9 @@ func (s *ListBucketAnalyticsConfigurationsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -14068,6 +15691,9 @@ func (s *ListBucketInventoryConfigurationsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -14179,6 +15805,9 @@ func (s *ListBucketMetricsConfigurationsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -14357,6 +15986,9 @@ func (s *ListMultipartUploadsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -14593,6 +16225,9 @@ func (s *ListObjectVersionsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -14825,6 +16460,9 @@ func (s *ListObjectsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -15042,6 +16680,9 @@ func (s *ListObjectsV2Input) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -15287,6 +16928,9 @@ func (s *ListPartsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -15980,8 +17624,8 @@ type NoncurrentVersionExpiration struct {
         // Specifies the number of days an object is noncurrent before Amazon S3 can
         // perform the associated action. For information about the noncurrent days
         // calculations, see How Amazon S3 Calculates When an Object Became Noncurrent
-        // (http://docs.aws.amazon.com/AmazonS3/latest/dev/s3-access-control.html) in
-        // the Amazon Simple Storage Service Developer Guide.
+        // (https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-access-control.html)
+        // in the Amazon Simple Storage Service Developer Guide.
         NoncurrentDays *int64 `type:"integer"`
 }
 
@@ -16002,19 +17646,20 @@ func (s *NoncurrentVersionExpiration) SetNoncurrentDays(v int64) *NoncurrentVers
 }
 
 // Container for the transition rule that describes when noncurrent objects
-// transition to the STANDARD_IA, ONEZONE_IA or GLACIER storage class. If your
-// bucket is versioning-enabled (or versioning is suspended), you can set this
-// action to request that Amazon S3 transition noncurrent object versions to
-// the STANDARD_IA, ONEZONE_IA or GLACIER storage class at a specific period
-// in the object's lifetime.
+// transition to the STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER or
+// DEEP_ARCHIVE storage class. If your bucket is versioning-enabled (or versioning
+// is suspended), you can set this action to request that Amazon S3 transition
+// noncurrent object versions to the STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING,
+// GLACIER or DEEP_ARCHIVE storage class at a specific period in the object's
+// lifetime.
 type NoncurrentVersionTransition struct {
         _ struct{} `type:"structure"`
 
         // Specifies the number of days an object is noncurrent before Amazon S3 can
         // perform the associated action. For information about the noncurrent days
         // calculations, see How Amazon S3 Calculates When an Object Became Noncurrent
-        // (http://docs.aws.amazon.com/AmazonS3/latest/dev/s3-access-control.html) in
-        // the Amazon Simple Storage Service Developer Guide.
+        // (https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-access-control.html)
+        // in the Amazon Simple Storage Service Developer Guide.
         NoncurrentDays *int64 `type:"integer"`
 
         // The class of storage used to store the object.
@@ -16043,8 +17688,8 @@ func (s *NoncurrentVersionTransition) SetStorageClass(v string) *NoncurrentVersi
         return s
 }
 
-// Container for specifying the notification configuration of the bucket. If
-// this element is empty, notifications are turned off on the bucket.
+// A container for specifying the notification configuration of the bucket.
+// If this element is empty, notifications are turned off for the bucket.
 type NotificationConfiguration struct {
         _ struct{} `type:"structure"`
 
@@ -16161,13 +17806,13 @@ func (s *NotificationConfigurationDeprecated) SetTopicConfiguration(v *TopicConf
         return s
 }
 
-// Container for object key name filtering rules. For information about key
-// name filtering, go to Configuring Event Notifications (http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
+// A container for object key name filtering rules. For information about key
+// name filtering, see Configuring Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
 // in the Amazon Simple Storage Service Developer Guide.
 type NotificationConfigurationFilter struct {
         _ struct{} `type:"structure"`
 
-        // Container for object key name prefix and suffix filtering rules.
+        // A container for object key name prefix and suffix filtering rules.
         Key *KeyFilter `locationName:"S3Key" type:"structure"`
 }
 
@@ -16300,6 +17945,121 @@ func (s *ObjectIdentifier) SetVersionId(v string) *ObjectIdentifier {
         return s
 }
 
+// The container element for Object Lock configuration parameters.
+type ObjectLockConfiguration struct {
+        _ struct{} `type:"structure"`
+
+        // Indicates whether this bucket has an Object Lock configuration enabled.
+        ObjectLockEnabled *string `type:"string" enum:"ObjectLockEnabled"`
+
+        // The Object Lock rule in place for the specified object.
+        Rule *ObjectLockRule `type:"structure"`
+}
+
+// String returns the string representation
+func (s ObjectLockConfiguration) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ObjectLockConfiguration) GoString() string {
+        return s.String()
+}
+
+// SetObjectLockEnabled sets the ObjectLockEnabled field's value.
+func (s *ObjectLockConfiguration) SetObjectLockEnabled(v string) *ObjectLockConfiguration {
+        s.ObjectLockEnabled = &v
+        return s
+}
+
+// SetRule sets the Rule field's value.
+func (s *ObjectLockConfiguration) SetRule(v *ObjectLockRule) *ObjectLockConfiguration {
+        s.Rule = v
+        return s
+}
+
+// A Legal Hold configuration for an object.
+type ObjectLockLegalHold struct {
+        _ struct{} `type:"structure"`
+
+        // Indicates whether the specified object has a Legal Hold in place.
+        Status *string `type:"string" enum:"ObjectLockLegalHoldStatus"`
+}
+
+// String returns the string representation
+func (s ObjectLockLegalHold) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ObjectLockLegalHold) GoString() string {
+        return s.String()
+}
+
+// SetStatus sets the Status field's value.
+func (s *ObjectLockLegalHold) SetStatus(v string) *ObjectLockLegalHold {
+        s.Status = &v
+        return s
+}
+
+// A Retention configuration for an object.
+type ObjectLockRetention struct {
+        _ struct{} `type:"structure"`
+
+        // Indicates the Retention mode for the specified object.
+        Mode *string `type:"string" enum:"ObjectLockRetentionMode"`
+
+        // The date on which this Object Lock Retention will expire.
+        RetainUntilDate *time.Time `type:"timestamp" timestampFormat:"iso8601"`
+}
+
+// String returns the string representation
+func (s ObjectLockRetention) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ObjectLockRetention) GoString() string {
+        return s.String()
+}
+
+// SetMode sets the Mode field's value.
+func (s *ObjectLockRetention) SetMode(v string) *ObjectLockRetention {
+        s.Mode = &v
+        return s
+}
+
+// SetRetainUntilDate sets the RetainUntilDate field's value.
+func (s *ObjectLockRetention) SetRetainUntilDate(v time.Time) *ObjectLockRetention {
+        s.RetainUntilDate = &v
+        return s
+}
+
+// The container element for an Object Lock rule.
+type ObjectLockRule struct {
+        _ struct{} `type:"structure"`
+
+        // The default retention period that you want to apply to new objects placed
+        // in the specified bucket.
+        DefaultRetention *DefaultRetention `type:"structure"`
+}
+
+// String returns the string representation
+func (s ObjectLockRule) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ObjectLockRule) GoString() string {
+        return s.String()
+}
+
+// SetDefaultRetention sets the DefaultRetention field's value.
+func (s *ObjectLockRule) SetDefaultRetention(v *DefaultRetention) *ObjectLockRule {
+        s.DefaultRetention = v
+        return s
+}
+
 type ObjectVersion struct {
         _ struct{} `type:"structure"`
 
@@ -16487,6 +18247,20 @@ func (s *Owner) SetID(v string) *Owner {
         return s
 }
 
+type ParquetInput struct {
+        _ struct{} `type:"structure"`
+}
+
+// String returns the string representation
+func (s ParquetInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ParquetInput) GoString() string {
+        return s.String()
+}
+
 type Part struct {
         _ struct{} `type:"structure"`
 
@@ -16500,7 +18274,7 @@ type Part struct {
         // 10,000.
         PartNumber *int64 `type:"integer"`
 
-        // Size of the uploaded part data.
+        // Size in bytes of the uploaded part data.
         Size *int64 `type:"integer"`
 }
 
@@ -16538,16 +18312,41 @@ func (s *Part) SetSize(v int64) *Part {
         return s
 }
 
+// The container element for a bucket's policy status.
+type PolicyStatus struct {
+        _ struct{} `type:"structure"`
+
+        // The policy status for this bucket. TRUE indicates that this bucket is public.
+        // FALSE indicates that the bucket is not public.
+        IsPublic *bool `locationName:"IsPublic" type:"boolean"`
+}
+
+// String returns the string representation
+func (s PolicyStatus) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PolicyStatus) GoString() string {
+        return s.String()
+}
+
+// SetIsPublic sets the IsPublic field's value.
+func (s *PolicyStatus) SetIsPublic(v bool) *PolicyStatus {
+        s.IsPublic = &v
+        return s
+}
+
 type Progress struct {
         _ struct{} `type:"structure"`
 
-        // Current number of uncompressed object bytes processed.
+        // The current number of uncompressed object bytes processed.
         BytesProcessed *int64 `type:"long"`
 
-        // Current number of bytes of records payload data returned.
+        // The current number of bytes of records payload data returned.
         BytesReturned *int64 `type:"long"`
 
-        // Current number of object bytes scanned.
+        // The current number of object bytes scanned.
         BytesScanned *int64 `type:"long"`
 }
 
@@ -16619,6 +18418,81 @@ func (s *ProgressEvent) UnmarshalEvent(
         return nil
 }
 
+type PublicAccessBlockConfiguration struct {
+        _ struct{} `type:"structure"`
+
+        // Specifies whether Amazon S3 should block public access control lists (ACLs)
+        // for this bucket and objects in this bucket. Setting this element to TRUE
+        // causes the following behavior:
+        //
+        //    * PUT Bucket acl and PUT Object acl calls fail if the specified ACL is
+        //    public.
+        //
+        //    * PUT Object calls fail if the request includes a public ACL.
+        //
+        // Enabling this setting doesn't affect existing policies or ACLs.
+        BlockPublicAcls *bool `locationName:"BlockPublicAcls" type:"boolean"`
+
+        // Specifies whether Amazon S3 should block public bucket policies for this
+        // bucket. Setting this element to TRUE causes Amazon S3 to reject calls to
+        // PUT Bucket policy if the specified bucket policy allows public access.
+        //
+        // Enabling this setting doesn't affect existing bucket policies.
+        BlockPublicPolicy *bool `locationName:"BlockPublicPolicy" type:"boolean"`
+
+        // Specifies whether Amazon S3 should ignore public ACLs for this bucket and
+        // objects in this bucket. Setting this element to TRUE causes Amazon S3 to
+        // ignore all public ACLs on this bucket and objects in this bucket.
+        //
+        // Enabling this setting doesn't affect the persistence of any existing ACLs
+        // and doesn't prevent new public ACLs from being set.
+        IgnorePublicAcls *bool `locationName:"IgnorePublicAcls" type:"boolean"`
+
+        // Specifies whether Amazon S3 should restrict public bucket policies for this
+        // bucket. Setting this element to TRUE restricts access to this bucket to only
+        // AWS services and authorized users within this account if the bucket has a
+        // public policy.
+        //
+        // Enabling this setting doesn't affect previously stored bucket policies, except
+        // that public and cross-account access within any public bucket policy, including
+        // non-public delegation to specific accounts, is blocked.
+        RestrictPublicBuckets *bool `locationName:"RestrictPublicBuckets" type:"boolean"`
+}
+
+// String returns the string representation
+func (s PublicAccessBlockConfiguration) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PublicAccessBlockConfiguration) GoString() string {
+        return s.String()
+}
+
+// SetBlockPublicAcls sets the BlockPublicAcls field's value.
+func (s *PublicAccessBlockConfiguration) SetBlockPublicAcls(v bool) *PublicAccessBlockConfiguration {
+        s.BlockPublicAcls = &v
+        return s
+}
+
+// SetBlockPublicPolicy sets the BlockPublicPolicy field's value.
+func (s *PublicAccessBlockConfiguration) SetBlockPublicPolicy(v bool) *PublicAccessBlockConfiguration {
+        s.BlockPublicPolicy = &v
+        return s
+}
+
+// SetIgnorePublicAcls sets the IgnorePublicAcls field's value.
+func (s *PublicAccessBlockConfiguration) SetIgnorePublicAcls(v bool) *PublicAccessBlockConfiguration {
+        s.IgnorePublicAcls = &v
+        return s
+}
+
+// SetRestrictPublicBuckets sets the RestrictPublicBuckets field's value.
+func (s *PublicAccessBlockConfiguration) SetRestrictPublicBuckets(v bool) *PublicAccessBlockConfiguration {
+        s.RestrictPublicBuckets = &v
+        return s
+}
+
 type PutBucketAccelerateConfigurationInput struct {
         _ struct{} `type:"structure" payload:"AccelerateConfiguration"`
 
@@ -16652,6 +18526,9 @@ func (s *PutBucketAccelerateConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
 
         if invalidParams.Len() > 0 {
                 return invalidParams
@@ -16736,6 +18613,9 @@ func (s *PutBucketAclInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.AccessControlPolicy != nil {
                 if err := s.AccessControlPolicy.Validate(); err != nil {
                         invalidParams.AddNested("AccessControlPolicy", err.(request.ErrInvalidParams))
@@ -16855,6 +18735,9 @@ func (s *PutBucketAnalyticsConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Id == nil {
                 invalidParams.Add(request.NewErrParamRequired("Id"))
         }
@@ -16935,6 +18818,9 @@ func (s *PutBucketCorsInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.CORSConfiguration == nil {
                 invalidParams.Add(request.NewErrParamRequired("CORSConfiguration"))
         }
@@ -17015,6 +18901,9 @@ func (s *PutBucketEncryptionInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.ServerSideEncryptionConfiguration == nil {
                 invalidParams.Add(request.NewErrParamRequired("ServerSideEncryptionConfiguration"))
         }
@@ -17098,6 +18987,9 @@ func (s *PutBucketInventoryConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Id == nil {
                 invalidParams.Add(request.NewErrParamRequired("Id"))
         }
@@ -17180,6 +19072,9 @@ func (s *PutBucketLifecycleConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.LifecycleConfiguration != nil {
                 if err := s.LifecycleConfiguration.Validate(); err != nil {
                         invalidParams.AddNested("LifecycleConfiguration", err.(request.ErrInvalidParams))
@@ -17250,6 +19145,9 @@ func (s *PutBucketLifecycleInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.LifecycleConfiguration != nil {
                 if err := s.LifecycleConfiguration.Validate(); err != nil {
                         invalidParams.AddNested("LifecycleConfiguration", err.(request.ErrInvalidParams))
@@ -17321,6 +19219,9 @@ func (s *PutBucketLoggingInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.BucketLoggingStatus == nil {
                 invalidParams.Add(request.NewErrParamRequired("BucketLoggingStatus"))
         }
@@ -17404,6 +19305,9 @@ func (s *PutBucketMetricsConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Id == nil {
                 invalidParams.Add(request.NewErrParamRequired("Id"))
         }
@@ -17467,8 +19371,8 @@ type PutBucketNotificationConfigurationInput struct {
         // Bucket is a required field
         Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
 
-        // Container for specifying the notification configuration of the bucket. If
-        // this element is empty, notifications are turned off on the bucket.
+        // A container for specifying the notification configuration of the bucket.
+        // If this element is empty, notifications are turned off for the bucket.
         //
         // NotificationConfiguration is a required field
         NotificationConfiguration *NotificationConfiguration `locationName:"NotificationConfiguration" type:"structure" required:"true" xmlURI:"http://s3.amazonaws.com/doc/2006-03-01/"`
@@ -17490,6 +19394,9 @@ func (s *PutBucketNotificationConfigurationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.NotificationConfiguration == nil {
                 invalidParams.Add(request.NewErrParamRequired("NotificationConfiguration"))
         }
@@ -17564,6 +19471,9 @@ func (s *PutBucketNotificationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.NotificationConfiguration == nil {
                 invalidParams.Add(request.NewErrParamRequired("NotificationConfiguration"))
         }
@@ -17639,6 +19549,9 @@ func (s *PutBucketPolicyInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Policy == nil {
                 invalidParams.Add(request.NewErrParamRequired("Policy"))
         }
@@ -17694,8 +19607,8 @@ type PutBucketReplicationInput struct {
         // Bucket is a required field
         Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
 
-        // Container for replication rules. You can add as many as 1,000 rules. Total
-        // replication configuration size can be up to 2 MB.
+        // A container for replication rules. You can add up to 1,000 rules. The maximum
+        // size of a replication configuration is 2 MB.
         //
         // ReplicationConfiguration is a required field
         ReplicationConfiguration *ReplicationConfiguration `locationName:"ReplicationConfiguration" type:"structure" required:"true" xmlURI:"http://s3.amazonaws.com/doc/2006-03-01/"`
@@ -17717,6 +19630,9 @@ func (s *PutBucketReplicationInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.ReplicationConfiguration == nil {
                 invalidParams.Add(request.NewErrParamRequired("ReplicationConfiguration"))
         }
@@ -17791,6 +19707,9 @@ func (s *PutBucketRequestPaymentInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.RequestPaymentConfiguration == nil {
                 invalidParams.Add(request.NewErrParamRequired("RequestPaymentConfiguration"))
         }
@@ -17865,6 +19784,9 @@ func (s *PutBucketTaggingInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Tagging == nil {
                 invalidParams.Add(request.NewErrParamRequired("Tagging"))
         }
@@ -17943,6 +19865,9 @@ func (s *PutBucketVersioningInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.VersioningConfiguration == nil {
                 invalidParams.Add(request.NewErrParamRequired("VersioningConfiguration"))
         }
@@ -18018,6 +19943,9 @@ func (s *PutBucketWebsiteInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.WebsiteConfiguration == nil {
                 invalidParams.Add(request.NewErrParamRequired("WebsiteConfiguration"))
         }
@@ -18122,6 +20050,9 @@ func (s *PutObjectAclInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -18269,7 +20200,8 @@ type PutObjectInput struct {
         // body cannot be determined automatically.
         ContentLength *int64 `location:"header" locationName:"Content-Length" type:"long"`
 
-        // The base64-encoded 128-bit MD5 digest of the part data.
+        // The base64-encoded 128-bit MD5 digest of the part data. This parameter is
+        // auto-populated when using the command from the CLI
         ContentMD5 *string `location:"header" locationName:"Content-MD5" type:"string"`
 
         // A standard MIME type describing the format of the object data.
@@ -18298,6 +20230,15 @@ type PutObjectInput struct {
         // A map of metadata to store with the object in S3.
         Metadata map[string]*string `location:"headers" locationName:"x-amz-meta-" type:"map"`
 
+        // The Legal Hold status that you want to apply to the specified object.
+        ObjectLockLegalHoldStatus *string `location:"header" locationName:"x-amz-object-lock-legal-hold" type:"string" enum:"ObjectLockLegalHoldStatus"`
+
+        // The Object Lock mode that you want to apply to this object.
+        ObjectLockMode *string `location:"header" locationName:"x-amz-object-lock-mode" type:"string" enum:"ObjectLockMode"`
+
+        // The date and time when you want this object's Object Lock to expire.
+        ObjectLockRetainUntilDate *time.Time `location:"header" locationName:"x-amz-object-lock-retain-until-date" type:"timestamp" timestampFormat:"iso8601"`
+
         // Confirms that the requester knows that she or he will be charged for the
         // request. Bucket owners need not specify this parameter in their requests.
         // Documentation on downloading objects from requester pays buckets can be found
@@ -18312,7 +20253,7 @@ type PutObjectInput struct {
         // does not store the encryption key. The key must be appropriate for use with
         // the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm
         // header.
-        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string"`
+        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
         // Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
         // Amazon S3 uses this header for a message integrity check to ensure the encryption
@@ -18323,7 +20264,7 @@ type PutObjectInput struct {
         // requests for an object protected by AWS KMS will fail if not made via SSL
         // or using SigV4. Documentation on configuring any of the officially supported
         // AWS SDKs and CLI can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#specify-signature-version
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -18332,7 +20273,8 @@ type PutObjectInput struct {
         // The type of storage to use for the object. Defaults to 'STANDARD'.
         StorageClass *string `location:"header" locationName:"x-amz-storage-class" type:"string" enum:"StorageClass"`
 
-        // The tag-set for the object. The tag-set must be encoded as URL Query parameters
+        // The tag-set for the object. The tag-set must be encoded as URL Query parameters.
+        // (For example, "Key1=Value1")
         Tagging *string `location:"header" locationName:"x-amz-tagging" type:"string"`
 
         // If the bucket is configured as a website, redirects requests for this object
@@ -18357,6 +20299,9 @@ func (s *PutObjectInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -18479,6 +20424,24 @@ func (s *PutObjectInput) SetMetadata(v map[string]*string) *PutObjectInput {
         return s
 }
 
+// SetObjectLockLegalHoldStatus sets the ObjectLockLegalHoldStatus field's value.
+func (s *PutObjectInput) SetObjectLockLegalHoldStatus(v string) *PutObjectInput {
+        s.ObjectLockLegalHoldStatus = &v
+        return s
+}
+
+// SetObjectLockMode sets the ObjectLockMode field's value.
+func (s *PutObjectInput) SetObjectLockMode(v string) *PutObjectInput {
+        s.ObjectLockMode = &v
+        return s
+}
+
+// SetObjectLockRetainUntilDate sets the ObjectLockRetainUntilDate field's value.
+func (s *PutObjectInput) SetObjectLockRetainUntilDate(v time.Time) *PutObjectInput {
+        s.ObjectLockRetainUntilDate = &v
+        return s
+}
+
 // SetRequestPayer sets the RequestPayer field's value.
 func (s *PutObjectInput) SetRequestPayer(v string) *PutObjectInput {
         s.RequestPayer = &v
@@ -18540,6 +20503,228 @@ func (s *PutObjectInput) SetWebsiteRedirectLocation(v string) *PutObjectInput {
         return s
 }
 
+type PutObjectLegalHoldInput struct {
+        _ struct{} `type:"structure" payload:"LegalHold"`
+
+        // The bucket containing the object that you want to place a Legal Hold on.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+
+        // The key name for the object that you want to place a Legal Hold on.
+        //
+        // Key is a required field
+        Key *string `location:"uri" locationName:"Key" min:"1" type:"string" required:"true"`
+
+        // Container element for the Legal Hold configuration you want to apply to the
+        // specified object.
+        LegalHold *ObjectLockLegalHold `locationName:"LegalHold" type:"structure" xmlURI:"http://s3.amazonaws.com/doc/2006-03-01/"`
+
+        // Confirms that the requester knows that she or he will be charged for the
+        // request. Bucket owners need not specify this parameter in their requests.
+        // Documentation on downloading objects from requester pays buckets can be found
+        // at http://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
+        RequestPayer *string `location:"header" locationName:"x-amz-request-payer" type:"string" enum:"RequestPayer"`
+
+        // The version ID of the object that you want to place a Legal Hold on.
+        VersionId *string `location:"querystring" locationName:"versionId" type:"string"`
+}
+
+// String returns the string representation
+func (s PutObjectLegalHoldInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutObjectLegalHoldInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *PutObjectLegalHoldInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "PutObjectLegalHoldInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+        if s.Key == nil {
+                invalidParams.Add(request.NewErrParamRequired("Key"))
+        }
+        if s.Key != nil && len(*s.Key) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Key", 1))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *PutObjectLegalHoldInput) SetBucket(v string) *PutObjectLegalHoldInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *PutObjectLegalHoldInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+// SetKey sets the Key field's value.
+func (s *PutObjectLegalHoldInput) SetKey(v string) *PutObjectLegalHoldInput {
+        s.Key = &v
+        return s
+}
+
+// SetLegalHold sets the LegalHold field's value.
+func (s *PutObjectLegalHoldInput) SetLegalHold(v *ObjectLockLegalHold) *PutObjectLegalHoldInput {
+        s.LegalHold = v
+        return s
+}
+
+// SetRequestPayer sets the RequestPayer field's value.
+func (s *PutObjectLegalHoldInput) SetRequestPayer(v string) *PutObjectLegalHoldInput {
+        s.RequestPayer = &v
+        return s
+}
+
+// SetVersionId sets the VersionId field's value.
+func (s *PutObjectLegalHoldInput) SetVersionId(v string) *PutObjectLegalHoldInput {
+        s.VersionId = &v
+        return s
+}
+
+type PutObjectLegalHoldOutput struct {
+        _ struct{} `type:"structure"`
+
+        // If present, indicates that the requester was successfully charged for the
+        // request.
+        RequestCharged *string `location:"header" locationName:"x-amz-request-charged" type:"string" enum:"RequestCharged"`
+}
+
+// String returns the string representation
+func (s PutObjectLegalHoldOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutObjectLegalHoldOutput) GoString() string {
+        return s.String()
+}
+
+// SetRequestCharged sets the RequestCharged field's value.
+func (s *PutObjectLegalHoldOutput) SetRequestCharged(v string) *PutObjectLegalHoldOutput {
+        s.RequestCharged = &v
+        return s
+}
+
+type PutObjectLockConfigurationInput struct {
+        _ struct{} `type:"structure" payload:"ObjectLockConfiguration"`
+
+        // The bucket whose Object Lock configuration you want to create or replace.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+
+        // The Object Lock configuration that you want to apply to the specified bucket.
+        ObjectLockConfiguration *ObjectLockConfiguration `locationName:"ObjectLockConfiguration" type:"structure" xmlURI:"http://s3.amazonaws.com/doc/2006-03-01/"`
+
+        // Confirms that the requester knows that she or he will be charged for the
+        // request. Bucket owners need not specify this parameter in their requests.
+        // Documentation on downloading objects from requester pays buckets can be found
+        // at http://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
+        RequestPayer *string `location:"header" locationName:"x-amz-request-payer" type:"string" enum:"RequestPayer"`
+
+        // A token to allow Object Lock to be enabled for an existing bucket.
+        Token *string `location:"header" locationName:"x-amz-bucket-object-lock-token" type:"string"`
+}
+
+// String returns the string representation
+func (s PutObjectLockConfigurationInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutObjectLockConfigurationInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *PutObjectLockConfigurationInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "PutObjectLockConfigurationInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *PutObjectLockConfigurationInput) SetBucket(v string) *PutObjectLockConfigurationInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *PutObjectLockConfigurationInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+// SetObjectLockConfiguration sets the ObjectLockConfiguration field's value.
+func (s *PutObjectLockConfigurationInput) SetObjectLockConfiguration(v *ObjectLockConfiguration) *PutObjectLockConfigurationInput {
+        s.ObjectLockConfiguration = v
+        return s
+}
+
+// SetRequestPayer sets the RequestPayer field's value.
+func (s *PutObjectLockConfigurationInput) SetRequestPayer(v string) *PutObjectLockConfigurationInput {
+        s.RequestPayer = &v
+        return s
+}
+
+// SetToken sets the Token field's value.
+func (s *PutObjectLockConfigurationInput) SetToken(v string) *PutObjectLockConfigurationInput {
+        s.Token = &v
+        return s
+}
+
+type PutObjectLockConfigurationOutput struct {
+        _ struct{} `type:"structure"`
+
+        // If present, indicates that the requester was successfully charged for the
+        // request.
+        RequestCharged *string `location:"header" locationName:"x-amz-request-charged" type:"string" enum:"RequestCharged"`
+}
+
+// String returns the string representation
+func (s PutObjectLockConfigurationOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutObjectLockConfigurationOutput) GoString() string {
+        return s.String()
+}
+
+// SetRequestCharged sets the RequestCharged field's value.
+func (s *PutObjectLockConfigurationOutput) SetRequestCharged(v string) *PutObjectLockConfigurationOutput {
+        s.RequestCharged = &v
+        return s
+}
+
 type PutObjectOutput struct {
         _ struct{} `type:"structure"`
 
@@ -18566,7 +20751,7 @@ type PutObjectOutput struct {
 
         // If present, specifies the ID of the AWS Key Management Service (KMS) master
         // encryption key that was used for the object.
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -18634,6 +20819,137 @@ func (s *PutObjectOutput) SetVersionId(v string) *PutObjectOutput {
         return s
 }
 
+type PutObjectRetentionInput struct {
+        _ struct{} `type:"structure" payload:"Retention"`
+
+        // The bucket that contains the object you want to apply this Object Retention
+        // configuration to.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+
+        // Indicates whether this operation should bypass Governance-mode restrictions.j
+        BypassGovernanceRetention *bool `location:"header" locationName:"x-amz-bypass-governance-retention" type:"boolean"`
+
+        // The key name for the object that you want to apply this Object Retention
+        // configuration to.
+        //
+        // Key is a required field
+        Key *string `location:"uri" locationName:"Key" min:"1" type:"string" required:"true"`
+
+        // Confirms that the requester knows that she or he will be charged for the
+        // request. Bucket owners need not specify this parameter in their requests.
+        // Documentation on downloading objects from requester pays buckets can be found
+        // at http://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
+        RequestPayer *string `location:"header" locationName:"x-amz-request-payer" type:"string" enum:"RequestPayer"`
+
+        // The container element for the Object Retention configuration.
+        Retention *ObjectLockRetention `locationName:"Retention" type:"structure" xmlURI:"http://s3.amazonaws.com/doc/2006-03-01/"`
+
+        // The version ID for the object that you want to apply this Object Retention
+        // configuration to.
+        VersionId *string `location:"querystring" locationName:"versionId" type:"string"`
+}
+
+// String returns the string representation
+func (s PutObjectRetentionInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutObjectRetentionInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *PutObjectRetentionInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "PutObjectRetentionInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+        if s.Key == nil {
+                invalidParams.Add(request.NewErrParamRequired("Key"))
+        }
+        if s.Key != nil && len(*s.Key) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Key", 1))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *PutObjectRetentionInput) SetBucket(v string) *PutObjectRetentionInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *PutObjectRetentionInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+// SetBypassGovernanceRetention sets the BypassGovernanceRetention field's value.
+func (s *PutObjectRetentionInput) SetBypassGovernanceRetention(v bool) *PutObjectRetentionInput {
+        s.BypassGovernanceRetention = &v
+        return s
+}
+
+// SetKey sets the Key field's value.
+func (s *PutObjectRetentionInput) SetKey(v string) *PutObjectRetentionInput {
+        s.Key = &v
+        return s
+}
+
+// SetRequestPayer sets the RequestPayer field's value.
+func (s *PutObjectRetentionInput) SetRequestPayer(v string) *PutObjectRetentionInput {
+        s.RequestPayer = &v
+        return s
+}
+
+// SetRetention sets the Retention field's value.
+func (s *PutObjectRetentionInput) SetRetention(v *ObjectLockRetention) *PutObjectRetentionInput {
+        s.Retention = v
+        return s
+}
+
+// SetVersionId sets the VersionId field's value.
+func (s *PutObjectRetentionInput) SetVersionId(v string) *PutObjectRetentionInput {
+        s.VersionId = &v
+        return s
+}
+
+type PutObjectRetentionOutput struct {
+        _ struct{} `type:"structure"`
+
+        // If present, indicates that the requester was successfully charged for the
+        // request.
+        RequestCharged *string `location:"header" locationName:"x-amz-request-charged" type:"string" enum:"RequestCharged"`
+}
+
+// String returns the string representation
+func (s PutObjectRetentionOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutObjectRetentionOutput) GoString() string {
+        return s.String()
+}
+
+// SetRequestCharged sets the RequestCharged field's value.
+func (s *PutObjectRetentionOutput) SetRequestCharged(v string) *PutObjectRetentionOutput {
+        s.RequestCharged = &v
+        return s
+}
+
 type PutObjectTaggingInput struct {
         _ struct{} `type:"structure" payload:"Tagging"`
 
@@ -18665,6 +20981,9 @@ func (s *PutObjectTaggingInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -18739,25 +21058,107 @@ func (s *PutObjectTaggingOutput) SetVersionId(v string) *PutObjectTaggingOutput
         return s
 }
 
-// Container for specifying an configuration when you want Amazon S3 to publish
-// events to an Amazon Simple Queue Service (Amazon SQS) queue.
+type PutPublicAccessBlockInput struct {
+        _ struct{} `type:"structure" payload:"PublicAccessBlockConfiguration"`
+
+        // The name of the Amazon S3 bucket whose PublicAccessBlock configuration you
+        // want to set.
+        //
+        // Bucket is a required field
+        Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
+
+        // The PublicAccessBlock configuration that you want to apply to this Amazon
+        // S3 bucket. You can enable the configuration options in any combination. For
+        // more information about when Amazon S3 considers a bucket or object public,
+        // see The Meaning of "Public" (https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html#access-control-block-public-access-policy-status)
+        // in the Amazon Simple Storage Service Developer Guide.
+        //
+        // PublicAccessBlockConfiguration is a required field
+        PublicAccessBlockConfiguration *PublicAccessBlockConfiguration `locationName:"PublicAccessBlockConfiguration" type:"structure" required:"true" xmlURI:"http://s3.amazonaws.com/doc/2006-03-01/"`
+}
+
+// String returns the string representation
+func (s PutPublicAccessBlockInput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutPublicAccessBlockInput) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *PutPublicAccessBlockInput) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "PutPublicAccessBlockInput"}
+        if s.Bucket == nil {
+                invalidParams.Add(request.NewErrParamRequired("Bucket"))
+        }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
+        if s.PublicAccessBlockConfiguration == nil {
+                invalidParams.Add(request.NewErrParamRequired("PublicAccessBlockConfiguration"))
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetBucket sets the Bucket field's value.
+func (s *PutPublicAccessBlockInput) SetBucket(v string) *PutPublicAccessBlockInput {
+        s.Bucket = &v
+        return s
+}
+
+func (s *PutPublicAccessBlockInput) getBucket() (v string) {
+        if s.Bucket == nil {
+                return v
+        }
+        return *s.Bucket
+}
+
+// SetPublicAccessBlockConfiguration sets the PublicAccessBlockConfiguration field's value.
+func (s *PutPublicAccessBlockInput) SetPublicAccessBlockConfiguration(v *PublicAccessBlockConfiguration) *PutPublicAccessBlockInput {
+        s.PublicAccessBlockConfiguration = v
+        return s
+}
+
+type PutPublicAccessBlockOutput struct {
+        _ struct{} `type:"structure"`
+}
+
+// String returns the string representation
+func (s PutPublicAccessBlockOutput) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutPublicAccessBlockOutput) GoString() string {
+        return s.String()
+}
+
+// A container for specifying the configuration for publication of messages
+// to an Amazon Simple Queue Service (Amazon SQS) queue.when Amazon S3 detects
+// specified events.
 type QueueConfiguration struct {
         _ struct{} `type:"structure"`
 
         // Events is a required field
         Events []*string `locationName:"Event" type:"list" flattened:"true" required:"true"`
 
-        // Container for object key name filtering rules. For information about key
-        // name filtering, go to Configuring Event Notifications (http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
+        // A container for object key name filtering rules. For information about key
+        // name filtering, see Configuring Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
         // in the Amazon Simple Storage Service Developer Guide.
         Filter *NotificationConfigurationFilter `type:"structure"`
 
-        // Optional unique identifier for configurations in a notification configuration.
+        // An optional unique identifier for configurations in a notification configuration.
         // If you don't provide one, Amazon S3 will assign an ID.
         Id *string `type:"string"`
 
-        // Amazon SQS queue ARN to which Amazon S3 will publish a message when it detects
-        // events of specified type.
+        // The Amazon Resource Name (ARN) of the Amazon SQS queue to which Amazon S3
+        // will publish a message when it detects events of the specified type.
         //
         // QueueArn is a required field
         QueueArn *string `locationName:"Queue" type:"string" required:"true"`
@@ -18816,12 +21217,14 @@ func (s *QueueConfiguration) SetQueueArn(v string) *QueueConfiguration {
 type QueueConfigurationDeprecated struct {
         _ struct{} `type:"structure"`
 
-        // Bucket event for which to send notifications.
+        // The bucket event for which to send notifications.
+        //
+        // Deprecated: Event has been deprecated
         Event *string `deprecated:"true" type:"string" enum:"Event"`
 
         Events []*string `locationName:"Event" type:"list" flattened:"true"`
 
-        // Optional unique identifier for configurations in a notification configuration.
+        // An optional unique identifier for configurations in a notification configuration.
         // If you don't provide one, Amazon S3 will assign an ID.
         Id *string `type:"string"`
 
@@ -19017,19 +21420,19 @@ func (s *RedirectAllRequestsTo) SetProtocol(v string) *RedirectAllRequestsTo {
         return s
 }
 
-// Container for replication rules. You can add as many as 1,000 rules. Total
-// replication configuration size can be up to 2 MB.
+// A container for replication rules. You can add up to 1,000 rules. The maximum
+// size of a replication configuration is 2 MB.
 type ReplicationConfiguration struct {
         _ struct{} `type:"structure"`
 
-        // Amazon Resource Name (ARN) of an IAM role for Amazon S3 to assume when replicating
-        // the objects.
+        // The Amazon Resource Name (ARN) of the AWS Identity and Access Management
+        // (IAM) role that Amazon S3 can assume when replicating the objects.
         //
         // Role is a required field
         Role *string `type:"string" required:"true"`
 
-        // Container for information about a particular replication rule. Replication
-        // configuration must have at least one rule and can contain up to 1,000 rules.
+        // A container for one or more replication rules. A replication configuration
+        // must have at least one rule and can contain a maximum of 1,000 rules.
         //
         // Rules is a required field
         Rules []*ReplicationRule `locationName:"Rule" type:"list" flattened:"true" required:"true"`
@@ -19083,29 +21486,57 @@ func (s *ReplicationConfiguration) SetRules(v []*ReplicationRule) *ReplicationCo
         return s
 }
 
-// Container for information about a particular replication rule.
+// A container for information about a specific replication rule.
 type ReplicationRule struct {
         _ struct{} `type:"structure"`
 
-        // Container for replication destination information.
+        // Specifies whether Amazon S3 should replicate delete makers.
+        DeleteMarkerReplication *DeleteMarkerReplication `type:"structure"`
+
+        // A container for information about the replication destination.
         //
         // Destination is a required field
         Destination *Destination `type:"structure" required:"true"`
 
-        // Unique identifier for the rule. The value cannot be longer than 255 characters.
+        // A filter that identifies the subset of objects to which the replication rule
+        // applies. A Filter must specify exactly one Prefix, Tag, or an And child element.
+        Filter *ReplicationRuleFilter `type:"structure"`
+
+        // A unique identifier for the rule. The maximum value is 255 characters.
         ID *string `type:"string"`
 
-        // Object keyname prefix identifying one or more objects to which the rule applies.
-        // Maximum prefix length can be up to 1,024 characters. Overlapping prefixes
-        // are not supported.
+        // An object keyname prefix that identifies the object or objects to which the
+        // rule applies. The maximum prefix length is 1,024 characters.
         //
-        // Prefix is a required field
-        Prefix *string `type:"string" required:"true"`
+        // Deprecated: Prefix has been deprecated
+        Prefix *string `deprecated:"true" type:"string"`
 
-        // Container for filters that define which source objects should be replicated.
+        // The priority associated with the rule. If you specify multiple rules in a
+        // replication configuration, Amazon S3 prioritizes the rules to prevent conflicts
+        // when filtering. If two or more rules identify the same object based on a
+        // specified filter, the rule with higher priority takes precedence. For example:
+        //
+        //    * Same object quality prefix based filter criteria If prefixes you specified
+        //    in multiple rules overlap
+        //
+        //    * Same object qualify tag based filter criteria specified in multiple
+        //    rules
+        //
+        // For more information, see Cross-Region Replication (CRR) ( https://docs.aws.amazon.com/AmazonS3/latest/dev/crr.html)
+        // in the Amazon S3 Developer Guide.
+        Priority *int64 `type:"integer"`
+
+        // A container that describes additional filters for identifying the source
+        // objects that you want to replicate. You can choose to enable or disable the
+        // replication of these objects. Currently, Amazon S3 supports only the filter
+        // that you can specify for objects created with server-side encryption using
+        // an AWS KMS-Managed Key (SSE-KMS).
+        //
+        // If you want Amazon S3 to replicate objects created with server-side encryption
+        // using AWS KMS-Managed Keys.
         SourceSelectionCriteria *SourceSelectionCriteria `type:"structure"`
 
-        // The rule is ignored if status is not Enabled.
+        // If status isn't enabled, the rule is ignored.
         //
         // Status is a required field
         Status *string `type:"string" required:"true" enum:"ReplicationRuleStatus"`
@@ -19127,9 +21558,6 @@ func (s *ReplicationRule) Validate() error {
         if s.Destination == nil {
                 invalidParams.Add(request.NewErrParamRequired("Destination"))
         }
-        if s.Prefix == nil {
-                invalidParams.Add(request.NewErrParamRequired("Prefix"))
-        }
         if s.Status == nil {
                 invalidParams.Add(request.NewErrParamRequired("Status"))
         }
@@ -19138,6 +21566,11 @@ func (s *ReplicationRule) Validate() error {
                         invalidParams.AddNested("Destination", err.(request.ErrInvalidParams))
                 }
         }
+        if s.Filter != nil {
+                if err := s.Filter.Validate(); err != nil {
+                        invalidParams.AddNested("Filter", err.(request.ErrInvalidParams))
+                }
+        }
         if s.SourceSelectionCriteria != nil {
                 if err := s.SourceSelectionCriteria.Validate(); err != nil {
                         invalidParams.AddNested("SourceSelectionCriteria", err.(request.ErrInvalidParams))
@@ -19150,12 +21583,24 @@ func (s *ReplicationRule) Validate() error {
         return nil
 }
 
+// SetDeleteMarkerReplication sets the DeleteMarkerReplication field's value.
+func (s *ReplicationRule) SetDeleteMarkerReplication(v *DeleteMarkerReplication) *ReplicationRule {
+        s.DeleteMarkerReplication = v
+        return s
+}
+
 // SetDestination sets the Destination field's value.
 func (s *ReplicationRule) SetDestination(v *Destination) *ReplicationRule {
         s.Destination = v
         return s
 }
 
+// SetFilter sets the Filter field's value.
+func (s *ReplicationRule) SetFilter(v *ReplicationRuleFilter) *ReplicationRule {
+        s.Filter = v
+        return s
+}
+
 // SetID sets the ID field's value.
 func (s *ReplicationRule) SetID(v string) *ReplicationRule {
         s.ID = &v
@@ -19168,6 +21613,12 @@ func (s *ReplicationRule) SetPrefix(v string) *ReplicationRule {
         return s
 }
 
+// SetPriority sets the Priority field's value.
+func (s *ReplicationRule) SetPriority(v int64) *ReplicationRule {
+        s.Priority = &v
+        return s
+}
+
 // SetSourceSelectionCriteria sets the SourceSelectionCriteria field's value.
 func (s *ReplicationRule) SetSourceSelectionCriteria(v *SourceSelectionCriteria) *ReplicationRule {
         s.SourceSelectionCriteria = v
@@ -19180,6 +21631,130 @@ func (s *ReplicationRule) SetStatus(v string) *ReplicationRule {
         return s
 }
 
+type ReplicationRuleAndOperator struct {
+        _ struct{} `type:"structure"`
+
+        Prefix *string `type:"string"`
+
+        Tags []*Tag `locationName:"Tag" locationNameList:"Tag" type:"list" flattened:"true"`
+}
+
+// String returns the string representation
+func (s ReplicationRuleAndOperator) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ReplicationRuleAndOperator) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ReplicationRuleAndOperator) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "ReplicationRuleAndOperator"}
+        if s.Tags != nil {
+                for i, v := range s.Tags {
+                        if v == nil {
+                                continue
+                        }
+                        if err := v.Validate(); err != nil {
+                                invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams))
+                        }
+                }
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetPrefix sets the Prefix field's value.
+func (s *ReplicationRuleAndOperator) SetPrefix(v string) *ReplicationRuleAndOperator {
+        s.Prefix = &v
+        return s
+}
+
+// SetTags sets the Tags field's value.
+func (s *ReplicationRuleAndOperator) SetTags(v []*Tag) *ReplicationRuleAndOperator {
+        s.Tags = v
+        return s
+}
+
+// A filter that identifies the subset of objects to which the replication rule
+// applies. A Filter must specify exactly one Prefix, Tag, or an And child element.
+type ReplicationRuleFilter struct {
+        _ struct{} `type:"structure"`
+
+        // A container for specifying rule filters. The filters determine the subset
+        // of objects to which the rule applies. This element is required only if you
+        // specify more than one filter. For example:
+        //
+        //    * If you specify both a Prefix and a Tag filter, wrap these filters in
+        //    an And tag.
+        //
+        //    * If you specify a filter based on multiple tags, wrap the Tag elements
+        //    in an And tag.
+        And *ReplicationRuleAndOperator `type:"structure"`
+
+        // An object keyname prefix that identifies the subset of objects to which the
+        // rule applies.
+        Prefix *string `type:"string"`
+
+        // A container for specifying a tag key and value.
+        //
+        // The rule applies only to objects that have the tag in their tag set.
+        Tag *Tag `type:"structure"`
+}
+
+// String returns the string representation
+func (s ReplicationRuleFilter) String() string {
+        return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ReplicationRuleFilter) GoString() string {
+        return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ReplicationRuleFilter) Validate() error {
+        invalidParams := request.ErrInvalidParams{Context: "ReplicationRuleFilter"}
+        if s.And != nil {
+                if err := s.And.Validate(); err != nil {
+                        invalidParams.AddNested("And", err.(request.ErrInvalidParams))
+                }
+        }
+        if s.Tag != nil {
+                if err := s.Tag.Validate(); err != nil {
+                        invalidParams.AddNested("Tag", err.(request.ErrInvalidParams))
+                }
+        }
+
+        if invalidParams.Len() > 0 {
+                return invalidParams
+        }
+        return nil
+}
+
+// SetAnd sets the And field's value.
+func (s *ReplicationRuleFilter) SetAnd(v *ReplicationRuleAndOperator) *ReplicationRuleFilter {
+        s.And = v
+        return s
+}
+
+// SetPrefix sets the Prefix field's value.
+func (s *ReplicationRuleFilter) SetPrefix(v string) *ReplicationRuleFilter {
+        s.Prefix = &v
+        return s
+}
+
+// SetTag sets the Tag field's value.
+func (s *ReplicationRuleFilter) SetTag(v *Tag) *ReplicationRuleFilter {
+        s.Tag = v
+        return s
+}
+
 type RequestPaymentConfiguration struct {
         _ struct{} `type:"structure"`
 
@@ -19279,6 +21854,9 @@ func (s *RestoreObjectInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -19484,7 +22062,7 @@ type RoutingRule struct {
 
         // Container for redirect information. You can redirect requests to another
         // host, to another page, or with another protocol. In the event of an error,
-        // you can can specify a different error code to return.
+        // you can specify a different error code to return.
         //
         // Redirect is a required field
         Redirect *Redirect `type:"structure" required:"true"`
@@ -19545,11 +22123,12 @@ type Rule struct {
         NoncurrentVersionExpiration *NoncurrentVersionExpiration `type:"structure"`
 
         // Container for the transition rule that describes when noncurrent objects
-        // transition to the STANDARD_IA, ONEZONE_IA or GLACIER storage class. If your
-        // bucket is versioning-enabled (or versioning is suspended), you can set this
-        // action to request that Amazon S3 transition noncurrent object versions to
-        // the STANDARD_IA, ONEZONE_IA or GLACIER storage class at a specific period
-        // in the object's lifetime.
+        // transition to the STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER or
+        // DEEP_ARCHIVE storage class. If your bucket is versioning-enabled (or versioning
+        // is suspended), you can set this action to request that Amazon S3 transition
+        // noncurrent object versions to the STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING,
+        // GLACIER or DEEP_ARCHIVE storage class at a specific period in the object's
+        // lifetime.
         NoncurrentVersionTransition *NoncurrentVersionTransition `type:"structure"`
 
         // Prefix identifying one or more objects to which the rule applies.
@@ -19640,7 +22219,7 @@ func (s *Rule) SetTransition(v *Transition) *Rule {
         return s
 }
 
-// Specifies the use of SSE-KMS to encrypt delievered Inventory reports.
+// Specifies the use of SSE-KMS to encrypt delivered Inventory reports.
 type SSEKMS struct {
         _ struct{} `locationName:"SSE-KMS" type:"structure"`
 
@@ -19648,7 +22227,7 @@ type SSEKMS struct {
         // key to use for encrypting Inventory reports.
         //
         // KeyId is a required field
-        KeyId *string `type:"string" required:"true"`
+        KeyId *string `type:"string" required:"true" sensitive:"true"`
 }
 
 // String returns the string representation
@@ -19680,7 +22259,7 @@ func (s *SSEKMS) SetKeyId(v string) *SSEKMS {
         return s
 }
 
-// Specifies the use of SSE-S3 to encrypt delievered Inventory reports.
+// Specifies the use of SSE-S3 to encrypt delivered Inventory reports.
 type SSES3 struct {
         _ struct{} `locationName:"SSE-S3" type:"structure"`
 }
@@ -19797,7 +22376,7 @@ type SelectObjectContentEventStreamReader interface {
         // HTTP this will also close the HTTP connection.
         Close() error
 
-        // Returns any error that has occured while reading from the event stream.
+        // Returns any error that has occurred while reading from the event stream.
         Err() error
 }
 
@@ -19917,15 +22496,15 @@ func (r *readSelectObjectContentEventStream) unmarshalerForEventType(
 
 // Request to filter the contents of an Amazon S3 object based on a simple Structured
 // Query Language (SQL) statement. In the request, along with the SQL expression,
-// you must also specify a data serialization format (JSON or CSV) of the object.
-// Amazon S3 uses this to parse object data into records, and returns only records
+// you must specify a data serialization format (JSON or CSV) of the object.
+// Amazon S3 uses this to parse object data into records. It returns only records
 // that match the specified SQL expression. You must also specify the data serialization
-// format for the response. For more information, go to S3Select API Documentation
-// (http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectSELECTContent.html).
+// format for the response. For more information, see S3Select API Documentation
+// (https://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectSELECTContent.html).
 type SelectObjectContentInput struct {
         _ struct{} `locationName:"SelectObjectContentRequest" type:"structure" xmlURI:"http://s3.amazonaws.com/doc/2006-03-01/"`
 
-        // The S3 Bucket.
+        // The S3 bucket.
         //
         // Bucket is a required field
         Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
@@ -19935,7 +22514,7 @@ type SelectObjectContentInput struct {
         // Expression is a required field
         Expression *string `type:"string" required:"true"`
 
-        // The type of the provided expression (e.g., SQL).
+        // The type of the provided expression (for example., SQL).
         //
         // ExpressionType is a required field
         ExpressionType *string `type:"string" required:"true" enum:"ExpressionType"`
@@ -19945,7 +22524,7 @@ type SelectObjectContentInput struct {
         // InputSerialization is a required field
         InputSerialization *InputSerialization `type:"structure" required:"true"`
 
-        // The Object Key.
+        // The object key.
         //
         // Key is a required field
         Key *string `location:"uri" locationName:"Key" min:"1" type:"string" required:"true"`
@@ -19958,16 +22537,16 @@ type SelectObjectContentInput struct {
         // Specifies if periodic request progress information should be enabled.
         RequestProgress *RequestProgress `type:"structure"`
 
-        // The SSE Algorithm used to encrypt the object. For more information, go to
-        //  Server-Side Encryption (Using Customer-Provided Encryption Keys (http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html).
+        // The SSE Algorithm used to encrypt the object. For more information, see
+        // Server-Side Encryption (Using Customer-Provided Encryption Keys (https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html).
         SSECustomerAlgorithm *string `location:"header" locationName:"x-amz-server-side-encryption-customer-algorithm" type:"string"`
 
-        // The SSE Customer Key. For more information, go to  Server-Side Encryption
-        // (Using Customer-Provided Encryption Keys (http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html).
-        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string"`
+        // The SSE Customer Key. For more information, see  Server-Side Encryption (Using
+        // Customer-Provided Encryption Keys (https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html).
+        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
-        // The SSE Customer Key MD5. For more information, go to  Server-Side Encryption
-        // (Using Customer-Provided Encryption Keys (http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html).
+        // The SSE Customer Key MD5. For more information, see  Server-Side Encryption
+        // (Using Customer-Provided Encryption Keys (https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html).
         SSECustomerKeyMD5 *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key-MD5" type:"string"`
 }
 
@@ -19987,6 +22566,9 @@ func (s *SelectObjectContentInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Expression == nil {
                 invalidParams.Add(request.NewErrParamRequired("Expression"))
         }
@@ -20217,7 +22799,7 @@ type ServerSideEncryptionByDefault struct {
 
         // KMS master key ID to use for the default encryption. This parameter is allowed
         // if SSEAlgorithm is aws:kms.
-        KMSMasterKeyID *string `type:"string"`
+        KMSMasterKeyID *string `type:"string" sensitive:"true"`
 
         // Server-side encryption algorithm to use for the default encryption.
         //
@@ -20353,11 +22935,13 @@ func (s *ServerSideEncryptionRule) SetApplyServerSideEncryptionByDefault(v *Serv
         return s
 }
 
-// Container for filters that define which source objects should be replicated.
+// A container for filters that define which source objects should be replicated.
 type SourceSelectionCriteria struct {
         _ struct{} `type:"structure"`
 
-        // Container for filter information of selection of KMS Encrypted S3 objects.
+        // A container for filter information for the selection of S3 objects encrypted
+        // with AWS KMS. If you include SourceSelectionCriteria in the replication configuration,
+        // this element is required.
         SseKmsEncryptedObjects *SseKmsEncryptedObjects `type:"structure"`
 }
 
@@ -20392,12 +22976,13 @@ func (s *SourceSelectionCriteria) SetSseKmsEncryptedObjects(v *SseKmsEncryptedOb
         return s
 }
 
-// Container for filter information of selection of KMS Encrypted S3 objects.
+// A container for filter information for the selection of S3 objects encrypted
+// with AWS KMS.
 type SseKmsEncryptedObjects struct {
         _ struct{} `type:"structure"`
 
-        // The replication for KMS encrypted S3 objects is disabled if status is not
-        // Enabled.
+        // If the status is not Enabled, replication for S3 objects encrypted with AWS
+        // KMS is disabled.
         //
         // Status is a required field
         Status *string `type:"string" required:"true" enum:"SseKmsEncryptedObjectsStatus"`
@@ -20435,13 +23020,13 @@ func (s *SseKmsEncryptedObjects) SetStatus(v string) *SseKmsEncryptedObjects {
 type Stats struct {
         _ struct{} `type:"structure"`
 
-        // Total number of uncompressed object bytes processed.
+        // The total number of uncompressed object bytes processed.
         BytesProcessed *int64 `type:"long"`
 
-        // Total number of bytes of records payload data returned.
+        // The total number of bytes of records payload data returned.
         BytesReturned *int64 `type:"long"`
 
-        // Total number of object bytes scanned.
+        // The total number of object bytes scanned.
         BytesScanned *int64 `type:"long"`
 }
 
@@ -20756,25 +23341,26 @@ func (s *TargetGrant) SetPermission(v string) *TargetGrant {
         return s
 }
 
-// Container for specifying the configuration when you want Amazon S3 to publish
-// events to an Amazon Simple Notification Service (Amazon SNS) topic.
+// A container for specifying the configuration for publication of messages
+// to an Amazon Simple Notification Service (Amazon SNS) topic.when Amazon S3
+// detects specified events.
 type TopicConfiguration struct {
         _ struct{} `type:"structure"`
 
         // Events is a required field
         Events []*string `locationName:"Event" type:"list" flattened:"true" required:"true"`
 
-        // Container for object key name filtering rules. For information about key
-        // name filtering, go to Configuring Event Notifications (http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
+        // A container for object key name filtering rules. For information about key
+        // name filtering, see Configuring Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
         // in the Amazon Simple Storage Service Developer Guide.
         Filter *NotificationConfigurationFilter `type:"structure"`
 
-        // Optional unique identifier for configurations in a notification configuration.
+        // An optional unique identifier for configurations in a notification configuration.
         // If you don't provide one, Amazon S3 will assign an ID.
         Id *string `type:"string"`
 
-        // Amazon SNS topic ARN to which Amazon S3 will publish a message when it detects
-        // events of specified type.
+        // The Amazon Resource Name (ARN) of the Amazon SNS topic to which Amazon S3
+        // will publish a message when it detects events of the specified type.
         //
         // TopicArn is a required field
         TopicArn *string `locationName:"Topic" type:"string" required:"true"`
@@ -20834,11 +23420,13 @@ type TopicConfigurationDeprecated struct {
         _ struct{} `type:"structure"`
 
         // Bucket event for which to send notifications.
+        //
+        // Deprecated: Event has been deprecated
         Event *string `deprecated:"true" type:"string" enum:"Event"`
 
         Events []*string `locationName:"Event" type:"list" flattened:"true"`
 
-        // Optional unique identifier for configurations in a notification configuration.
+        // An optional unique identifier for configurations in a notification configuration.
         // If you don't provide one, Amazon S3 will assign an ID.
         Id *string `type:"string"`
 
@@ -20953,7 +23541,7 @@ type UploadPartCopyInput struct {
         // the form bytes=first-last, where the first and last are the zero-based byte
         // offsets to copy. For example, bytes=0-9 indicates that you want to copy the
         // first ten bytes of the source. You can copy a range only if the source object
-        // is greater than 5 GB.
+        // is greater than 5 MB.
         CopySourceRange *string `location:"header" locationName:"x-amz-copy-source-range" type:"string"`
 
         // Specifies the algorithm to use when decrypting the source object (e.g., AES256).
@@ -20962,7 +23550,7 @@ type UploadPartCopyInput struct {
         // Specifies the customer-provided encryption key for Amazon S3 to use to decrypt
         // the source object. The encryption key provided in this header must be one
         // that was used when the source object was created.
-        CopySourceSSECustomerKey *string `location:"header" locationName:"x-amz-copy-source-server-side-encryption-customer-key" type:"string"`
+        CopySourceSSECustomerKey *string `location:"header" locationName:"x-amz-copy-source-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
         // Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
         // Amazon S3 uses this header for a message integrity check to ensure the encryption
@@ -20993,7 +23581,7 @@ type UploadPartCopyInput struct {
         // the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm
         // header. This must be the same encryption key specified in the initiate multipart
         // upload request.
-        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string"`
+        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
         // Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
         // Amazon S3 uses this header for a message integrity check to ensure the encryption
@@ -21022,6 +23610,9 @@ func (s *UploadPartCopyInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.CopySource == nil {
                 invalidParams.Add(request.NewErrParamRequired("CopySource"))
         }
@@ -21192,7 +23783,7 @@ type UploadPartCopyOutput struct {
 
         // If present, specifies the ID of the AWS Key Management Service (KMS) master
         // encryption key that was used for the object.
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -21295,7 +23886,7 @@ type UploadPartInput struct {
         // the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm
         // header. This must be the same encryption key specified in the initiate multipart
         // upload request.
-        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string"`
+        SSECustomerKey *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
         // Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
         // Amazon S3 uses this header for a message integrity check to ensure the encryption
@@ -21324,6 +23915,9 @@ func (s *UploadPartInput) Validate() error {
         if s.Bucket == nil {
                 invalidParams.Add(request.NewErrParamRequired("Bucket"))
         }
+        if s.Bucket != nil && len(*s.Bucket) < 1 {
+                invalidParams.Add(request.NewErrParamMinLen("Bucket", 1))
+        }
         if s.Key == nil {
                 invalidParams.Add(request.NewErrParamRequired("Key"))
         }
@@ -21445,7 +24039,7 @@ type UploadPartOutput struct {
 
         // If present, specifies the ID of the AWS Key Management Service (KMS) master
         // encryption key that was used for the object.
-        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string"`
+        SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
         // The Server-side encryption algorithm used when storing this object in S3
         // (e.g., AES256, aws:kms).
@@ -21705,6 +24299,14 @@ const (
         CompressionTypeBzip2 = "BZIP2"
 )
 
+const (
+        // DeleteMarkerReplicationStatusEnabled is a DeleteMarkerReplicationStatus enum value
+        DeleteMarkerReplicationStatusEnabled = "Enabled"
+
+        // DeleteMarkerReplicationStatusDisabled is a DeleteMarkerReplicationStatus enum value
+        DeleteMarkerReplicationStatusDisabled = "Disabled"
+)
+
 // Requests Amazon S3 to encode the object keys in the response and specifies
 // the encoding method to use. An object key may contain any Unicode character;
 // however, XML 1.0 parser cannot parse some characters, such as characters
@@ -21716,7 +24318,7 @@ const (
         EncodingTypeUrl = "url"
 )
 
-// Bucket event for which to send notifications.
+// The bucket event for which to send notifications.
 const (
         // EventS3ReducedRedundancyLostObject is a Event enum value
         EventS3ReducedRedundancyLostObject = "s3:ReducedRedundancyLostObject"
@@ -21744,6 +24346,12 @@ const (
 
         // EventS3ObjectRemovedDeleteMarkerCreated is a Event enum value
         EventS3ObjectRemovedDeleteMarkerCreated = "s3:ObjectRemoved:DeleteMarkerCreated"
+
+        // EventS3ObjectRestorePost is a Event enum value
+        EventS3ObjectRestorePost = "s3:ObjectRestore:Post"
+
+        // EventS3ObjectRestoreCompleted is a Event enum value
+        EventS3ObjectRestoreCompleted = "s3:ObjectRestore:Completed"
 )
 
 const (
@@ -21784,6 +24392,9 @@ const (
 
         // InventoryFormatOrc is a InventoryFormat enum value
         InventoryFormatOrc = "ORC"
+
+        // InventoryFormatParquet is a InventoryFormat enum value
+        InventoryFormatParquet = "Parquet"
 )
 
 const (
@@ -21823,6 +24434,15 @@ const (
 
         // InventoryOptionalFieldEncryptionStatus is a InventoryOptionalField enum value
         InventoryOptionalFieldEncryptionStatus = "EncryptionStatus"
+
+        // InventoryOptionalFieldObjectLockRetainUntilDate is a InventoryOptionalField enum value
+        InventoryOptionalFieldObjectLockRetainUntilDate = "ObjectLockRetainUntilDate"
+
+        // InventoryOptionalFieldObjectLockMode is a InventoryOptionalField enum value
+        InventoryOptionalFieldObjectLockMode = "ObjectLockMode"
+
+        // InventoryOptionalFieldObjectLockLegalHoldStatus is a InventoryOptionalField enum value
+        InventoryOptionalFieldObjectLockLegalHoldStatus = "ObjectLockLegalHoldStatus"
 )
 
 const (
@@ -21881,6 +24501,35 @@ const (
 )
 
 const (
+        // ObjectLockEnabledEnabled is a ObjectLockEnabled enum value
+        ObjectLockEnabledEnabled = "Enabled"
+)
+
+const (
+        // ObjectLockLegalHoldStatusOn is a ObjectLockLegalHoldStatus enum value
+        ObjectLockLegalHoldStatusOn = "ON"
+
+        // ObjectLockLegalHoldStatusOff is a ObjectLockLegalHoldStatus enum value
+        ObjectLockLegalHoldStatusOff = "OFF"
+)
+
+const (
+        // ObjectLockModeGovernance is a ObjectLockMode enum value
+        ObjectLockModeGovernance = "GOVERNANCE"
+
+        // ObjectLockModeCompliance is a ObjectLockMode enum value
+        ObjectLockModeCompliance = "COMPLIANCE"
+)
+
+const (
+        // ObjectLockRetentionModeGovernance is a ObjectLockRetentionMode enum value
+        ObjectLockRetentionModeGovernance = "GOVERNANCE"
+
+        // ObjectLockRetentionModeCompliance is a ObjectLockRetentionMode enum value
+        ObjectLockRetentionModeCompliance = "COMPLIANCE"
+)
+
+const (
         // ObjectStorageClassStandard is a ObjectStorageClass enum value
         ObjectStorageClassStandard = "STANDARD"
 
@@ -21895,6 +24544,12 @@ const (
 
         // ObjectStorageClassOnezoneIa is a ObjectStorageClass enum value
         ObjectStorageClassOnezoneIa = "ONEZONE_IA"
+
+        // ObjectStorageClassIntelligentTiering is a ObjectStorageClass enum value
+        ObjectStorageClassIntelligentTiering = "INTELLIGENT_TIERING"
+
+        // ObjectStorageClassDeepArchive is a ObjectStorageClass enum value
+        ObjectStorageClassDeepArchive = "DEEP_ARCHIVE"
 )
 
 const (
@@ -22019,6 +24674,15 @@ const (
 
         // StorageClassOnezoneIa is a StorageClass enum value
         StorageClassOnezoneIa = "ONEZONE_IA"
+
+        // StorageClassIntelligentTiering is a StorageClass enum value
+        StorageClassIntelligentTiering = "INTELLIGENT_TIERING"
+
+        // StorageClassGlacier is a StorageClass enum value
+        StorageClassGlacier = "GLACIER"
+
+        // StorageClassDeepArchive is a StorageClass enum value
+        StorageClassDeepArchive = "DEEP_ARCHIVE"
 )
 
 const (
@@ -22054,6 +24718,12 @@ const (
 
         // TransitionStorageClassOnezoneIa is a TransitionStorageClass enum value
         TransitionStorageClassOnezoneIa = "ONEZONE_IA"
+
+        // TransitionStorageClassIntelligentTiering is a TransitionStorageClass enum value
+        TransitionStorageClassIntelligentTiering = "INTELLIGENT_TIERING"
+
+        // TransitionStorageClassDeepArchive is a TransitionStorageClass enum value
+        TransitionStorageClassDeepArchive = "DEEP_ARCHIVE"
 )
 
 const (
diff --git a/vendor/github.com/aws/aws-sdk-go/service/s3/customizations.go b/vendor/github.com/aws/aws-sdk-go/service/s3/customizations.go
index a55beab..95f2456 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/s3/customizations.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/s3/customizations.go
@@ -3,6 +3,7 @@ package s3
 import (
         "github.com/aws/aws-sdk-go/aws/client"
         "github.com/aws/aws-sdk-go/aws/request"
+        "github.com/aws/aws-sdk-go/internal/s3err"
 )
 
 func init() {
@@ -21,6 +22,7 @@ func defaultInitClientFn(c *client.Client) {
         // S3 uses custom error unmarshaling logic
         c.Handlers.UnmarshalError.Clear()
         c.Handlers.UnmarshalError.PushBack(unmarshalError)
+        c.Handlers.UnmarshalError.PushBackNamed(s3err.RequestFailureWrapperHandler())
 }
 
 func defaultInitRequestFn(r *request.Request) {
@@ -31,6 +33,7 @@ func defaultInitRequestFn(r *request.Request) {
         switch r.Operation.Name {
         case opPutBucketCors, opPutBucketLifecycle, opPutBucketPolicy,
                 opPutBucketTagging, opDeleteObjects, opPutBucketLifecycleConfiguration,
+                opPutObjectLegalHold, opPutObjectRetention, opPutObjectLockConfiguration,
                 opPutBucketReplication:
                 // These S3 operations require Content-MD5 to be set
                 r.Handlers.Build.PushBack(contentMD5)
@@ -42,6 +45,7 @@ func defaultInitRequestFn(r *request.Request) {
                 r.Handlers.Validate.PushFront(populateLocationConstraint)
         case opCopyObject, opUploadPartCopy, opCompleteMultipartUpload:
                 r.Handlers.Unmarshal.PushFront(copyMultipartStatusOKUnmarhsalError)
+                r.Handlers.Unmarshal.PushBackNamed(s3err.RequestFailureWrapperHandler())
         case opPutObject, opUploadPart:
                 r.Handlers.Build.PushBack(computeBodyHashes)
                 // Disabled until #1837 root issue is resolved.
diff --git a/vendor/github.com/aws/aws-sdk-go/service/s3/service.go b/vendor/github.com/aws/aws-sdk-go/service/s3/service.go
index 20de53f..d17dcc9 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/s3/service.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/s3/service.go
@@ -67,7 +67,9 @@ func newClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegio
         }
 
         // Handlers
-        svc.Handlers.Sign.PushBackNamed(v4.SignRequestHandler)
+        svc.Handlers.Sign.PushBackNamed(v4.BuildNamedHandler(v4.SignRequestHandler.Name, func(s *v4.Signer) {
+                s.DisableURIPathEscaping = true
+        }))
         svc.Handlers.Build.PushBackNamed(restxml.BuildHandler)
         svc.Handlers.Unmarshal.PushBackNamed(restxml.UnmarshalHandler)
         svc.Handlers.UnmarshalMeta.PushBackNamed(restxml.UnmarshalMetaHandler)
diff --git a/vendor/github.com/aws/aws-sdk-go/service/s3/statusok_error.go b/vendor/github.com/aws/aws-sdk-go/service/s3/statusok_error.go
index 9f33efc..fde3050 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/s3/statusok_error.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/s3/statusok_error.go
@@ -13,7 +13,11 @@ import (
 func copyMultipartStatusOKUnmarhsalError(r *request.Request) {
         b, err := ioutil.ReadAll(r.HTTPResponse.Body)
         if err != nil {
-                r.Error = awserr.New("SerializationError", "unable to read response body", err)
+                r.Error = awserr.NewRequestFailure(
+                        awserr.New("SerializationError", "unable to read response body", err),
+                        r.HTTPResponse.StatusCode,
+                        r.RequestID,
+                )
                 return
         }
         body := bytes.NewReader(b)
diff --git a/vendor/github.com/aws/aws-sdk-go/service/s3/unmarshal_error.go b/vendor/github.com/aws/aws-sdk-go/service/s3/unmarshal_error.go
index bcca862..1db7e13 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/s3/unmarshal_error.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/s3/unmarshal_error.go
@@ -23,22 +23,22 @@ func unmarshalError(r *request.Request) {
         defer r.HTTPResponse.Body.Close()
         defer io.Copy(ioutil.Discard, r.HTTPResponse.Body)
 
-        hostID := r.HTTPResponse.Header.Get("X-Amz-Id-2")
-
         // Bucket exists in a different region, and request needs
         // to be made to the correct region.
         if r.HTTPResponse.StatusCode == http.StatusMovedPermanently {
-                r.Error = requestFailure{
-                        RequestFailure: awserr.NewRequestFailure(
-                                awserr.New("BucketRegionError",
-                                        fmt.Sprintf("incorrect region, the bucket is not in '%s' region",
-                                                aws.StringValue(r.Config.Region)),
-                                        nil),
-                                r.HTTPResponse.StatusCode,
-                                r.RequestID,
-                        ),
-                        hostID: hostID,
+                msg := fmt.Sprintf(
+                        "incorrect region, the bucket is not in '%s' region at endpoint '%s'",
+                        aws.StringValue(r.Config.Region),
+                        aws.StringValue(r.Config.Endpoint),
+                )
+                if v := r.HTTPResponse.Header.Get("x-amz-bucket-region"); len(v) != 0 {
+                        msg += fmt.Sprintf(", bucket is in '%s' region", v)
                 }
+                r.Error = awserr.NewRequestFailure(
+                        awserr.New("BucketRegionError", msg, nil),
+                        r.HTTPResponse.StatusCode,
+                        r.RequestID,
+                )
                 return
         }
 
@@ -63,14 +63,11 @@ func unmarshalError(r *request.Request) {
                 errMsg = statusText
         }
 
-        r.Error = requestFailure{
-                RequestFailure: awserr.NewRequestFailure(
-                        awserr.New(errCode, errMsg, err),
-                        r.HTTPResponse.StatusCode,
-                        r.RequestID,
-                ),
-                hostID: hostID,
-        }
+        r.Error = awserr.NewRequestFailure(
+                awserr.New(errCode, errMsg, err),
+                r.HTTPResponse.StatusCode,
+                r.RequestID,
+        )
 }
 
 // A RequestFailure provides access to the S3 Request ID and Host ID values
@@ -83,21 +80,3 @@ type RequestFailure interface {
         // Host ID is the S3 Host ID needed for debug, and contacting support
         HostID() string
 }
-
-type requestFailure struct {
-        awserr.RequestFailure
-
-        hostID string
-}
-
-func (r requestFailure) Error() string {
-        extra := fmt.Sprintf("status code: %d, request id: %s, host id: %s",
-                r.StatusCode(), r.RequestID(), r.hostID)
-        return awserr.SprintError(r.Code(), r.Message(), extra, r.OrigErr())
-}
-func (r requestFailure) String() string {
-        return r.Error()
-}
-func (r requestFailure) HostID() string {
-        return r.hostID
-}
diff --git a/vendor/github.com/aws/aws-sdk-go/service/sts/api.go b/vendor/github.com/aws/aws-sdk-go/service/sts/api.go
index 6f89a79..8113089 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/sts/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/sts/api.go
@@ -7,6 +7,7 @@ import (
 
         "github.com/aws/aws-sdk-go/aws"
         "github.com/aws/aws-sdk-go/aws/awsutil"
+        "github.com/aws/aws-sdk-go/aws/credentials"
         "github.com/aws/aws-sdk-go/aws/request"
 )
 
@@ -15,7 +16,7 @@ const opAssumeRole = "AssumeRole"
 // AssumeRoleRequest generates a "aws/request.Request" representing the
 // client's request for the AssumeRole operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -209,7 +210,7 @@ const opAssumeRoleWithSAML = "AssumeRoleWithSAML"
 // AssumeRoleWithSAMLRequest generates a "aws/request.Request" representing the
 // client's request for the AssumeRoleWithSAML operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -243,6 +244,7 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 
         output = &AssumeRoleWithSAMLOutput{}
         req = c.newRequest(op, input, output)
+        req.Config.Credentials = credentials.AnonymousCredentials
         return
 }
 
@@ -391,7 +393,7 @@ const opAssumeRoleWithWebIdentity = "AssumeRoleWithWebIdentity"
 // AssumeRoleWithWebIdentityRequest generates a "aws/request.Request" representing the
 // client's request for the AssumeRoleWithWebIdentity operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -425,6 +427,7 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 
         output = &AssumeRoleWithWebIdentityOutput{}
         req = c.newRequest(op, input, output)
+        req.Config.Credentials = credentials.AnonymousCredentials
         return
 }
 
@@ -602,7 +605,7 @@ const opDecodeAuthorizationMessage = "DecodeAuthorizationMessage"
 // DecodeAuthorizationMessageRequest generates a "aws/request.Request" representing the
 // client's request for the DecodeAuthorizationMessage operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -714,7 +717,7 @@ const opGetCallerIdentity = "GetCallerIdentity"
 // GetCallerIdentityRequest generates a "aws/request.Request" representing the
 // client's request for the GetCallerIdentity operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -789,7 +792,7 @@ const opGetFederationToken = "GetFederationToken"
 // GetFederationTokenRequest generates a "aws/request.Request" representing the
 // client's request for the GetFederationToken operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
@@ -958,7 +961,7 @@ const opGetSessionToken = "GetSessionToken"
 // GetSessionTokenRequest generates a "aws/request.Request" representing the
 // client's request for the GetSessionToken operation. The "output" return
 // value will be populated with the request's response once the request completes
-// successfuly.
+// successfully.
 //
 // Use "Send" method on the returned Request to send the API call to the service.
 // the "output" return value is not valid until after Send returns without error.
diff --git a/vendor/github.com/aws/aws-sdk-go/service/sts/customizations.go b/vendor/github.com/aws/aws-sdk-go/service/sts/customizations.go
deleted file mode 100644
index 4010cc7..0000000
--- a/vendor/github.com/aws/aws-sdk-go/service/sts/customizations.go
+++ /dev/null
@@ -1,12 +0,0 @@
-package sts
-
-import "github.com/aws/aws-sdk-go/aws/request"
-
-func init() {
-        initRequest = func(r *request.Request) {
-                switch r.Operation.Name {
-                case opAssumeRoleWithSAML, opAssumeRoleWithWebIdentity:
-                        r.Handlers.Sign.Clear() // these operations are unsigned
-                }
-        }
-}
diff --git a/vendor/github.com/bgentry/speakeasy/LICENSE b/vendor/github.com/bgentry/speakeasy/LICENSE
new file mode 100644
index 0000000..37d60fc
--- /dev/null
+++ b/vendor/github.com/bgentry/speakeasy/LICENSE
@@ -0,0 +1,24 @@
+MIT License
+
+Copyright (c) 2017 Blake Gentry
+
+This license applies to the non-Windows portions of this library. The Windows
+portion maintains its own Apache 2.0 license.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/vendor/github.com/fatih/color/.travis.yml b/vendor/github.com/fatih/color/.travis.yml
new file mode 100644
index 0000000..95f8a1f
--- /dev/null
+++ b/vendor/github.com/fatih/color/.travis.yml
@@ -0,0 +1,5 @@
+language: go
+go: 
+ - 1.8.x
+ - tip
+
diff --git a/vendor/github.com/fatih/color/Gopkg.lock b/vendor/github.com/fatih/color/Gopkg.lock
new file mode 100644
index 0000000..7d879e9
--- /dev/null
+++ b/vendor/github.com/fatih/color/Gopkg.lock
@@ -0,0 +1,27 @@
+# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
+
+
+[[projects]]
+  name = "github.com/mattn/go-colorable"
+  packages = ["."]
+  revision = "167de6bfdfba052fa6b2d3664c8f5272e23c9072"
+  version = "v0.0.9"
+
+[[projects]]
+  name = "github.com/mattn/go-isatty"
+  packages = ["."]
+  revision = "0360b2af4f38e8d38c7fce2a9f4e702702d73a39"
+  version = "v0.0.3"
+
+[[projects]]
+  branch = "master"
+  name = "golang.org/x/sys"
+  packages = ["unix"]
+  revision = "37707fdb30a5b38865cfb95e5aab41707daec7fd"
+
+[solve-meta]
+  analyzer-name = "dep"
+  analyzer-version = 1
+  inputs-digest = "e8a50671c3cb93ea935bf210b1cd20702876b9d9226129be581ef646d1565cdc"
+  solver-name = "gps-cdcl"
+  solver-version = 1
diff --git a/vendor/github.com/fatih/color/Gopkg.toml b/vendor/github.com/fatih/color/Gopkg.toml
new file mode 100644
index 0000000..ff1617f
--- /dev/null
+++ b/vendor/github.com/fatih/color/Gopkg.toml
@@ -0,0 +1,30 @@
+
+# Gopkg.toml example
+#
+# Refer to https://github.com/golang/dep/blob/master/docs/Gopkg.toml.md
+# for detailed Gopkg.toml documentation.
+#
+# required = ["github.com/user/thing/cmd/thing"]
+# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
+#
+# [[constraint]]
+#   name = "github.com/user/project"
+#   version = "1.0.0"
+#
+# [[constraint]]
+#   name = "github.com/user/project2"
+#   branch = "dev"
+#   source = "github.com/myfork/project2"
+#
+# [[override]]
+#  name = "github.com/x/y"
+#  version = "2.4.0"
+
+
+[[constraint]]
+  name = "github.com/mattn/go-colorable"
+  version = "0.0.9"
+
+[[constraint]]
+  name = "github.com/mattn/go-isatty"
+  version = "0.0.3"
diff --git a/vendor/github.com/fatih/color/LICENSE.md b/vendor/github.com/fatih/color/LICENSE.md
new file mode 100644
index 0000000..25fdaf6
--- /dev/null
+++ b/vendor/github.com/fatih/color/LICENSE.md
@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2013 Fatih Arslan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/vendor/github.com/fatih/color/README.md b/vendor/github.com/fatih/color/README.md
new file mode 100644
index 0000000..3fc9544
--- /dev/null
+++ b/vendor/github.com/fatih/color/README.md
@@ -0,0 +1,179 @@
+# Color [![GoDoc](https://godoc.org/github.com/fatih/color?status.svg)](https://godoc.org/github.com/fatih/color) [![Build Status](https://img.shields.io/travis/fatih/color.svg?style=flat-square)](https://travis-ci.org/fatih/color)
+
+
+
+Color lets you use colorized outputs in terms of [ANSI Escape
+Codes](http://en.wikipedia.org/wiki/ANSI_escape_code#Colors) in Go (Golang). It
+has support for Windows too! The API can be used in several ways, pick one that
+suits you.
+
+
+![Color](https://i.imgur.com/c1JI0lA.png)
+
+
+## Install
+
+```bash
+go get github.com/fatih/color
+```
+
+Note that the `vendor` folder is here for stability. Remove the folder if you
+already have the dependencies in your GOPATH.
+
+## Examples
+
+### Standard colors
+
+```go
+// Print with default helper functions
+color.Cyan("Prints text in cyan.")
+
+// A newline will be appended automatically
+color.Blue("Prints %s in blue.", "text")
+
+// These are using the default foreground colors
+color.Red("We have red")
+color.Magenta("And many others ..")
+
+```
+
+### Mix and reuse colors
+
+```go
+// Create a new color object
+c := color.New(color.FgCyan).Add(color.Underline)
+c.Println("Prints cyan text with an underline.")
+
+// Or just add them to New()
+d := color.New(color.FgCyan, color.Bold)
+d.Printf("This prints bold cyan %s\n", "too!.")
+
+// Mix up foreground and background colors, create new mixes!
+red := color.New(color.FgRed)
+
+boldRed := red.Add(color.Bold)
+boldRed.Println("This will print text in bold red.")
+
+whiteBackground := red.Add(color.BgWhite)
+whiteBackground.Println("Red text with white background.")
+```
+
+### Use your own output (io.Writer)
+
+```go
+// Use your own io.Writer output
+color.New(color.FgBlue).Fprintln(myWriter, "blue color!")
+
+blue := color.New(color.FgBlue)
+blue.Fprint(writer, "This will print text in blue.")
+```
+
+### Custom print functions (PrintFunc)
+
+```go
+// Create a custom print function for convenience
+red := color.New(color.FgRed).PrintfFunc()
+red("Warning")
+red("Error: %s", err)
+
+// Mix up multiple attributes
+notice := color.New(color.Bold, color.FgGreen).PrintlnFunc()
+notice("Don't forget this...")
+```
+
+### Custom fprint functions (FprintFunc)
+
+```go
+blue := color.New(FgBlue).FprintfFunc()
+blue(myWriter, "important notice: %s", stars)
+
+// Mix up with multiple attributes
+success := color.New(color.Bold, color.FgGreen).FprintlnFunc()
+success(myWriter, "Don't forget this...")
+```
+
+### Insert into noncolor strings (SprintFunc)
+
+```go
+// Create SprintXxx functions to mix strings with other non-colorized strings:
+yellow := color.New(color.FgYellow).SprintFunc()
+red := color.New(color.FgRed).SprintFunc()
+fmt.Printf("This is a %s and this is %s.\n", yellow("warning"), red("error"))
+
+info := color.New(color.FgWhite, color.BgGreen).SprintFunc()
+fmt.Printf("This %s rocks!\n", info("package"))
+
+// Use helper functions
+fmt.Println("This", color.RedString("warning"), "should be not neglected.")
+fmt.Printf("%v %v\n", color.GreenString("Info:"), "an important message.")
+
+// Windows supported too! Just don't forget to change the output to color.Output
+fmt.Fprintf(color.Output, "Windows support: %s", color.GreenString("PASS"))
+```
+
+### Plug into existing code
+
+```go
+// Use handy standard colors
+color.Set(color.FgYellow)
+
+fmt.Println("Existing text will now be in yellow")
+fmt.Printf("This one %s\n", "too")
+
+color.Unset() // Don't forget to unset
+
+// You can mix up parameters
+color.Set(color.FgMagenta, color.Bold)
+defer color.Unset() // Use it in your function
+
+fmt.Println("All text will now be bold magenta.")
+```
+
+### Disable/Enable color
+ 
+There might be a case where you want to explicitly disable/enable color output. the 
+`go-isatty` package will automatically disable color output for non-tty output streams 
+(for example if the output were piped directly to `less`)
+
+`Color` has support to disable/enable colors both globally and for single color 
+definitions. For example suppose you have a CLI app and a `--no-color` bool flag. You 
+can easily disable the color output with:
+
+```go
+
+var flagNoColor = flag.Bool("no-color", false, "Disable color output")
+
+if *flagNoColor {
+        color.NoColor = true // disables colorized output
+}
+```
+
+It also has support for single color definitions (local). You can
+disable/enable color output on the fly:
+
+```go
+c := color.New(color.FgCyan)
+c.Println("Prints cyan text")
+
+c.DisableColor()
+c.Println("This is printed without any color")
+
+c.EnableColor()
+c.Println("This prints again cyan...")
+```
+
+## Todo
+
+* Save/Return previous values
+* Evaluate fmt.Formatter interface
+
+
+## Credits
+
+ * [Fatih Arslan](https://github.com/fatih)
+ * Windows support via @mattn: [colorable](https://github.com/mattn/go-colorable)
+
+## License
+
+The MIT License (MIT) - see [`LICENSE.md`](https://github.com/fatih/color/blob/master/LICENSE.md) for more details
+
diff --git a/vendor/github.com/fatih/color/color.go b/vendor/github.com/fatih/color/color.go
new file mode 100644
index 0000000..91c8e9f
--- /dev/null
+++ b/vendor/github.com/fatih/color/color.go
@@ -0,0 +1,603 @@
+package color
+
+import (
+        "fmt"
+        "io"
+        "os"
+        "strconv"
+        "strings"
+        "sync"
+
+        "github.com/mattn/go-colorable"
+        "github.com/mattn/go-isatty"
+)
+
+var (
+        // NoColor defines if the output is colorized or not. It's dynamically set to
+        // false or true based on the stdout's file descriptor referring to a terminal
+        // or not. This is a global option and affects all colors. For more control
+        // over each color block use the methods DisableColor() individually.
+        NoColor = os.Getenv("TERM") == "dumb" ||
+                (!isatty.IsTerminal(os.Stdout.Fd()) && !isatty.IsCygwinTerminal(os.Stdout.Fd()))
+
+        // Output defines the standard output of the print functions. By default
+        // os.Stdout is used.
+        Output = colorable.NewColorableStdout()
+
+        // Error defines a color supporting writer for os.Stderr.
+        Error = colorable.NewColorableStderr()
+
+        // colorsCache is used to reduce the count of created Color objects and
+        // allows to reuse already created objects with required Attribute.
+        colorsCache   = make(map[Attribute]*Color)
+        colorsCacheMu sync.Mutex // protects colorsCache
+)
+
+// Color defines a custom color object which is defined by SGR parameters.
+type Color struct {
+        params  []Attribute
+        noColor *bool
+}
+
+// Attribute defines a single SGR Code
+type Attribute int
+
+const escape = "\x1b"
+
+// Base attributes
+const (
+        Reset Attribute = iota
+        Bold
+        Faint
+        Italic
+        Underline
+        BlinkSlow
+        BlinkRapid
+        ReverseVideo
+        Concealed
+        CrossedOut
+)
+
+// Foreground text colors
+const (
+        FgBlack Attribute = iota + 30
+        FgRed
+        FgGreen
+        FgYellow
+        FgBlue
+        FgMagenta
+        FgCyan
+        FgWhite
+)
+
+// Foreground Hi-Intensity text colors
+const (
+        FgHiBlack Attribute = iota + 90
+        FgHiRed
+        FgHiGreen
+        FgHiYellow
+        FgHiBlue
+        FgHiMagenta
+        FgHiCyan
+        FgHiWhite
+)
+
+// Background text colors
+const (
+        BgBlack Attribute = iota + 40
+        BgRed
+        BgGreen
+        BgYellow
+        BgBlue
+        BgMagenta
+        BgCyan
+        BgWhite
+)
+
+// Background Hi-Intensity text colors
+const (
+        BgHiBlack Attribute = iota + 100
+        BgHiRed
+        BgHiGreen
+        BgHiYellow
+        BgHiBlue
+        BgHiMagenta
+        BgHiCyan
+        BgHiWhite
+)
+
+// New returns a newly created color object.
+func New(value ...Attribute) *Color {
+        c := &Color{params: make([]Attribute, 0)}
+        c.Add(value...)
+        return c
+}
+
+// Set sets the given parameters immediately. It will change the color of
+// output with the given SGR parameters until color.Unset() is called.
+func Set(p ...Attribute) *Color {
+        c := New(p...)
+        c.Set()
+        return c
+}
+
+// Unset resets all escape attributes and clears the output. Usually should
+// be called after Set().
+func Unset() {
+        if NoColor {
+                return
+        }
+
+        fmt.Fprintf(Output, "%s[%dm", escape, Reset)
+}
+
+// Set sets the SGR sequence.
+func (c *Color) Set() *Color {
+        if c.isNoColorSet() {
+                return c
+        }
+
+        fmt.Fprintf(Output, c.format())
+        return c
+}
+
+func (c *Color) unset() {
+        if c.isNoColorSet() {
+                return
+        }
+
+        Unset()
+}
+
+func (c *Color) setWriter(w io.Writer) *Color {
+        if c.isNoColorSet() {
+                return c
+        }
+
+        fmt.Fprintf(w, c.format())
+        return c
+}
+
+func (c *Color) unsetWriter(w io.Writer) {
+        if c.isNoColorSet() {
+                return
+        }
+
+        if NoColor {
+                return
+        }
+
+        fmt.Fprintf(w, "%s[%dm", escape, Reset)
+}
+
+// Add is used to chain SGR parameters. Use as many as parameters to combine
+// and create custom color objects. Example: Add(color.FgRed, color.Underline).
+func (c *Color) Add(value ...Attribute) *Color {
+        c.params = append(c.params, value...)
+        return c
+}
+
+func (c *Color) prepend(value Attribute) {
+        c.params = append(c.params, 0)
+        copy(c.params[1:], c.params[0:])
+        c.params[0] = value
+}
+
+// Fprint formats using the default formats for its operands and writes to w.
+// Spaces are added between operands when neither is a string.
+// It returns the number of bytes written and any write error encountered.
+// On Windows, users should wrap w with colorable.NewColorable() if w is of
+// type *os.File.
+func (c *Color) Fprint(w io.Writer, a ...interface{}) (n int, err error) {
+        c.setWriter(w)
+        defer c.unsetWriter(w)
+
+        return fmt.Fprint(w, a...)
+}
+
+// Print formats using the default formats for its operands and writes to
+// standard output. Spaces are added between operands when neither is a
+// string. It returns the number of bytes written and any write error
+// encountered. This is the standard fmt.Print() method wrapped with the given
+// color.
+func (c *Color) Print(a ...interface{}) (n int, err error) {
+        c.Set()
+        defer c.unset()
+
+        return fmt.Fprint(Output, a...)
+}
+
+// Fprintf formats according to a format specifier and writes to w.
+// It returns the number of bytes written and any write error encountered.
+// On Windows, users should wrap w with colorable.NewColorable() if w is of
+// type *os.File.
+func (c *Color) Fprintf(w io.Writer, format string, a ...interface{}) (n int, err error) {
+        c.setWriter(w)
+        defer c.unsetWriter(w)
+
+        return fmt.Fprintf(w, format, a...)
+}
+
+// Printf formats according to a format specifier and writes to standard output.
+// It returns the number of bytes written and any write error encountered.
+// This is the standard fmt.Printf() method wrapped with the given color.
+func (c *Color) Printf(format string, a ...interface{}) (n int, err error) {
+        c.Set()
+        defer c.unset()
+
+        return fmt.Fprintf(Output, format, a...)
+}
+
+// Fprintln formats using the default formats for its operands and writes to w.
+// Spaces are always added between operands and a newline is appended.
+// On Windows, users should wrap w with colorable.NewColorable() if w is of
+// type *os.File.
+func (c *Color) Fprintln(w io.Writer, a ...interface{}) (n int, err error) {
+        c.setWriter(w)
+        defer c.unsetWriter(w)
+
+        return fmt.Fprintln(w, a...)
+}
+
+// Println formats using the default formats for its operands and writes to
+// standard output. Spaces are always added between operands and a newline is
+// appended. It returns the number of bytes written and any write error
+// encountered. This is the standard fmt.Print() method wrapped with the given
+// color.
+func (c *Color) Println(a ...interface{}) (n int, err error) {
+        c.Set()
+        defer c.unset()
+
+        return fmt.Fprintln(Output, a...)
+}
+
+// Sprint is just like Print, but returns a string instead of printing it.
+func (c *Color) Sprint(a ...interface{}) string {
+        return c.wrap(fmt.Sprint(a...))
+}
+
+// Sprintln is just like Println, but returns a string instead of printing it.
+func (c *Color) Sprintln(a ...interface{}) string {
+        return c.wrap(fmt.Sprintln(a...))
+}
+
+// Sprintf is just like Printf, but returns a string instead of printing it.
+func (c *Color) Sprintf(format string, a ...interface{}) string {
+        return c.wrap(fmt.Sprintf(format, a...))
+}
+
+// FprintFunc returns a new function that prints the passed arguments as
+// colorized with color.Fprint().
+func (c *Color) FprintFunc() func(w io.Writer, a ...interface{}) {
+        return func(w io.Writer, a ...interface{}) {
+                c.Fprint(w, a...)
+        }
+}
+
+// PrintFunc returns a new function that prints the passed arguments as
+// colorized with color.Print().
+func (c *Color) PrintFunc() func(a ...interface{}) {
+        return func(a ...interface{}) {
+                c.Print(a...)
+        }
+}
+
+// FprintfFunc returns a new function that prints the passed arguments as
+// colorized with color.Fprintf().
+func (c *Color) FprintfFunc() func(w io.Writer, format string, a ...interface{}) {
+        return func(w io.Writer, format string, a ...interface{}) {
+                c.Fprintf(w, format, a...)
+        }
+}
+
+// PrintfFunc returns a new function that prints the passed arguments as
+// colorized with color.Printf().
+func (c *Color) PrintfFunc() func(format string, a ...interface{}) {
+        return func(format string, a ...interface{}) {
+                c.Printf(format, a...)
+        }
+}
+
+// FprintlnFunc returns a new function that prints the passed arguments as
+// colorized with color.Fprintln().
+func (c *Color) FprintlnFunc() func(w io.Writer, a ...interface{}) {
+        return func(w io.Writer, a ...interface{}) {
+                c.Fprintln(w, a...)
+        }
+}
+
+// PrintlnFunc returns a new function that prints the passed arguments as
+// colorized with color.Println().
+func (c *Color) PrintlnFunc() func(a ...interface{}) {
+        return func(a ...interface{}) {
+                c.Println(a...)
+        }
+}
+
+// SprintFunc returns a new function that returns colorized strings for the
+// given arguments with fmt.Sprint(). Useful to put into or mix into other
+// string. Windows users should use this in conjunction with color.Output, example:
+//
+//      put := New(FgYellow).SprintFunc()
+//      fmt.Fprintf(color.Output, "This is a %s", put("warning"))
+func (c *Color) SprintFunc() func(a ...interface{}) string {
+        return func(a ...interface{}) string {
+                return c.wrap(fmt.Sprint(a...))
+        }
+}
+
+// SprintfFunc returns a new function that returns colorized strings for the
+// given arguments with fmt.Sprintf(). Useful to put into or mix into other
+// string. Windows users should use this in conjunction with color.Output.
+func (c *Color) SprintfFunc() func(format string, a ...interface{}) string {
+        return func(format string, a ...interface{}) string {
+                return c.wrap(fmt.Sprintf(format, a...))
+        }
+}
+
+// SprintlnFunc returns a new function that returns colorized strings for the
+// given arguments with fmt.Sprintln(). Useful to put into or mix into other
+// string. Windows users should use this in conjunction with color.Output.
+func (c *Color) SprintlnFunc() func(a ...interface{}) string {
+        return func(a ...interface{}) string {
+                return c.wrap(fmt.Sprintln(a...))
+        }
+}
+
+// sequence returns a formatted SGR sequence to be plugged into a "\x1b[...m"
+// an example output might be: "1;36" -> bold cyan
+func (c *Color) sequence() string {
+        format := make([]string, len(c.params))
+        for i, v := range c.params {
+                format[i] = strconv.Itoa(int(v))
+        }
+
+        return strings.Join(format, ";")
+}
+
+// wrap wraps the s string with the colors attributes. The string is ready to
+// be printed.
+func (c *Color) wrap(s string) string {
+        if c.isNoColorSet() {
+                return s
+        }
+
+        return c.format() + s + c.unformat()
+}
+
+func (c *Color) format() string {
+        return fmt.Sprintf("%s[%sm", escape, c.sequence())
+}
+
+func (c *Color) unformat() string {
+        return fmt.Sprintf("%s[%dm", escape, Reset)
+}
+
+// DisableColor disables the color output. Useful to not change any existing
+// code and still being able to output. Can be used for flags like
+// "--no-color". To enable back use EnableColor() method.
+func (c *Color) DisableColor() {
+        c.noColor = boolPtr(true)
+}
+
+// EnableColor enables the color output. Use it in conjunction with
+// DisableColor(). Otherwise this method has no side effects.
+func (c *Color) EnableColor() {
+        c.noColor = boolPtr(false)
+}
+
+func (c *Color) isNoColorSet() bool {
+        // check first if we have user setted action
+        if c.noColor != nil {
+                return *c.noColor
+        }
+
+        // if not return the global option, which is disabled by default
+        return NoColor
+}
+
+// Equals returns a boolean value indicating whether two colors are equal.
+func (c *Color) Equals(c2 *Color) bool {
+        if len(c.params) != len(c2.params) {
+                return false
+        }
+
+        for _, attr := range c.params {
+                if !c2.attrExists(attr) {
+                        return false
+                }
+        }
+
+        return true
+}
+
+func (c *Color) attrExists(a Attribute) bool {
+        for _, attr := range c.params {
+                if attr == a {
+                        return true
+                }
+        }
+
+        return false
+}
+
+func boolPtr(v bool) *bool {
+        return &v
+}
+
+func getCachedColor(p Attribute) *Color {
+        colorsCacheMu.Lock()
+        defer colorsCacheMu.Unlock()
+
+        c, ok := colorsCache[p]
+        if !ok {
+                c = New(p)
+                colorsCache[p] = c
+        }
+
+        return c
+}
+
+func colorPrint(format string, p Attribute, a ...interface{}) {
+        c := getCachedColor(p)
+
+        if !strings.HasSuffix(format, "\n") {
+                format += "\n"
+        }
+
+        if len(a) == 0 {
+                c.Print(format)
+        } else {
+                c.Printf(format, a...)
+        }
+}
+
+func colorString(format string, p Attribute, a ...interface{}) string {
+        c := getCachedColor(p)
+
+        if len(a) == 0 {
+                return c.SprintFunc()(format)
+        }
+
+        return c.SprintfFunc()(format, a...)
+}
+
+// Black is a convenient helper function to print with black foreground. A
+// newline is appended to format by default.
+func Black(format string, a ...interface{}) { colorPrint(format, FgBlack, a...) }
+
+// Red is a convenient helper function to print with red foreground. A
+// newline is appended to format by default.
+func Red(format string, a ...interface{}) { colorPrint(format, FgRed, a...) }
+
+// Green is a convenient helper function to print with green foreground. A
+// newline is appended to format by default.
+func Green(format string, a ...interface{}) { colorPrint(format, FgGreen, a...) }
+
+// Yellow is a convenient helper function to print with yellow foreground.
+// A newline is appended to format by default.
+func Yellow(format string, a ...interface{}) { colorPrint(format, FgYellow, a...) }
+
+// Blue is a convenient helper function to print with blue foreground. A
+// newline is appended to format by default.
+func Blue(format string, a ...interface{}) { colorPrint(format, FgBlue, a...) }
+
+// Magenta is a convenient helper function to print with magenta foreground.
+// A newline is appended to format by default.
+func Magenta(format string, a ...interface{}) { colorPrint(format, FgMagenta, a...) }
+
+// Cyan is a convenient helper function to print with cyan foreground. A
+// newline is appended to format by default.
+func Cyan(format string, a ...interface{}) { colorPrint(format, FgCyan, a...) }
+
+// White is a convenient helper function to print with white foreground. A
+// newline is appended to format by default.
+func White(format string, a ...interface{}) { colorPrint(format, FgWhite, a...) }
+
+// BlackString is a convenient helper function to return a string with black
+// foreground.
+func BlackString(format string, a ...interface{}) string { return colorString(format, FgBlack, a...) }
+
+// RedString is a convenient helper function to return a string with red
+// foreground.
+func RedString(format string, a ...interface{}) string { return colorString(format, FgRed, a...) }
+
+// GreenString is a convenient helper function to return a string with green
+// foreground.
+func GreenString(format string, a ...interface{}) string { return colorString(format, FgGreen, a...) }
+
+// YellowString is a convenient helper function to return a string with yellow
+// foreground.
+func YellowString(format string, a ...interface{}) string { return colorString(format, FgYellow, a...) }
+
+// BlueString is a convenient helper function to return a string with blue
+// foreground.
+func BlueString(format string, a ...interface{}) string { return colorString(format, FgBlue, a...) }
+
+// MagentaString is a convenient helper function to return a string with magenta
+// foreground.
+func MagentaString(format string, a ...interface{}) string {
+        return colorString(format, FgMagenta, a...)
+}
+
+// CyanString is a convenient helper function to return a string with cyan
+// foreground.
+func CyanString(format string, a ...interface{}) string { return colorString(format, FgCyan, a...) }
+
+// WhiteString is a convenient helper function to return a string with white
+// foreground.
+func WhiteString(format string, a ...interface{}) string { return colorString(format, FgWhite, a...) }
+
+// HiBlack is a convenient helper function to print with hi-intensity black foreground. A
+// newline is appended to format by default.
+func HiBlack(format string, a ...interface{}) { colorPrint(format, FgHiBlack, a...) }
+
+// HiRed is a convenient helper function to print with hi-intensity red foreground. A
+// newline is appended to format by default.
+func HiRed(format string, a ...interface{}) { colorPrint(format, FgHiRed, a...) }
+
+// HiGreen is a convenient helper function to print with hi-intensity green foreground. A
+// newline is appended to format by default.
+func HiGreen(format string, a ...interface{}) { colorPrint(format, FgHiGreen, a...) }
+
+// HiYellow is a convenient helper function to print with hi-intensity yellow foreground.
+// A newline is appended to format by default.
+func HiYellow(format string, a ...interface{}) { colorPrint(format, FgHiYellow, a...) }
+
+// HiBlue is a convenient helper function to print with hi-intensity blue foreground. A
+// newline is appended to format by default.
+func HiBlue(format string, a ...interface{}) { colorPrint(format, FgHiBlue, a...) }
+
+// HiMagenta is a convenient helper function to print with hi-intensity magenta foreground.
+// A newline is appended to format by default.
+func HiMagenta(format string, a ...interface{}) { colorPrint(format, FgHiMagenta, a...) }
+
+// HiCyan is a convenient helper function to print with hi-intensity cyan foreground. A
+// newline is appended to format by default.
+func HiCyan(format string, a ...interface{}) { colorPrint(format, FgHiCyan, a...) }
+
+// HiWhite is a convenient helper function to print with hi-intensity white foreground. A
+// newline is appended to format by default.
+func HiWhite(format string, a ...interface{}) { colorPrint(format, FgHiWhite, a...) }
+
+// HiBlackString is a convenient helper function to return a string with hi-intensity black
+// foreground.
+func HiBlackString(format string, a ...interface{}) string {
+        return colorString(format, FgHiBlack, a...)
+}
+
+// HiRedString is a convenient helper function to return a string with hi-intensity red
+// foreground.
+func HiRedString(format string, a ...interface{}) string { return colorString(format, FgHiRed, a...) }
+
+// HiGreenString is a convenient helper function to return a string with hi-intensity green
+// foreground.
+func HiGreenString(format string, a ...interface{}) string {
+        return colorString(format, FgHiGreen, a...)
+}
+
+// HiYellowString is a convenient helper function to return a string with hi-intensity yellow
+// foreground.
+func HiYellowString(format string, a ...interface{}) string {
+        return colorString(format, FgHiYellow, a...)
+}
+
+// HiBlueString is a convenient helper function to return a string with hi-intensity blue
+// foreground.
+func HiBlueString(format string, a ...interface{}) string { return colorString(format, FgHiBlue, a...) }
+
+// HiMagentaString is a convenient helper function to return a string with hi-intensity magenta
+// foreground.
+func HiMagentaString(format string, a ...interface{}) string {
+        return colorString(format, FgHiMagenta, a...)
+}
+
+// HiCyanString is a convenient helper function to return a string with hi-intensity cyan
+// foreground.
+func HiCyanString(format string, a ...interface{}) string { return colorString(format, FgHiCyan, a...) }
+
+// HiWhiteString is a convenient helper function to return a string with hi-intensity white
+// foreground.
+func HiWhiteString(format string, a ...interface{}) string {
+        return colorString(format, FgHiWhite, a...)
+}
diff --git a/vendor/github.com/fatih/color/doc.go b/vendor/github.com/fatih/color/doc.go
new file mode 100644
index 0000000..cf1e965
--- /dev/null
+++ b/vendor/github.com/fatih/color/doc.go
@@ -0,0 +1,133 @@
+/*
+Package color is an ANSI color package to output colorized or SGR defined
+output to the standard output. The API can be used in several way, pick one
+that suits you.
+
+Use simple and default helper functions with predefined foreground colors:
+
+    color.Cyan("Prints text in cyan.")
+
+    // a newline will be appended automatically
+    color.Blue("Prints %s in blue.", "text")
+
+    // More default foreground colors..
+    color.Red("We have red")
+    color.Yellow("Yellow color too!")
+    color.Magenta("And many others ..")
+
+    // Hi-intensity colors
+    color.HiGreen("Bright green color.")
+    color.HiBlack("Bright black means gray..")
+    color.HiWhite("Shiny white color!")
+
+However there are times where custom color mixes are required. Below are some
+examples to create custom color objects and use the print functions of each
+separate color object.
+
+    // Create a new color object
+    c := color.New(color.FgCyan).Add(color.Underline)
+    c.Println("Prints cyan text with an underline.")
+
+    // Or just add them to New()
+    d := color.New(color.FgCyan, color.Bold)
+    d.Printf("This prints bold cyan %s\n", "too!.")
+
+
+    // Mix up foreground and background colors, create new mixes!
+    red := color.New(color.FgRed)
+
+    boldRed := red.Add(color.Bold)
+    boldRed.Println("This will print text in bold red.")
+
+    whiteBackground := red.Add(color.BgWhite)
+    whiteBackground.Println("Red text with White background.")
+
+    // Use your own io.Writer output
+    color.New(color.FgBlue).Fprintln(myWriter, "blue color!")
+
+    blue := color.New(color.FgBlue)
+    blue.Fprint(myWriter, "This will print text in blue.")
+
+You can create PrintXxx functions to simplify even more:
+
+    // Create a custom print function for convenient
+    red := color.New(color.FgRed).PrintfFunc()
+    red("warning")
+    red("error: %s", err)
+
+    // Mix up multiple attributes
+    notice := color.New(color.Bold, color.FgGreen).PrintlnFunc()
+    notice("don't forget this...")
+
+You can also FprintXxx functions to pass your own io.Writer:
+
+    blue := color.New(FgBlue).FprintfFunc()
+    blue(myWriter, "important notice: %s", stars)
+
+    // Mix up with multiple attributes
+    success := color.New(color.Bold, color.FgGreen).FprintlnFunc()
+    success(myWriter, don't forget this...")
+
+
+Or create SprintXxx functions to mix strings with other non-colorized strings:
+
+    yellow := New(FgYellow).SprintFunc()
+    red := New(FgRed).SprintFunc()
+
+    fmt.Printf("this is a %s and this is %s.\n", yellow("warning"), red("error"))
+
+    info := New(FgWhite, BgGreen).SprintFunc()
+    fmt.Printf("this %s rocks!\n", info("package"))
+
+Windows support is enabled by default. All Print functions work as intended.
+However only for color.SprintXXX functions, user should use fmt.FprintXXX and
+set the output to color.Output:
+
+    fmt.Fprintf(color.Output, "Windows support: %s", color.GreenString("PASS"))
+
+    info := New(FgWhite, BgGreen).SprintFunc()
+    fmt.Fprintf(color.Output, "this %s rocks!\n", info("package"))
+
+Using with existing code is possible. Just use the Set() method to set the
+standard output to the given parameters. That way a rewrite of an existing
+code is not required.
+
+    // Use handy standard colors.
+    color.Set(color.FgYellow)
+
+    fmt.Println("Existing text will be now in Yellow")
+    fmt.Printf("This one %s\n", "too")
+
+    color.Unset() // don't forget to unset
+
+    // You can mix up parameters
+    color.Set(color.FgMagenta, color.Bold)
+    defer color.Unset() // use it in your function
+
+    fmt.Println("All text will be now bold magenta.")
+
+There might be a case where you want to disable color output (for example to
+pipe the standard output of your app to somewhere else). `Color` has support to
+disable colors both globally and for single color definition. For example
+suppose you have a CLI app and a `--no-color` bool flag. You can easily disable
+the color output with:
+
+    var flagNoColor = flag.Bool("no-color", false, "Disable color output")
+
+    if *flagNoColor {
+        color.NoColor = true // disables colorized output
+    }
+
+It also has support for single color definitions (local). You can
+disable/enable color output on the fly:
+
+     c := color.New(color.FgCyan)
+     c.Println("Prints cyan text")
+
+     c.DisableColor()
+     c.Println("This is printed without any color")
+
+     c.EnableColor()
+     c.Println("This prints again cyan...")
+*/
+package color
diff --git a/vendor/github.com/go-ini/ini/.gitignore b/vendor/github.com/go-ini/ini/.gitignore
deleted file mode 100644
index c5203bf..0000000
--- a/vendor/github.com/go-ini/ini/.gitignore
+++ /dev/null
@@ -1,5 +0,0 @@
-testdata/conf_out.ini
-ini.sublime-project
-ini.sublime-workspace
-testdata/conf_reflect.ini
-.idea
diff --git a/vendor/github.com/go-ini/ini/.travis.yml b/vendor/github.com/go-ini/ini/.travis.yml
deleted file mode 100644
index 65c872b..0000000
--- a/vendor/github.com/go-ini/ini/.travis.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-sudo: false
-language: go
-go:
-  - 1.4.x
-  - 1.5.x
-  - 1.6.x
-  - 1.7.x
-  - master
-
-script: 
-  - go get golang.org/x/tools/cmd/cover
-  - go get github.com/smartystreets/goconvey
-  - go test -v -cover -race
-
-notifications:
-  email:
-    - u@gogs.io
diff --git a/vendor/github.com/go-ini/ini/LICENSE b/vendor/github.com/go-ini/ini/LICENSE
deleted file mode 100644
index 37ec93a..0000000
--- a/vendor/github.com/go-ini/ini/LICENSE
+++ /dev/null
@@ -1,191 +0,0 @@
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction, and
-distribution as defined by Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by the copyright
-owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all other entities
-that control, are controlled by, or are under common control with that entity.
-For the purposes of this definition, "control" means (i) the power, direct or
-indirect, to cause the direction or management of such entity, whether by
-contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
-outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity exercising
-permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications, including
-but not limited to software source code, documentation source, and configuration
-files.
-
-"Object" form shall mean any form resulting from mechanical transformation or
-translation of a Source form, including but not limited to compiled object code,
-generated documentation, and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or Object form, made
-available under the License, as indicated by a copyright notice that is included
-in or attached to the work (an example is provided in the Appendix below).
-
-"Derivative Works" shall mean any work, whether in Source or Object form, that
-is based on (or derived from) the Work and for which the editorial revisions,
-annotations, elaborations, or other modifications represent, as a whole, an
-original work of authorship. For the purposes of this License, Derivative Works
-shall not include works that remain separable from, or merely link (or bind by
-name) to the interfaces of, the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including the original version
-of the Work and any modifications or additions to that Work or Derivative Works
-thereof, that is intentionally submitted to Licensor for inclusion in the Work
-by the copyright owner or by an individual or Legal Entity authorized to submit
-on behalf of the copyright owner. For the purposes of this definition,
-"submitted" means any form of electronic, verbal, or written communication sent
-to the Licensor or its representatives, including but not limited to
-communication on electronic mailing lists, source code control systems, and
-issue tracking systems that are managed by, or on behalf of, the Licensor for
-the purpose of discussing and improving the Work, but excluding communication
-that is conspicuously marked or otherwise designated in writing by the copyright
-owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
-of whom a Contribution has been received by Licensor and subsequently
-incorporated within the Work.
-
-2. Grant of Copyright License.
-
-Subject to the terms and conditions of this License, each Contributor hereby
-grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
-irrevocable copyright license to reproduce, prepare Derivative Works of,
-publicly display, publicly perform, sublicense, and distribute the Work and such
-Derivative Works in Source or Object form.
-
-3. Grant of Patent License.
-
-Subject to the terms and conditions of this License, each Contributor hereby
-grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
-irrevocable (except as stated in this section) patent license to make, have
-made, use, offer to sell, sell, import, and otherwise transfer the Work, where
-such license applies only to those patent claims licensable by such Contributor
-that are necessarily infringed by their Contribution(s) alone or by combination
-of their Contribution(s) with the Work to which such Contribution(s) was
-submitted. If You institute patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Work or a
-Contribution incorporated within the Work constitutes direct or contributory
-patent infringement, then any patent licenses granted to You under this License
-for that Work shall terminate as of the date such litigation is filed.
-
-4. Redistribution.
-
-You may reproduce and distribute copies of the Work or Derivative Works thereof
-in any medium, with or without modifications, and in Source or Object form,
-provided that You meet the following conditions:
-
-You must give any other recipients of the Work or Derivative Works a copy of
-this License; and
-You must cause any modified files to carry prominent notices stating that You
-changed the files; and
-You must retain, in the Source form of any Derivative Works that You distribute,
-all copyright, patent, trademark, and attribution notices from the Source form
-of the Work, excluding those notices that do not pertain to any part of the
-Derivative Works; and
-If the Work includes a "NOTICE" text file as part of its distribution, then any
-Derivative Works that You distribute must include a readable copy of the
-attribution notices contained within such NOTICE file, excluding those notices
-that do not pertain to any part of the Derivative Works, in at least one of the
-following places: within a NOTICE text file distributed as part of the
-Derivative Works; within the Source form or documentation, if provided along
-with the Derivative Works; or, within a display generated by the Derivative
-Works, if and wherever such third-party notices normally appear. The contents of
-the NOTICE file are for informational purposes only and do not modify the
-License. You may add Your own attribution notices within Derivative Works that
-You distribute, alongside or as an addendum to the NOTICE text from the Work,
-provided that such additional attribution notices cannot be construed as
-modifying the License.
-You may add Your own copyright statement to Your modifications and may provide
-additional or different license terms and conditions for use, reproduction, or
-distribution of Your modifications, or for any such Derivative Works as a whole,
-provided Your use, reproduction, and distribution of the Work otherwise complies
-with the conditions stated in this License.
-
-5. Submission of Contributions.
-
-Unless You explicitly state otherwise, any Contribution intentionally submitted
-for inclusion in the Work by You to the Licensor shall be under the terms and
-conditions of this License, without any additional terms or conditions.
-Notwithstanding the above, nothing herein shall supersede or modify the terms of
-any separate license agreement you may have executed with Licensor regarding
-such Contributions.
-
-6. Trademarks.
-
-This License does not grant permission to use the trade names, trademarks,
-service marks, or product names of the Licensor, except as required for
-reasonable and customary use in describing the origin of the Work and
-reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty.
-
-Unless required by applicable law or agreed to in writing, Licensor provides the
-Work (and each Contributor provides its Contributions) on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,
-including, without limitation, any warranties or conditions of TITLE,
-NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are
-solely responsible for determining the appropriateness of using or
-redistributing the Work and assume any risks associated with Your exercise of
-permissions under this License.
-
-8. Limitation of Liability.
-
-In no event and under no legal theory, whether in tort (including negligence),
-contract, or otherwise, unless required by applicable law (such as deliberate
-and grossly negligent acts) or agreed to in writing, shall any Contributor be
-liable to You for damages, including any direct, indirect, special, incidental,
-or consequential damages of any character arising as a result of this License or
-out of the use or inability to use the Work (including but not limited to
-damages for loss of goodwill, work stoppage, computer failure or malfunction, or
-any and all other commercial damages or losses), even if such Contributor has
-been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability.
-
-While redistributing the Work or Derivative Works thereof, You may choose to
-offer, and charge a fee for, acceptance of support, warranty, indemnity, or
-other liability obligations and/or rights consistent with this License. However,
-in accepting such obligations, You may act only on Your own behalf and on Your
-sole responsibility, not on behalf of any other Contributor, and only if You
-agree to indemnify, defend, and hold each Contributor harmless for any liability
-incurred by, or claims asserted against, such Contributor by reason of your
-accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work
-
-To apply the Apache License to your work, attach the following boilerplate
-notice, with the fields enclosed by brackets "[]" replaced with your own
-identifying information. (Don't include the brackets!) The text should be
-enclosed in the appropriate comment syntax for the file format. We also
-recommend that a file or class name and description of purpose be included on
-the same "printed page" as the copyright notice for easier identification within
-third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/vendor/github.com/go-ini/ini/Makefile b/vendor/github.com/go-ini/ini/Makefile
deleted file mode 100644
index ac034e5..0000000
--- a/vendor/github.com/go-ini/ini/Makefile
+++ /dev/null
@@ -1,12 +0,0 @@
-.PHONY: build test bench vet
-
-build: vet bench
-
-test:
-        go test -v -cover -race
-
-bench:
-        go test -v -cover -race -test.bench=. -test.benchmem
-
-vet:
-        go vet
diff --git a/vendor/github.com/go-ini/ini/README.md b/vendor/github.com/go-ini/ini/README.md
deleted file mode 100644
index 8594742..0000000
--- a/vendor/github.com/go-ini/ini/README.md
+++ /dev/null
@@ -1,740 +0,0 @@
-INI [![Build Status](https://travis-ci.org/go-ini/ini.svg?branch=master)](https://travis-ci.org/go-ini/ini) [![Sourcegraph](https://sourcegraph.com/github.com/go-ini/ini/-/badge.svg)](https://sourcegraph.com/github.com/go-ini/ini?badge)
-===
-
-![](https://avatars0.githubusercontent.com/u/10216035?v=3&s=200)
-
-Package ini provides INI file read and write functionality in Go.
-
-[简体中文](README_ZH.md)
-
-## Feature
-
-- Load multiple data sources(`[]byte`, file and `io.ReadCloser`) with overwrites.
-- Read with recursion values.
-- Read with parent-child sections.
-- Read with auto-increment key names.
-- Read with multiple-line values.
-- Read with tons of helper methods.
-- Read and convert values to Go types.
-- Read and **WRITE** comments of sections and keys.
-- Manipulate sections, keys and comments with ease.
-- Keep sections and keys in order as you parse and save.
-
-## Installation
-
-To use a tagged revision:
-
-        go get gopkg.in/ini.v1
-
-To use with latest changes:
-
-        go get github.com/go-ini/ini
-
-Please add `-u` flag to update in the future.
-
-### Testing
-
-If you want to test on your machine, please apply `-t` flag:
-
-        go get -t gopkg.in/ini.v1
-
-Please add `-u` flag to update in the future.
-
-## Getting Started
-
-### Loading from data sources
-
-A **Data Source** is either raw data in type `[]byte`, a file name with type `string` or `io.ReadCloser`. You can load **as many data sources as you want**. Passing other types will simply return an error.
-
-```go
-cfg, err := ini.Load([]byte("raw data"), "filename", ioutil.NopCloser(bytes.NewReader([]byte("some other data"))))
-```
-
-Or start with an empty object:
-
-```go
-cfg := ini.Empty()
-```
-
-When you cannot decide how many data sources to load at the beginning, you will still be able to **Append()** them later.
-
-```go
-err := cfg.Append("other file", []byte("other raw data"))
-```
-
-If you have a list of files with possibilities that some of them may not available at the time, and you don't know exactly which ones, you can use `LooseLoad` to ignore nonexistent files without returning error.
-
-```go
-cfg, err := ini.LooseLoad("filename", "filename_404")
-```
-
-The cool thing is, whenever the file is available to load while you're calling `Reload` method, it will be counted as usual.
-
-#### Ignore cases of key name
-
-When you do not care about cases of section and key names, you can use `InsensitiveLoad` to force all names to be lowercased while parsing.
-
-```go
-cfg, err := ini.InsensitiveLoad("filename")
-//...
-
-// sec1 and sec2 are the exactly same section object
-sec1, err := cfg.GetSection("Section")
-sec2, err := cfg.GetSection("SecTIOn")
-
-// key1 and key2 are the exactly same key object
-key1, err := cfg.GetKey("Key")
-key2, err := cfg.GetKey("KeY")
-```
-
-#### MySQL-like boolean key 
-
-MySQL's configuration allows a key without value as follows:
-
-```ini
-[mysqld]
-...
-skip-host-cache
-skip-name-resolve
-```
-
-By default, this is considered as missing value. But if you know you're going to deal with those cases, you can assign advanced load options:
-
-```go
-cfg, err := LoadSources(LoadOptions{AllowBooleanKeys: true}, "my.cnf"))
-```
-
-The value of those keys are always `true`, and when you save to a file, it will keep in the same foramt as you read.
-
-To generate such keys in your program, you could use `NewBooleanKey`:
-
-```go
-key, err := sec.NewBooleanKey("skip-host-cache")
-```
-
-#### Comment
-
-Take care that following format will be treated as comment:
-
-1. Line begins with `#` or `;`
-2. Words after `#` or `;`
-3. Words after section name (i.e words after `[some section name]`)
-
-If you want to save a value with `#` or `;`, please quote them with ``` ` ``` or ``` """ ```.
-
-### Working with sections
-
-To get a section, you would need to:
-
-```go
-section, err := cfg.GetSection("section name")
-```
-
-For a shortcut for default section, just give an empty string as name:
-
-```go
-section, err := cfg.GetSection("")
-```
-
-When you're pretty sure the section exists, following code could make your life easier:
-
-```go
-section := cfg.Section("section name")
-```
-
-What happens when the section somehow does not exist? Don't panic, it automatically creates and returns a new section to you.
-
-To create a new section:
-
-```go
-err := cfg.NewSection("new section")
-```
-
-To get a list of sections or section names:
-
-```go
-sections := cfg.Sections()
-names := cfg.SectionStrings()
-```
-
-### Working with keys
-
-To get a key under a section:
-
-```go
-key, err := cfg.Section("").GetKey("key name")
-```
-
-Same rule applies to key operations:
-
-```go
-key := cfg.Section("").Key("key name")
-```
-
-To check if a key exists:
-
-```go
-yes := cfg.Section("").HasKey("key name")
-```
-
-To create a new key:
-
-```go
-err := cfg.Section("").NewKey("name", "value")
-```
-
-To get a list of keys or key names:
-
-```go
-keys := cfg.Section("").Keys()
-names := cfg.Section("").KeyStrings()
-```
-
-To get a clone hash of keys and corresponding values:
-
-```go
-hash := cfg.Section("").KeysHash()
-```
-
-### Working with values
-
-To get a string value:
-
-```go
-val := cfg.Section("").Key("key name").String()
-```
-
-To validate key value on the fly:
-
-```go
-val := cfg.Section("").Key("key name").Validate(func(in string) string {
-        if len(in) == 0 {
-                return "default"
-        }
-        return in
-})
-```
-
-If you do not want any auto-transformation (such as recursive read) for the values, you can get raw value directly (this way you get much better performance):
-
-```go
-val := cfg.Section("").Key("key name").Value()
-```
-
-To check if raw value exists:
-
-```go
-yes := cfg.Section("").HasValue("test value")
-```
-
-To get value with types:
-
-```go
-// For boolean values:
-// true when value is: 1, t, T, TRUE, true, True, YES, yes, Yes, y, ON, on, On
-// false when value is: 0, f, F, FALSE, false, False, NO, no, No, n, OFF, off, Off
-v, err = cfg.Section("").Key("BOOL").Bool()
-v, err = cfg.Section("").Key("FLOAT64").Float64()
-v, err = cfg.Section("").Key("INT").Int()
-v, err = cfg.Section("").Key("INT64").Int64()
-v, err = cfg.Section("").Key("UINT").Uint()
-v, err = cfg.Section("").Key("UINT64").Uint64()
-v, err = cfg.Section("").Key("TIME").TimeFormat(time.RFC3339)
-v, err = cfg.Section("").Key("TIME").Time() // RFC3339
-
-v = cfg.Section("").Key("BOOL").MustBool()
-v = cfg.Section("").Key("FLOAT64").MustFloat64()
-v = cfg.Section("").Key("INT").MustInt()
-v = cfg.Section("").Key("INT64").MustInt64()
-v = cfg.Section("").Key("UINT").MustUint()
-v = cfg.Section("").Key("UINT64").MustUint64()
-v = cfg.Section("").Key("TIME").MustTimeFormat(time.RFC3339)
-v = cfg.Section("").Key("TIME").MustTime() // RFC3339
-
-// Methods start with Must also accept one argument for default value
-// when key not found or fail to parse value to given type.
-// Except method MustString, which you have to pass a default value.
-
-v = cfg.Section("").Key("String").MustString("default")
-v = cfg.Section("").Key("BOOL").MustBool(true)
-v = cfg.Section("").Key("FLOAT64").MustFloat64(1.25)
-v = cfg.Section("").Key("INT").MustInt(10)
-v = cfg.Section("").Key("INT64").MustInt64(99)
-v = cfg.Section("").Key("UINT").MustUint(3)
-v = cfg.Section("").Key("UINT64").MustUint64(6)
-v = cfg.Section("").Key("TIME").MustTimeFormat(time.RFC3339, time.Now())
-v = cfg.Section("").Key("TIME").MustTime(time.Now()) // RFC3339
-```
-
-What if my value is three-line long?
-
-```ini
-[advance]
-ADDRESS = """404 road,
-NotFound, State, 5000
-Earth"""
-```
-
-Not a problem!
-
-```go
-cfg.Section("advance").Key("ADDRESS").String()
-
-/* --- start ---
-404 road,
-NotFound, State, 5000
-Earth
-------  end  --- */
-```
-
-That's cool, how about continuation lines?
-
-```ini
-[advance]
-two_lines = how about \
-        continuation lines?
-lots_of_lines = 1 \
-        2 \
-        3 \
-        4
-```
-
-Piece of cake!
-
-```go
-cfg.Section("advance").Key("two_lines").String() // how about continuation lines?
-cfg.Section("advance").Key("lots_of_lines").String() // 1 2 3 4
-```
-
-Well, I hate continuation lines, how do I disable that?
-
-```go
-cfg, err := ini.LoadSources(ini.LoadOptions{
-        IgnoreContinuation: true,
-}, "filename")
-```
-
-Holy crap! 
-
-Note that single quotes around values will be stripped:
-
-```ini
-foo = "some value" // foo: some value
-bar = 'some value' // bar: some value
-```
-
-That's all? Hmm, no.
-
-#### Helper methods of working with values
-
-To get value with given candidates:
-
-```go
-v = cfg.Section("").Key("STRING").In("default", []string{"str", "arr", "types"})
-v = cfg.Section("").Key("FLOAT64").InFloat64(1.1, []float64{1.25, 2.5, 3.75})
-v = cfg.Section("").Key("INT").InInt(5, []int{10, 20, 30})
-v = cfg.Section("").Key("INT64").InInt64(10, []int64{10, 20, 30})
-v = cfg.Section("").Key("UINT").InUint(4, []int{3, 6, 9})
-v = cfg.Section("").Key("UINT64").InUint64(8, []int64{3, 6, 9})
-v = cfg.Section("").Key("TIME").InTimeFormat(time.RFC3339, time.Now(), []time.Time{time1, time2, time3})
-v = cfg.Section("").Key("TIME").InTime(time.Now(), []time.Time{time1, time2, time3}) // RFC3339
-```
-
-Default value will be presented if value of key is not in candidates you given, and default value does not need be one of candidates.
-
-To validate value in a given range:
-
-```go
-vals = cfg.Section("").Key("FLOAT64").RangeFloat64(0.0, 1.1, 2.2)
-vals = cfg.Section("").Key("INT").RangeInt(0, 10, 20)
-vals = cfg.Section("").Key("INT64").RangeInt64(0, 10, 20)
-vals = cfg.Section("").Key("UINT").RangeUint(0, 3, 9)
-vals = cfg.Section("").Key("UINT64").RangeUint64(0, 3, 9)
-vals = cfg.Section("").Key("TIME").RangeTimeFormat(time.RFC3339, time.Now(), minTime, maxTime)
-vals = cfg.Section("").Key("TIME").RangeTime(time.Now(), minTime, maxTime) // RFC3339
-```
-
-##### Auto-split values into a slice
-
-To use zero value of type for invalid inputs:
-
-```go
-// Input: 1.1, 2.2, 3.3, 4.4 -> [1.1 2.2 3.3 4.4]
-// Input: how, 2.2, are, you -> [0.0 2.2 0.0 0.0]
-vals = cfg.Section("").Key("STRINGS").Strings(",")
-vals = cfg.Section("").Key("FLOAT64S").Float64s(",")
-vals = cfg.Section("").Key("INTS").Ints(",")
-vals = cfg.Section("").Key("INT64S").Int64s(",")
-vals = cfg.Section("").Key("UINTS").Uints(",")
-vals = cfg.Section("").Key("UINT64S").Uint64s(",")
-vals = cfg.Section("").Key("TIMES").Times(",")
-```
-
-To exclude invalid values out of result slice:
-
-```go
-// Input: 1.1, 2.2, 3.3, 4.4 -> [1.1 2.2 3.3 4.4]
-// Input: how, 2.2, are, you -> [2.2]
-vals = cfg.Section("").Key("FLOAT64S").ValidFloat64s(",")
-vals = cfg.Section("").Key("INTS").ValidInts(",")
-vals = cfg.Section("").Key("INT64S").ValidInt64s(",")
-vals = cfg.Section("").Key("UINTS").ValidUints(",")
-vals = cfg.Section("").Key("UINT64S").ValidUint64s(",")
-vals = cfg.Section("").Key("TIMES").ValidTimes(",")
-```
-
-Or to return nothing but error when have invalid inputs:
-
-```go
-// Input: 1.1, 2.2, 3.3, 4.4 -> [1.1 2.2 3.3 4.4]
-// Input: how, 2.2, are, you -> error
-vals = cfg.Section("").Key("FLOAT64S").StrictFloat64s(",")
-vals = cfg.Section("").Key("INTS").StrictInts(",")
-vals = cfg.Section("").Key("INT64S").StrictInt64s(",")
-vals = cfg.Section("").Key("UINTS").StrictUints(",")
-vals = cfg.Section("").Key("UINT64S").StrictUint64s(",")
-vals = cfg.Section("").Key("TIMES").StrictTimes(",")
-```
-
-### Save your configuration
-
-Finally, it's time to save your configuration to somewhere.
-
-A typical way to save configuration is writing it to a file:
-
-```go
-// ...
-err = cfg.SaveTo("my.ini")
-err = cfg.SaveToIndent("my.ini", "\t")
-```
-
-Another way to save is writing to a `io.Writer` interface:
-
-```go
-// ...
-cfg.WriteTo(writer)
-cfg.WriteToIndent(writer, "\t")
-```
-
-By default, spaces are used to align "=" sign between key and values, to disable that:
-
-```go
-ini.PrettyFormat = false
-``` 
-
-## Advanced Usage
-
-### Recursive Values
-
-For all value of keys, there is a special syntax `%(<name>)s`, where `<name>` is the key name in same section or default section, and `%(<name>)s` will be replaced by corresponding value(empty string if key not found). You can use this syntax at most 99 level of recursions.
-
-```ini
-NAME = ini
-
-[author]
-NAME = Unknwon
-GITHUB = https://github.com/%(NAME)s
-
-[package]
-FULL_NAME = github.com/go-ini/%(NAME)s
-```
-
-```go
-cfg.Section("author").Key("GITHUB").String()            // https://github.com/Unknwon
-cfg.Section("package").Key("FULL_NAME").String()        // github.com/go-ini/ini
-```
-
-### Parent-child Sections
-
-You can use `.` in section name to indicate parent-child relationship between two or more sections. If the key not found in the child section, library will try again on its parent section until there is no parent section.
-
-```ini
-NAME = ini
-VERSION = v1
-IMPORT_PATH = gopkg.in/%(NAME)s.%(VERSION)s
-
-[package]
-CLONE_URL = https://%(IMPORT_PATH)s
-
-[package.sub]
-```
-
-```go
-cfg.Section("package.sub").Key("CLONE_URL").String()    // https://gopkg.in/ini.v1
-```
-
-#### Retrieve parent keys available to a child section
-
-```go
-cfg.Section("package.sub").ParentKeys() // ["CLONE_URL"]
-```
-
-### Unparseable Sections
-
-Sometimes, you have sections that do not contain key-value pairs but raw content, to handle such case, you can use `LoadOptions.UnparsableSections`:
-
-```go
-cfg, err := LoadSources(LoadOptions{UnparseableSections: []string{"COMMENTS"}}, `[COMMENTS]
-<1><L.Slide#2> This slide has the fuel listed in the wrong units <e.1>`))
-
-body := cfg.Section("COMMENTS").Body()
-
-/* --- start ---
-<1><L.Slide#2> This slide has the fuel listed in the wrong units <e.1>
-------  end  --- */
-```
-
-### Auto-increment Key Names
-
-If key name is `-` in data source, then it would be seen as special syntax for auto-increment key name start from 1, and every section is independent on counter.
-
-```ini
-[features]
--: Support read/write comments of keys and sections
--: Support auto-increment of key names
--: Support load multiple files to overwrite key values
-```
-
-```go
-cfg.Section("features").KeyStrings()    // []{"#1", "#2", "#3"}
-```
-
-### Map To Struct
-
-Want more objective way to play with INI? Cool.
-
-```ini
-Name = Unknwon
-age = 21
-Male = true
-Born = 1993-01-01T20:17:05Z
-
-[Note]
-Content = Hi is a good man!
-Cities = HangZhou, Boston
-```
-
-```go
-type Note struct {
-        Content string
-        Cities  []string
-}
-
-type Person struct {
-        Name string
-        Age  int `ini:"age"`
-        Male bool
-        Born time.Time
-        Note
-        Created time.Time `ini:"-"`
-}
-
-func main() {
-        cfg, err := ini.Load("path/to/ini")
-        // ...
-        p := new(Person)
-        err = cfg.MapTo(p)
-        // ...
-
-        // Things can be simpler.
-        err = ini.MapTo(p, "path/to/ini")
-        // ...
-
-        // Just map a section? Fine.
-        n := new(Note)
-        err = cfg.Section("Note").MapTo(n)
-        // ...
-}
-```
-
-Can I have default value for field? Absolutely.
-
-Assign it before you map to struct. It will keep the value as it is if the key is not presented or got wrong type.
-
-```go
-// ...
-p := &Person{
-        Name: "Joe",
-}
-// ...
-```
-
-It's really cool, but what's the point if you can't give me my file back from struct?
-
-### Reflect From Struct
-
-Why not?
-
-```go
-type Embeded struct {
-        Dates  []time.Time `delim:"|"`
-        Places []string    `ini:"places,omitempty"`
-        None   []int       `ini:",omitempty"`
-}
-
-type Author struct {
-        Name      string `ini:"NAME"`
-        Male      bool
-        Age       int
-        GPA       float64
-        NeverMind string `ini:"-"`
-        *Embeded
-}
-
-func main() {
-        a := &Author{"Unknwon", true, 21, 2.8, "",
-                &Embeded{
-                        []time.Time{time.Now(), time.Now()},
-                        []string{"HangZhou", "Boston"},
-                        []int{},
-                }}
-        cfg := ini.Empty()
-        err = ini.ReflectFrom(cfg, a)
-        // ...
-}
-```
-
-So, what do I get?
-
-```ini
-NAME = Unknwon
-Male = true
-Age = 21
-GPA = 2.8
-
-[Embeded]
-Dates = 2015-08-07T22:14:22+08:00|2015-08-07T22:14:22+08:00
-places = HangZhou,Boston
-```
-
-#### Name Mapper
-
-To save your time and make your code cleaner, this library supports [`NameMapper`](https://gowalker.org/gopkg.in/ini.v1#NameMapper) between struct field and actual section and key name.
-
-There are 2 built-in name mappers:
-
-- `AllCapsUnderscore`: it converts to format `ALL_CAPS_UNDERSCORE` then match section or key.
-- `TitleUnderscore`: it converts to format `title_underscore` then match section or key.
-
-To use them:
-
-```go
-type Info struct {
-        PackageName string
-}
-
-func main() {
-        err = ini.MapToWithMapper(&Info{}, ini.TitleUnderscore, []byte("package_name=ini"))
-        // ...
-
-        cfg, err := ini.Load([]byte("PACKAGE_NAME=ini"))
-        // ...
-        info := new(Info)
-        cfg.NameMapper = ini.AllCapsUnderscore
-        err = cfg.MapTo(info)
-        // ...
-}
-```
-
-Same rules of name mapper apply to `ini.ReflectFromWithMapper` function.
-
-#### Value Mapper
-
-To expand values (e.g. from environment variables), you can use the `ValueMapper` to transform values:
-
-```go
-type Env struct {
-        Foo string `ini:"foo"`
-}
-
-func main() {
-        cfg, err := ini.Load([]byte("[env]\nfoo = ${MY_VAR}\n")
-        cfg.ValueMapper = os.ExpandEnv
-        // ...
-        env := &Env{}
-        err = cfg.Section("env").MapTo(env)
-}
-```
-
-This would set the value of `env.Foo` to the value of the environment variable `MY_VAR`.
-
-#### Other Notes On Map/Reflect
-
-Any embedded struct is treated as a section by default, and there is no automatic parent-child relations in map/reflect feature:
-
-```go
-type Child struct {
-        Age string
-}
-
-type Parent struct {
-        Name string
-        Child
-}
-
-type Config struct {
-        City string
-        Parent
-}
-```
-
-Example configuration:
-
-```ini
-City = Boston
-
-[Parent]
-Name = Unknwon
-
-[Child]
-Age = 21
-```
-
-What if, yes, I'm paranoid, I want embedded struct to be in the same section. Well, all roads lead to Rome.
-
-```go
-type Child struct {
-        Age string
-}
-
-type Parent struct {
-        Name string
-        Child `ini:"Parent"`
-}
-
-type Config struct {
-        City string
-        Parent
-}
-```
-
-Example configuration:
-
-```ini
-City = Boston
-
-[Parent]
-Name = Unknwon
-Age = 21
-```
-
-## Getting Help
-
-- [API Documentation](https://gowalker.org/gopkg.in/ini.v1)
-- [File An Issue](https://github.com/go-ini/ini/issues/new)
-
-## FAQs
-
-### What does `BlockMode` field do?
-
-By default, library lets you read and write values so we need a locker to make sure your data is safe. But in cases that you are very sure about only reading data through the library, you can set `cfg.BlockMode = false` to speed up read operations about **50-70%** faster.
-
-### Why another INI library?
-
-Many people are using my another INI library [goconfig](https://github.com/Unknwon/goconfig), so the reason for this one is I would like to make more Go style code. Also when you set `cfg.BlockMode = false`, this one is about **10-30%** faster.
-
-To make those changes I have to confirm API broken, so it's safer to keep it in another place and start using `gopkg.in` to version my package at this time.(PS: shorter import path)
-
-## License
-
-This project is under Apache v2 License. See the [LICENSE](LICENSE) file for the full license text.
diff --git a/vendor/github.com/go-ini/ini/README_ZH.md b/vendor/github.com/go-ini/ini/README_ZH.md
deleted file mode 100644
index 163432d..0000000
--- a/vendor/github.com/go-ini/ini/README_ZH.md
+++ /dev/null
@@ -1,727 +0,0 @@
-本包提供了 Go 语言中读写 INI 文件的功能。
-
-## 功能特性
-
-- 支持覆盖加载多个数据源（`[]byte`、文件和 `io.ReadCloser`）
-- 支持递归读取键值
-- 支持读取父子分区
-- 支持读取自增键名
-- 支持读取多行的键值
-- 支持大量辅助方法
-- 支持在读取时直接转换为 Go 语言类型
-- 支持读取和 **写入** 分区和键的注释
-- 轻松操作分区、键值和注释
-- 在保存文件时分区和键值会保持原有的顺序
-
-## 下载安装
-
-使用一个特定版本：
-
-    go get gopkg.in/ini.v1
-
-使用最新版：
-
-        go get github.com/go-ini/ini
-
-如需更新请添加 `-u` 选项。
-
-### 测试安装
-
-如果您想要在自己的机器上运行测试，请使用 `-t` 标记：
-
-        go get -t gopkg.in/ini.v1
-
-如需更新请添加 `-u` 选项。
-
-## 开始使用
-
-### 从数据源加载
-
-一个 **数据源** 可以是 `[]byte` 类型的原始数据，`string` 类型的文件路径或 `io.ReadCloser`。您可以加载 **任意多个** 数据源。如果您传递其它类型的数据源，则会直接返回错误。
-
-```go
-cfg, err := ini.Load([]byte("raw data"), "filename", ioutil.NopCloser(bytes.NewReader([]byte("some other data"))))
-```
-
-或者从一个空白的文件开始：
-
-```go
-cfg := ini.Empty()
-```
-
-当您在一开始无法决定需要加载哪些数据源时，仍可以使用 **Append()** 在需要的时候加载它们。
-
-```go
-err := cfg.Append("other file", []byte("other raw data"))
-```
-
-当您想要加载一系列文件，但是不能够确定其中哪些文件是不存在的，可以通过调用函数 `LooseLoad` 来忽略它们（`Load` 会因为文件不存在而返回错误）：
-
-```go
-cfg, err := ini.LooseLoad("filename", "filename_404")
-```
-
-更牛逼的是，当那些之前不存在的文件在重新调用 `Reload` 方法的时候突然出现了，那么它们会被正常加载。
-
-#### 忽略键名的大小写
-
-有时候分区和键的名称大小写混合非常烦人，这个时候就可以通过 `InsensitiveLoad` 将所有分区和键名在读取里强制转换为小写：
-
-```go
-cfg, err := ini.InsensitiveLoad("filename")
-//...
-
-// sec1 和 sec2 指向同一个分区对象
-sec1, err := cfg.GetSection("Section")
-sec2, err := cfg.GetSection("SecTIOn")
-
-// key1 和 key2 指向同一个键对象
-key1, err := cfg.GetKey("Key")
-key2, err := cfg.GetKey("KeY")
-```
-
-#### 类似 MySQL 配置中的布尔值键
-
-MySQL 的配置文件中会出现没有具体值的布尔类型的键：
-
-```ini
-[mysqld]
-...
-skip-host-cache
-skip-name-resolve
-```
-
-默认情况下这被认为是缺失值而无法完成解析，但可以通过高级的加载选项对它们进行处理：
-
-```go
-cfg, err := LoadSources(LoadOptions{AllowBooleanKeys: true}, "my.cnf"))
-```
-
-这些键的值永远为 `true`，且在保存到文件时也只会输出键名。
-
-如果您想要通过程序来生成此类键，则可以使用 `NewBooleanKey`：
-
-```go
-key, err := sec.NewBooleanKey("skip-host-cache")
-```
-
-#### 关于注释
-
-下述几种情况的内容将被视为注释：
-
-1. 所有以 `#` 或 `;` 开头的行
-2. 所有在 `#` 或 `;` 之后的内容
-3. 分区标签后的文字 (即 `[分区名]` 之后的内容)
-
-如果你希望使用包含 `#` 或 `;` 的值，请使用 ``` ` ``` 或 ``` """ ``` 进行包覆。
-
-### 操作分区（Section）
-
-获取指定分区：
-
-```go
-section, err := cfg.GetSection("section name")
-```
-
-如果您想要获取默认分区，则可以用空字符串代替分区名：
-
-```go
-section, err := cfg.GetSection("")
-```
-
-当您非常确定某个分区是存在的，可以使用以下简便方法：
-
-```go
-section := cfg.Section("section name")
-```
-
-如果不小心判断错了，要获取的分区其实是不存在的，那会发生什么呢？没事的，它会自动创建并返回一个对应的分区对象给您。
-
-创建一个分区：
-
-```go
-err := cfg.NewSection("new section")
-```
-
-获取所有分区对象或名称：
-
-```go
-sections := cfg.Sections()
-names := cfg.SectionStrings()
-```
-
-### 操作键（Key）
-
-获取某个分区下的键：
-
-```go
-key, err := cfg.Section("").GetKey("key name")
-```
-
-和分区一样，您也可以直接获取键而忽略错误处理：
-
-```go
-key := cfg.Section("").Key("key name")
-```
-
-判断某个键是否存在：
-
-```go
-yes := cfg.Section("").HasKey("key name")
-```
-
-创建一个新的键：
-
-```go
-err := cfg.Section("").NewKey("name", "value")
-```
-
-获取分区下的所有键或键名：
-
-```go
-keys := cfg.Section("").Keys()
-names := cfg.Section("").KeyStrings()
-```
-
-获取分区下的所有键值对的克隆：
-
-```go
-hash := cfg.Section("").KeysHash()
-```
-
-### 操作键值（Value）
-
-获取一个类型为字符串（string）的值：
-
-```go
-val := cfg.Section("").Key("key name").String()
-```
-
-获取值的同时通过自定义函数进行处理验证：
-
-```go
-val := cfg.Section("").Key("key name").Validate(func(in string) string {
-        if len(in) == 0 {
-                return "default"
-        }
-        return in
-})
-```
-
-如果您不需要任何对值的自动转变功能（例如递归读取），可以直接获取原值（这种方式性能最佳）：
-
-```go
-val := cfg.Section("").Key("key name").Value()
-```
-
-判断某个原值是否存在：
-
-```go
-yes := cfg.Section("").HasValue("test value")
-```
-
-获取其它类型的值：
-
-```go
-// 布尔值的规则：
-// true 当值为：1, t, T, TRUE, true, True, YES, yes, Yes, y, ON, on, On
-// false 当值为：0, f, F, FALSE, false, False, NO, no, No, n, OFF, off, Off
-v, err = cfg.Section("").Key("BOOL").Bool()
-v, err = cfg.Section("").Key("FLOAT64").Float64()
-v, err = cfg.Section("").Key("INT").Int()
-v, err = cfg.Section("").Key("INT64").Int64()
-v, err = cfg.Section("").Key("UINT").Uint()
-v, err = cfg.Section("").Key("UINT64").Uint64()
-v, err = cfg.Section("").Key("TIME").TimeFormat(time.RFC3339)
-v, err = cfg.Section("").Key("TIME").Time() // RFC3339
-
-v = cfg.Section("").Key("BOOL").MustBool()
-v = cfg.Section("").Key("FLOAT64").MustFloat64()
-v = cfg.Section("").Key("INT").MustInt()
-v = cfg.Section("").Key("INT64").MustInt64()
-v = cfg.Section("").Key("UINT").MustUint()
-v = cfg.Section("").Key("UINT64").MustUint64()
-v = cfg.Section("").Key("TIME").MustTimeFormat(time.RFC3339)
-v = cfg.Section("").Key("TIME").MustTime() // RFC3339
-
-// 由 Must 开头的方法名允许接收一个相同类型的参数来作为默认值，
-// 当键不存在或者转换失败时，则会直接返回该默认值。
-// 但是，MustString 方法必须传递一个默认值。
-
-v = cfg.Seciont("").Key("String").MustString("default")
-v = cfg.Section("").Key("BOOL").MustBool(true)
-v = cfg.Section("").Key("FLOAT64").MustFloat64(1.25)
-v = cfg.Section("").Key("INT").MustInt(10)
-v = cfg.Section("").Key("INT64").MustInt64(99)
-v = cfg.Section("").Key("UINT").MustUint(3)
-v = cfg.Section("").Key("UINT64").MustUint64(6)
-v = cfg.Section("").Key("TIME").MustTimeFormat(time.RFC3339, time.Now())
-v = cfg.Section("").Key("TIME").MustTime(time.Now()) // RFC3339
-```
-
-如果我的值有好多行怎么办？
-
-```ini
-[advance]
-ADDRESS = """404 road,
-NotFound, State, 5000
-Earth"""
-```
-
-嗯哼？小 case！
-
-```go
-cfg.Section("advance").Key("ADDRESS").String()
-
-/* --- start ---
-404 road,
-NotFound, State, 5000
-Earth
-------  end  --- */
-```
-
-赞爆了！那要是我属于一行的内容写不下想要写到第二行怎么办？
-
-```ini
-[advance]
-two_lines = how about \
-        continuation lines?
-lots_of_lines = 1 \
-        2 \
-        3 \
-        4
-```
-
-简直是小菜一碟！
-
-```go
-cfg.Section("advance").Key("two_lines").String() // how about continuation lines?
-cfg.Section("advance").Key("lots_of_lines").String() // 1 2 3 4
-```
-
-可是我有时候觉得两行连在一起特别没劲，怎么才能不自动连接两行呢？
-
-```go
-cfg, err := ini.LoadSources(ini.LoadOptions{
-        IgnoreContinuation: true,
-}, "filename")
-```
-
-哇靠给力啊！
-
-需要注意的是，值两侧的单引号会被自动剔除：
-
-```ini
-foo = "some value" // foo: some value
-bar = 'some value' // bar: some value
-```
-
-这就是全部了？哈哈，当然不是。
-
-#### 操作键值的辅助方法
-
-获取键值时设定候选值：
-
-```go
-v = cfg.Section("").Key("STRING").In("default", []string{"str", "arr", "types"})
-v = cfg.Section("").Key("FLOAT64").InFloat64(1.1, []float64{1.25, 2.5, 3.75})
-v = cfg.Section("").Key("INT").InInt(5, []int{10, 20, 30})
-v = cfg.Section("").Key("INT64").InInt64(10, []int64{10, 20, 30})
-v = cfg.Section("").Key("UINT").InUint(4, []int{3, 6, 9})
-v = cfg.Section("").Key("UINT64").InUint64(8, []int64{3, 6, 9})
-v = cfg.Section("").Key("TIME").InTimeFormat(time.RFC3339, time.Now(), []time.Time{time1, time2, time3})
-v = cfg.Section("").Key("TIME").InTime(time.Now(), []time.Time{time1, time2, time3}) // RFC3339
-```
-
-如果获取到的值不是候选值的任意一个，则会返回默认值，而默认值不需要是候选值中的一员。
-
-验证获取的值是否在指定范围内：
-
-```go
-vals = cfg.Section("").Key("FLOAT64").RangeFloat64(0.0, 1.1, 2.2)
-vals = cfg.Section("").Key("INT").RangeInt(0, 10, 20)
-vals = cfg.Section("").Key("INT64").RangeInt64(0, 10, 20)
-vals = cfg.Section("").Key("UINT").RangeUint(0, 3, 9)
-vals = cfg.Section("").Key("UINT64").RangeUint64(0, 3, 9)
-vals = cfg.Section("").Key("TIME").RangeTimeFormat(time.RFC3339, time.Now(), minTime, maxTime)
-vals = cfg.Section("").Key("TIME").RangeTime(time.Now(), minTime, maxTime) // RFC3339
-```
-
-##### 自动分割键值到切片（slice）
-
-当存在无效输入时，使用零值代替：
-
-```go
-// Input: 1.1, 2.2, 3.3, 4.4 -> [1.1 2.2 3.3 4.4]
-// Input: how, 2.2, are, you -> [0.0 2.2 0.0 0.0]
-vals = cfg.Section("").Key("STRINGS").Strings(",")
-vals = cfg.Section("").Key("FLOAT64S").Float64s(",")
-vals = cfg.Section("").Key("INTS").Ints(",")
-vals = cfg.Section("").Key("INT64S").Int64s(",")
-vals = cfg.Section("").Key("UINTS").Uints(",")
-vals = cfg.Section("").Key("UINT64S").Uint64s(",")
-vals = cfg.Section("").Key("TIMES").Times(",")
-```
-
-从结果切片中剔除无效输入：
-
-```go
-// Input: 1.1, 2.2, 3.3, 4.4 -> [1.1 2.2 3.3 4.4]
-// Input: how, 2.2, are, you -> [2.2]
-vals = cfg.Section("").Key("FLOAT64S").ValidFloat64s(",")
-vals = cfg.Section("").Key("INTS").ValidInts(",")
-vals = cfg.Section("").Key("INT64S").ValidInt64s(",")
-vals = cfg.Section("").Key("UINTS").ValidUints(",")
-vals = cfg.Section("").Key("UINT64S").ValidUint64s(",")
-vals = cfg.Section("").Key("TIMES").ValidTimes(",")
-```
-
-当存在无效输入时，直接返回错误：
-
-```go
-// Input: 1.1, 2.2, 3.3, 4.4 -> [1.1 2.2 3.3 4.4]
-// Input: how, 2.2, are, you -> error
-vals = cfg.Section("").Key("FLOAT64S").StrictFloat64s(",")
-vals = cfg.Section("").Key("INTS").StrictInts(",")
-vals = cfg.Section("").Key("INT64S").StrictInt64s(",")
-vals = cfg.Section("").Key("UINTS").StrictUints(",")
-vals = cfg.Section("").Key("UINT64S").StrictUint64s(",")
-vals = cfg.Section("").Key("TIMES").StrictTimes(",")
-```
-
-### 保存配置
-
-终于到了这个时刻，是时候保存一下配置了。
-
-比较原始的做法是输出配置到某个文件：
-
-```go
-// ...
-err = cfg.SaveTo("my.ini")
-err = cfg.SaveToIndent("my.ini", "\t")
-```
-
-另一个比较高级的做法是写入到任何实现 `io.Writer` 接口的对象中：
-
-```go
-// ...
-cfg.WriteTo(writer)
-cfg.WriteToIndent(writer, "\t")
-```
-
-默认情况下，空格将被用于对齐键值之间的等号以美化输出结果，以下代码可以禁用该功能：
-
-```go
-ini.PrettyFormat = false
-``` 
-
-## 高级用法
-
-### 递归读取键值
-
-在获取所有键值的过程中，特殊语法 `%(<name>)s` 会被应用，其中 `<name>` 可以是相同分区或者默认分区下的键名。字符串 `%(<name>)s` 会被相应的键值所替代，如果指定的键不存在，则会用空字符串替代。您可以最多使用 99 层的递归嵌套。
-
-```ini
-NAME = ini
-
-[author]
-NAME = Unknwon
-GITHUB = https://github.com/%(NAME)s
-
-[package]
-FULL_NAME = github.com/go-ini/%(NAME)s
-```
-
-```go
-cfg.Section("author").Key("GITHUB").String()            // https://github.com/Unknwon
-cfg.Section("package").Key("FULL_NAME").String()        // github.com/go-ini/ini
-```
-
-### 读取父子分区
-
-您可以在分区名称中使用 `.` 来表示两个或多个分区之间的父子关系。如果某个键在子分区中不存在，则会去它的父分区中再次寻找，直到没有父分区为止。
-
-```ini
-NAME = ini
-VERSION = v1
-IMPORT_PATH = gopkg.in/%(NAME)s.%(VERSION)s
-
-[package]
-CLONE_URL = https://%(IMPORT_PATH)s
-
-[package.sub]
-```
-
-```go
-cfg.Section("package.sub").Key("CLONE_URL").String()    // https://gopkg.in/ini.v1
-```
-
-#### 获取上级父分区下的所有键名
-
-```go
-cfg.Section("package.sub").ParentKeys() // ["CLONE_URL"]
-```
-
-### 无法解析的分区
-
-如果遇到一些比较特殊的分区，它们不包含常见的键值对，而是没有固定格式的纯文本，则可以使用 `LoadOptions.UnparsableSections` 进行处理：
-
-```go
-cfg, err := LoadSources(LoadOptions{UnparseableSections: []string{"COMMENTS"}}, `[COMMENTS]
-<1><L.Slide#2> This slide has the fuel listed in the wrong units <e.1>`))
-
-body := cfg.Section("COMMENTS").Body()
-
-/* --- start ---
-<1><L.Slide#2> This slide has the fuel listed in the wrong units <e.1>
-------  end  --- */
-```
-
-### 读取自增键名
-
-如果数据源中的键名为 `-`，则认为该键使用了自增键名的特殊语法。计数器从 1 开始，并且分区之间是相互独立的。
-
-```ini
-[features]
--: Support read/write comments of keys and sections
--: Support auto-increment of key names
--: Support load multiple files to overwrite key values
-```
-
-```go
-cfg.Section("features").KeyStrings()    // []{"#1", "#2", "#3"}
-```
-
-### 映射到结构
-
-想要使用更加面向对象的方式玩转 INI 吗？好主意。
-
-```ini
-Name = Unknwon
-age = 21
-Male = true
-Born = 1993-01-01T20:17:05Z
-
-[Note]
-Content = Hi is a good man!
-Cities = HangZhou, Boston
-```
-
-```go
-type Note struct {
-        Content string
-        Cities  []string
-}
-
-type Person struct {
-        Name string
-        Age  int `ini:"age"`
-        Male bool
-        Born time.Time
-        Note
-        Created time.Time `ini:"-"`
-}
-
-func main() {
-        cfg, err := ini.Load("path/to/ini")
-        // ...
-        p := new(Person)
-        err = cfg.MapTo(p)
-        // ...
-
-        // 一切竟可以如此的简单。
-        err = ini.MapTo(p, "path/to/ini")
-        // ...
-
-        // 嗯哼？只需要映射一个分区吗？
-        n := new(Note)
-        err = cfg.Section("Note").MapTo(n)
-        // ...
-}
-```
-
-结构的字段怎么设置默认值呢？很简单，只要在映射之前对指定字段进行赋值就可以了。如果键未找到或者类型错误，该值不会发生改变。
-
-```go
-// ...
-p := &Person{
-        Name: "Joe",
-}
-// ...
-```
-
-这样玩 INI 真的好酷啊！然而，如果不能还给我原来的配置文件，有什么卵用？
-
-### 从结构反射
-
-可是，我有说不能吗？
-
-```go
-type Embeded struct {
-        Dates  []time.Time `delim:"|"`
-        Places []string    `ini:"places,omitempty"`
-        None   []int       `ini:",omitempty"`
-}
-
-type Author struct {
-        Name      string `ini:"NAME"`
-        Male      bool
-        Age       int
-        GPA       float64
-        NeverMind string `ini:"-"`
-        *Embeded
-}
-
-func main() {
-        a := &Author{"Unknwon", true, 21, 2.8, "",
-                &Embeded{
-                        []time.Time{time.Now(), time.Now()},
-                        []string{"HangZhou", "Boston"},
-                        []int{},
-                }}
-        cfg := ini.Empty()
-        err = ini.ReflectFrom(cfg, a)
-        // ...
-}
-```
-
-瞧瞧，奇迹发生了。
-
-```ini
-NAME = Unknwon
-Male = true
-Age = 21
-GPA = 2.8
-
-[Embeded]
-Dates = 2015-08-07T22:14:22+08:00|2015-08-07T22:14:22+08:00
-places = HangZhou,Boston
-```
-
-#### 名称映射器（Name Mapper）
-
-为了节省您的时间并简化代码，本库支持类型为 [`NameMapper`](https://gowalker.org/gopkg.in/ini.v1#NameMapper) 的名称映射器，该映射器负责结构字段名与分区名和键名之间的映射。
-
-目前有 2 款内置的映射器：
-
-- `AllCapsUnderscore`：该映射器将字段名转换至格式 `ALL_CAPS_UNDERSCORE` 后再去匹配分区名和键名。
-- `TitleUnderscore`：该映射器将字段名转换至格式 `title_underscore` 后再去匹配分区名和键名。
-
-使用方法：
-
-```go
-type Info struct{
-        PackageName string
-}
-
-func main() {
-        err = ini.MapToWithMapper(&Info{}, ini.TitleUnderscore, []byte("package_name=ini"))
-        // ...
-
-        cfg, err := ini.Load([]byte("PACKAGE_NAME=ini"))
-        // ...
-        info := new(Info)
-        cfg.NameMapper = ini.AllCapsUnderscore
-        err = cfg.MapTo(info)
-        // ...
-}
-```
-
-使用函数 `ini.ReflectFromWithMapper` 时也可应用相同的规则。
-
-#### 值映射器（Value Mapper）
-
-值映射器允许使用一个自定义函数自动展开值的具体内容，例如：运行时获取环境变量：
-
-```go
-type Env struct {
-        Foo string `ini:"foo"`
-}
-
-func main() {
-        cfg, err := ini.Load([]byte("[env]\nfoo = ${MY_VAR}\n")
-        cfg.ValueMapper = os.ExpandEnv
-        // ...
-        env := &Env{}
-        err = cfg.Section("env").MapTo(env)
-}
-```
-
-本例中，`env.Foo` 将会是运行时所获取到环境变量 `MY_VAR` 的值。
-
-#### 映射/反射的其它说明
-
-任何嵌入的结构都会被默认认作一个不同的分区，并且不会自动产生所谓的父子分区关联：
-
-```go
-type Child struct {
-        Age string
-}
-
-type Parent struct {
-        Name string
-        Child
-}
-
-type Config struct {
-        City string
-        Parent
-}
-```
-
-示例配置文件：
-
-```ini
-City = Boston
-
-[Parent]
-Name = Unknwon
-
-[Child]
-Age = 21
-```
-
-很好，但是，我就是要嵌入结构也在同一个分区。好吧，你爹是李刚！
-
-```go
-type Child struct {
-        Age string
-}
-
-type Parent struct {
-        Name string
-        Child `ini:"Parent"`
-}
-
-type Config struct {
-        City string
-        Parent
-}
-```
-
-示例配置文件：
-
-```ini
-City = Boston
-
-[Parent]
-Name = Unknwon
-Age = 21
-```
-
-## 获取帮助
-
-- [API 文档](https://gowalker.org/gopkg.in/ini.v1)
-- [创建工单](https://github.com/go-ini/ini/issues/new)
-
-## 常见问题
-
-### 字段 `BlockMode` 是什么？
-
-默认情况下，本库会在您进行读写操作时采用锁机制来确保数据时间。但在某些情况下，您非常确定只进行读操作。此时，您可以通过设置 `cfg.BlockMode = false` 来将读操作提升大约 **50-70%** 的性能。
-
-### 为什么要写另一个 INI 解析库？
-
-许多人都在使用我的 [goconfig](https://github.com/Unknwon/goconfig) 来完成对 INI 文件的操作，但我希望使用更加 Go 风格的代码。并且当您设置 `cfg.BlockMode = false` 时，会有大约 **10-30%** 的性能提升。
-
-为了做出这些改变，我必须对 API 进行破坏，所以新开一个仓库是最安全的做法。除此之外，本库直接使用 `gopkg.in` 来进行版本化发布。（其实真相是导入路径更短了）
diff --git a/vendor/github.com/go-ini/ini/error.go b/vendor/github.com/go-ini/ini/error.go
deleted file mode 100644
index 80afe74..0000000
--- a/vendor/github.com/go-ini/ini/error.go
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2016 Unknwon
-//
-// Licensed under the Apache License, Version 2.0 (the "License"): you may
-// not use this file except in compliance with the License. You may obtain
-// a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-// License for the specific language governing permissions and limitations
-// under the License.
-
-package ini
-
-import (
-        "fmt"
-)
-
-type ErrDelimiterNotFound struct {
-        Line string
-}
-
-func IsErrDelimiterNotFound(err error) bool {
-        _, ok := err.(ErrDelimiterNotFound)
-        return ok
-}
-
-func (err ErrDelimiterNotFound) Error() string {
-        return fmt.Sprintf("key-value delimiter not found: %s", err.Line)
-}
diff --git a/vendor/github.com/go-ini/ini/ini.go b/vendor/github.com/go-ini/ini/ini.go
deleted file mode 100644
index 68d73aa..0000000
--- a/vendor/github.com/go-ini/ini/ini.go
+++ /dev/null
@@ -1,549 +0,0 @@
-// Copyright 2014 Unknwon
-//
-// Licensed under the Apache License, Version 2.0 (the "License"): you may
-// not use this file except in compliance with the License. You may obtain
-// a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-// License for the specific language governing permissions and limitations
-// under the License.
-
-// Package ini provides INI file read and write functionality in Go.
-package ini
-
-import (
-        "bytes"
-        "errors"
-        "fmt"
-        "io"
-        "io/ioutil"
-        "os"
-        "regexp"
-        "runtime"
-        "strconv"
-        "strings"
-        "sync"
-        "time"
-)
-
-const (
-        // Name for default section. You can use this constant or the string literal.
-        // In most of cases, an empty string is all you need to access the section.
-        DEFAULT_SECTION = "DEFAULT"
-
-        // Maximum allowed depth when recursively substituing variable names.
-        _DEPTH_VALUES = 99
-        _VERSION      = "1.25.4"
-)
-
-// Version returns current package version literal.
-func Version() string {
-        return _VERSION
-}
-
-var (
-        // Delimiter to determine or compose a new line.
-        // This variable will be changed to "\r\n" automatically on Windows
-        // at package init time.
-        LineBreak = "\n"
-
-        // Variable regexp pattern: %(variable)s
-        varPattern = regexp.MustCompile(`%\(([^\)]+)\)s`)
-
-        // Indicate whether to align "=" sign with spaces to produce pretty output
-        // or reduce all possible spaces for compact format.
-        PrettyFormat = true
-
-        // Explicitly write DEFAULT section header
-        DefaultHeader = false
-)
-
-func init() {
-        if runtime.GOOS == "windows" {
-                LineBreak = "\r\n"
-        }
-}
-
-func inSlice(str string, s []string) bool {
-        for _, v := range s {
-                if str == v {
-                        return true
-                }
-        }
-        return false
-}
-
-// dataSource is an interface that returns object which can be read and closed.
-type dataSource interface {
-        ReadCloser() (io.ReadCloser, error)
-}
-
-// sourceFile represents an object that contains content on the local file system.
-type sourceFile struct {
-        name string
-}
-
-func (s sourceFile) ReadCloser() (_ io.ReadCloser, err error) {
-        return os.Open(s.name)
-}
-
-type bytesReadCloser struct {
-        reader io.Reader
-}
-
-func (rc *bytesReadCloser) Read(p []byte) (n int, err error) {
-        return rc.reader.Read(p)
-}
-
-func (rc *bytesReadCloser) Close() error {
-        return nil
-}
-
-// sourceData represents an object that contains content in memory.
-type sourceData struct {
-        data []byte
-}
-
-func (s *sourceData) ReadCloser() (io.ReadCloser, error) {
-        return ioutil.NopCloser(bytes.NewReader(s.data)), nil
-}
-
-// sourceReadCloser represents an input stream with Close method.
-type sourceReadCloser struct {
-        reader io.ReadCloser
-}
-
-func (s *sourceReadCloser) ReadCloser() (io.ReadCloser, error) {
-        return s.reader, nil
-}
-
-// File represents a combination of a or more INI file(s) in memory.
-type File struct {
-        // Should make things safe, but sometimes doesn't matter.
-        BlockMode bool
-        // Make sure data is safe in multiple goroutines.
-        lock sync.RWMutex
-
-        // Allow combination of multiple data sources.
-        dataSources []dataSource
-        // Actual data is stored here.
-        sections map[string]*Section
-
-        // To keep data in order.
-        sectionList []string
-
-        options LoadOptions
-
-        NameMapper
-        ValueMapper
-}
-
-// newFile initializes File object with given data sources.
-func newFile(dataSources []dataSource, opts LoadOptions) *File {
-        return &File{
-                BlockMode:   true,
-                dataSources: dataSources,
-                sections:    make(map[string]*Section),
-                sectionList: make([]string, 0, 10),
-                options:     opts,
-        }
-}
-
-func parseDataSource(source interface{}) (dataSource, error) {
-        switch s := source.(type) {
-        case string:
-                return sourceFile{s}, nil
-        case []byte:
-                return &sourceData{s}, nil
-        case io.ReadCloser:
-                return &sourceReadCloser{s}, nil
-        default:
-                return nil, fmt.Errorf("error parsing data source: unknown type '%s'", s)
-        }
-}
-
-type LoadOptions struct {
-        // Loose indicates whether the parser should ignore nonexistent files or return error.
-        Loose bool
-        // Insensitive indicates whether the parser forces all section and key names to lowercase.
-        Insensitive bool
-        // IgnoreContinuation indicates whether to ignore continuation lines while parsing.
-        IgnoreContinuation bool
-        // AllowBooleanKeys indicates whether to allow boolean type keys or treat as value is missing.
-        // This type of keys are mostly used in my.cnf.
-        AllowBooleanKeys bool
-        // AllowShadows indicates whether to keep track of keys with same name under same section.
-        AllowShadows bool
-        // Some INI formats allow group blocks that store a block of raw content that doesn't otherwise
-        // conform to key/value pairs. Specify the names of those blocks here.
-        UnparseableSections []string
-}
-
-func LoadSources(opts LoadOptions, source interface{}, others ...interface{}) (_ *File, err error) {
-        sources := make([]dataSource, len(others)+1)
-        sources[0], err = parseDataSource(source)
-        if err != nil {
-                return nil, err
-        }
-        for i := range others {
-                sources[i+1], err = parseDataSource(others[i])
-                if err != nil {
-                        return nil, err
-                }
-        }
-        f := newFile(sources, opts)
-        if err = f.Reload(); err != nil {
-                return nil, err
-        }
-        return f, nil
-}
-
-// Load loads and parses from INI data sources.
-// Arguments can be mixed of file name with string type, or raw data in []byte.
-// It will return error if list contains nonexistent files.
-func Load(source interface{}, others ...interface{}) (*File, error) {
-        return LoadSources(LoadOptions{}, source, others...)
-}
-
-// LooseLoad has exactly same functionality as Load function
-// except it ignores nonexistent files instead of returning error.
-func LooseLoad(source interface{}, others ...interface{}) (*File, error) {
-        return LoadSources(LoadOptions{Loose: true}, source, others...)
-}
-
-// InsensitiveLoad has exactly same functionality as Load function
-// except it forces all section and key names to be lowercased.
-func InsensitiveLoad(source interface{}, others ...interface{}) (*File, error) {
-        return LoadSources(LoadOptions{Insensitive: true}, source, others...)
-}
-
-// InsensitiveLoad has exactly same functionality as Load function
-// except it allows have shadow keys.
-func ShadowLoad(source interface{}, others ...interface{}) (*File, error) {
-        return LoadSources(LoadOptions{AllowShadows: true}, source, others...)
-}
-
-// Empty returns an empty file object.
-func Empty() *File {
-        // Ignore error here, we sure our data is good.
-        f, _ := Load([]byte(""))
-        return f
-}
-
-// NewSection creates a new section.
-func (f *File) NewSection(name string) (*Section, error) {
-        if len(name) == 0 {
-                return nil, errors.New("error creating new section: empty section name")
-        } else if f.options.Insensitive && name != DEFAULT_SECTION {
-                name = strings.ToLower(name)
-        }
-
-        if f.BlockMode {
-                f.lock.Lock()
-                defer f.lock.Unlock()
-        }
-
-        if inSlice(name, f.sectionList) {
-                return f.sections[name], nil
-        }
-
-        f.sectionList = append(f.sectionList, name)
-        f.sections[name] = newSection(f, name)
-        return f.sections[name], nil
-}
-
-// NewRawSection creates a new section with an unparseable body.
-func (f *File) NewRawSection(name, body string) (*Section, error) {
-        section, err := f.NewSection(name)
-        if err != nil {
-                return nil, err
-        }
-
-        section.isRawSection = true
-        section.rawBody = body
-        return section, nil
-}
-
-// NewSections creates a list of sections.
-func (f *File) NewSections(names ...string) (err error) {
-        for _, name := range names {
-                if _, err = f.NewSection(name); err != nil {
-                        return err
-                }
-        }
-        return nil
-}
-
-// GetSection returns section by given name.
-func (f *File) GetSection(name string) (*Section, error) {
-        if len(name) == 0 {
-                name = DEFAULT_SECTION
-        } else if f.options.Insensitive {
-                name = strings.ToLower(name)
-        }
-
-        if f.BlockMode {
-                f.lock.RLock()
-                defer f.lock.RUnlock()
-        }
-
-        sec := f.sections[name]
-        if sec == nil {
-                return nil, fmt.Errorf("section '%s' does not exist", name)
-        }
-        return sec, nil
-}
-
-// Section assumes named section exists and returns a zero-value when not.
-func (f *File) Section(name string) *Section {
-        sec, err := f.GetSection(name)
-        if err != nil {
-                // Note: It's OK here because the only possible error is empty section name,
-                // but if it's empty, this piece of code won't be executed.
-                sec, _ = f.NewSection(name)
-                return sec
-        }
-        return sec
-}
-
-// Section returns list of Section.
-func (f *File) Sections() []*Section {
-        sections := make([]*Section, len(f.sectionList))
-        for i := range f.sectionList {
-                sections[i] = f.Section(f.sectionList[i])
-        }
-        return sections
-}
-
-// SectionStrings returns list of section names.
-func (f *File) SectionStrings() []string {
-        list := make([]string, len(f.sectionList))
-        copy(list, f.sectionList)
-        return list
-}
-
-// DeleteSection deletes a section.
-func (f *File) DeleteSection(name string) {
-        if f.BlockMode {
-                f.lock.Lock()
-                defer f.lock.Unlock()
-        }
-
-        if len(name) == 0 {
-                name = DEFAULT_SECTION
-        }
-
-        for i, s := range f.sectionList {
-                if s == name {
-                        f.sectionList = append(f.sectionList[:i], f.sectionList[i+1:]...)
-                        delete(f.sections, name)
-                        return
-                }
-        }
-}
-
-func (f *File) reload(s dataSource) error {
-        r, err := s.ReadCloser()
-        if err != nil {
-                return err
-        }
-        defer r.Close()
-
-        return f.parse(r)
-}
-
-// Reload reloads and parses all data sources.
-func (f *File) Reload() (err error) {
-        for _, s := range f.dataSources {
-                if err = f.reload(s); err != nil {
-                        // In loose mode, we create an empty default section for nonexistent files.
-                        if os.IsNotExist(err) && f.options.Loose {
-                                f.parse(bytes.NewBuffer(nil))
-                                continue
-                        }
-                        return err
-                }
-        }
-        return nil
-}
-
-// Append appends one or more data sources and reloads automatically.
-func (f *File) Append(source interface{}, others ...interface{}) error {
-        ds, err := parseDataSource(source)
-        if err != nil {
-                return err
-        }
-        f.dataSources = append(f.dataSources, ds)
-        for _, s := range others {
-                ds, err = parseDataSource(s)
-                if err != nil {
-                        return err
-                }
-                f.dataSources = append(f.dataSources, ds)
-        }
-        return f.Reload()
-}
-
-// WriteToIndent writes content into io.Writer with given indention.
-// If PrettyFormat has been set to be true,
-// it will align "=" sign with spaces under each section.
-func (f *File) WriteToIndent(w io.Writer, indent string) (n int64, err error) {
-        equalSign := "="
-        if PrettyFormat {
-                equalSign = " = "
-        }
-
-        // Use buffer to make sure target is safe until finish encoding.
-        buf := bytes.NewBuffer(nil)
-        for i, sname := range f.sectionList {
-                sec := f.Section(sname)
-                if len(sec.Comment) > 0 {
-                        if sec.Comment[0] != '#' && sec.Comment[0] != ';' {
-                                sec.Comment = "; " + sec.Comment
-                        }
-                        if _, err = buf.WriteString(sec.Comment + LineBreak); err != nil {
-                                return 0, err
-                        }
-                }
-
-                if i > 0 || DefaultHeader {
-                        if _, err = buf.WriteString("[" + sname + "]" + LineBreak); err != nil {
-                                return 0, err
-                        }
-                } else {
-                        // Write nothing if default section is empty
-                        if len(sec.keyList) == 0 {
-                                continue
-                        }
-                }
-
-                if sec.isRawSection {
-                        if _, err = buf.WriteString(sec.rawBody); err != nil {
-                                return 0, err
-                        }
-                        continue
-                }
-
-                // Count and generate alignment length and buffer spaces using the
-                // longest key. Keys may be modifed if they contain certain characters so
-                // we need to take that into account in our calculation.
-                alignLength := 0
-                if PrettyFormat {
-                        for _, kname := range sec.keyList {
-                                keyLength := len(kname)
-                                // First case will surround key by ` and second by """
-                                if strings.ContainsAny(kname, "\"=:") {
-                                        keyLength += 2
-                                } else if strings.Contains(kname, "`") {
-                                        keyLength += 6
-                                }
-
-                                if keyLength > alignLength {
-                                        alignLength = keyLength
-                                }
-                        }
-                }
-                alignSpaces := bytes.Repeat([]byte(" "), alignLength)
-
-        KEY_LIST:
-                for _, kname := range sec.keyList {
-                        key := sec.Key(kname)
-                        if len(key.Comment) > 0 {
-                                if len(indent) > 0 && sname != DEFAULT_SECTION {
-                                        buf.WriteString(indent)
-                                }
-                                if key.Comment[0] != '#' && key.Comment[0] != ';' {
-                                        key.Comment = "; " + key.Comment
-                                }
-                                if _, err = buf.WriteString(key.Comment + LineBreak); err != nil {
-                                        return 0, err
-                                }
-                        }
-
-                        if len(indent) > 0 && sname != DEFAULT_SECTION {
-                                buf.WriteString(indent)
-                        }
-
-                        switch {
-                        case key.isAutoIncrement:
-                                kname = "-"
-                        case strings.ContainsAny(kname, "\"=:"):
-                                kname = "`" + kname + "`"
-                        case strings.Contains(kname, "`"):
-                                kname = `"""` + kname + `"""`
-                        }
-
-                        for _, val := range key.ValueWithShadows() {
-                                if _, err = buf.WriteString(kname); err != nil {
-                                        return 0, err
-                                }
-
-                                if key.isBooleanType {
-                                        if kname != sec.keyList[len(sec.keyList)-1] {
-                                                buf.WriteString(LineBreak)
-                                        }
-                                        continue KEY_LIST
-                                }
-
-                                // Write out alignment spaces before "=" sign
-                                if PrettyFormat {
-                                        buf.Write(alignSpaces[:alignLength-len(kname)])
-                                }
-
-                                // In case key value contains "\n", "`", "\"", "#" or ";"
-                                if strings.ContainsAny(val, "\n`") {
-                                        val = `"""` + val + `"""`
-                                } else if strings.ContainsAny(val, "#;") {
-                                        val = "`" + val + "`"
-                                }
-                                if _, err = buf.WriteString(equalSign + val + LineBreak); err != nil {
-                                        return 0, err
-                                }
-                        }
-                }
-
-                // Put a line between sections
-                if _, err = buf.WriteString(LineBreak); err != nil {
-                        return 0, err
-                }
-        }
-
-        return buf.WriteTo(w)
-}
-
-// WriteTo writes file content into io.Writer.
-func (f *File) WriteTo(w io.Writer) (int64, error) {
-        return f.WriteToIndent(w, "")
-}
-
-// SaveToIndent writes content to file system with given value indention.
-func (f *File) SaveToIndent(filename, indent string) error {
-        // Note: Because we are truncating with os.Create,
-        //      so it's safer to save to a temporary file location and rename afte done.
-        tmpPath := filename + "." + strconv.Itoa(time.Now().Nanosecond()) + ".tmp"
-        defer os.Remove(tmpPath)
-
-        fw, err := os.Create(tmpPath)
-        if err != nil {
-                return err
-        }
-
-        if _, err = f.WriteToIndent(fw, indent); err != nil {
-                fw.Close()
-                return err
-        }
-        fw.Close()
-
-        // Remove old file and rename the new one.
-        os.Remove(filename)
-        return os.Rename(tmpPath, filename)
-}
-
-// SaveTo writes content to file system.
-func (f *File) SaveTo(filename string) error {
-        return f.SaveToIndent(filename, "")
-}
diff --git a/vendor/github.com/go-ini/ini/key.go b/vendor/github.com/go-ini/ini/key.go
deleted file mode 100644
index 852696f..0000000
--- a/vendor/github.com/go-ini/ini/key.go
+++ /dev/null
@@ -1,703 +0,0 @@
-// Copyright 2014 Unknwon
-//
-// Licensed under the Apache License, Version 2.0 (the "License"): you may
-// not use this file except in compliance with the License. You may obtain
-// a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-// License for the specific language governing permissions and limitations
-// under the License.
-
-package ini
-
-import (
-        "errors"
-        "fmt"
-        "strconv"
-        "strings"
-        "time"
-)
-
-// Key represents a key under a section.
-type Key struct {
-        s               *Section
-        name            string
-        value           string
-        isAutoIncrement bool
-        isBooleanType   bool
-
-        isShadow bool
-        shadows  []*Key
-
-        Comment string
-}
-
-// newKey simply return a key object with given values.
-func newKey(s *Section, name, val string) *Key {
-        return &Key{
-                s:     s,
-                name:  name,
-                value: val,
-        }
-}
-
-func (k *Key) addShadow(val string) error {
-        if k.isShadow {
-                return errors.New("cannot add shadow to another shadow key")
-        } else if k.isAutoIncrement || k.isBooleanType {
-                return errors.New("cannot add shadow to auto-increment or boolean key")
-        }
-
-        shadow := newKey(k.s, k.name, val)
-        shadow.isShadow = true
-        k.shadows = append(k.shadows, shadow)
-        return nil
-}
-
-// AddShadow adds a new shadow key to itself.
-func (k *Key) AddShadow(val string) error {
-        if !k.s.f.options.AllowShadows {
-                return errors.New("shadow key is not allowed")
-        }
-        return k.addShadow(val)
-}
-
-// ValueMapper represents a mapping function for values, e.g. os.ExpandEnv
-type ValueMapper func(string) string
-
-// Name returns name of key.
-func (k *Key) Name() string {
-        return k.name
-}
-
-// Value returns raw value of key for performance purpose.
-func (k *Key) Value() string {
-        return k.value
-}
-
-// ValueWithShadows returns raw values of key and its shadows if any.
-func (k *Key) ValueWithShadows() []string {
-        if len(k.shadows) == 0 {
-                return []string{k.value}
-        }
-        vals := make([]string, len(k.shadows)+1)
-        vals[0] = k.value
-        for i := range k.shadows {
-                vals[i+1] = k.shadows[i].value
-        }
-        return vals
-}
-
-// transformValue takes a raw value and transforms to its final string.
-func (k *Key) transformValue(val string) string {
-        if k.s.f.ValueMapper != nil {
-                val = k.s.f.ValueMapper(val)
-        }
-
-        // Fail-fast if no indicate char found for recursive value
-        if !strings.Contains(val, "%") {
-                return val
-        }
-        for i := 0; i < _DEPTH_VALUES; i++ {
-                vr := varPattern.FindString(val)
-                if len(vr) == 0 {
-                        break
-                }
-
-                // Take off leading '%(' and trailing ')s'.
-                noption := strings.TrimLeft(vr, "%(")
-                noption = strings.TrimRight(noption, ")s")
-
-                // Search in the same section.
-                nk, err := k.s.GetKey(noption)
-                if err != nil {
-                        // Search again in default section.
-                        nk, _ = k.s.f.Section("").GetKey(noption)
-                }
-
-                // Substitute by new value and take off leading '%(' and trailing ')s'.
-                val = strings.Replace(val, vr, nk.value, -1)
-        }
-        return val
-}
-
-// String returns string representation of value.
-func (k *Key) String() string {
-        return k.transformValue(k.value)
-}
-
-// Validate accepts a validate function which can
-// return modifed result as key value.
-func (k *Key) Validate(fn func(string) string) string {
-        return fn(k.String())
-}
-
-// parseBool returns the boolean value represented by the string.
-//
-// It accepts 1, t, T, TRUE, true, True, YES, yes, Yes, y, ON, on, On,
-// 0, f, F, FALSE, false, False, NO, no, No, n, OFF, off, Off.
-// Any other value returns an error.
-func parseBool(str string) (value bool, err error) {
-        switch str {
-        case "1", "t", "T", "true", "TRUE", "True", "YES", "yes", "Yes", "y", "ON", "on", "On":
-                return true, nil
-        case "0", "f", "F", "false", "FALSE", "False", "NO", "no", "No", "n", "OFF", "off", "Off":
-                return false, nil
-        }
-        return false, fmt.Errorf("parsing \"%s\": invalid syntax", str)
-}
-
-// Bool returns bool type value.
-func (k *Key) Bool() (bool, error) {
-        return parseBool(k.String())
-}
-
-// Float64 returns float64 type value.
-func (k *Key) Float64() (float64, error) {
-        return strconv.ParseFloat(k.String(), 64)
-}
-
-// Int returns int type value.
-func (k *Key) Int() (int, error) {
-        return strconv.Atoi(k.String())
-}
-
-// Int64 returns int64 type value.
-func (k *Key) Int64() (int64, error) {
-        return strconv.ParseInt(k.String(), 10, 64)
-}
-
-// Uint returns uint type valued.
-func (k *Key) Uint() (uint, error) {
-        u, e := strconv.ParseUint(k.String(), 10, 64)
-        return uint(u), e
-}
-
-// Uint64 returns uint64 type value.
-func (k *Key) Uint64() (uint64, error) {
-        return strconv.ParseUint(k.String(), 10, 64)
-}
-
-// Duration returns time.Duration type value.
-func (k *Key) Duration() (time.Duration, error) {
-        return time.ParseDuration(k.String())
-}
-
-// TimeFormat parses with given format and returns time.Time type value.
-func (k *Key) TimeFormat(format string) (time.Time, error) {
-        return time.Parse(format, k.String())
-}
-
-// Time parses with RFC3339 format and returns time.Time type value.
-func (k *Key) Time() (time.Time, error) {
-        return k.TimeFormat(time.RFC3339)
-}
-
-// MustString returns default value if key value is empty.
-func (k *Key) MustString(defaultVal string) string {
-        val := k.String()
-        if len(val) == 0 {
-                k.value = defaultVal
-                return defaultVal
-        }
-        return val
-}
-
-// MustBool always returns value without error,
-// it returns false if error occurs.
-func (k *Key) MustBool(defaultVal ...bool) bool {
-        val, err := k.Bool()
-        if len(defaultVal) > 0 && err != nil {
-                k.value = strconv.FormatBool(defaultVal[0])
-                return defaultVal[0]
-        }
-        return val
-}
-
-// MustFloat64 always returns value without error,
-// it returns 0.0 if error occurs.
-func (k *Key) MustFloat64(defaultVal ...float64) float64 {
-        val, err := k.Float64()
-        if len(defaultVal) > 0 && err != nil {
-                k.value = strconv.FormatFloat(defaultVal[0], 'f', -1, 64)
-                return defaultVal[0]
-        }
-        return val
-}
-
-// MustInt always returns value without error,
-// it returns 0 if error occurs.
-func (k *Key) MustInt(defaultVal ...int) int {
-        val, err := k.Int()
-        if len(defaultVal) > 0 && err != nil {
-                k.value = strconv.FormatInt(int64(defaultVal[0]), 10)
-                return defaultVal[0]
-        }
-        return val
-}
-
-// MustInt64 always returns value without error,
-// it returns 0 if error occurs.
-func (k *Key) MustInt64(defaultVal ...int64) int64 {
-        val, err := k.Int64()
-        if len(defaultVal) > 0 && err != nil {
-                k.value = strconv.FormatInt(defaultVal[0], 10)
-                return defaultVal[0]
-        }
-        return val
-}
-
-// MustUint always returns value without error,
-// it returns 0 if error occurs.
-func (k *Key) MustUint(defaultVal ...uint) uint {
-        val, err := k.Uint()
-        if len(defaultVal) > 0 && err != nil {
-                k.value = strconv.FormatUint(uint64(defaultVal[0]), 10)
-                return defaultVal[0]
-        }
-        return val
-}
-
-// MustUint64 always returns value without error,
-// it returns 0 if error occurs.
-func (k *Key) MustUint64(defaultVal ...uint64) uint64 {
-        val, err := k.Uint64()
-        if len(defaultVal) > 0 && err != nil {
-                k.value = strconv.FormatUint(defaultVal[0], 10)
-                return defaultVal[0]
-        }
-        return val
-}
-
-// MustDuration always returns value without error,
-// it returns zero value if error occurs.
-func (k *Key) MustDuration(defaultVal ...time.Duration) time.Duration {
-        val, err := k.Duration()
-        if len(defaultVal) > 0 && err != nil {
-                k.value = defaultVal[0].String()
-                return defaultVal[0]
-        }
-        return val
-}
-
-// MustTimeFormat always parses with given format and returns value without error,
-// it returns zero value if error occurs.
-func (k *Key) MustTimeFormat(format string, defaultVal ...time.Time) time.Time {
-        val, err := k.TimeFormat(format)
-        if len(defaultVal) > 0 && err != nil {
-                k.value = defaultVal[0].Format(format)
-                return defaultVal[0]
-        }
-        return val
-}
-
-// MustTime always parses with RFC3339 format and returns value without error,
-// it returns zero value if error occurs.
-func (k *Key) MustTime(defaultVal ...time.Time) time.Time {
-        return k.MustTimeFormat(time.RFC3339, defaultVal...)
-}
-
-// In always returns value without error,
-// it returns default value if error occurs or doesn't fit into candidates.
-func (k *Key) In(defaultVal string, candidates []string) string {
-        val := k.String()
-        for _, cand := range candidates {
-                if val == cand {
-                        return val
-                }
-        }
-        return defaultVal
-}
-
-// InFloat64 always returns value without error,
-// it returns default value if error occurs or doesn't fit into candidates.
-func (k *Key) InFloat64(defaultVal float64, candidates []float64) float64 {
-        val := k.MustFloat64()
-        for _, cand := range candidates {
-                if val == cand {
-                        return val
-                }
-        }
-        return defaultVal
-}
-
-// InInt always returns value without error,
-// it returns default value if error occurs or doesn't fit into candidates.
-func (k *Key) InInt(defaultVal int, candidates []int) int {
-        val := k.MustInt()
-        for _, cand := range candidates {
-                if val == cand {
-                        return val
-                }
-        }
-        return defaultVal
-}
-
-// InInt64 always returns value without error,
-// it returns default value if error occurs or doesn't fit into candidates.
-func (k *Key) InInt64(defaultVal int64, candidates []int64) int64 {
-        val := k.MustInt64()
-        for _, cand := range candidates {
-                if val == cand {
-                        return val
-                }
-        }
-        return defaultVal
-}
-
-// InUint always returns value without error,
-// it returns default value if error occurs or doesn't fit into candidates.
-func (k *Key) InUint(defaultVal uint, candidates []uint) uint {
-        val := k.MustUint()
-        for _, cand := range candidates {
-                if val == cand {
-                        return val
-                }
-        }
-        return defaultVal
-}
-
-// InUint64 always returns value without error,
-// it returns default value if error occurs or doesn't fit into candidates.
-func (k *Key) InUint64(defaultVal uint64, candidates []uint64) uint64 {
-        val := k.MustUint64()
-        for _, cand := range candidates {
-                if val == cand {
-                        return val
-                }
-        }
-        return defaultVal
-}
-
-// InTimeFormat always parses with given format and returns value without error,
-// it returns default value if error occurs or doesn't fit into candidates.
-func (k *Key) InTimeFormat(format string, defaultVal time.Time, candidates []time.Time) time.Time {
-        val := k.MustTimeFormat(format)
-        for _, cand := range candidates {
-                if val == cand {
-                        return val
-                }
-        }
-        return defaultVal
-}
-
-// InTime always parses with RFC3339 format and returns value without error,
-// it returns default value if error occurs or doesn't fit into candidates.
-func (k *Key) InTime(defaultVal time.Time, candidates []time.Time) time.Time {
-        return k.InTimeFormat(time.RFC3339, defaultVal, candidates)
-}
-
-// RangeFloat64 checks if value is in given range inclusively,
-// and returns default value if it's not.
-func (k *Key) RangeFloat64(defaultVal, min, max float64) float64 {
-        val := k.MustFloat64()
-        if val < min || val > max {
-                return defaultVal
-        }
-        return val
-}
-
-// RangeInt checks if value is in given range inclusively,
-// and returns default value if it's not.
-func (k *Key) RangeInt(defaultVal, min, max int) int {
-        val := k.MustInt()
-        if val < min || val > max {
-                return defaultVal
-        }
-        return val
-}
-
-// RangeInt64 checks if value is in given range inclusively,
-// and returns default value if it's not.
-func (k *Key) RangeInt64(defaultVal, min, max int64) int64 {
-        val := k.MustInt64()
-        if val < min || val > max {
-                return defaultVal
-        }
-        return val
-}
-
-// RangeTimeFormat checks if value with given format is in given range inclusively,
-// and returns default value if it's not.
-func (k *Key) RangeTimeFormat(format string, defaultVal, min, max time.Time) time.Time {
-        val := k.MustTimeFormat(format)
-        if val.Unix() < min.Unix() || val.Unix() > max.Unix() {
-                return defaultVal
-        }
-        return val
-}
-
-// RangeTime checks if value with RFC3339 format is in given range inclusively,
-// and returns default value if it's not.
-func (k *Key) RangeTime(defaultVal, min, max time.Time) time.Time {
-        return k.RangeTimeFormat(time.RFC3339, defaultVal, min, max)
-}
-
-// Strings returns list of string divided by given delimiter.
-func (k *Key) Strings(delim string) []string {
-        str := k.String()
-        if len(str) == 0 {
-                return []string{}
-        }
-
-        vals := strings.Split(str, delim)
-        for i := range vals {
-                // vals[i] = k.transformValue(strings.TrimSpace(vals[i]))
-                vals[i] = strings.TrimSpace(vals[i])
-        }
-        return vals
-}
-
-// StringsWithShadows returns list of string divided by given delimiter.
-// Shadows will also be appended if any.
-func (k *Key) StringsWithShadows(delim string) []string {
-        vals := k.ValueWithShadows()
-        results := make([]string, 0, len(vals)*2)
-        for i := range vals {
-                if len(vals) == 0 {
-                        continue
-                }
-
-                results = append(results, strings.Split(vals[i], delim)...)
-        }
-
-        for i := range results {
-                results[i] = k.transformValue(strings.TrimSpace(results[i]))
-        }
-        return results
-}
-
-// Float64s returns list of float64 divided by given delimiter. Any invalid input will be treated as zero value.
-func (k *Key) Float64s(delim string) []float64 {
-        vals, _ := k.getFloat64s(delim, true, false)
-        return vals
-}
-
-// Ints returns list of int divided by given delimiter. Any invalid input will be treated as zero value.
-func (k *Key) Ints(delim string) []int {
-        vals, _ := k.parseInts(k.Strings(delim), true, false)
-        return vals
-}
-
-// Int64s returns list of int64 divided by given delimiter. Any invalid input will be treated as zero value.
-func (k *Key) Int64s(delim string) []int64 {
-        vals, _ := k.parseInt64s(k.Strings(delim), true, false)
-        return vals
-}
-
-// Uints returns list of uint divided by given delimiter. Any invalid input will be treated as zero value.
-func (k *Key) Uints(delim string) []uint {
-        vals, _ := k.getUints(delim, true, false)
-        return vals
-}
-
-// Uint64s returns list of uint64 divided by given delimiter. Any invalid input will be treated as zero value.
-func (k *Key) Uint64s(delim string) []uint64 {
-        vals, _ := k.getUint64s(delim, true, false)
-        return vals
-}
-
-// TimesFormat parses with given format and returns list of time.Time divided by given delimiter.
-// Any invalid input will be treated as zero value (0001-01-01 00:00:00 +0000 UTC).
-func (k *Key) TimesFormat(format, delim string) []time.Time {
-        vals, _ := k.getTimesFormat(format, delim, true, false)
-        return vals
-}
-
-// Times parses with RFC3339 format and returns list of time.Time divided by given delimiter.
-// Any invalid input will be treated as zero value (0001-01-01 00:00:00 +0000 UTC).
-func (k *Key) Times(delim string) []time.Time {
-        return k.TimesFormat(time.RFC3339, delim)
-}
-
-// ValidFloat64s returns list of float64 divided by given delimiter. If some value is not float, then
-// it will not be included to result list.
-func (k *Key) ValidFloat64s(delim string) []float64 {
-        vals, _ := k.getFloat64s(delim, false, false)
-        return vals
-}
-
-// ValidInts returns list of int divided by given delimiter. If some value is not integer, then it will
-// not be included to result list.
-func (k *Key) ValidInts(delim string) []int {
-        vals, _ := k.parseInts(k.Strings(delim), false, false)
-        return vals
-}
-
-// ValidInt64s returns list of int64 divided by given delimiter. If some value is not 64-bit integer,
-// then it will not be included to result list.
-func (k *Key) ValidInt64s(delim string) []int64 {
-        vals, _ := k.parseInt64s(k.Strings(delim), false, false)
-        return vals
-}
-
-// ValidUints returns list of uint divided by given delimiter. If some value is not unsigned integer,
-// then it will not be included to result list.
-func (k *Key) ValidUints(delim string) []uint {
-        vals, _ := k.getUints(delim, false, false)
-        return vals
-}
-
-// ValidUint64s returns list of uint64 divided by given delimiter. If some value is not 64-bit unsigned
-// integer, then it will not be included to result list.
-func (k *Key) ValidUint64s(delim string) []uint64 {
-        vals, _ := k.getUint64s(delim, false, false)
-        return vals
-}
-
-// ValidTimesFormat parses with given format and returns list of time.Time divided by given delimiter.
-func (k *Key) ValidTimesFormat(format, delim string) []time.Time {
-        vals, _ := k.getTimesFormat(format, delim, false, false)
-        return vals
-}
-
-// ValidTimes parses with RFC3339 format and returns list of time.Time divided by given delimiter.
-func (k *Key) ValidTimes(delim string) []time.Time {
-        return k.ValidTimesFormat(time.RFC3339, delim)
-}
-
-// StrictFloat64s returns list of float64 divided by given delimiter or error on first invalid input.
-func (k *Key) StrictFloat64s(delim string) ([]float64, error) {
-        return k.getFloat64s(delim, false, true)
-}
-
-// StrictInts returns list of int divided by given delimiter or error on first invalid input.
-func (k *Key) StrictInts(delim string) ([]int, error) {
-        return k.parseInts(k.Strings(delim), false, true)
-}
-
-// StrictInt64s returns list of int64 divided by given delimiter or error on first invalid input.
-func (k *Key) StrictInt64s(delim string) ([]int64, error) {
-        return k.parseInt64s(k.Strings(delim), false, true)
-}
-
-// StrictUints returns list of uint divided by given delimiter or error on first invalid input.
-func (k *Key) StrictUints(delim string) ([]uint, error) {
-        return k.getUints(delim, false, true)
-}
-
-// StrictUint64s returns list of uint64 divided by given delimiter or error on first invalid input.
-func (k *Key) StrictUint64s(delim string) ([]uint64, error) {
-        return k.getUint64s(delim, false, true)
-}
-
-// StrictTimesFormat parses with given format and returns list of time.Time divided by given delimiter
-// or error on first invalid input.
-func (k *Key) StrictTimesFormat(format, delim string) ([]time.Time, error) {
-        return k.getTimesFormat(format, delim, false, true)
-}
-
-// StrictTimes parses with RFC3339 format and returns list of time.Time divided by given delimiter
-// or error on first invalid input.
-func (k *Key) StrictTimes(delim string) ([]time.Time, error) {
-        return k.StrictTimesFormat(time.RFC3339, delim)
-}
-
-// getFloat64s returns list of float64 divided by given delimiter.
-func (k *Key) getFloat64s(delim string, addInvalid, returnOnInvalid bool) ([]float64, error) {
-        strs := k.Strings(delim)
-        vals := make([]float64, 0, len(strs))
-        for _, str := range strs {
-                val, err := strconv.ParseFloat(str, 64)
-                if err != nil && returnOnInvalid {
-                        return nil, err
-                }
-                if err == nil || addInvalid {
-                        vals = append(vals, val)
-                }
-        }
-        return vals, nil
-}
-
-// parseInts transforms strings to ints.
-func (k *Key) parseInts(strs []string, addInvalid, returnOnInvalid bool) ([]int, error) {
-        vals := make([]int, 0, len(strs))
-        for _, str := range strs {
-                val, err := strconv.Atoi(str)
-                if err != nil && returnOnInvalid {
-                        return nil, err
-                }
-                if err == nil || addInvalid {
-                        vals = append(vals, val)
-                }
-        }
-        return vals, nil
-}
-
-// parseInt64s transforms strings to int64s.
-func (k *Key) parseInt64s(strs []string, addInvalid, returnOnInvalid bool) ([]int64, error) {
-        vals := make([]int64, 0, len(strs))
-        for _, str := range strs {
-                val, err := strconv.ParseInt(str, 10, 64)
-                if err != nil && returnOnInvalid {
-                        return nil, err
-                }
-                if err == nil || addInvalid {
-                        vals = append(vals, val)
-                }
-        }
-        return vals, nil
-}
-
-// getUints returns list of uint divided by given delimiter.
-func (k *Key) getUints(delim string, addInvalid, returnOnInvalid bool) ([]uint, error) {
-        strs := k.Strings(delim)
-        vals := make([]uint, 0, len(strs))
-        for _, str := range strs {
-                val, err := strconv.ParseUint(str, 10, 0)
-                if err != nil && returnOnInvalid {
-                        return nil, err
-                }
-                if err == nil || addInvalid {
-                        vals = append(vals, uint(val))
-                }
-        }
-        return vals, nil
-}
-
-// getUint64s returns list of uint64 divided by given delimiter.
-func (k *Key) getUint64s(delim string, addInvalid, returnOnInvalid bool) ([]uint64, error) {
-        strs := k.Strings(delim)
-        vals := make([]uint64, 0, len(strs))
-        for _, str := range strs {
-                val, err := strconv.ParseUint(str, 10, 64)
-                if err != nil && returnOnInvalid {
-                        return nil, err
-                }
-                if err == nil || addInvalid {
-                        vals = append(vals, val)
-                }
-        }
-        return vals, nil
-}
-
-// getTimesFormat parses with given format and returns list of time.Time divided by given delimiter.
-func (k *Key) getTimesFormat(format, delim string, addInvalid, returnOnInvalid bool) ([]time.Time, error) {
-        strs := k.Strings(delim)
-        vals := make([]time.Time, 0, len(strs))
-        for _, str := range strs {
-                val, err := time.Parse(format, str)
-                if err != nil && returnOnInvalid {
-                        return nil, err
-                }
-                if err == nil || addInvalid {
-                        vals = append(vals, val)
-                }
-        }
-        return vals, nil
-}
-
-// SetValue changes key value.
-func (k *Key) SetValue(v string) {
-        if k.s.f.BlockMode {
-                k.s.f.lock.Lock()
-                defer k.s.f.lock.Unlock()
-        }
-
-        k.value = v
-        k.s.keysHash[k.name] = v
-}
diff --git a/vendor/github.com/go-ini/ini/parser.go b/vendor/github.com/go-ini/ini/parser.go
deleted file mode 100644
index 673ef80..0000000
--- a/vendor/github.com/go-ini/ini/parser.go
+++ /dev/null
@@ -1,358 +0,0 @@
-// Copyright 2015 Unknwon
-//
-// Licensed under the Apache License, Version 2.0 (the "License"): you may
-// not use this file except in compliance with the License. You may obtain
-// a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-// License for the specific language governing permissions and limitations
-// under the License.
-
-package ini
-
-import (
-        "bufio"
-        "bytes"
-        "fmt"
-        "io"
-        "strconv"
-        "strings"
-        "unicode"
-)
-
-type tokenType int
-
-const (
-        _TOKEN_INVALID tokenType = iota
-        _TOKEN_COMMENT
-        _TOKEN_SECTION
-        _TOKEN_KEY
-)
-
-type parser struct {
-        buf     *bufio.Reader
-        isEOF   bool
-        count   int
-        comment *bytes.Buffer
-}
-
-func newParser(r io.Reader) *parser {
-        return &parser{
-                buf:     bufio.NewReader(r),
-                count:   1,
-                comment: &bytes.Buffer{},
-        }
-}
-
-// BOM handles header of UTF-8, UTF-16 LE and UTF-16 BE's BOM format.
-// http://en.wikipedia.org/wiki/Byte_order_mark#Representations_of_byte_order_marks_by_encoding
-func (p *parser) BOM() error {
-        mask, err := p.buf.Peek(2)
-        if err != nil && err != io.EOF {
-                return err
-        } else if len(mask) < 2 {
-                return nil
-        }
-
-        switch {
-        case mask[0] == 254 && mask[1] == 255:
-                fallthrough
-        case mask[0] == 255 && mask[1] == 254:
-                p.buf.Read(mask)
-        case mask[0] == 239 && mask[1] == 187:
-                mask, err := p.buf.Peek(3)
-                if err != nil && err != io.EOF {
-                        return err
-                } else if len(mask) < 3 {
-                        return nil
-                }
-                if mask[2] == 191 {
-                        p.buf.Read(mask)
-                }
-        }
-        return nil
-}
-
-func (p *parser) readUntil(delim byte) ([]byte, error) {
-        data, err := p.buf.ReadBytes(delim)
-        if err != nil {
-                if err == io.EOF {
-                        p.isEOF = true
-                } else {
-                        return nil, err
-                }
-        }
-        return data, nil
-}
-
-func cleanComment(in []byte) ([]byte, bool) {
-        i := bytes.IndexAny(in, "#;")
-        if i == -1 {
-                return nil, false
-        }
-        return in[i:], true
-}
-
-func readKeyName(in []byte) (string, int, error) {
-        line := string(in)
-
-        // Check if key name surrounded by quotes.
-        var keyQuote string
-        if line[0] == '"' {
-                if len(line) > 6 && string(line[0:3]) == `"""` {
-                        keyQuote = `"""`
-                } else {
-                        keyQuote = `"`
-                }
-        } else if line[0] == '`' {
-                keyQuote = "`"
-        }
-
-        // Get out key name
-        endIdx := -1
-        if len(keyQuote) > 0 {
-                startIdx := len(keyQuote)
-                // FIXME: fail case -> """"""name"""=value
-                pos := strings.Index(line[startIdx:], keyQuote)
-                if pos == -1 {
-                        return "", -1, fmt.Errorf("missing closing key quote: %s", line)
-                }
-                pos += startIdx
-
-                // Find key-value delimiter
-                i := strings.IndexAny(line[pos+startIdx:], "=:")
-                if i < 0 {
-                        return "", -1, ErrDelimiterNotFound{line}
-                }
-                endIdx = pos + i
-                return strings.TrimSpace(line[startIdx:pos]), endIdx + startIdx + 1, nil
-        }
-
-        endIdx = strings.IndexAny(line, "=:")
-        if endIdx < 0 {
-                return "", -1, ErrDelimiterNotFound{line}
-        }
-        return strings.TrimSpace(line[0:endIdx]), endIdx + 1, nil
-}
-
-func (p *parser) readMultilines(line, val, valQuote string) (string, error) {
-        for {
-                data, err := p.readUntil('\n')
-                if err != nil {
-                        return "", err
-                }
-                next := string(data)
-
-                pos := strings.LastIndex(next, valQuote)
-                if pos > -1 {
-                        val += next[:pos]
-
-                        comment, has := cleanComment([]byte(next[pos:]))
-                        if has {
-                                p.comment.Write(bytes.TrimSpace(comment))
-                        }
-                        break
-                }
-                val += next
-                if p.isEOF {
-                        return "", fmt.Errorf("missing closing key quote from '%s' to '%s'", line, next)
-                }
-        }
-        return val, nil
-}
-
-func (p *parser) readContinuationLines(val string) (string, error) {
-        for {
-                data, err := p.readUntil('\n')
-                if err != nil {
-                        return "", err
-                }
-                next := strings.TrimSpace(string(data))
-
-                if len(next) == 0 {
-                        break
-                }
-                val += next
-                if val[len(val)-1] != '\\' {
-                        break
-                }
-                val = val[:len(val)-1]
-        }
-        return val, nil
-}
-
-// hasSurroundedQuote check if and only if the first and last characters
-// are quotes \" or \'.
-// It returns false if any other parts also contain same kind of quotes.
-func hasSurroundedQuote(in string, quote byte) bool {
-        return len(in) > 2 && in[0] == quote && in[len(in)-1] == quote &&
-                strings.IndexByte(in[1:], quote) == len(in)-2
-}
-
-func (p *parser) readValue(in []byte, ignoreContinuation bool) (string, error) {
-        line := strings.TrimLeftFunc(string(in), unicode.IsSpace)
-        if len(line) == 0 {
-                return "", nil
-        }
-
-        var valQuote string
-        if len(line) > 3 && string(line[0:3]) == `"""` {
-                valQuote = `"""`
-        } else if line[0] == '`' {
-                valQuote = "`"
-        }
-
-        if len(valQuote) > 0 {
-                startIdx := len(valQuote)
-                pos := strings.LastIndex(line[startIdx:], valQuote)
-                // Check for multi-line value
-                if pos == -1 {
-                        return p.readMultilines(line, line[startIdx:], valQuote)
-                }
-
-                return line[startIdx : pos+startIdx], nil
-        }
-
-        // Won't be able to reach here if value only contains whitespace.
-        line = strings.TrimSpace(line)
-
-        // Check continuation lines when desired.
-        if !ignoreContinuation && line[len(line)-1] == '\\' {
-                return p.readContinuationLines(line[:len(line)-1])
-        }
-
-        i := strings.IndexAny(line, "#;")
-        if i > -1 {
-                p.comment.WriteString(line[i:])
-                line = strings.TrimSpace(line[:i])
-        }
-
-        // Trim single quotes
-        if hasSurroundedQuote(line, '\'') ||
-                hasSurroundedQuote(line, '"') {
-                line = line[1 : len(line)-1]
-        }
-        return line, nil
-}
-
-// parse parses data through an io.Reader.
-func (f *File) parse(reader io.Reader) (err error) {
-        p := newParser(reader)
-        if err = p.BOM(); err != nil {
-                return fmt.Errorf("BOM: %v", err)
-        }
-
-        // Ignore error because default section name is never empty string.
-        section, _ := f.NewSection(DEFAULT_SECTION)
-
-        var line []byte
-        var inUnparseableSection bool
-        for !p.isEOF {
-                line, err = p.readUntil('\n')
-                if err != nil {
-                        return err
-                }
-
-                line = bytes.TrimLeftFunc(line, unicode.IsSpace)
-                if len(line) == 0 {
-                        continue
-                }
-
-                // Comments
-                if line[0] == '#' || line[0] == ';' {
-                        // Note: we do not care ending line break,
-                        // it is needed for adding second line,
-                        // so just clean it once at the end when set to value.
-                        p.comment.Write(line)
-                        continue
-                }
-
-                // Section
-                if line[0] == '[' {
-                        // Read to the next ']' (TODO: support quoted strings)
-                        // TODO(unknwon): use LastIndexByte when stop supporting Go1.4
-                        closeIdx := bytes.LastIndex(line, []byte("]"))
-                        if closeIdx == -1 {
-                                return fmt.Errorf("unclosed section: %s", line)
-                        }
-
-                        name := string(line[1:closeIdx])
-                        section, err = f.NewSection(name)
-                        if err != nil {
-                                return err
-                        }
-
-                        comment, has := cleanComment(line[closeIdx+1:])
-                        if has {
-                                p.comment.Write(comment)
-                        }
-
-                        section.Comment = strings.TrimSpace(p.comment.String())
-
-                        // Reset aotu-counter and comments
-                        p.comment.Reset()
-                        p.count = 1
-
-                        inUnparseableSection = false
-                        for i := range f.options.UnparseableSections {
-                                if f.options.UnparseableSections[i] == name ||
-                                        (f.options.Insensitive && strings.ToLower(f.options.UnparseableSections[i]) == strings.ToLower(name)) {
-                                        inUnparseableSection = true
-                                        continue
-                                }
-                        }
-                        continue
-                }
-
-                if inUnparseableSection {
-                        section.isRawSection = true
-                        section.rawBody += string(line)
-                        continue
-                }
-
-                kname, offset, err := readKeyName(line)
-                if err != nil {
-                        // Treat as boolean key when desired, and whole line is key name.
-                        if IsErrDelimiterNotFound(err) && f.options.AllowBooleanKeys {
-                                kname, err := p.readValue(line, f.options.IgnoreContinuation)
-                                if err != nil {
-                                        return err
-                                }
-                                key, err := section.NewBooleanKey(kname)
-                                if err != nil {
-                                        return err
-                                }
-                                key.Comment = strings.TrimSpace(p.comment.String())
-                                p.comment.Reset()
-                                continue
-                        }
-                        return err
-                }
-
-                // Auto increment.
-                isAutoIncr := false
-                if kname == "-" {
-                        isAutoIncr = true
-                        kname = "#" + strconv.Itoa(p.count)
-                        p.count++
-                }
-
-                value, err := p.readValue(line[offset:], f.options.IgnoreContinuation)
-                if err != nil {
-                        return err
-                }
-
-                key, err := section.NewKey(kname, value)
-                if err != nil {
-                        return err
-                }
-                key.isAutoIncrement = isAutoIncr
-                key.Comment = strings.TrimSpace(p.comment.String())
-                p.comment.Reset()
-        }
-        return nil
-}
diff --git a/vendor/github.com/go-ini/ini/section.go b/vendor/github.com/go-ini/ini/section.go
deleted file mode 100644
index c9fa27e..0000000
--- a/vendor/github.com/go-ini/ini/section.go
+++ /dev/null
@@ -1,234 +0,0 @@
-// Copyright 2014 Unknwon
-//
-// Licensed under the Apache License, Version 2.0 (the "License"): you may
-// not use this file except in compliance with the License. You may obtain
-// a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-// License for the specific language governing permissions and limitations
-// under the License.
-
-package ini
-
-import (
-        "errors"
-        "fmt"
-        "strings"
-)
-
-// Section represents a config section.
-type Section struct {
-        f        *File
-        Comment  string
-        name     string
-        keys     map[string]*Key
-        keyList  []string
-        keysHash map[string]string
-
-        isRawSection bool
-        rawBody      string
-}
-
-func newSection(f *File, name string) *Section {
-        return &Section{
-                f:        f,
-                name:     name,
-                keys:     make(map[string]*Key),
-                keyList:  make([]string, 0, 10),
-                keysHash: make(map[string]string),
-        }
-}
-
-// Name returns name of Section.
-func (s *Section) Name() string {
-        return s.name
-}
-
-// Body returns rawBody of Section if the section was marked as unparseable.
-// It still follows the other rules of the INI format surrounding leading/trailing whitespace.
-func (s *Section) Body() string {
-        return strings.TrimSpace(s.rawBody)
-}
-
-// NewKey creates a new key to given section.
-func (s *Section) NewKey(name, val string) (*Key, error) {
-        if len(name) == 0 {
-                return nil, errors.New("error creating new key: empty key name")
-        } else if s.f.options.Insensitive {
-                name = strings.ToLower(name)
-        }
-
-        if s.f.BlockMode {
-                s.f.lock.Lock()
-                defer s.f.lock.Unlock()
-        }
-
-        if inSlice(name, s.keyList) {
-                if s.f.options.AllowShadows {
-                        if err := s.keys[name].addShadow(val); err != nil {
-                                return nil, err
-                        }
-                } else {
-                        s.keys[name].value = val
-                }
-                return s.keys[name], nil
-        }
-
-        s.keyList = append(s.keyList, name)
-        s.keys[name] = newKey(s, name, val)
-        s.keysHash[name] = val
-        return s.keys[name], nil
-}
-
-// NewBooleanKey creates a new boolean type key to given section.
-func (s *Section) NewBooleanKey(name string) (*Key, error) {
-        key, err := s.NewKey(name, "true")
-        if err != nil {
-                return nil, err
-        }
-
-        key.isBooleanType = true
-        return key, nil
-}
-
-// GetKey returns key in section by given name.
-func (s *Section) GetKey(name string) (*Key, error) {
-        // FIXME: change to section level lock?
-        if s.f.BlockMode {
-                s.f.lock.RLock()
-        }
-        if s.f.options.Insensitive {
-                name = strings.ToLower(name)
-        }
-        key := s.keys[name]
-        if s.f.BlockMode {
-                s.f.lock.RUnlock()
-        }
-
-        if key == nil {
-                // Check if it is a child-section.
-                sname := s.name
-                for {
-                        if i := strings.LastIndex(sname, "."); i > -1 {
-                                sname = sname[:i]
-                                sec, err := s.f.GetSection(sname)
-                                if err != nil {
-                                        continue
-                                }
-                                return sec.GetKey(name)
-                        } else {
-                                break
-                        }
-                }
-                return nil, fmt.Errorf("error when getting key of section '%s': key '%s' not exists", s.name, name)
-        }
-        return key, nil
-}
-
-// HasKey returns true if section contains a key with given name.
-func (s *Section) HasKey(name string) bool {
-        key, _ := s.GetKey(name)
-        return key != nil
-}
-
-// Haskey is a backwards-compatible name for HasKey.
-func (s *Section) Haskey(name string) bool {
-        return s.HasKey(name)
-}
-
-// HasValue returns true if section contains given raw value.
-func (s *Section) HasValue(value string) bool {
-        if s.f.BlockMode {
-                s.f.lock.RLock()
-                defer s.f.lock.RUnlock()
-        }
-
-        for _, k := range s.keys {
-                if value == k.value {
-                        return true
-                }
-        }
-        return false
-}
-
-// Key assumes named Key exists in section and returns a zero-value when not.
-func (s *Section) Key(name string) *Key {
-        key, err := s.GetKey(name)
-        if err != nil {
-                // It's OK here because the only possible error is empty key name,
-                // but if it's empty, this piece of code won't be executed.
-                key, _ = s.NewKey(name, "")
-                return key
-        }
-        return key
-}
-
-// Keys returns list of keys of section.
-func (s *Section) Keys() []*Key {
-        keys := make([]*Key, len(s.keyList))
-        for i := range s.keyList {
-                keys[i] = s.Key(s.keyList[i])
-        }
-        return keys
-}
-
-// ParentKeys returns list of keys of parent section.
-func (s *Section) ParentKeys() []*Key {
-        var parentKeys []*Key
-        sname := s.name
-        for {
-                if i := strings.LastIndex(sname, "."); i > -1 {
-                        sname = sname[:i]
-                        sec, err := s.f.GetSection(sname)
-                        if err != nil {
-                                continue
-                        }
-                        parentKeys = append(parentKeys, sec.Keys()...)
-                } else {
-                        break
-                }
-
-        }
-        return parentKeys
-}
-
-// KeyStrings returns list of key names of section.
-func (s *Section) KeyStrings() []string {
-        list := make([]string, len(s.keyList))
-        copy(list, s.keyList)
-        return list
-}
-
-// KeysHash returns keys hash consisting of names and values.
-func (s *Section) KeysHash() map[string]string {
-        if s.f.BlockMode {
-                s.f.lock.RLock()
-                defer s.f.lock.RUnlock()
-        }
-
-        hash := map[string]string{}
-        for key, value := range s.keysHash {
-                hash[key] = value
-        }
-        return hash
-}
-
-// DeleteKey deletes a key from section.
-func (s *Section) DeleteKey(name string) {
-        if s.f.BlockMode {
-                s.f.lock.Lock()
-                defer s.f.lock.Unlock()
-        }
-
-        for i, k := range s.keyList {
-                if k == name {
-                        s.keyList = append(s.keyList[:i], s.keyList[i+1:]...)
-                        delete(s.keys, name)
-                        return
-                }
-        }
-}
diff --git a/vendor/github.com/go-ini/ini/struct.go b/vendor/github.com/go-ini/ini/struct.go
deleted file mode 100644
index 509c682..0000000
--- a/vendor/github.com/go-ini/ini/struct.go
+++ /dev/null
@@ -1,450 +0,0 @@
-// Copyright 2014 Unknwon
-//
-// Licensed under the Apache License, Version 2.0 (the "License"): you may
-// not use this file except in compliance with the License. You may obtain
-// a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-// License for the specific language governing permissions and limitations
-// under the License.
-
-package ini
-
-import (
-        "bytes"
-        "errors"
-        "fmt"
-        "reflect"
-        "strings"
-        "time"
-        "unicode"
-)
-
-// NameMapper represents a ini tag name mapper.
-type NameMapper func(string) string
-
-// Built-in name getters.
-var (
-        // AllCapsUnderscore converts to format ALL_CAPS_UNDERSCORE.
-        AllCapsUnderscore NameMapper = func(raw string) string {
-                newstr := make([]rune, 0, len(raw))
-                for i, chr := range raw {
-                        if isUpper := 'A' <= chr && chr <= 'Z'; isUpper {
-                                if i > 0 {
-                                        newstr = append(newstr, '_')
-                                }
-                        }
-                        newstr = append(newstr, unicode.ToUpper(chr))
-                }
-                return string(newstr)
-        }
-        // TitleUnderscore converts to format title_underscore.
-        TitleUnderscore NameMapper = func(raw string) string {
-                newstr := make([]rune, 0, len(raw))
-                for i, chr := range raw {
-                        if isUpper := 'A' <= chr && chr <= 'Z'; isUpper {
-                                if i > 0 {
-                                        newstr = append(newstr, '_')
-                                }
-                                chr -= ('A' - 'a')
-                        }
-                        newstr = append(newstr, chr)
-                }
-                return string(newstr)
-        }
-)
-
-func (s *Section) parseFieldName(raw, actual string) string {
-        if len(actual) > 0 {
-                return actual
-        }
-        if s.f.NameMapper != nil {
-                return s.f.NameMapper(raw)
-        }
-        return raw
-}
-
-func parseDelim(actual string) string {
-        if len(actual) > 0 {
-                return actual
-        }
-        return ","
-}
-
-var reflectTime = reflect.TypeOf(time.Now()).Kind()
-
-// setSliceWithProperType sets proper values to slice based on its type.
-func setSliceWithProperType(key *Key, field reflect.Value, delim string, allowShadow bool) error {
-        var strs []string
-        if allowShadow {
-                strs = key.StringsWithShadows(delim)
-        } else {
-                strs = key.Strings(delim)
-        }
-
-        numVals := len(strs)
-        if numVals == 0 {
-                return nil
-        }
-
-        var vals interface{}
-
-        sliceOf := field.Type().Elem().Kind()
-        switch sliceOf {
-        case reflect.String:
-                vals = strs
-        case reflect.Int:
-                vals, _ = key.parseInts(strs, true, false)
-        case reflect.Int64:
-                vals, _ = key.parseInt64s(strs, true, false)
-        case reflect.Uint:
-                vals = key.Uints(delim)
-        case reflect.Uint64:
-                vals = key.Uint64s(delim)
-        case reflect.Float64:
-                vals = key.Float64s(delim)
-        case reflectTime:
-                vals = key.Times(delim)
-        default:
-                return fmt.Errorf("unsupported type '[]%s'", sliceOf)
-        }
-
-        slice := reflect.MakeSlice(field.Type(), numVals, numVals)
-        for i := 0; i < numVals; i++ {
-                switch sliceOf {
-                case reflect.String:
-                        slice.Index(i).Set(reflect.ValueOf(vals.([]string)[i]))
-                case reflect.Int:
-                        slice.Index(i).Set(reflect.ValueOf(vals.([]int)[i]))
-                case reflect.Int64:
-                        slice.Index(i).Set(reflect.ValueOf(vals.([]int64)[i]))
-                case reflect.Uint:
-                        slice.Index(i).Set(reflect.ValueOf(vals.([]uint)[i]))
-                case reflect.Uint64:
-                        slice.Index(i).Set(reflect.ValueOf(vals.([]uint64)[i]))
-                case reflect.Float64:
-                        slice.Index(i).Set(reflect.ValueOf(vals.([]float64)[i]))
-                case reflectTime:
-                        slice.Index(i).Set(reflect.ValueOf(vals.([]time.Time)[i]))
-                }
-        }
-        field.Set(slice)
-        return nil
-}
-
-// setWithProperType sets proper value to field based on its type,
-// but it does not return error for failing parsing,
-// because we want to use default value that is already assigned to strcut.
-func setWithProperType(t reflect.Type, key *Key, field reflect.Value, delim string, allowShadow bool) error {
-        switch t.Kind() {
-        case reflect.String:
-                if len(key.String()) == 0 {
-                        return nil
-                }
-                field.SetString(key.String())
-        case reflect.Bool:
-                boolVal, err := key.Bool()
-                if err != nil {
-                        return nil
-                }
-                field.SetBool(boolVal)
-        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-                durationVal, err := key.Duration()
-                // Skip zero value
-                if err == nil && int(durationVal) > 0 {
-                        field.Set(reflect.ValueOf(durationVal))
-                        return nil
-                }
-
-                intVal, err := key.Int64()
-                if err != nil || intVal == 0 {
-                        return nil
-                }
-                field.SetInt(intVal)
-        //      byte is an alias for uint8, so supporting uint8 breaks support for byte
-        case reflect.Uint, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-                durationVal, err := key.Duration()
-                // Skip zero value
-                if err == nil && int(durationVal) > 0 {
-                        field.Set(reflect.ValueOf(durationVal))
-                        return nil
-                }
-
-                uintVal, err := key.Uint64()
-                if err != nil {
-                        return nil
-                }
-                field.SetUint(uintVal)
-
-        case reflect.Float32, reflect.Float64:
-                floatVal, err := key.Float64()
-                if err != nil {
-                        return nil
-                }
-                field.SetFloat(floatVal)
-        case reflectTime:
-                timeVal, err := key.Time()
-                if err != nil {
-                        return nil
-                }
-                field.Set(reflect.ValueOf(timeVal))
-        case reflect.Slice:
-                return setSliceWithProperType(key, field, delim, allowShadow)
-        default:
-                return fmt.Errorf("unsupported type '%s'", t)
-        }
-        return nil
-}
-
-func parseTagOptions(tag string) (rawName string, omitEmpty bool, allowShadow bool) {
-        opts := strings.SplitN(tag, ",", 3)
-        rawName = opts[0]
-        if len(opts) > 1 {
-                omitEmpty = opts[1] == "omitempty"
-        }
-        if len(opts) > 2 {
-                allowShadow = opts[2] == "allowshadow"
-        }
-        return rawName, omitEmpty, allowShadow
-}
-
-func (s *Section) mapTo(val reflect.Value) error {
-        if val.Kind() == reflect.Ptr {
-                val = val.Elem()
-        }
-        typ := val.Type()
-
-        for i := 0; i < typ.NumField(); i++ {
-                field := val.Field(i)
-                tpField := typ.Field(i)
-
-                tag := tpField.Tag.Get("ini")
-                if tag == "-" {
-                        continue
-                }
-
-                rawName, _, allowShadow := parseTagOptions(tag)
-                fieldName := s.parseFieldName(tpField.Name, rawName)
-                if len(fieldName) == 0 || !field.CanSet() {
-                        continue
-                }
-
-                isAnonymous := tpField.Type.Kind() == reflect.Ptr && tpField.Anonymous
-                isStruct := tpField.Type.Kind() == reflect.Struct
-                if isAnonymous {
-                        field.Set(reflect.New(tpField.Type.Elem()))
-                }
-
-                if isAnonymous || isStruct {
-                        if sec, err := s.f.GetSection(fieldName); err == nil {
-                                if err = sec.mapTo(field); err != nil {
-                                        return fmt.Errorf("error mapping field(%s): %v", fieldName, err)
-                                }
-                                continue
-                        }
-                }
-
-                if key, err := s.GetKey(fieldName); err == nil {
-                        delim := parseDelim(tpField.Tag.Get("delim"))
-                        if err = setWithProperType(tpField.Type, key, field, delim, allowShadow); err != nil {
-                                return fmt.Errorf("error mapping field(%s): %v", fieldName, err)
-                        }
-                }
-        }
-        return nil
-}
-
-// MapTo maps section to given struct.
-func (s *Section) MapTo(v interface{}) error {
-        typ := reflect.TypeOf(v)
-        val := reflect.ValueOf(v)
-        if typ.Kind() == reflect.Ptr {
-                typ = typ.Elem()
-                val = val.Elem()
-        } else {
-                return errors.New("cannot map to non-pointer struct")
-        }
-
-        return s.mapTo(val)
-}
-
-// MapTo maps file to given struct.
-func (f *File) MapTo(v interface{}) error {
-        return f.Section("").MapTo(v)
-}
-
-// MapTo maps data sources to given struct with name mapper.
-func MapToWithMapper(v interface{}, mapper NameMapper, source interface{}, others ...interface{}) error {
-        cfg, err := Load(source, others...)
-        if err != nil {
-                return err
-        }
-        cfg.NameMapper = mapper
-        return cfg.MapTo(v)
-}
-
-// MapTo maps data sources to given struct.
-func MapTo(v, source interface{}, others ...interface{}) error {
-        return MapToWithMapper(v, nil, source, others...)
-}
-
-// reflectSliceWithProperType does the opposite thing as setSliceWithProperType.
-func reflectSliceWithProperType(key *Key, field reflect.Value, delim string) error {
-        slice := field.Slice(0, field.Len())
-        if field.Len() == 0 {
-                return nil
-        }
-
-        var buf bytes.Buffer
-        sliceOf := field.Type().Elem().Kind()
-        for i := 0; i < field.Len(); i++ {
-                switch sliceOf {
-                case reflect.String:
-                        buf.WriteString(slice.Index(i).String())
-                case reflect.Int, reflect.Int64:
-                        buf.WriteString(fmt.Sprint(slice.Index(i).Int()))
-                case reflect.Uint, reflect.Uint64:
-                        buf.WriteString(fmt.Sprint(slice.Index(i).Uint()))
-                case reflect.Float64:
-                        buf.WriteString(fmt.Sprint(slice.Index(i).Float()))
-                case reflectTime:
-                        buf.WriteString(slice.Index(i).Interface().(time.Time).Format(time.RFC3339))
-                default:
-                        return fmt.Errorf("unsupported type '[]%s'", sliceOf)
-                }
-                buf.WriteString(delim)
-        }
-        key.SetValue(buf.String()[:buf.Len()-1])
-        return nil
-}
-
-// reflectWithProperType does the opposite thing as setWithProperType.
-func reflectWithProperType(t reflect.Type, key *Key, field reflect.Value, delim string) error {
-        switch t.Kind() {
-        case reflect.String:
-                key.SetValue(field.String())
-        case reflect.Bool:
-                key.SetValue(fmt.Sprint(field.Bool()))
-        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-                key.SetValue(fmt.Sprint(field.Int()))
-        case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-                key.SetValue(fmt.Sprint(field.Uint()))
-        case reflect.Float32, reflect.Float64:
-                key.SetValue(fmt.Sprint(field.Float()))
-        case reflectTime:
-                key.SetValue(fmt.Sprint(field.Interface().(time.Time).Format(time.RFC3339)))
-        case reflect.Slice:
-                return reflectSliceWithProperType(key, field, delim)
-        default:
-                return fmt.Errorf("unsupported type '%s'", t)
-        }
-        return nil
-}
-
-// CR: copied from encoding/json/encode.go with modifications of time.Time support.
-// TODO: add more test coverage.
-func isEmptyValue(v reflect.Value) bool {
-        switch v.Kind() {
-        case reflect.Array, reflect.Map, reflect.Slice, reflect.String:
-                return v.Len() == 0
-        case reflect.Bool:
-                return !v.Bool()
-        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-                return v.Int() == 0
-        case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
-                return v.Uint() == 0
-        case reflect.Float32, reflect.Float64:
-                return v.Float() == 0
-        case reflectTime:
-                return v.Interface().(time.Time).IsZero()
-        case reflect.Interface, reflect.Ptr:
-                return v.IsNil()
-        }
-        return false
-}
-
-func (s *Section) reflectFrom(val reflect.Value) error {
-        if val.Kind() == reflect.Ptr {
-                val = val.Elem()
-        }
-        typ := val.Type()
-
-        for i := 0; i < typ.NumField(); i++ {
-                field := val.Field(i)
-                tpField := typ.Field(i)
-
-                tag := tpField.Tag.Get("ini")
-                if tag == "-" {
-                        continue
-                }
-
-                opts := strings.SplitN(tag, ",", 2)
-                if len(opts) == 2 && opts[1] == "omitempty" && isEmptyValue(field) {
-                        continue
-                }
-
-                fieldName := s.parseFieldName(tpField.Name, opts[0])
-                if len(fieldName) == 0 || !field.CanSet() {
-                        continue
-                }
-
-                if (tpField.Type.Kind() == reflect.Ptr && tpField.Anonymous) ||
-                        (tpField.Type.Kind() == reflect.Struct && tpField.Type.Name() != "Time") {
-                        // Note: The only error here is section doesn't exist.
-                        sec, err := s.f.GetSection(fieldName)
-                        if err != nil {
-                                // Note: fieldName can never be empty here, ignore error.
-                                sec, _ = s.f.NewSection(fieldName)
-                        }
-                        if err = sec.reflectFrom(field); err != nil {
-                                return fmt.Errorf("error reflecting field (%s): %v", fieldName, err)
-                        }
-                        continue
-                }
-
-                // Note: Same reason as secion.
-                key, err := s.GetKey(fieldName)
-                if err != nil {
-                        key, _ = s.NewKey(fieldName, "")
-                }
-                if err = reflectWithProperType(tpField.Type, key, field, parseDelim(tpField.Tag.Get("delim"))); err != nil {
-                        return fmt.Errorf("error reflecting field (%s): %v", fieldName, err)
-                }
-
-        }
-        return nil
-}
-
-// ReflectFrom reflects secion from given struct.
-func (s *Section) ReflectFrom(v interface{}) error {
-        typ := reflect.TypeOf(v)
-        val := reflect.ValueOf(v)
-        if typ.Kind() == reflect.Ptr {
-                typ = typ.Elem()
-                val = val.Elem()
-        } else {
-                return errors.New("cannot reflect from non-pointer struct")
-        }
-
-        return s.reflectFrom(val)
-}
-
-// ReflectFrom reflects file from given struct.
-func (f *File) ReflectFrom(v interface{}) error {
-        return f.Section("").ReflectFrom(v)
-}
-
-// ReflectFrom reflects data sources from given struct with name mapper.
-func ReflectFromWithMapper(cfg *File, v interface{}, mapper NameMapper) error {
-        cfg.NameMapper = mapper
-        return cfg.ReflectFrom(v)
-}
-
-// ReflectFrom reflects data sources from given struct.
-func ReflectFrom(cfg *File, v interface{}) error {
-        return ReflectFromWithMapper(cfg, v, nil)
-}
diff --git a/vendor/github.com/golang/protobuf/proto/decode.go b/vendor/github.com/golang/protobuf/proto/decode.go
index d9aa3c4..63b0f08 100644
--- a/vendor/github.com/golang/protobuf/proto/decode.go
+++ b/vendor/github.com/golang/protobuf/proto/decode.go
@@ -186,7 +186,6 @@ func (p *Buffer) DecodeVarint() (x uint64, err error) {
         if b&0x80 == 0 {
                 goto done
         }
-        // x -= 0x80 << 63 // Always zero.
 
         return 0, errOverflow
 
diff --git a/vendor/github.com/golang/protobuf/proto/deprecated.go b/vendor/github.com/golang/protobuf/proto/deprecated.go
new file mode 100644
index 0000000..35b882c
--- /dev/null
+++ b/vendor/github.com/golang/protobuf/proto/deprecated.go
@@ -0,0 +1,63 @@
+// Go support for Protocol Buffers - Google's data interchange format
+//
+// Copyright 2018 The Go Authors.  All rights reserved.
+// https://github.com/golang/protobuf
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package proto
+
+import "errors"
+
+// Deprecated: do not use.
+type Stats struct{ Emalloc, Dmalloc, Encode, Decode, Chit, Cmiss, Size uint64 }
+
+// Deprecated: do not use.
+func GetStats() Stats { return Stats{} }
+
+// Deprecated: do not use.
+func MarshalMessageSet(interface{}) ([]byte, error) {
+        return nil, errors.New("proto: not implemented")
+}
+
+// Deprecated: do not use.
+func UnmarshalMessageSet([]byte, interface{}) error {
+        return errors.New("proto: not implemented")
+}
+
+// Deprecated: do not use.
+func MarshalMessageSetJSON(interface{}) ([]byte, error) {
+        return nil, errors.New("proto: not implemented")
+}
+
+// Deprecated: do not use.
+func UnmarshalMessageSetJSON([]byte, interface{}) error {
+        return errors.New("proto: not implemented")
+}
+
+// Deprecated: do not use.
+func RegisterMessageSetType(Message, int32, string) {}
diff --git a/vendor/github.com/golang/protobuf/proto/equal.go b/vendor/github.com/golang/protobuf/proto/equal.go
index d4db5a1..f9b6e41 100644
--- a/vendor/github.com/golang/protobuf/proto/equal.go
+++ b/vendor/github.com/golang/protobuf/proto/equal.go
@@ -246,7 +246,8 @@ func equalExtMap(base reflect.Type, em1, em2 map[int32]Extension) bool {
                         return false
                 }
 
-                m1, m2 := e1.value, e2.value
+                m1 := extensionAsLegacyType(e1.value)
+                m2 := extensionAsLegacyType(e2.value)
 
                 if m1 == nil && m2 == nil {
                         // Both have only encoded form.
diff --git a/vendor/github.com/golang/protobuf/proto/extensions.go b/vendor/github.com/golang/protobuf/proto/extensions.go
index 816a3b9..fa88add 100644
--- a/vendor/github.com/golang/protobuf/proto/extensions.go
+++ b/vendor/github.com/golang/protobuf/proto/extensions.go
@@ -185,9 +185,25 @@ type Extension struct {
         // extension will have only enc set. When such an extension is
         // accessed using GetExtension (or GetExtensions) desc and value
         // will be set.
-        desc  *ExtensionDesc
+        desc *ExtensionDesc
+
+        // value is a concrete value for the extension field. Let the type of
+        // desc.ExtensionType be the "API type" and the type of Extension.value
+        // be the "storage type". The API type and storage type are the same except:
+        //      * For scalars (except []byte), the API type uses *T,
+        //      while the storage type uses T.
+        //      * For repeated fields, the API type uses []T, while the storage type
+        //      uses *[]T.
+        //
+        // The reason for the divergence is so that the storage type more naturally
+        // matches what is expected of when retrieving the values through the
+        // protobuf reflection APIs.
+        //
+        // The value may only be populated if desc is also populated.
         value interface{}
-        enc   []byte
+
+        // enc is the raw bytes for the extension field.
+        enc []byte
 }
 
 // SetRawExtension is for testing only.
@@ -334,7 +350,7 @@ func GetExtension(pb Message, extension *ExtensionDesc) (interface{}, error) {
                         // descriptors with the same field number.
                         return nil, errors.New("proto: descriptor conflict")
                 }
-                return e.value, nil
+                return extensionAsLegacyType(e.value), nil
         }
 
         if extension.ExtensionType == nil {
@@ -349,11 +365,11 @@ func GetExtension(pb Message, extension *ExtensionDesc) (interface{}, error) {
 
         // Remember the decoded version and drop the encoded version.
         // That way it is safe to mutate what we return.
-        e.value = v
+        e.value = extensionAsStorageType(v)
         e.desc = extension
         e.enc = nil
         emap[extension.Field] = e
-        return e.value, nil
+        return extensionAsLegacyType(e.value), nil
 }
 
 // defaultExtensionValue returns the default value for extension.
@@ -488,7 +504,7 @@ func SetExtension(pb Message, extension *ExtensionDesc, value interface{}) error
         }
         typ := reflect.TypeOf(extension.ExtensionType)
         if typ != reflect.TypeOf(value) {
-                return errors.New("proto: bad extension value type")
+                return fmt.Errorf("proto: bad extension value type. got: %T, want: %T", value, extension.ExtensionType)
         }
         // nil extension values need to be caught early, because the
         // encoder can't distinguish an ErrNil due to a nil extension
@@ -500,7 +516,7 @@ func SetExtension(pb Message, extension *ExtensionDesc, value interface{}) error
         }
 
         extmap := epb.extensionsWrite()
-        extmap[extension.Field] = Extension{desc: extension, value: value}
+        extmap[extension.Field] = Extension{desc: extension, value: extensionAsStorageType(value)}
         return nil
 }
 
@@ -541,3 +557,51 @@ func RegisterExtension(desc *ExtensionDesc) {
 func RegisteredExtensions(pb Message) map[int32]*ExtensionDesc {
         return extensionMaps[reflect.TypeOf(pb).Elem()]
 }
+
+// extensionAsLegacyType converts an value in the storage type as the API type.
+// See Extension.value.
+func extensionAsLegacyType(v interface{}) interface{} {
+        switch rv := reflect.ValueOf(v); rv.Kind() {
+        case reflect.Bool, reflect.Int32, reflect.Int64, reflect.Uint32, reflect.Uint64, reflect.Float32, reflect.Float64, reflect.String:
+                // Represent primitive types as a pointer to the value.
+                rv2 := reflect.New(rv.Type())
+                rv2.Elem().Set(rv)
+                v = rv2.Interface()
+        case reflect.Ptr:
+                // Represent slice types as the value itself.
+                switch rv.Type().Elem().Kind() {
+                case reflect.Slice:
+                        if rv.IsNil() {
+                                v = reflect.Zero(rv.Type().Elem()).Interface()
+                        } else {
+                                v = rv.Elem().Interface()
+                        }
+                }
+        }
+        return v
+}
+
+// extensionAsStorageType converts an value in the API type as the storage type.
+// See Extension.value.
+func extensionAsStorageType(v interface{}) interface{} {
+        switch rv := reflect.ValueOf(v); rv.Kind() {
+        case reflect.Ptr:
+                // Represent slice types as the value itself.
+                switch rv.Type().Elem().Kind() {
+                case reflect.Bool, reflect.Int32, reflect.Int64, reflect.Uint32, reflect.Uint64, reflect.Float32, reflect.Float64, reflect.String:
+                        if rv.IsNil() {
+                                v = reflect.Zero(rv.Type().Elem()).Interface()
+                        } else {
+                                v = rv.Elem().Interface()
+                        }
+                }
+        case reflect.Slice:
+                // Represent slice types as a pointer to the value.
+                if rv.Type().Elem().Kind() != reflect.Uint8 {
+                        rv2 := reflect.New(rv.Type())
+                        rv2.Elem().Set(rv)
+                        v = rv2.Interface()
+                }
+        }
+        return v
+}
diff --git a/vendor/github.com/golang/protobuf/proto/lib.go b/vendor/github.com/golang/protobuf/proto/lib.go
index 75565cc..fdd328b 100644
--- a/vendor/github.com/golang/protobuf/proto/lib.go
+++ b/vendor/github.com/golang/protobuf/proto/lib.go
@@ -341,26 +341,6 @@ type Message interface {
         ProtoMessage()
 }
 
-// Stats records allocation details about the protocol buffer encoders
-// and decoders.  Useful for tuning the library itself.
-type Stats struct {
-        Emalloc uint64 // mallocs in encode
-        Dmalloc uint64 // mallocs in decode
-        Encode  uint64 // number of encodes
-        Decode  uint64 // number of decodes
-        Chit    uint64 // number of cache hits
-        Cmiss   uint64 // number of cache misses
-        Size    uint64 // number of sizes
-}
-
-// Set to true to enable stats collection.
-const collectStats = false
-
-var stats Stats
-
-// GetStats returns a copy of the global Stats structure.
-func GetStats() Stats { return stats }
-
 // A Buffer is a buffer manager for marshaling and unmarshaling
 // protocol buffers.  It may be reused between invocations to
 // reduce memory usage.  It is not necessary to use a Buffer;
@@ -960,13 +940,19 @@ func isProto3Zero(v reflect.Value) bool {
         return false
 }
 
-// ProtoPackageIsVersion2 is referenced from generated protocol buffer files
-// to assert that that code is compatible with this version of the proto package.
-const ProtoPackageIsVersion2 = true
+const (
+        // ProtoPackageIsVersion3 is referenced from generated protocol buffer files
+        // to assert that that code is compatible with this version of the proto package.
+        ProtoPackageIsVersion3 = true
+
+        // ProtoPackageIsVersion2 is referenced from generated protocol buffer files
+        // to assert that that code is compatible with this version of the proto package.
+        ProtoPackageIsVersion2 = true
 
-// ProtoPackageIsVersion1 is referenced from generated protocol buffer files
-// to assert that that code is compatible with this version of the proto package.
-const ProtoPackageIsVersion1 = true
+        // ProtoPackageIsVersion1 is referenced from generated protocol buffer files
+        // to assert that that code is compatible with this version of the proto package.
+        ProtoPackageIsVersion1 = true
+)
 
 // InternalMessageInfo is a type used internally by generated .pb.go files.
 // This type is not intended to be used by non-generated code.
diff --git a/vendor/github.com/golang/protobuf/proto/message_set.go b/vendor/github.com/golang/protobuf/proto/message_set.go
index 3b6ca41..f48a756 100644
--- a/vendor/github.com/golang/protobuf/proto/message_set.go
+++ b/vendor/github.com/golang/protobuf/proto/message_set.go
@@ -36,13 +36,7 @@ package proto
  */
 
 import (
-        "bytes"
-        "encoding/json"
         "errors"
-        "fmt"
-        "reflect"
-        "sort"
-        "sync"
 )
 
 // errNoMessageTypeID occurs when a protocol buffer does not have a message type ID.
@@ -145,46 +139,9 @@ func skipVarint(buf []byte) []byte {
         return buf[i+1:]
 }
 
-// MarshalMessageSet encodes the extension map represented by m in the message set wire format.
-// It is called by generated Marshal methods on protocol buffer messages with the message_set_wire_format option.
-func MarshalMessageSet(exts interface{}) ([]byte, error) {
-        return marshalMessageSet(exts, false)
-}
-
-// marshaMessageSet implements above function, with the opt to turn on / off deterministic during Marshal.
-func marshalMessageSet(exts interface{}, deterministic bool) ([]byte, error) {
-        switch exts := exts.(type) {
-        case *XXX_InternalExtensions:
-                var u marshalInfo
-                siz := u.sizeMessageSet(exts)
-                b := make([]byte, 0, siz)
-                return u.appendMessageSet(b, exts, deterministic)
-
-        case map[int32]Extension:
-                // This is an old-style extension map.
-                // Wrap it in a new-style XXX_InternalExtensions.
-                ie := XXX_InternalExtensions{
-                        p: &struct {
-                                mu           sync.Mutex
-                                extensionMap map[int32]Extension
-                        }{
-                                extensionMap: exts,
-                        },
-                }
-
-                var u marshalInfo
-                siz := u.sizeMessageSet(&ie)
-                b := make([]byte, 0, siz)
-                return u.appendMessageSet(b, &ie, deterministic)
-
-        default:
-                return nil, errors.New("proto: not an extension map")
-        }
-}
-
-// UnmarshalMessageSet decodes the extension map encoded in buf in the message set wire format.
+// unmarshalMessageSet decodes the extension map encoded in buf in the message set wire format.
 // It is called by Unmarshal methods on protocol buffer messages with the message_set_wire_format option.
-func UnmarshalMessageSet(buf []byte, exts interface{}) error {
+func unmarshalMessageSet(buf []byte, exts interface{}) error {
         var m map[int32]Extension
         switch exts := exts.(type) {
         case *XXX_InternalExtensions:
@@ -222,93 +179,3 @@ func UnmarshalMessageSet(buf []byte, exts interface{}) error {
         }
         return nil
 }
-
-// MarshalMessageSetJSON encodes the extension map represented by m in JSON format.
-// It is called by generated MarshalJSON methods on protocol buffer messages with the message_set_wire_format option.
-func MarshalMessageSetJSON(exts interface{}) ([]byte, error) {
-        var m map[int32]Extension
-        switch exts := exts.(type) {
-        case *XXX_InternalExtensions:
-                var mu sync.Locker
-                m, mu = exts.extensionsRead()
-                if m != nil {
-                        // Keep the extensions map locked until we're done marshaling to prevent
-                        // races between marshaling and unmarshaling the lazily-{en,de}coded
-                        // values.
-                        mu.Lock()
-                        defer mu.Unlock()
-                }
-        case map[int32]Extension:
-                m = exts
-        default:
-                return nil, errors.New("proto: not an extension map")
-        }
-        var b bytes.Buffer
-        b.WriteByte('{')
-
-        // Process the map in key order for deterministic output.
-        ids := make([]int32, 0, len(m))
-        for id := range m {
-                ids = append(ids, id)
-        }
-        sort.Sort(int32Slice(ids)) // int32Slice defined in text.go
-
-        for i, id := range ids {
-                ext := m[id]
-                msd, ok := messageSetMap[id]
-                if !ok {
-                        // Unknown type; we can't render it, so skip it.
-                        continue
-                }
-
-                if i > 0 && b.Len() > 1 {
-                        b.WriteByte(',')
-                }
-
-                fmt.Fprintf(&b, `"[%s]":`, msd.name)
-
-                x := ext.value
-                if x == nil {
-                        x = reflect.New(msd.t.Elem()).Interface()
-                        if err := Unmarshal(ext.enc, x.(Message)); err != nil {
-                                return nil, err
-                        }
-                }
-                d, err := json.Marshal(x)
-                if err != nil {
-                        return nil, err
-                }
-                b.Write(d)
-        }
-        b.WriteByte('}')
-        return b.Bytes(), nil
-}
-
-// UnmarshalMessageSetJSON decodes the extension map encoded in buf in JSON format.
-// It is called by generated UnmarshalJSON methods on protocol buffer messages with the message_set_wire_format option.
-func UnmarshalMessageSetJSON(buf []byte, exts interface{}) error {
-        // Common-case fast path.
-        if len(buf) == 0 || bytes.Equal(buf, []byte("{}")) {
-                return nil
-        }
-
-        // This is fairly tricky, and it's not clear that it is needed.
-        return errors.New("TODO: UnmarshalMessageSetJSON not yet implemented")
-}
-
-// A global registry of types that can be used in a MessageSet.
-
-var messageSetMap = make(map[int32]messageSetDesc)
-
-type messageSetDesc struct {
-        t    reflect.Type // pointer to struct
-        name string
-}
-
-// RegisterMessageSetType is called from the generated code.
-func RegisterMessageSetType(m Message, fieldNum int32, name string) {
-        messageSetMap[fieldNum] = messageSetDesc{
-                t:    reflect.TypeOf(m),
-                name: name,
-        }
-}
diff --git a/vendor/github.com/golang/protobuf/proto/pointer_reflect.go b/vendor/github.com/golang/protobuf/proto/pointer_reflect.go
index b6cad90..94fa919 100644
--- a/vendor/github.com/golang/protobuf/proto/pointer_reflect.go
+++ b/vendor/github.com/golang/protobuf/proto/pointer_reflect.go
@@ -79,10 +79,13 @@ func toPointer(i *Message) pointer {
 
 // toAddrPointer converts an interface to a pointer that points to
 // the interface data.
-func toAddrPointer(i *interface{}, isptr bool) pointer {
+func toAddrPointer(i *interface{}, isptr, deref bool) pointer {
         v := reflect.ValueOf(*i)
         u := reflect.New(v.Type())
         u.Elem().Set(v)
+        if deref {
+                u = u.Elem()
+        }
         return pointer{v: u}
 }
 
diff --git a/vendor/github.com/golang/protobuf/proto/pointer_unsafe.go b/vendor/github.com/golang/protobuf/proto/pointer_unsafe.go
index d55a335..dbfffe0 100644
--- a/vendor/github.com/golang/protobuf/proto/pointer_unsafe.go
+++ b/vendor/github.com/golang/protobuf/proto/pointer_unsafe.go
@@ -85,16 +85,21 @@ func toPointer(i *Message) pointer {
 
 // toAddrPointer converts an interface to a pointer that points to
 // the interface data.
-func toAddrPointer(i *interface{}, isptr bool) pointer {
+func toAddrPointer(i *interface{}, isptr, deref bool) (p pointer) {
         // Super-tricky - read or get the address of data word of interface value.
         if isptr {
                 // The interface is of pointer type, thus it is a direct interface.
                 // The data word is the pointer data itself. We take its address.
-                return pointer{p: unsafe.Pointer(uintptr(unsafe.Pointer(i)) + ptrSize)}
+                p = pointer{p: unsafe.Pointer(uintptr(unsafe.Pointer(i)) + ptrSize)}
+        } else {
+                // The interface is not of pointer type. The data word is the pointer
+                // to the data.
+                p = pointer{p: (*[2]unsafe.Pointer)(unsafe.Pointer(i))[1]}
         }
-        // The interface is not of pointer type. The data word is the pointer
-        // to the data.
-        return pointer{p: (*[2]unsafe.Pointer)(unsafe.Pointer(i))[1]}
+        if deref {
+                p.p = *(*unsafe.Pointer)(p.p)
+        }
+        return p
 }
 
 // valToPointer converts v to a pointer. v must be of pointer type.
diff --git a/vendor/github.com/golang/protobuf/proto/properties.go b/vendor/github.com/golang/protobuf/proto/properties.go
index 50b99b8..79668ff 100644
--- a/vendor/github.com/golang/protobuf/proto/properties.go
+++ b/vendor/github.com/golang/protobuf/proto/properties.go
@@ -334,9 +334,6 @@ func GetProperties(t reflect.Type) *StructProperties {
         sprop, ok := propertiesMap[t]
         propertiesMu.RUnlock()
         if ok {
-                if collectStats {
-                        stats.Chit++
-                }
                 return sprop
         }
 
@@ -346,17 +343,20 @@ func GetProperties(t reflect.Type) *StructProperties {
         return sprop
 }
 
+type (
+        oneofFuncsIface interface {
+                XXX_OneofFuncs() (func(Message, *Buffer) error, func(Message, int, int, *Buffer) (bool, error), func(Message) int, []interface{})
+        }
+        oneofWrappersIface interface {
+                XXX_OneofWrappers() []interface{}
+        }
+)
+
 // getPropertiesLocked requires that propertiesMu is held.
 func getPropertiesLocked(t reflect.Type) *StructProperties {
         if prop, ok := propertiesMap[t]; ok {
-                if collectStats {
-                        stats.Chit++
-                }
                 return prop
         }
-        if collectStats {
-                stats.Cmiss++
-        }
 
         prop := new(StructProperties)
         // in case of recursive protos, fill this in now.
@@ -391,13 +391,14 @@ func getPropertiesLocked(t reflect.Type) *StructProperties {
         // Re-order prop.order.
         sort.Sort(prop)
 
-        type oneofMessage interface {
-                XXX_OneofFuncs() (func(Message, *Buffer) error, func(Message, int, int, *Buffer) (bool, error), func(Message) int, []interface{})
+        var oots []interface{}
+        switch m := reflect.Zero(reflect.PtrTo(t)).Interface().(type) {
+        case oneofFuncsIface:
+                _, _, _, oots = m.XXX_OneofFuncs()
+        case oneofWrappersIface:
+                oots = m.XXX_OneofWrappers()
         }
-        if om, ok := reflect.Zero(reflect.PtrTo(t)).Interface().(oneofMessage); ok {
-                var oots []interface{}
-                _, _, _, oots = om.XXX_OneofFuncs()
-
+        if len(oots) > 0 {
                 // Interpret oneof metadata.
                 prop.OneofTypes = make(map[string]*OneofProperties)
                 for _, oot := range oots {
diff --git a/vendor/github.com/golang/protobuf/proto/table_marshal.go b/vendor/github.com/golang/protobuf/proto/table_marshal.go
index b167944..5cb11fa 100644
--- a/vendor/github.com/golang/protobuf/proto/table_marshal.go
+++ b/vendor/github.com/golang/protobuf/proto/table_marshal.go
@@ -87,6 +87,7 @@ type marshalElemInfo struct {
         sizer     sizer
         marshaler marshaler
         isptr     bool // elem is pointer typed, thus interface of this type is a direct interface (extension only)
+        deref     bool // dereference the pointer before operating on it; implies isptr
 }
 
 var (
@@ -320,8 +321,11 @@ func (u *marshalInfo) computeMarshalInfo() {
 
         // get oneof implementers
         var oneofImplementers []interface{}
-        if m, ok := reflect.Zero(reflect.PtrTo(t)).Interface().(oneofMessage); ok {
+        switch m := reflect.Zero(reflect.PtrTo(t)).Interface().(type) {
+        case oneofFuncsIface:
                 _, _, _, oneofImplementers = m.XXX_OneofFuncs()
+        case oneofWrappersIface:
+                oneofImplementers = m.XXX_OneofWrappers()
         }
 
         n := t.NumField()
@@ -407,13 +411,22 @@ func (u *marshalInfo) getExtElemInfo(desc *ExtensionDesc) *marshalElemInfo {
                 panic("tag is not an integer")
         }
         wt := wiretype(tags[0])
+        if t.Kind() == reflect.Ptr && t.Elem().Kind() != reflect.Struct {
+                t = t.Elem()
+        }
         sizer, marshaler := typeMarshaler(t, tags, false, false)
+        var deref bool
+        if t.Kind() == reflect.Slice && t.Elem().Kind() != reflect.Uint8 {
+                t = reflect.PtrTo(t)
+                deref = true
+        }
         e = &marshalElemInfo{
                 wiretag:   uint64(tag)<<3 | wt,
                 tagsize:   SizeVarint(uint64(tag) << 3),
                 sizer:     sizer,
                 marshaler: marshaler,
                 isptr:     t.Kind() == reflect.Ptr,
+                deref:     deref,
         }
 
         // update cache
@@ -448,7 +461,7 @@ func (fi *marshalFieldInfo) computeMarshalFieldInfo(f *reflect.StructField) {
 
 func (fi *marshalFieldInfo) computeOneofFieldInfo(f *reflect.StructField, oneofImplementers []interface{}) {
         fi.field = toField(f)
-        fi.wiretag = 1<<31 - 1 // Use a large tag number, make oneofs sorted at the end. This tag will not appear on the wire.
+        fi.wiretag = math.MaxInt32 // Use a large tag number, make oneofs sorted at the end. This tag will not appear on the wire.
         fi.isPointer = true
         fi.sizer, fi.marshaler = makeOneOfMarshaler(fi, f)
         fi.oneofElems = make(map[reflect.Type]*marshalElemInfo)
@@ -476,10 +489,6 @@ func (fi *marshalFieldInfo) computeOneofFieldInfo(f *reflect.StructField, oneofI
         }
 }
 
-type oneofMessage interface {
-        XXX_OneofFuncs() (func(Message, *Buffer) error, func(Message, int, int, *Buffer) (bool, error), func(Message) int, []interface{})
-}
-
 // wiretype returns the wire encoding of the type.
 func wiretype(encoding string) uint64 {
         switch encoding {
@@ -2310,8 +2319,8 @@ func makeMapMarshaler(f *reflect.StructField) (sizer, marshaler) {
                         for _, k := range m.MapKeys() {
                                 ki := k.Interface()
                                 vi := m.MapIndex(k).Interface()
-                                kaddr := toAddrPointer(&ki, false)             // pointer to key
-                                vaddr := toAddrPointer(&vi, valIsPtr)          // pointer to value
+                                kaddr := toAddrPointer(&ki, false, false)      // pointer to key
+                                vaddr := toAddrPointer(&vi, valIsPtr, false)   // pointer to value
                                 siz := keySizer(kaddr, 1) + valSizer(vaddr, 1) // tag of key = 1 (size=1), tag of val = 2 (size=1)
                                 n += siz + SizeVarint(uint64(siz)) + tagsize
                         }
@@ -2329,8 +2338,8 @@ func makeMapMarshaler(f *reflect.StructField) (sizer, marshaler) {
                         for _, k := range keys {
                                 ki := k.Interface()
                                 vi := m.MapIndex(k).Interface()
-                                kaddr := toAddrPointer(&ki, false)    // pointer to key
-                                vaddr := toAddrPointer(&vi, valIsPtr) // pointer to value
+                                kaddr := toAddrPointer(&ki, false, false)    // pointer to key
+                                vaddr := toAddrPointer(&vi, valIsPtr, false) // pointer to value
                                 b = appendVarint(b, tag)
                                 siz := keySizer(kaddr, 1) + valCachedSizer(vaddr, 1) // tag of key = 1 (size=1), tag of val = 2 (size=1)
                                 b = appendVarint(b, uint64(siz))
@@ -2399,7 +2408,7 @@ func (u *marshalInfo) sizeExtensions(ext *XXX_InternalExtensions) int {
                 // the last time this function was called.
                 ei := u.getExtElemInfo(e.desc)
                 v := e.value
-                p := toAddrPointer(&v, ei.isptr)
+                p := toAddrPointer(&v, ei.isptr, ei.deref)
                 n += ei.sizer(p, ei.tagsize)
         }
         mu.Unlock()
@@ -2434,7 +2443,7 @@ func (u *marshalInfo) appendExtensions(b []byte, ext *XXX_InternalExtensions, de
 
                         ei := u.getExtElemInfo(e.desc)
                         v := e.value
-                        p := toAddrPointer(&v, ei.isptr)
+                        p := toAddrPointer(&v, ei.isptr, ei.deref)
                         b, err = ei.marshaler(b, p, ei.wiretag, deterministic)
                         if !nerr.Merge(err) {
                                 return b, err
@@ -2465,7 +2474,7 @@ func (u *marshalInfo) appendExtensions(b []byte, ext *XXX_InternalExtensions, de
 
                 ei := u.getExtElemInfo(e.desc)
                 v := e.value
-                p := toAddrPointer(&v, ei.isptr)
+                p := toAddrPointer(&v, ei.isptr, ei.deref)
                 b, err = ei.marshaler(b, p, ei.wiretag, deterministic)
                 if !nerr.Merge(err) {
                         return b, err
@@ -2510,7 +2519,7 @@ func (u *marshalInfo) sizeMessageSet(ext *XXX_InternalExtensions) int {
 
                 ei := u.getExtElemInfo(e.desc)
                 v := e.value
-                p := toAddrPointer(&v, ei.isptr)
+                p := toAddrPointer(&v, ei.isptr, ei.deref)
                 n += ei.sizer(p, 1) // message, tag = 3 (size=1)
         }
         mu.Unlock()
@@ -2553,7 +2562,7 @@ func (u *marshalInfo) appendMessageSet(b []byte, ext *XXX_InternalExtensions, de
 
                         ei := u.getExtElemInfo(e.desc)
                         v := e.value
-                        p := toAddrPointer(&v, ei.isptr)
+                        p := toAddrPointer(&v, ei.isptr, ei.deref)
                         b, err = ei.marshaler(b, p, 3<<3|WireBytes, deterministic)
                         if !nerr.Merge(err) {
                                 return b, err
@@ -2591,7 +2600,7 @@ func (u *marshalInfo) appendMessageSet(b []byte, ext *XXX_InternalExtensions, de
 
                 ei := u.getExtElemInfo(e.desc)
                 v := e.value
-                p := toAddrPointer(&v, ei.isptr)
+                p := toAddrPointer(&v, ei.isptr, ei.deref)
                 b, err = ei.marshaler(b, p, 3<<3|WireBytes, deterministic)
                 b = append(b, 1<<3|WireEndGroup)
                 if !nerr.Merge(err) {
@@ -2621,7 +2630,7 @@ func (u *marshalInfo) sizeV1Extensions(m map[int32]Extension) int {
 
                 ei := u.getExtElemInfo(e.desc)
                 v := e.value
-                p := toAddrPointer(&v, ei.isptr)
+                p := toAddrPointer(&v, ei.isptr, ei.deref)
                 n += ei.sizer(p, ei.tagsize)
         }
         return n
@@ -2656,7 +2665,7 @@ func (u *marshalInfo) appendV1Extensions(b []byte, m map[int32]Extension, determ
 
                 ei := u.getExtElemInfo(e.desc)
                 v := e.value
-                p := toAddrPointer(&v, ei.isptr)
+                p := toAddrPointer(&v, ei.isptr, ei.deref)
                 b, err = ei.marshaler(b, p, ei.wiretag, deterministic)
                 if !nerr.Merge(err) {
                         return b, err
diff --git a/vendor/github.com/golang/protobuf/proto/table_unmarshal.go b/vendor/github.com/golang/protobuf/proto/table_unmarshal.go
index ebf1caa..acee2fc 100644
--- a/vendor/github.com/golang/protobuf/proto/table_unmarshal.go
+++ b/vendor/github.com/golang/protobuf/proto/table_unmarshal.go
@@ -136,7 +136,7 @@ func (u *unmarshalInfo) unmarshal(m pointer, b []byte) error {
                 u.computeUnmarshalInfo()
         }
         if u.isMessageSet {
-                return UnmarshalMessageSet(b, m.offset(u.extensions).toExtensions())
+                return unmarshalMessageSet(b, m.offset(u.extensions).toExtensions())
         }
         var reqMask uint64 // bitmask of required fields we've seen.
         var errLater error
@@ -362,46 +362,48 @@ func (u *unmarshalInfo) computeUnmarshalInfo() {
         }
 
         // Find any types associated with oneof fields.
-        // TODO: XXX_OneofFuncs returns more info than we need.  Get rid of some of it?
-        fn := reflect.Zero(reflect.PtrTo(t)).MethodByName("XXX_OneofFuncs")
-        if fn.IsValid() {
-                res := fn.Call(nil)[3] // last return value from XXX_OneofFuncs: []interface{}
-                for i := res.Len() - 1; i >= 0; i-- {
-                        v := res.Index(i)                             // interface{}
-                        tptr := reflect.ValueOf(v.Interface()).Type() // *Msg_X
-                        typ := tptr.Elem()                            // Msg_X
-
-                        f := typ.Field(0) // oneof implementers have one field
-                        baseUnmarshal := fieldUnmarshaler(&f)
-                        tags := strings.Split(f.Tag.Get("protobuf"), ",")
-                        fieldNum, err := strconv.Atoi(tags[1])
-                        if err != nil {
-                                panic("protobuf tag field not an integer: " + tags[1])
-                        }
-                        var name string
-                        for _, tag := range tags {
-                                if strings.HasPrefix(tag, "name=") {
-                                        name = strings.TrimPrefix(tag, "name=")
-                                        break
-                                }
+        var oneofImplementers []interface{}
+        switch m := reflect.Zero(reflect.PtrTo(t)).Interface().(type) {
+        case oneofFuncsIface:
+                _, _, _, oneofImplementers = m.XXX_OneofFuncs()
+        case oneofWrappersIface:
+                oneofImplementers = m.XXX_OneofWrappers()
+        }
+        for _, v := range oneofImplementers {
+                tptr := reflect.TypeOf(v) // *Msg_X
+                typ := tptr.Elem()        // Msg_X
+
+                f := typ.Field(0) // oneof implementers have one field
+                baseUnmarshal := fieldUnmarshaler(&f)
+                tags := strings.Split(f.Tag.Get("protobuf"), ",")
+                fieldNum, err := strconv.Atoi(tags[1])
+                if err != nil {
+                        panic("protobuf tag field not an integer: " + tags[1])
+                }
+                var name string
+                for _, tag := range tags {
+                        if strings.HasPrefix(tag, "name=") {
+                                name = strings.TrimPrefix(tag, "name=")
+                                break
                         }
+                }
 
-                        // Find the oneof field that this struct implements.
-                        // Might take O(n^2) to process all of the oneofs, but who cares.
-                        for _, of := range oneofFields {
-                                if tptr.Implements(of.ityp) {
-                                        // We have found the corresponding interface for this struct.
-                                        // That lets us know where this struct should be stored
-                                        // when we encounter it during unmarshaling.
-                                        unmarshal := makeUnmarshalOneof(typ, of.ityp, baseUnmarshal)
-                                        u.setTag(fieldNum, of.field, unmarshal, 0, name)
-                                }
+                // Find the oneof field that this struct implements.
+                // Might take O(n^2) to process all of the oneofs, but who cares.
+                for _, of := range oneofFields {
+                        if tptr.Implements(of.ityp) {
+                                // We have found the corresponding interface for this struct.
+                                // That lets us know where this struct should be stored
+                                // when we encounter it during unmarshaling.
+                                unmarshal := makeUnmarshalOneof(typ, of.ityp, baseUnmarshal)
+                                u.setTag(fieldNum, of.field, unmarshal, 0, name)
                         }
                 }
+
         }
 
         // Get extension ranges, if any.
-        fn = reflect.Zero(reflect.PtrTo(t)).MethodByName("ExtensionRangeArray")
+        fn := reflect.Zero(reflect.PtrTo(t)).MethodByName("ExtensionRangeArray")
         if fn.IsValid() {
                 if !u.extensions.IsValid() && !u.oldExtensions.IsValid() {
                         panic("a message with extensions, but no extensions field in " + t.Name())
@@ -1948,7 +1950,7 @@ func encodeVarint(b []byte, x uint64) []byte {
 // If there is an error, it returns 0,0.
 func decodeVarint(b []byte) (uint64, int) {
         var x, y uint64
-        if len(b) <= 0 {
+        if len(b) == 0 {
                 goto bad
         }
         x = uint64(b[0])
diff --git a/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.pb.go b/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.pb.go
new file mode 100644
index 0000000..1ded05b
--- /dev/null
+++ b/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.pb.go
@@ -0,0 +1,2887 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: google/protobuf/descriptor.proto
+
+package descriptor
+
+import (
+        fmt "fmt"
+        proto "github.com/golang/protobuf/proto"
+        math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
+
+type FieldDescriptorProto_Type int32
+
+const (
+        // 0 is reserved for errors.
+        // Order is weird for historical reasons.
+        FieldDescriptorProto_TYPE_DOUBLE FieldDescriptorProto_Type = 1
+        FieldDescriptorProto_TYPE_FLOAT  FieldDescriptorProto_Type = 2
+        // Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT64 if
+        // negative values are likely.
+        FieldDescriptorProto_TYPE_INT64  FieldDescriptorProto_Type = 3
+        FieldDescriptorProto_TYPE_UINT64 FieldDescriptorProto_Type = 4
+        // Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT32 if
+        // negative values are likely.
+        FieldDescriptorProto_TYPE_INT32   FieldDescriptorProto_Type = 5
+        FieldDescriptorProto_TYPE_FIXED64 FieldDescriptorProto_Type = 6
+        FieldDescriptorProto_TYPE_FIXED32 FieldDescriptorProto_Type = 7
+        FieldDescriptorProto_TYPE_BOOL    FieldDescriptorProto_Type = 8
+        FieldDescriptorProto_TYPE_STRING  FieldDescriptorProto_Type = 9
+        // Tag-delimited aggregate.
+        // Group type is deprecated and not supported in proto3. However, Proto3
+        // implementations should still be able to parse the group wire format and
+        // treat group fields as unknown fields.
+        FieldDescriptorProto_TYPE_GROUP   FieldDescriptorProto_Type = 10
+        FieldDescriptorProto_TYPE_MESSAGE FieldDescriptorProto_Type = 11
+        // New in version 2.
+        FieldDescriptorProto_TYPE_BYTES    FieldDescriptorProto_Type = 12
+        FieldDescriptorProto_TYPE_UINT32   FieldDescriptorProto_Type = 13
+        FieldDescriptorProto_TYPE_ENUM     FieldDescriptorProto_Type = 14
+        FieldDescriptorProto_TYPE_SFIXED32 FieldDescriptorProto_Type = 15
+        FieldDescriptorProto_TYPE_SFIXED64 FieldDescriptorProto_Type = 16
+        FieldDescriptorProto_TYPE_SINT32   FieldDescriptorProto_Type = 17
+        FieldDescriptorProto_TYPE_SINT64   FieldDescriptorProto_Type = 18
+)
+
+var FieldDescriptorProto_Type_name = map[int32]string{
+        1:  "TYPE_DOUBLE",
+        2:  "TYPE_FLOAT",
+        3:  "TYPE_INT64",
+        4:  "TYPE_UINT64",
+        5:  "TYPE_INT32",
+        6:  "TYPE_FIXED64",
+        7:  "TYPE_FIXED32",
+        8:  "TYPE_BOOL",
+        9:  "TYPE_STRING",
+        10: "TYPE_GROUP",
+        11: "TYPE_MESSAGE",
+        12: "TYPE_BYTES",
+        13: "TYPE_UINT32",
+        14: "TYPE_ENUM",
+        15: "TYPE_SFIXED32",
+        16: "TYPE_SFIXED64",
+        17: "TYPE_SINT32",
+        18: "TYPE_SINT64",
+}
+
+var FieldDescriptorProto_Type_value = map[string]int32{
+        "TYPE_DOUBLE":   1,
+        "TYPE_FLOAT":    2,
+        "TYPE_INT64":    3,
+        "TYPE_UINT64":   4,
+        "TYPE_INT32":    5,
+        "TYPE_FIXED64":  6,
+        "TYPE_FIXED32":  7,
+        "TYPE_BOOL":     8,
+        "TYPE_STRING":   9,
+        "TYPE_GROUP":    10,
+        "TYPE_MESSAGE":  11,
+        "TYPE_BYTES":    12,
+        "TYPE_UINT32":   13,
+        "TYPE_ENUM":     14,
+        "TYPE_SFIXED32": 15,
+        "TYPE_SFIXED64": 16,
+        "TYPE_SINT32":   17,
+        "TYPE_SINT64":   18,
+}
+
+func (x FieldDescriptorProto_Type) Enum() *FieldDescriptorProto_Type {
+        p := new(FieldDescriptorProto_Type)
+        *p = x
+        return p
+}
+
+func (x FieldDescriptorProto_Type) String() string {
+        return proto.EnumName(FieldDescriptorProto_Type_name, int32(x))
+}
+
+func (x *FieldDescriptorProto_Type) UnmarshalJSON(data []byte) error {
+        value, err := proto.UnmarshalJSONEnum(FieldDescriptorProto_Type_value, data, "FieldDescriptorProto_Type")
+        if err != nil {
+                return err
+        }
+        *x = FieldDescriptorProto_Type(value)
+        return nil
+}
+
+func (FieldDescriptorProto_Type) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{4, 0}
+}
+
+type FieldDescriptorProto_Label int32
+
+const (
+        // 0 is reserved for errors
+        FieldDescriptorProto_LABEL_OPTIONAL FieldDescriptorProto_Label = 1
+        FieldDescriptorProto_LABEL_REQUIRED FieldDescriptorProto_Label = 2
+        FieldDescriptorProto_LABEL_REPEATED FieldDescriptorProto_Label = 3
+)
+
+var FieldDescriptorProto_Label_name = map[int32]string{
+        1: "LABEL_OPTIONAL",
+        2: "LABEL_REQUIRED",
+        3: "LABEL_REPEATED",
+}
+
+var FieldDescriptorProto_Label_value = map[string]int32{
+        "LABEL_OPTIONAL": 1,
+        "LABEL_REQUIRED": 2,
+        "LABEL_REPEATED": 3,
+}
+
+func (x FieldDescriptorProto_Label) Enum() *FieldDescriptorProto_Label {
+        p := new(FieldDescriptorProto_Label)
+        *p = x
+        return p
+}
+
+func (x FieldDescriptorProto_Label) String() string {
+        return proto.EnumName(FieldDescriptorProto_Label_name, int32(x))
+}
+
+func (x *FieldDescriptorProto_Label) UnmarshalJSON(data []byte) error {
+        value, err := proto.UnmarshalJSONEnum(FieldDescriptorProto_Label_value, data, "FieldDescriptorProto_Label")
+        if err != nil {
+                return err
+        }
+        *x = FieldDescriptorProto_Label(value)
+        return nil
+}
+
+func (FieldDescriptorProto_Label) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{4, 1}
+}
+
+// Generated classes can be optimized for speed or code size.
+type FileOptions_OptimizeMode int32
+
+const (
+        FileOptions_SPEED FileOptions_OptimizeMode = 1
+        // etc.
+        FileOptions_CODE_SIZE    FileOptions_OptimizeMode = 2
+        FileOptions_LITE_RUNTIME FileOptions_OptimizeMode = 3
+)
+
+var FileOptions_OptimizeMode_name = map[int32]string{
+        1: "SPEED",
+        2: "CODE_SIZE",
+        3: "LITE_RUNTIME",
+}
+
+var FileOptions_OptimizeMode_value = map[string]int32{
+        "SPEED":        1,
+        "CODE_SIZE":    2,
+        "LITE_RUNTIME": 3,
+}
+
+func (x FileOptions_OptimizeMode) Enum() *FileOptions_OptimizeMode {
+        p := new(FileOptions_OptimizeMode)
+        *p = x
+        return p
+}
+
+func (x FileOptions_OptimizeMode) String() string {
+        return proto.EnumName(FileOptions_OptimizeMode_name, int32(x))
+}
+
+func (x *FileOptions_OptimizeMode) UnmarshalJSON(data []byte) error {
+        value, err := proto.UnmarshalJSONEnum(FileOptions_OptimizeMode_value, data, "FileOptions_OptimizeMode")
+        if err != nil {
+                return err
+        }
+        *x = FileOptions_OptimizeMode(value)
+        return nil
+}
+
+func (FileOptions_OptimizeMode) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{10, 0}
+}
+
+type FieldOptions_CType int32
+
+const (
+        // Default mode.
+        FieldOptions_STRING       FieldOptions_CType = 0
+        FieldOptions_CORD         FieldOptions_CType = 1
+        FieldOptions_STRING_PIECE FieldOptions_CType = 2
+)
+
+var FieldOptions_CType_name = map[int32]string{
+        0: "STRING",
+        1: "CORD",
+        2: "STRING_PIECE",
+}
+
+var FieldOptions_CType_value = map[string]int32{
+        "STRING":       0,
+        "CORD":         1,
+        "STRING_PIECE": 2,
+}
+
+func (x FieldOptions_CType) Enum() *FieldOptions_CType {
+        p := new(FieldOptions_CType)
+        *p = x
+        return p
+}
+
+func (x FieldOptions_CType) String() string {
+        return proto.EnumName(FieldOptions_CType_name, int32(x))
+}
+
+func (x *FieldOptions_CType) UnmarshalJSON(data []byte) error {
+        value, err := proto.UnmarshalJSONEnum(FieldOptions_CType_value, data, "FieldOptions_CType")
+        if err != nil {
+                return err
+        }
+        *x = FieldOptions_CType(value)
+        return nil
+}
+
+func (FieldOptions_CType) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{12, 0}
+}
+
+type FieldOptions_JSType int32
+
+const (
+        // Use the default type.
+        FieldOptions_JS_NORMAL FieldOptions_JSType = 0
+        // Use JavaScript strings.
+        FieldOptions_JS_STRING FieldOptions_JSType = 1
+        // Use JavaScript numbers.
+        FieldOptions_JS_NUMBER FieldOptions_JSType = 2
+)
+
+var FieldOptions_JSType_name = map[int32]string{
+        0: "JS_NORMAL",
+        1: "JS_STRING",
+        2: "JS_NUMBER",
+}
+
+var FieldOptions_JSType_value = map[string]int32{
+        "JS_NORMAL": 0,
+        "JS_STRING": 1,
+        "JS_NUMBER": 2,
+}
+
+func (x FieldOptions_JSType) Enum() *FieldOptions_JSType {
+        p := new(FieldOptions_JSType)
+        *p = x
+        return p
+}
+
+func (x FieldOptions_JSType) String() string {
+        return proto.EnumName(FieldOptions_JSType_name, int32(x))
+}
+
+func (x *FieldOptions_JSType) UnmarshalJSON(data []byte) error {
+        value, err := proto.UnmarshalJSONEnum(FieldOptions_JSType_value, data, "FieldOptions_JSType")
+        if err != nil {
+                return err
+        }
+        *x = FieldOptions_JSType(value)
+        return nil
+}
+
+func (FieldOptions_JSType) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{12, 1}
+}
+
+// Is this method side-effect-free (or safe in HTTP parlance), or idempotent,
+// or neither? HTTP based RPC implementation may choose GET verb for safe
+// methods, and PUT verb for idempotent methods instead of the default POST.
+type MethodOptions_IdempotencyLevel int32
+
+const (
+        MethodOptions_IDEMPOTENCY_UNKNOWN MethodOptions_IdempotencyLevel = 0
+        MethodOptions_NO_SIDE_EFFECTS     MethodOptions_IdempotencyLevel = 1
+        MethodOptions_IDEMPOTENT          MethodOptions_IdempotencyLevel = 2
+)
+
+var MethodOptions_IdempotencyLevel_name = map[int32]string{
+        0: "IDEMPOTENCY_UNKNOWN",
+        1: "NO_SIDE_EFFECTS",
+        2: "IDEMPOTENT",
+}
+
+var MethodOptions_IdempotencyLevel_value = map[string]int32{
+        "IDEMPOTENCY_UNKNOWN": 0,
+        "NO_SIDE_EFFECTS":     1,
+        "IDEMPOTENT":          2,
+}
+
+func (x MethodOptions_IdempotencyLevel) Enum() *MethodOptions_IdempotencyLevel {
+        p := new(MethodOptions_IdempotencyLevel)
+        *p = x
+        return p
+}
+
+func (x MethodOptions_IdempotencyLevel) String() string {
+        return proto.EnumName(MethodOptions_IdempotencyLevel_name, int32(x))
+}
+
+func (x *MethodOptions_IdempotencyLevel) UnmarshalJSON(data []byte) error {
+        value, err := proto.UnmarshalJSONEnum(MethodOptions_IdempotencyLevel_value, data, "MethodOptions_IdempotencyLevel")
+        if err != nil {
+                return err
+        }
+        *x = MethodOptions_IdempotencyLevel(value)
+        return nil
+}
+
+func (MethodOptions_IdempotencyLevel) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{17, 0}
+}
+
+// The protocol compiler can output a FileDescriptorSet containing the .proto
+// files it parses.
+type FileDescriptorSet struct {
+        File                 []*FileDescriptorProto `protobuf:"bytes,1,rep,name=file" json:"file,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}               `json:"-"`
+        XXX_unrecognized     []byte                 `json:"-"`
+        XXX_sizecache        int32                  `json:"-"`
+}
+
+func (m *FileDescriptorSet) Reset()         { *m = FileDescriptorSet{} }
+func (m *FileDescriptorSet) String() string { return proto.CompactTextString(m) }
+func (*FileDescriptorSet) ProtoMessage()    {}
+func (*FileDescriptorSet) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{0}
+}
+
+func (m *FileDescriptorSet) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_FileDescriptorSet.Unmarshal(m, b)
+}
+func (m *FileDescriptorSet) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_FileDescriptorSet.Marshal(b, m, deterministic)
+}
+func (m *FileDescriptorSet) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_FileDescriptorSet.Merge(m, src)
+}
+func (m *FileDescriptorSet) XXX_Size() int {
+        return xxx_messageInfo_FileDescriptorSet.Size(m)
+}
+func (m *FileDescriptorSet) XXX_DiscardUnknown() {
+        xxx_messageInfo_FileDescriptorSet.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FileDescriptorSet proto.InternalMessageInfo
+
+func (m *FileDescriptorSet) GetFile() []*FileDescriptorProto {
+        if m != nil {
+                return m.File
+        }
+        return nil
+}
+
+// Describes a complete .proto file.
+type FileDescriptorProto struct {
+        Name    *string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+        Package *string `protobuf:"bytes,2,opt,name=package" json:"package,omitempty"`
+        // Names of files imported by this file.
+        Dependency []string `protobuf:"bytes,3,rep,name=dependency" json:"dependency,omitempty"`
+        // Indexes of the public imported files in the dependency list above.
+        PublicDependency []int32 `protobuf:"varint,10,rep,name=public_dependency,json=publicDependency" json:"public_dependency,omitempty"`
+        // Indexes of the weak imported files in the dependency list.
+        // For Google-internal migration only. Do not use.
+        WeakDependency []int32 `protobuf:"varint,11,rep,name=weak_dependency,json=weakDependency" json:"weak_dependency,omitempty"`
+        // All top-level definitions in this file.
+        MessageType []*DescriptorProto        `protobuf:"bytes,4,rep,name=message_type,json=messageType" json:"message_type,omitempty"`
+        EnumType    []*EnumDescriptorProto    `protobuf:"bytes,5,rep,name=enum_type,json=enumType" json:"enum_type,omitempty"`
+        Service     []*ServiceDescriptorProto `protobuf:"bytes,6,rep,name=service" json:"service,omitempty"`
+        Extension   []*FieldDescriptorProto   `protobuf:"bytes,7,rep,name=extension" json:"extension,omitempty"`
+        Options     *FileOptions              `protobuf:"bytes,8,opt,name=options" json:"options,omitempty"`
+        // This field contains optional information about the original source code.
+        // You may safely remove this entire field without harming runtime
+        // functionality of the descriptors -- the information is needed only by
+        // development tools.
+        SourceCodeInfo *SourceCodeInfo `protobuf:"bytes,9,opt,name=source_code_info,json=sourceCodeInfo" json:"source_code_info,omitempty"`
+        // The syntax of the proto file.
+        // The supported values are "proto2" and "proto3".
+        Syntax               *string  `protobuf:"bytes,12,opt,name=syntax" json:"syntax,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *FileDescriptorProto) Reset()         { *m = FileDescriptorProto{} }
+func (m *FileDescriptorProto) String() string { return proto.CompactTextString(m) }
+func (*FileDescriptorProto) ProtoMessage()    {}
+func (*FileDescriptorProto) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{1}
+}
+
+func (m *FileDescriptorProto) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_FileDescriptorProto.Unmarshal(m, b)
+}
+func (m *FileDescriptorProto) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_FileDescriptorProto.Marshal(b, m, deterministic)
+}
+func (m *FileDescriptorProto) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_FileDescriptorProto.Merge(m, src)
+}
+func (m *FileDescriptorProto) XXX_Size() int {
+        return xxx_messageInfo_FileDescriptorProto.Size(m)
+}
+func (m *FileDescriptorProto) XXX_DiscardUnknown() {
+        xxx_messageInfo_FileDescriptorProto.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FileDescriptorProto proto.InternalMessageInfo
+
+func (m *FileDescriptorProto) GetName() string {
+        if m != nil && m.Name != nil {
+                return *m.Name
+        }
+        return ""
+}
+
+func (m *FileDescriptorProto) GetPackage() string {
+        if m != nil && m.Package != nil {
+                return *m.Package
+        }
+        return ""
+}
+
+func (m *FileDescriptorProto) GetDependency() []string {
+        if m != nil {
+                return m.Dependency
+        }
+        return nil
+}
+
+func (m *FileDescriptorProto) GetPublicDependency() []int32 {
+        if m != nil {
+                return m.PublicDependency
+        }
+        return nil
+}
+
+func (m *FileDescriptorProto) GetWeakDependency() []int32 {
+        if m != nil {
+                return m.WeakDependency
+        }
+        return nil
+}
+
+func (m *FileDescriptorProto) GetMessageType() []*DescriptorProto {
+        if m != nil {
+                return m.MessageType
+        }
+        return nil
+}
+
+func (m *FileDescriptorProto) GetEnumType() []*EnumDescriptorProto {
+        if m != nil {
+                return m.EnumType
+        }
+        return nil
+}
+
+func (m *FileDescriptorProto) GetService() []*ServiceDescriptorProto {
+        if m != nil {
+                return m.Service
+        }
+        return nil
+}
+
+func (m *FileDescriptorProto) GetExtension() []*FieldDescriptorProto {
+        if m != nil {
+                return m.Extension
+        }
+        return nil
+}
+
+func (m *FileDescriptorProto) GetOptions() *FileOptions {
+        if m != nil {
+                return m.Options
+        }
+        return nil
+}
+
+func (m *FileDescriptorProto) GetSourceCodeInfo() *SourceCodeInfo {
+        if m != nil {
+                return m.SourceCodeInfo
+        }
+        return nil
+}
+
+func (m *FileDescriptorProto) GetSyntax() string {
+        if m != nil && m.Syntax != nil {
+                return *m.Syntax
+        }
+        return ""
+}
+
+// Describes a message type.
+type DescriptorProto struct {
+        Name           *string                           `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+        Field          []*FieldDescriptorProto           `protobuf:"bytes,2,rep,name=field" json:"field,omitempty"`
+        Extension      []*FieldDescriptorProto           `protobuf:"bytes,6,rep,name=extension" json:"extension,omitempty"`
+        NestedType     []*DescriptorProto                `protobuf:"bytes,3,rep,name=nested_type,json=nestedType" json:"nested_type,omitempty"`
+        EnumType       []*EnumDescriptorProto            `protobuf:"bytes,4,rep,name=enum_type,json=enumType" json:"enum_type,omitempty"`
+        ExtensionRange []*DescriptorProto_ExtensionRange `protobuf:"bytes,5,rep,name=extension_range,json=extensionRange" json:"extension_range,omitempty"`
+        OneofDecl      []*OneofDescriptorProto           `protobuf:"bytes,8,rep,name=oneof_decl,json=oneofDecl" json:"oneof_decl,omitempty"`
+        Options        *MessageOptions                   `protobuf:"bytes,7,opt,name=options" json:"options,omitempty"`
+        ReservedRange  []*DescriptorProto_ReservedRange  `protobuf:"bytes,9,rep,name=reserved_range,json=reservedRange" json:"reserved_range,omitempty"`
+        // Reserved field names, which may not be used by fields in the same message.
+        // A given name may only be reserved once.
+        ReservedName         []string `protobuf:"bytes,10,rep,name=reserved_name,json=reservedName" json:"reserved_name,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *DescriptorProto) Reset()         { *m = DescriptorProto{} }
+func (m *DescriptorProto) String() string { return proto.CompactTextString(m) }
+func (*DescriptorProto) ProtoMessage()    {}
+func (*DescriptorProto) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{2}
+}
+
+func (m *DescriptorProto) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_DescriptorProto.Unmarshal(m, b)
+}
+func (m *DescriptorProto) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_DescriptorProto.Marshal(b, m, deterministic)
+}
+func (m *DescriptorProto) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_DescriptorProto.Merge(m, src)
+}
+func (m *DescriptorProto) XXX_Size() int {
+        return xxx_messageInfo_DescriptorProto.Size(m)
+}
+func (m *DescriptorProto) XXX_DiscardUnknown() {
+        xxx_messageInfo_DescriptorProto.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_DescriptorProto proto.InternalMessageInfo
+
+func (m *DescriptorProto) GetName() string {
+        if m != nil && m.Name != nil {
+                return *m.Name
+        }
+        return ""
+}
+
+func (m *DescriptorProto) GetField() []*FieldDescriptorProto {
+        if m != nil {
+                return m.Field
+        }
+        return nil
+}
+
+func (m *DescriptorProto) GetExtension() []*FieldDescriptorProto {
+        if m != nil {
+                return m.Extension
+        }
+        return nil
+}
+
+func (m *DescriptorProto) GetNestedType() []*DescriptorProto {
+        if m != nil {
+                return m.NestedType
+        }
+        return nil
+}
+
+func (m *DescriptorProto) GetEnumType() []*EnumDescriptorProto {
+        if m != nil {
+                return m.EnumType
+        }
+        return nil
+}
+
+func (m *DescriptorProto) GetExtensionRange() []*DescriptorProto_ExtensionRange {
+        if m != nil {
+                return m.ExtensionRange
+        }
+        return nil
+}
+
+func (m *DescriptorProto) GetOneofDecl() []*OneofDescriptorProto {
+        if m != nil {
+                return m.OneofDecl
+        }
+        return nil
+}
+
+func (m *DescriptorProto) GetOptions() *MessageOptions {
+        if m != nil {
+                return m.Options
+        }
+        return nil
+}
+
+func (m *DescriptorProto) GetReservedRange() []*DescriptorProto_ReservedRange {
+        if m != nil {
+                return m.ReservedRange
+        }
+        return nil
+}
+
+func (m *DescriptorProto) GetReservedName() []string {
+        if m != nil {
+                return m.ReservedName
+        }
+        return nil
+}
+
+type DescriptorProto_ExtensionRange struct {
+        Start                *int32                 `protobuf:"varint,1,opt,name=start" json:"start,omitempty"`
+        End                  *int32                 `protobuf:"varint,2,opt,name=end" json:"end,omitempty"`
+        Options              *ExtensionRangeOptions `protobuf:"bytes,3,opt,name=options" json:"options,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}               `json:"-"`
+        XXX_unrecognized     []byte                 `json:"-"`
+        XXX_sizecache        int32                  `json:"-"`
+}
+
+func (m *DescriptorProto_ExtensionRange) Reset()         { *m = DescriptorProto_ExtensionRange{} }
+func (m *DescriptorProto_ExtensionRange) String() string { return proto.CompactTextString(m) }
+func (*DescriptorProto_ExtensionRange) ProtoMessage()    {}
+func (*DescriptorProto_ExtensionRange) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{2, 0}
+}
+
+func (m *DescriptorProto_ExtensionRange) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_DescriptorProto_ExtensionRange.Unmarshal(m, b)
+}
+func (m *DescriptorProto_ExtensionRange) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_DescriptorProto_ExtensionRange.Marshal(b, m, deterministic)
+}
+func (m *DescriptorProto_ExtensionRange) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_DescriptorProto_ExtensionRange.Merge(m, src)
+}
+func (m *DescriptorProto_ExtensionRange) XXX_Size() int {
+        return xxx_messageInfo_DescriptorProto_ExtensionRange.Size(m)
+}
+func (m *DescriptorProto_ExtensionRange) XXX_DiscardUnknown() {
+        xxx_messageInfo_DescriptorProto_ExtensionRange.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_DescriptorProto_ExtensionRange proto.InternalMessageInfo
+
+func (m *DescriptorProto_ExtensionRange) GetStart() int32 {
+        if m != nil && m.Start != nil {
+                return *m.Start
+        }
+        return 0
+}
+
+func (m *DescriptorProto_ExtensionRange) GetEnd() int32 {
+        if m != nil && m.End != nil {
+                return *m.End
+        }
+        return 0
+}
+
+func (m *DescriptorProto_ExtensionRange) GetOptions() *ExtensionRangeOptions {
+        if m != nil {
+                return m.Options
+        }
+        return nil
+}
+
+// Range of reserved tag numbers. Reserved tag numbers may not be used by
+// fields or extension ranges in the same message. Reserved ranges may
+// not overlap.
+type DescriptorProto_ReservedRange struct {
+        Start                *int32   `protobuf:"varint,1,opt,name=start" json:"start,omitempty"`
+        End                  *int32   `protobuf:"varint,2,opt,name=end" json:"end,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *DescriptorProto_ReservedRange) Reset()         { *m = DescriptorProto_ReservedRange{} }
+func (m *DescriptorProto_ReservedRange) String() string { return proto.CompactTextString(m) }
+func (*DescriptorProto_ReservedRange) ProtoMessage()    {}
+func (*DescriptorProto_ReservedRange) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{2, 1}
+}
+
+func (m *DescriptorProto_ReservedRange) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_DescriptorProto_ReservedRange.Unmarshal(m, b)
+}
+func (m *DescriptorProto_ReservedRange) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_DescriptorProto_ReservedRange.Marshal(b, m, deterministic)
+}
+func (m *DescriptorProto_ReservedRange) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_DescriptorProto_ReservedRange.Merge(m, src)
+}
+func (m *DescriptorProto_ReservedRange) XXX_Size() int {
+        return xxx_messageInfo_DescriptorProto_ReservedRange.Size(m)
+}
+func (m *DescriptorProto_ReservedRange) XXX_DiscardUnknown() {
+        xxx_messageInfo_DescriptorProto_ReservedRange.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_DescriptorProto_ReservedRange proto.InternalMessageInfo
+
+func (m *DescriptorProto_ReservedRange) GetStart() int32 {
+        if m != nil && m.Start != nil {
+                return *m.Start
+        }
+        return 0
+}
+
+func (m *DescriptorProto_ReservedRange) GetEnd() int32 {
+        if m != nil && m.End != nil {
+                return *m.End
+        }
+        return 0
+}
+
+type ExtensionRangeOptions struct {
+        // The parser stores options it doesn't recognize here. See above.
+        UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
+        XXX_NoUnkeyedLiteral         struct{}               `json:"-"`
+        proto.XXX_InternalExtensions `json:"-"`
+        XXX_unrecognized             []byte `json:"-"`
+        XXX_sizecache                int32  `json:"-"`
+}
+
+func (m *ExtensionRangeOptions) Reset()         { *m = ExtensionRangeOptions{} }
+func (m *ExtensionRangeOptions) String() string { return proto.CompactTextString(m) }
+func (*ExtensionRangeOptions) ProtoMessage()    {}
+func (*ExtensionRangeOptions) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{3}
+}
+
+var extRange_ExtensionRangeOptions = []proto.ExtensionRange{
+        {Start: 1000, End: 536870911},
+}
+
+func (*ExtensionRangeOptions) ExtensionRangeArray() []proto.ExtensionRange {
+        return extRange_ExtensionRangeOptions
+}
+
+func (m *ExtensionRangeOptions) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ExtensionRangeOptions.Unmarshal(m, b)
+}
+func (m *ExtensionRangeOptions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ExtensionRangeOptions.Marshal(b, m, deterministic)
+}
+func (m *ExtensionRangeOptions) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ExtensionRangeOptions.Merge(m, src)
+}
+func (m *ExtensionRangeOptions) XXX_Size() int {
+        return xxx_messageInfo_ExtensionRangeOptions.Size(m)
+}
+func (m *ExtensionRangeOptions) XXX_DiscardUnknown() {
+        xxx_messageInfo_ExtensionRangeOptions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ExtensionRangeOptions proto.InternalMessageInfo
+
+func (m *ExtensionRangeOptions) GetUninterpretedOption() []*UninterpretedOption {
+        if m != nil {
+                return m.UninterpretedOption
+        }
+        return nil
+}
+
+// Describes a field within a message.
+type FieldDescriptorProto struct {
+        Name   *string                     `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+        Number *int32                      `protobuf:"varint,3,opt,name=number" json:"number,omitempty"`
+        Label  *FieldDescriptorProto_Label `protobuf:"varint,4,opt,name=label,enum=google.protobuf.FieldDescriptorProto_Label" json:"label,omitempty"`
+        // If type_name is set, this need not be set.  If both this and type_name
+        // are set, this must be one of TYPE_ENUM, TYPE_MESSAGE or TYPE_GROUP.
+        Type *FieldDescriptorProto_Type `protobuf:"varint,5,opt,name=type,enum=google.protobuf.FieldDescriptorProto_Type" json:"type,omitempty"`
+        // For message and enum types, this is the name of the type.  If the name
+        // starts with a '.', it is fully-qualified.  Otherwise, C++-like scoping
+        // rules are used to find the type (i.e. first the nested types within this
+        // message are searched, then within the parent, on up to the root
+        // namespace).
+        TypeName *string `protobuf:"bytes,6,opt,name=type_name,json=typeName" json:"type_name,omitempty"`
+        // For extensions, this is the name of the type being extended.  It is
+        // resolved in the same manner as type_name.
+        Extendee *string `protobuf:"bytes,2,opt,name=extendee" json:"extendee,omitempty"`
+        // For numeric types, contains the original text representation of the value.
+        // For booleans, "true" or "false".
+        // For strings, contains the default text contents (not escaped in any way).
+        // For bytes, contains the C escaped value.  All bytes >= 128 are escaped.
+        // TODO(kenton):  Base-64 encode?
+        DefaultValue *string `protobuf:"bytes,7,opt,name=default_value,json=defaultValue" json:"default_value,omitempty"`
+        // If set, gives the index of a oneof in the containing type's oneof_decl
+        // list.  This field is a member of that oneof.
+        OneofIndex *int32 `protobuf:"varint,9,opt,name=oneof_index,json=oneofIndex" json:"oneof_index,omitempty"`
+        // JSON name of this field. The value is set by protocol compiler. If the
+        // user has set a "json_name" option on this field, that option's value
+        // will be used. Otherwise, it's deduced from the field's name by converting
+        // it to camelCase.
+        JsonName             *string       `protobuf:"bytes,10,opt,name=json_name,json=jsonName" json:"json_name,omitempty"`
+        Options              *FieldOptions `protobuf:"bytes,8,opt,name=options" json:"options,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *FieldDescriptorProto) Reset()         { *m = FieldDescriptorProto{} }
+func (m *FieldDescriptorProto) String() string { return proto.CompactTextString(m) }
+func (*FieldDescriptorProto) ProtoMessage()    {}
+func (*FieldDescriptorProto) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{4}
+}
+
+func (m *FieldDescriptorProto) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_FieldDescriptorProto.Unmarshal(m, b)
+}
+func (m *FieldDescriptorProto) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_FieldDescriptorProto.Marshal(b, m, deterministic)
+}
+func (m *FieldDescriptorProto) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_FieldDescriptorProto.Merge(m, src)
+}
+func (m *FieldDescriptorProto) XXX_Size() int {
+        return xxx_messageInfo_FieldDescriptorProto.Size(m)
+}
+func (m *FieldDescriptorProto) XXX_DiscardUnknown() {
+        xxx_messageInfo_FieldDescriptorProto.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FieldDescriptorProto proto.InternalMessageInfo
+
+func (m *FieldDescriptorProto) GetName() string {
+        if m != nil && m.Name != nil {
+                return *m.Name
+        }
+        return ""
+}
+
+func (m *FieldDescriptorProto) GetNumber() int32 {
+        if m != nil && m.Number != nil {
+                return *m.Number
+        }
+        return 0
+}
+
+func (m *FieldDescriptorProto) GetLabel() FieldDescriptorProto_Label {
+        if m != nil && m.Label != nil {
+                return *m.Label
+        }
+        return FieldDescriptorProto_LABEL_OPTIONAL
+}
+
+func (m *FieldDescriptorProto) GetType() FieldDescriptorProto_Type {
+        if m != nil && m.Type != nil {
+                return *m.Type
+        }
+        return FieldDescriptorProto_TYPE_DOUBLE
+}
+
+func (m *FieldDescriptorProto) GetTypeName() string {
+        if m != nil && m.TypeName != nil {
+                return *m.TypeName
+        }
+        return ""
+}
+
+func (m *FieldDescriptorProto) GetExtendee() string {
+        if m != nil && m.Extendee != nil {
+                return *m.Extendee
+        }
+        return ""
+}
+
+func (m *FieldDescriptorProto) GetDefaultValue() string {
+        if m != nil && m.DefaultValue != nil {
+                return *m.DefaultValue
+        }
+        return ""
+}
+
+func (m *FieldDescriptorProto) GetOneofIndex() int32 {
+        if m != nil && m.OneofIndex != nil {
+                return *m.OneofIndex
+        }
+        return 0
+}
+
+func (m *FieldDescriptorProto) GetJsonName() string {
+        if m != nil && m.JsonName != nil {
+                return *m.JsonName
+        }
+        return ""
+}
+
+func (m *FieldDescriptorProto) GetOptions() *FieldOptions {
+        if m != nil {
+                return m.Options
+        }
+        return nil
+}
+
+// Describes a oneof.
+type OneofDescriptorProto struct {
+        Name                 *string       `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+        Options              *OneofOptions `protobuf:"bytes,2,opt,name=options" json:"options,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *OneofDescriptorProto) Reset()         { *m = OneofDescriptorProto{} }
+func (m *OneofDescriptorProto) String() string { return proto.CompactTextString(m) }
+func (*OneofDescriptorProto) ProtoMessage()    {}
+func (*OneofDescriptorProto) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{5}
+}
+
+func (m *OneofDescriptorProto) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_OneofDescriptorProto.Unmarshal(m, b)
+}
+func (m *OneofDescriptorProto) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_OneofDescriptorProto.Marshal(b, m, deterministic)
+}
+func (m *OneofDescriptorProto) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_OneofDescriptorProto.Merge(m, src)
+}
+func (m *OneofDescriptorProto) XXX_Size() int {
+        return xxx_messageInfo_OneofDescriptorProto.Size(m)
+}
+func (m *OneofDescriptorProto) XXX_DiscardUnknown() {
+        xxx_messageInfo_OneofDescriptorProto.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_OneofDescriptorProto proto.InternalMessageInfo
+
+func (m *OneofDescriptorProto) GetName() string {
+        if m != nil && m.Name != nil {
+                return *m.Name
+        }
+        return ""
+}
+
+func (m *OneofDescriptorProto) GetOptions() *OneofOptions {
+        if m != nil {
+                return m.Options
+        }
+        return nil
+}
+
+// Describes an enum type.
+type EnumDescriptorProto struct {
+        Name    *string                     `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+        Value   []*EnumValueDescriptorProto `protobuf:"bytes,2,rep,name=value" json:"value,omitempty"`
+        Options *EnumOptions                `protobuf:"bytes,3,opt,name=options" json:"options,omitempty"`
+        // Range of reserved numeric values. Reserved numeric values may not be used
+        // by enum values in the same enum declaration. Reserved ranges may not
+        // overlap.
+        ReservedRange []*EnumDescriptorProto_EnumReservedRange `protobuf:"bytes,4,rep,name=reserved_range,json=reservedRange" json:"reserved_range,omitempty"`
+        // Reserved enum value names, which may not be reused. A given name may only
+        // be reserved once.
+        ReservedName         []string `protobuf:"bytes,5,rep,name=reserved_name,json=reservedName" json:"reserved_name,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *EnumDescriptorProto) Reset()         { *m = EnumDescriptorProto{} }
+func (m *EnumDescriptorProto) String() string { return proto.CompactTextString(m) }
+func (*EnumDescriptorProto) ProtoMessage()    {}
+func (*EnumDescriptorProto) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{6}
+}
+
+func (m *EnumDescriptorProto) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_EnumDescriptorProto.Unmarshal(m, b)
+}
+func (m *EnumDescriptorProto) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_EnumDescriptorProto.Marshal(b, m, deterministic)
+}
+func (m *EnumDescriptorProto) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_EnumDescriptorProto.Merge(m, src)
+}
+func (m *EnumDescriptorProto) XXX_Size() int {
+        return xxx_messageInfo_EnumDescriptorProto.Size(m)
+}
+func (m *EnumDescriptorProto) XXX_DiscardUnknown() {
+        xxx_messageInfo_EnumDescriptorProto.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_EnumDescriptorProto proto.InternalMessageInfo
+
+func (m *EnumDescriptorProto) GetName() string {
+        if m != nil && m.Name != nil {
+                return *m.Name
+        }
+        return ""
+}
+
+func (m *EnumDescriptorProto) GetValue() []*EnumValueDescriptorProto {
+        if m != nil {
+                return m.Value
+        }
+        return nil
+}
+
+func (m *EnumDescriptorProto) GetOptions() *EnumOptions {
+        if m != nil {
+                return m.Options
+        }
+        return nil
+}
+
+func (m *EnumDescriptorProto) GetReservedRange() []*EnumDescriptorProto_EnumReservedRange {
+        if m != nil {
+                return m.ReservedRange
+        }
+        return nil
+}
+
+func (m *EnumDescriptorProto) GetReservedName() []string {
+        if m != nil {
+                return m.ReservedName
+        }
+        return nil
+}
+
+// Range of reserved numeric values. Reserved values may not be used by
+// entries in the same enum. Reserved ranges may not overlap.
+//
+// Note that this is distinct from DescriptorProto.ReservedRange in that it
+// is inclusive such that it can appropriately represent the entire int32
+// domain.
+type EnumDescriptorProto_EnumReservedRange struct {
+        Start                *int32   `protobuf:"varint,1,opt,name=start" json:"start,omitempty"`
+        End                  *int32   `protobuf:"varint,2,opt,name=end" json:"end,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *EnumDescriptorProto_EnumReservedRange) Reset()         { *m = EnumDescriptorProto_EnumReservedRange{} }
+func (m *EnumDescriptorProto_EnumReservedRange) String() string { return proto.CompactTextString(m) }
+func (*EnumDescriptorProto_EnumReservedRange) ProtoMessage()    {}
+func (*EnumDescriptorProto_EnumReservedRange) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{6, 0}
+}
+
+func (m *EnumDescriptorProto_EnumReservedRange) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_EnumDescriptorProto_EnumReservedRange.Unmarshal(m, b)
+}
+func (m *EnumDescriptorProto_EnumReservedRange) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_EnumDescriptorProto_EnumReservedRange.Marshal(b, m, deterministic)
+}
+func (m *EnumDescriptorProto_EnumReservedRange) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_EnumDescriptorProto_EnumReservedRange.Merge(m, src)
+}
+func (m *EnumDescriptorProto_EnumReservedRange) XXX_Size() int {
+        return xxx_messageInfo_EnumDescriptorProto_EnumReservedRange.Size(m)
+}
+func (m *EnumDescriptorProto_EnumReservedRange) XXX_DiscardUnknown() {
+        xxx_messageInfo_EnumDescriptorProto_EnumReservedRange.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_EnumDescriptorProto_EnumReservedRange proto.InternalMessageInfo
+
+func (m *EnumDescriptorProto_EnumReservedRange) GetStart() int32 {
+        if m != nil && m.Start != nil {
+                return *m.Start
+        }
+        return 0
+}
+
+func (m *EnumDescriptorProto_EnumReservedRange) GetEnd() int32 {
+        if m != nil && m.End != nil {
+                return *m.End
+        }
+        return 0
+}
+
+// Describes a value within an enum.
+type EnumValueDescriptorProto struct {
+        Name                 *string           `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+        Number               *int32            `protobuf:"varint,2,opt,name=number" json:"number,omitempty"`
+        Options              *EnumValueOptions `protobuf:"bytes,3,opt,name=options" json:"options,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+        XXX_unrecognized     []byte            `json:"-"`
+        XXX_sizecache        int32             `json:"-"`
+}
+
+func (m *EnumValueDescriptorProto) Reset()         { *m = EnumValueDescriptorProto{} }
+func (m *EnumValueDescriptorProto) String() string { return proto.CompactTextString(m) }
+func (*EnumValueDescriptorProto) ProtoMessage()    {}
+func (*EnumValueDescriptorProto) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{7}
+}
+
+func (m *EnumValueDescriptorProto) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_EnumValueDescriptorProto.Unmarshal(m, b)
+}
+func (m *EnumValueDescriptorProto) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_EnumValueDescriptorProto.Marshal(b, m, deterministic)
+}
+func (m *EnumValueDescriptorProto) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_EnumValueDescriptorProto.Merge(m, src)
+}
+func (m *EnumValueDescriptorProto) XXX_Size() int {
+        return xxx_messageInfo_EnumValueDescriptorProto.Size(m)
+}
+func (m *EnumValueDescriptorProto) XXX_DiscardUnknown() {
+        xxx_messageInfo_EnumValueDescriptorProto.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_EnumValueDescriptorProto proto.InternalMessageInfo
+
+func (m *EnumValueDescriptorProto) GetName() string {
+        if m != nil && m.Name != nil {
+                return *m.Name
+        }
+        return ""
+}
+
+func (m *EnumValueDescriptorProto) GetNumber() int32 {
+        if m != nil && m.Number != nil {
+                return *m.Number
+        }
+        return 0
+}
+
+func (m *EnumValueDescriptorProto) GetOptions() *EnumValueOptions {
+        if m != nil {
+                return m.Options
+        }
+        return nil
+}
+
+// Describes a service.
+type ServiceDescriptorProto struct {
+        Name                 *string                  `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+        Method               []*MethodDescriptorProto `protobuf:"bytes,2,rep,name=method" json:"method,omitempty"`
+        Options              *ServiceOptions          `protobuf:"bytes,3,opt,name=options" json:"options,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}                 `json:"-"`
+        XXX_unrecognized     []byte                   `json:"-"`
+        XXX_sizecache        int32                    `json:"-"`
+}
+
+func (m *ServiceDescriptorProto) Reset()         { *m = ServiceDescriptorProto{} }
+func (m *ServiceDescriptorProto) String() string { return proto.CompactTextString(m) }
+func (*ServiceDescriptorProto) ProtoMessage()    {}
+func (*ServiceDescriptorProto) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{8}
+}
+
+func (m *ServiceDescriptorProto) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ServiceDescriptorProto.Unmarshal(m, b)
+}
+func (m *ServiceDescriptorProto) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ServiceDescriptorProto.Marshal(b, m, deterministic)
+}
+func (m *ServiceDescriptorProto) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ServiceDescriptorProto.Merge(m, src)
+}
+func (m *ServiceDescriptorProto) XXX_Size() int {
+        return xxx_messageInfo_ServiceDescriptorProto.Size(m)
+}
+func (m *ServiceDescriptorProto) XXX_DiscardUnknown() {
+        xxx_messageInfo_ServiceDescriptorProto.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ServiceDescriptorProto proto.InternalMessageInfo
+
+func (m *ServiceDescriptorProto) GetName() string {
+        if m != nil && m.Name != nil {
+                return *m.Name
+        }
+        return ""
+}
+
+func (m *ServiceDescriptorProto) GetMethod() []*MethodDescriptorProto {
+        if m != nil {
+                return m.Method
+        }
+        return nil
+}
+
+func (m *ServiceDescriptorProto) GetOptions() *ServiceOptions {
+        if m != nil {
+                return m.Options
+        }
+        return nil
+}
+
+// Describes a method of a service.
+type MethodDescriptorProto struct {
+        Name *string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+        // Input and output type names.  These are resolved in the same way as
+        // FieldDescriptorProto.type_name, but must refer to a message type.
+        InputType  *string        `protobuf:"bytes,2,opt,name=input_type,json=inputType" json:"input_type,omitempty"`
+        OutputType *string        `protobuf:"bytes,3,opt,name=output_type,json=outputType" json:"output_type,omitempty"`
+        Options    *MethodOptions `protobuf:"bytes,4,opt,name=options" json:"options,omitempty"`
+        // Identifies if client streams multiple client messages
+        ClientStreaming *bool `protobuf:"varint,5,opt,name=client_streaming,json=clientStreaming,def=0" json:"client_streaming,omitempty"`
+        // Identifies if server streams multiple server messages
+        ServerStreaming      *bool    `protobuf:"varint,6,opt,name=server_streaming,json=serverStreaming,def=0" json:"server_streaming,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *MethodDescriptorProto) Reset()         { *m = MethodDescriptorProto{} }
+func (m *MethodDescriptorProto) String() string { return proto.CompactTextString(m) }
+func (*MethodDescriptorProto) ProtoMessage()    {}
+func (*MethodDescriptorProto) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{9}
+}
+
+func (m *MethodDescriptorProto) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_MethodDescriptorProto.Unmarshal(m, b)
+}
+func (m *MethodDescriptorProto) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_MethodDescriptorProto.Marshal(b, m, deterministic)
+}
+func (m *MethodDescriptorProto) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_MethodDescriptorProto.Merge(m, src)
+}
+func (m *MethodDescriptorProto) XXX_Size() int {
+        return xxx_messageInfo_MethodDescriptorProto.Size(m)
+}
+func (m *MethodDescriptorProto) XXX_DiscardUnknown() {
+        xxx_messageInfo_MethodDescriptorProto.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_MethodDescriptorProto proto.InternalMessageInfo
+
+const Default_MethodDescriptorProto_ClientStreaming bool = false
+const Default_MethodDescriptorProto_ServerStreaming bool = false
+
+func (m *MethodDescriptorProto) GetName() string {
+        if m != nil && m.Name != nil {
+                return *m.Name
+        }
+        return ""
+}
+
+func (m *MethodDescriptorProto) GetInputType() string {
+        if m != nil && m.InputType != nil {
+                return *m.InputType
+        }
+        return ""
+}
+
+func (m *MethodDescriptorProto) GetOutputType() string {
+        if m != nil && m.OutputType != nil {
+                return *m.OutputType
+        }
+        return ""
+}
+
+func (m *MethodDescriptorProto) GetOptions() *MethodOptions {
+        if m != nil {
+                return m.Options
+        }
+        return nil
+}
+
+func (m *MethodDescriptorProto) GetClientStreaming() bool {
+        if m != nil && m.ClientStreaming != nil {
+                return *m.ClientStreaming
+        }
+        return Default_MethodDescriptorProto_ClientStreaming
+}
+
+func (m *MethodDescriptorProto) GetServerStreaming() bool {
+        if m != nil && m.ServerStreaming != nil {
+                return *m.ServerStreaming
+        }
+        return Default_MethodDescriptorProto_ServerStreaming
+}
+
+type FileOptions struct {
+        // Sets the Java package where classes generated from this .proto will be
+        // placed.  By default, the proto package is used, but this is often
+        // inappropriate because proto packages do not normally start with backwards
+        // domain names.
+        JavaPackage *string `protobuf:"bytes,1,opt,name=java_package,json=javaPackage" json:"java_package,omitempty"`
+        // If set, all the classes from the .proto file are wrapped in a single
+        // outer class with the given name.  This applies to both Proto1
+        // (equivalent to the old "--one_java_file" option) and Proto2 (where
+        // a .proto always translates to a single class, but you may want to
+        // explicitly choose the class name).
+        JavaOuterClassname *string `protobuf:"bytes,8,opt,name=java_outer_classname,json=javaOuterClassname" json:"java_outer_classname,omitempty"`
+        // If set true, then the Java code generator will generate a separate .java
+        // file for each top-level message, enum, and service defined in the .proto
+        // file.  Thus, these types will *not* be nested inside the outer class
+        // named by java_outer_classname.  However, the outer class will still be
+        // generated to contain the file's getDescriptor() method as well as any
+        // top-level extensions defined in the file.
+        JavaMultipleFiles *bool `protobuf:"varint,10,opt,name=java_multiple_files,json=javaMultipleFiles,def=0" json:"java_multiple_files,omitempty"`
+        // This option does nothing.
+        JavaGenerateEqualsAndHash *bool `protobuf:"varint,20,opt,name=java_generate_equals_and_hash,json=javaGenerateEqualsAndHash" json:"java_generate_equals_and_hash,omitempty"` // Deprecated: Do not use.
+        // If set true, then the Java2 code generator will generate code that
+        // throws an exception whenever an attempt is made to assign a non-UTF-8
+        // byte sequence to a string field.
+        // Message reflection will do the same.
+        // However, an extension field still accepts non-UTF-8 byte sequences.
+        // This option has no effect on when used with the lite runtime.
+        JavaStringCheckUtf8 *bool                     `protobuf:"varint,27,opt,name=java_string_check_utf8,json=javaStringCheckUtf8,def=0" json:"java_string_check_utf8,omitempty"`
+        OptimizeFor         *FileOptions_OptimizeMode `protobuf:"varint,9,opt,name=optimize_for,json=optimizeFor,enum=google.protobuf.FileOptions_OptimizeMode,def=1" json:"optimize_for,omitempty"`
+        // Sets the Go package where structs generated from this .proto will be
+        // placed. If omitted, the Go package will be derived from the following:
+        //   - The basename of the package import path, if provided.
+        //   - Otherwise, the package statement in the .proto file, if present.
+        //   - Otherwise, the basename of the .proto file, without extension.
+        GoPackage *string `protobuf:"bytes,11,opt,name=go_package,json=goPackage" json:"go_package,omitempty"`
+        // Should generic services be generated in each language?  "Generic" services
+        // are not specific to any particular RPC system.  They are generated by the
+        // main code generators in each language (without additional plugins).
+        // Generic services were the only kind of service generation supported by
+        // early versions of google.protobuf.
+        //
+        // Generic services are now considered deprecated in favor of using plugins
+        // that generate code specific to your particular RPC system.  Therefore,
+        // these default to false.  Old code which depends on generic services should
+        // explicitly set them to true.
+        CcGenericServices   *bool `protobuf:"varint,16,opt,name=cc_generic_services,json=ccGenericServices,def=0" json:"cc_generic_services,omitempty"`
+        JavaGenericServices *bool `protobuf:"varint,17,opt,name=java_generic_services,json=javaGenericServices,def=0" json:"java_generic_services,omitempty"`
+        PyGenericServices   *bool `protobuf:"varint,18,opt,name=py_generic_services,json=pyGenericServices,def=0" json:"py_generic_services,omitempty"`
+        PhpGenericServices  *bool `protobuf:"varint,42,opt,name=php_generic_services,json=phpGenericServices,def=0" json:"php_generic_services,omitempty"`
+        // Is this file deprecated?
+        // Depending on the target platform, this can emit Deprecated annotations
+        // for everything in the file, or it will be completely ignored; in the very
+        // least, this is a formalization for deprecating files.
+        Deprecated *bool `protobuf:"varint,23,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+        // Enables the use of arenas for the proto messages in this file. This applies
+        // only to generated classes for C++.
+        CcEnableArenas *bool `protobuf:"varint,31,opt,name=cc_enable_arenas,json=ccEnableArenas,def=0" json:"cc_enable_arenas,omitempty"`
+        // Sets the objective c class prefix which is prepended to all objective c
+        // generated classes from this .proto. There is no default.
+        ObjcClassPrefix *string `protobuf:"bytes,36,opt,name=objc_class_prefix,json=objcClassPrefix" json:"objc_class_prefix,omitempty"`
+        // Namespace for generated classes; defaults to the package.
+        CsharpNamespace *string `protobuf:"bytes,37,opt,name=csharp_namespace,json=csharpNamespace" json:"csharp_namespace,omitempty"`
+        // By default Swift generators will take the proto package and CamelCase it
+        // replacing '.' with underscore and use that to prefix the types/symbols
+        // defined. When this options is provided, they will use this value instead
+        // to prefix the types/symbols defined.
+        SwiftPrefix *string `protobuf:"bytes,39,opt,name=swift_prefix,json=swiftPrefix" json:"swift_prefix,omitempty"`
+        // Sets the php class prefix which is prepended to all php generated classes
+        // from this .proto. Default is empty.
+        PhpClassPrefix *string `protobuf:"bytes,40,opt,name=php_class_prefix,json=phpClassPrefix" json:"php_class_prefix,omitempty"`
+        // Use this option to change the namespace of php generated classes. Default
+        // is empty. When this option is empty, the package name will be used for
+        // determining the namespace.
+        PhpNamespace *string `protobuf:"bytes,41,opt,name=php_namespace,json=phpNamespace" json:"php_namespace,omitempty"`
+        // Use this option to change the namespace of php generated metadata classes.
+        // Default is empty. When this option is empty, the proto file name will be used
+        // for determining the namespace.
+        PhpMetadataNamespace *string `protobuf:"bytes,44,opt,name=php_metadata_namespace,json=phpMetadataNamespace" json:"php_metadata_namespace,omitempty"`
+        // Use this option to change the package of ruby generated classes. Default
+        // is empty. When this option is not set, the package name will be used for
+        // determining the ruby package.
+        RubyPackage *string `protobuf:"bytes,45,opt,name=ruby_package,json=rubyPackage" json:"ruby_package,omitempty"`
+        // The parser stores options it doesn't recognize here.
+        // See the documentation for the "Options" section above.
+        UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
+        XXX_NoUnkeyedLiteral         struct{}               `json:"-"`
+        proto.XXX_InternalExtensions `json:"-"`
+        XXX_unrecognized             []byte `json:"-"`
+        XXX_sizecache                int32  `json:"-"`
+}
+
+func (m *FileOptions) Reset()         { *m = FileOptions{} }
+func (m *FileOptions) String() string { return proto.CompactTextString(m) }
+func (*FileOptions) ProtoMessage()    {}
+func (*FileOptions) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{10}
+}
+
+var extRange_FileOptions = []proto.ExtensionRange{
+        {Start: 1000, End: 536870911},
+}
+
+func (*FileOptions) ExtensionRangeArray() []proto.ExtensionRange {
+        return extRange_FileOptions
+}
+
+func (m *FileOptions) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_FileOptions.Unmarshal(m, b)
+}
+func (m *FileOptions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_FileOptions.Marshal(b, m, deterministic)
+}
+func (m *FileOptions) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_FileOptions.Merge(m, src)
+}
+func (m *FileOptions) XXX_Size() int {
+        return xxx_messageInfo_FileOptions.Size(m)
+}
+func (m *FileOptions) XXX_DiscardUnknown() {
+        xxx_messageInfo_FileOptions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FileOptions proto.InternalMessageInfo
+
+const Default_FileOptions_JavaMultipleFiles bool = false
+const Default_FileOptions_JavaStringCheckUtf8 bool = false
+const Default_FileOptions_OptimizeFor FileOptions_OptimizeMode = FileOptions_SPEED
+const Default_FileOptions_CcGenericServices bool = false
+const Default_FileOptions_JavaGenericServices bool = false
+const Default_FileOptions_PyGenericServices bool = false
+const Default_FileOptions_PhpGenericServices bool = false
+const Default_FileOptions_Deprecated bool = false
+const Default_FileOptions_CcEnableArenas bool = false
+
+func (m *FileOptions) GetJavaPackage() string {
+        if m != nil && m.JavaPackage != nil {
+                return *m.JavaPackage
+        }
+        return ""
+}
+
+func (m *FileOptions) GetJavaOuterClassname() string {
+        if m != nil && m.JavaOuterClassname != nil {
+                return *m.JavaOuterClassname
+        }
+        return ""
+}
+
+func (m *FileOptions) GetJavaMultipleFiles() bool {
+        if m != nil && m.JavaMultipleFiles != nil {
+                return *m.JavaMultipleFiles
+        }
+        return Default_FileOptions_JavaMultipleFiles
+}
+
+// Deprecated: Do not use.
+func (m *FileOptions) GetJavaGenerateEqualsAndHash() bool {
+        if m != nil && m.JavaGenerateEqualsAndHash != nil {
+                return *m.JavaGenerateEqualsAndHash
+        }
+        return false
+}
+
+func (m *FileOptions) GetJavaStringCheckUtf8() bool {
+        if m != nil && m.JavaStringCheckUtf8 != nil {
+                return *m.JavaStringCheckUtf8
+        }
+        return Default_FileOptions_JavaStringCheckUtf8
+}
+
+func (m *FileOptions) GetOptimizeFor() FileOptions_OptimizeMode {
+        if m != nil && m.OptimizeFor != nil {
+                return *m.OptimizeFor
+        }
+        return Default_FileOptions_OptimizeFor
+}
+
+func (m *FileOptions) GetGoPackage() string {
+        if m != nil && m.GoPackage != nil {
+                return *m.GoPackage
+        }
+        return ""
+}
+
+func (m *FileOptions) GetCcGenericServices() bool {
+        if m != nil && m.CcGenericServices != nil {
+                return *m.CcGenericServices
+        }
+        return Default_FileOptions_CcGenericServices
+}
+
+func (m *FileOptions) GetJavaGenericServices() bool {
+        if m != nil && m.JavaGenericServices != nil {
+                return *m.JavaGenericServices
+        }
+        return Default_FileOptions_JavaGenericServices
+}
+
+func (m *FileOptions) GetPyGenericServices() bool {
+        if m != nil && m.PyGenericServices != nil {
+                return *m.PyGenericServices
+        }
+        return Default_FileOptions_PyGenericServices
+}
+
+func (m *FileOptions) GetPhpGenericServices() bool {
+        if m != nil && m.PhpGenericServices != nil {
+                return *m.PhpGenericServices
+        }
+        return Default_FileOptions_PhpGenericServices
+}
+
+func (m *FileOptions) GetDeprecated() bool {
+        if m != nil && m.Deprecated != nil {
+                return *m.Deprecated
+        }
+        return Default_FileOptions_Deprecated
+}
+
+func (m *FileOptions) GetCcEnableArenas() bool {
+        if m != nil && m.CcEnableArenas != nil {
+                return *m.CcEnableArenas
+        }
+        return Default_FileOptions_CcEnableArenas
+}
+
+func (m *FileOptions) GetObjcClassPrefix() string {
+        if m != nil && m.ObjcClassPrefix != nil {
+                return *m.ObjcClassPrefix
+        }
+        return ""
+}
+
+func (m *FileOptions) GetCsharpNamespace() string {
+        if m != nil && m.CsharpNamespace != nil {
+                return *m.CsharpNamespace
+        }
+        return ""
+}
+
+func (m *FileOptions) GetSwiftPrefix() string {
+        if m != nil && m.SwiftPrefix != nil {
+                return *m.SwiftPrefix
+        }
+        return ""
+}
+
+func (m *FileOptions) GetPhpClassPrefix() string {
+        if m != nil && m.PhpClassPrefix != nil {
+                return *m.PhpClassPrefix
+        }
+        return ""
+}
+
+func (m *FileOptions) GetPhpNamespace() string {
+        if m != nil && m.PhpNamespace != nil {
+                return *m.PhpNamespace
+        }
+        return ""
+}
+
+func (m *FileOptions) GetPhpMetadataNamespace() string {
+        if m != nil && m.PhpMetadataNamespace != nil {
+                return *m.PhpMetadataNamespace
+        }
+        return ""
+}
+
+func (m *FileOptions) GetRubyPackage() string {
+        if m != nil && m.RubyPackage != nil {
+                return *m.RubyPackage
+        }
+        return ""
+}
+
+func (m *FileOptions) GetUninterpretedOption() []*UninterpretedOption {
+        if m != nil {
+                return m.UninterpretedOption
+        }
+        return nil
+}
+
+type MessageOptions struct {
+        // Set true to use the old proto1 MessageSet wire format for extensions.
+        // This is provided for backwards-compatibility with the MessageSet wire
+        // format.  You should not use this for any other reason:  It's less
+        // efficient, has fewer features, and is more complicated.
+        //
+        // The message must be defined exactly as follows:
+        //   message Foo {
+        //     option message_set_wire_format = true;
+        //     extensions 4 to max;
+        //   }
+        // Note that the message cannot have any defined fields; MessageSets only
+        // have extensions.
+        //
+        // All extensions of your type must be singular messages; e.g. they cannot
+        // be int32s, enums, or repeated messages.
+        //
+        // Because this is an option, the above two restrictions are not enforced by
+        // the protocol compiler.
+        MessageSetWireFormat *bool `protobuf:"varint,1,opt,name=message_set_wire_format,json=messageSetWireFormat,def=0" json:"message_set_wire_format,omitempty"`
+        // Disables the generation of the standard "descriptor()" accessor, which can
+        // conflict with a field of the same name.  This is meant to make migration
+        // from proto1 easier; new code should avoid fields named "descriptor".
+        NoStandardDescriptorAccessor *bool `protobuf:"varint,2,opt,name=no_standard_descriptor_accessor,json=noStandardDescriptorAccessor,def=0" json:"no_standard_descriptor_accessor,omitempty"`
+        // Is this message deprecated?
+        // Depending on the target platform, this can emit Deprecated annotations
+        // for the message, or it will be completely ignored; in the very least,
+        // this is a formalization for deprecating messages.
+        Deprecated *bool `protobuf:"varint,3,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+        // Whether the message is an automatically generated map entry type for the
+        // maps field.
+        //
+        // For maps fields:
+        //     map<KeyType, ValueType> map_field = 1;
+        // The parsed descriptor looks like:
+        //     message MapFieldEntry {
+        //         option map_entry = true;
+        //         optional KeyType key = 1;
+        //         optional ValueType value = 2;
+        //     }
+        //     repeated MapFieldEntry map_field = 1;
+        //
+        // Implementations may choose not to generate the map_entry=true message, but
+        // use a native map in the target language to hold the keys and values.
+        // The reflection APIs in such implementions still need to work as
+        // if the field is a repeated message field.
+        //
+        // NOTE: Do not set the option in .proto files. Always use the maps syntax
+        // instead. The option should only be implicitly set by the proto compiler
+        // parser.
+        MapEntry *bool `protobuf:"varint,7,opt,name=map_entry,json=mapEntry" json:"map_entry,omitempty"`
+        // The parser stores options it doesn't recognize here. See above.
+        UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
+        XXX_NoUnkeyedLiteral         struct{}               `json:"-"`
+        proto.XXX_InternalExtensions `json:"-"`
+        XXX_unrecognized             []byte `json:"-"`
+        XXX_sizecache                int32  `json:"-"`
+}
+
+func (m *MessageOptions) Reset()         { *m = MessageOptions{} }
+func (m *MessageOptions) String() string { return proto.CompactTextString(m) }
+func (*MessageOptions) ProtoMessage()    {}
+func (*MessageOptions) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{11}
+}
+
+var extRange_MessageOptions = []proto.ExtensionRange{
+        {Start: 1000, End: 536870911},
+}
+
+func (*MessageOptions) ExtensionRangeArray() []proto.ExtensionRange {
+        return extRange_MessageOptions
+}
+
+func (m *MessageOptions) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_MessageOptions.Unmarshal(m, b)
+}
+func (m *MessageOptions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_MessageOptions.Marshal(b, m, deterministic)
+}
+func (m *MessageOptions) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_MessageOptions.Merge(m, src)
+}
+func (m *MessageOptions) XXX_Size() int {
+        return xxx_messageInfo_MessageOptions.Size(m)
+}
+func (m *MessageOptions) XXX_DiscardUnknown() {
+        xxx_messageInfo_MessageOptions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_MessageOptions proto.InternalMessageInfo
+
+const Default_MessageOptions_MessageSetWireFormat bool = false
+const Default_MessageOptions_NoStandardDescriptorAccessor bool = false
+const Default_MessageOptions_Deprecated bool = false
+
+func (m *MessageOptions) GetMessageSetWireFormat() bool {
+        if m != nil && m.MessageSetWireFormat != nil {
+                return *m.MessageSetWireFormat
+        }
+        return Default_MessageOptions_MessageSetWireFormat
+}
+
+func (m *MessageOptions) GetNoStandardDescriptorAccessor() bool {
+        if m != nil && m.NoStandardDescriptorAccessor != nil {
+                return *m.NoStandardDescriptorAccessor
+        }
+        return Default_MessageOptions_NoStandardDescriptorAccessor
+}
+
+func (m *MessageOptions) GetDeprecated() bool {
+        if m != nil && m.Deprecated != nil {
+                return *m.Deprecated
+        }
+        return Default_MessageOptions_Deprecated
+}
+
+func (m *MessageOptions) GetMapEntry() bool {
+        if m != nil && m.MapEntry != nil {
+                return *m.MapEntry
+        }
+        return false
+}
+
+func (m *MessageOptions) GetUninterpretedOption() []*UninterpretedOption {
+        if m != nil {
+                return m.UninterpretedOption
+        }
+        return nil
+}
+
+type FieldOptions struct {
+        // The ctype option instructs the C++ code generator to use a different
+        // representation of the field than it normally would.  See the specific
+        // options below.  This option is not yet implemented in the open source
+        // release -- sorry, we'll try to include it in a future version!
+        Ctype *FieldOptions_CType `protobuf:"varint,1,opt,name=ctype,enum=google.protobuf.FieldOptions_CType,def=0" json:"ctype,omitempty"`
+        // The packed option can be enabled for repeated primitive fields to enable
+        // a more efficient representation on the wire. Rather than repeatedly
+        // writing the tag and type for each element, the entire array is encoded as
+        // a single length-delimited blob. In proto3, only explicit setting it to
+        // false will avoid using packed encoding.
+        Packed *bool `protobuf:"varint,2,opt,name=packed" json:"packed,omitempty"`
+        // The jstype option determines the JavaScript type used for values of the
+        // field.  The option is permitted only for 64 bit integral and fixed types
+        // (int64, uint64, sint64, fixed64, sfixed64).  A field with jstype JS_STRING
+        // is represented as JavaScript string, which avoids loss of precision that
+        // can happen when a large value is converted to a floating point JavaScript.
+        // Specifying JS_NUMBER for the jstype causes the generated JavaScript code to
+        // use the JavaScript "number" type.  The behavior of the default option
+        // JS_NORMAL is implementation dependent.
+        //
+        // This option is an enum to permit additional types to be added, e.g.
+        // goog.math.Integer.
+        Jstype *FieldOptions_JSType `protobuf:"varint,6,opt,name=jstype,enum=google.protobuf.FieldOptions_JSType,def=0" json:"jstype,omitempty"`
+        // Should this field be parsed lazily?  Lazy applies only to message-type
+        // fields.  It means that when the outer message is initially parsed, the
+        // inner message's contents will not be parsed but instead stored in encoded
+        // form.  The inner message will actually be parsed when it is first accessed.
+        //
+        // This is only a hint.  Implementations are free to choose whether to use
+        // eager or lazy parsing regardless of the value of this option.  However,
+        // setting this option true suggests that the protocol author believes that
+        // using lazy parsing on this field is worth the additional bookkeeping
+        // overhead typically needed to implement it.
+        //
+        // This option does not affect the public interface of any generated code;
+        // all method signatures remain the same.  Furthermore, thread-safety of the
+        // interface is not affected by this option; const methods remain safe to
+        // call from multiple threads concurrently, while non-const methods continue
+        // to require exclusive access.
+        //
+        //
+        // Note that implementations may choose not to check required fields within
+        // a lazy sub-message.  That is, calling IsInitialized() on the outer message
+        // may return true even if the inner message has missing required fields.
+        // This is necessary because otherwise the inner message would have to be
+        // parsed in order to perform the check, defeating the purpose of lazy
+        // parsing.  An implementation which chooses not to check required fields
+        // must be consistent about it.  That is, for any particular sub-message, the
+        // implementation must either *always* check its required fields, or *never*
+        // check its required fields, regardless of whether or not the message has
+        // been parsed.
+        Lazy *bool `protobuf:"varint,5,opt,name=lazy,def=0" json:"lazy,omitempty"`
+        // Is this field deprecated?
+        // Depending on the target platform, this can emit Deprecated annotations
+        // for accessors, or it will be completely ignored; in the very least, this
+        // is a formalization for deprecating fields.
+        Deprecated *bool `protobuf:"varint,3,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+        // For Google-internal migration only. Do not use.
+        Weak *bool `protobuf:"varint,10,opt,name=weak,def=0" json:"weak,omitempty"`
+        // The parser stores options it doesn't recognize here. See above.
+        UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
+        XXX_NoUnkeyedLiteral         struct{}               `json:"-"`
+        proto.XXX_InternalExtensions `json:"-"`
+        XXX_unrecognized             []byte `json:"-"`
+        XXX_sizecache                int32  `json:"-"`
+}
+
+func (m *FieldOptions) Reset()         { *m = FieldOptions{} }
+func (m *FieldOptions) String() string { return proto.CompactTextString(m) }
+func (*FieldOptions) ProtoMessage()    {}
+func (*FieldOptions) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{12}
+}
+
+var extRange_FieldOptions = []proto.ExtensionRange{
+        {Start: 1000, End: 536870911},
+}
+
+func (*FieldOptions) ExtensionRangeArray() []proto.ExtensionRange {
+        return extRange_FieldOptions
+}
+
+func (m *FieldOptions) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_FieldOptions.Unmarshal(m, b)
+}
+func (m *FieldOptions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_FieldOptions.Marshal(b, m, deterministic)
+}
+func (m *FieldOptions) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_FieldOptions.Merge(m, src)
+}
+func (m *FieldOptions) XXX_Size() int {
+        return xxx_messageInfo_FieldOptions.Size(m)
+}
+func (m *FieldOptions) XXX_DiscardUnknown() {
+        xxx_messageInfo_FieldOptions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_FieldOptions proto.InternalMessageInfo
+
+const Default_FieldOptions_Ctype FieldOptions_CType = FieldOptions_STRING
+const Default_FieldOptions_Jstype FieldOptions_JSType = FieldOptions_JS_NORMAL
+const Default_FieldOptions_Lazy bool = false
+const Default_FieldOptions_Deprecated bool = false
+const Default_FieldOptions_Weak bool = false
+
+func (m *FieldOptions) GetCtype() FieldOptions_CType {
+        if m != nil && m.Ctype != nil {
+                return *m.Ctype
+        }
+        return Default_FieldOptions_Ctype
+}
+
+func (m *FieldOptions) GetPacked() bool {
+        if m != nil && m.Packed != nil {
+                return *m.Packed
+        }
+        return false
+}
+
+func (m *FieldOptions) GetJstype() FieldOptions_JSType {
+        if m != nil && m.Jstype != nil {
+                return *m.Jstype
+        }
+        return Default_FieldOptions_Jstype
+}
+
+func (m *FieldOptions) GetLazy() bool {
+        if m != nil && m.Lazy != nil {
+                return *m.Lazy
+        }
+        return Default_FieldOptions_Lazy
+}
+
+func (m *FieldOptions) GetDeprecated() bool {
+        if m != nil && m.Deprecated != nil {
+                return *m.Deprecated
+        }
+        return Default_FieldOptions_Deprecated
+}
+
+func (m *FieldOptions) GetWeak() bool {
+        if m != nil && m.Weak != nil {
+                return *m.Weak
+        }
+        return Default_FieldOptions_Weak
+}
+
+func (m *FieldOptions) GetUninterpretedOption() []*UninterpretedOption {
+        if m != nil {
+                return m.UninterpretedOption
+        }
+        return nil
+}
+
+type OneofOptions struct {
+        // The parser stores options it doesn't recognize here. See above.
+        UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
+        XXX_NoUnkeyedLiteral         struct{}               `json:"-"`
+        proto.XXX_InternalExtensions `json:"-"`
+        XXX_unrecognized             []byte `json:"-"`
+        XXX_sizecache                int32  `json:"-"`
+}
+
+func (m *OneofOptions) Reset()         { *m = OneofOptions{} }
+func (m *OneofOptions) String() string { return proto.CompactTextString(m) }
+func (*OneofOptions) ProtoMessage()    {}
+func (*OneofOptions) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{13}
+}
+
+var extRange_OneofOptions = []proto.ExtensionRange{
+        {Start: 1000, End: 536870911},
+}
+
+func (*OneofOptions) ExtensionRangeArray() []proto.ExtensionRange {
+        return extRange_OneofOptions
+}
+
+func (m *OneofOptions) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_OneofOptions.Unmarshal(m, b)
+}
+func (m *OneofOptions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_OneofOptions.Marshal(b, m, deterministic)
+}
+func (m *OneofOptions) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_OneofOptions.Merge(m, src)
+}
+func (m *OneofOptions) XXX_Size() int {
+        return xxx_messageInfo_OneofOptions.Size(m)
+}
+func (m *OneofOptions) XXX_DiscardUnknown() {
+        xxx_messageInfo_OneofOptions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_OneofOptions proto.InternalMessageInfo
+
+func (m *OneofOptions) GetUninterpretedOption() []*UninterpretedOption {
+        if m != nil {
+                return m.UninterpretedOption
+        }
+        return nil
+}
+
+type EnumOptions struct {
+        // Set this option to true to allow mapping different tag names to the same
+        // value.
+        AllowAlias *bool `protobuf:"varint,2,opt,name=allow_alias,json=allowAlias" json:"allow_alias,omitempty"`
+        // Is this enum deprecated?
+        // Depending on the target platform, this can emit Deprecated annotations
+        // for the enum, or it will be completely ignored; in the very least, this
+        // is a formalization for deprecating enums.
+        Deprecated *bool `protobuf:"varint,3,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+        // The parser stores options it doesn't recognize here. See above.
+        UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
+        XXX_NoUnkeyedLiteral         struct{}               `json:"-"`
+        proto.XXX_InternalExtensions `json:"-"`
+        XXX_unrecognized             []byte `json:"-"`
+        XXX_sizecache                int32  `json:"-"`
+}
+
+func (m *EnumOptions) Reset()         { *m = EnumOptions{} }
+func (m *EnumOptions) String() string { return proto.CompactTextString(m) }
+func (*EnumOptions) ProtoMessage()    {}
+func (*EnumOptions) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{14}
+}
+
+var extRange_EnumOptions = []proto.ExtensionRange{
+        {Start: 1000, End: 536870911},
+}
+
+func (*EnumOptions) ExtensionRangeArray() []proto.ExtensionRange {
+        return extRange_EnumOptions
+}
+
+func (m *EnumOptions) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_EnumOptions.Unmarshal(m, b)
+}
+func (m *EnumOptions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_EnumOptions.Marshal(b, m, deterministic)
+}
+func (m *EnumOptions) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_EnumOptions.Merge(m, src)
+}
+func (m *EnumOptions) XXX_Size() int {
+        return xxx_messageInfo_EnumOptions.Size(m)
+}
+func (m *EnumOptions) XXX_DiscardUnknown() {
+        xxx_messageInfo_EnumOptions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_EnumOptions proto.InternalMessageInfo
+
+const Default_EnumOptions_Deprecated bool = false
+
+func (m *EnumOptions) GetAllowAlias() bool {
+        if m != nil && m.AllowAlias != nil {
+                return *m.AllowAlias
+        }
+        return false
+}
+
+func (m *EnumOptions) GetDeprecated() bool {
+        if m != nil && m.Deprecated != nil {
+                return *m.Deprecated
+        }
+        return Default_EnumOptions_Deprecated
+}
+
+func (m *EnumOptions) GetUninterpretedOption() []*UninterpretedOption {
+        if m != nil {
+                return m.UninterpretedOption
+        }
+        return nil
+}
+
+type EnumValueOptions struct {
+        // Is this enum value deprecated?
+        // Depending on the target platform, this can emit Deprecated annotations
+        // for the enum value, or it will be completely ignored; in the very least,
+        // this is a formalization for deprecating enum values.
+        Deprecated *bool `protobuf:"varint,1,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+        // The parser stores options it doesn't recognize here. See above.
+        UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
+        XXX_NoUnkeyedLiteral         struct{}               `json:"-"`
+        proto.XXX_InternalExtensions `json:"-"`
+        XXX_unrecognized             []byte `json:"-"`
+        XXX_sizecache                int32  `json:"-"`
+}
+
+func (m *EnumValueOptions) Reset()         { *m = EnumValueOptions{} }
+func (m *EnumValueOptions) String() string { return proto.CompactTextString(m) }
+func (*EnumValueOptions) ProtoMessage()    {}
+func (*EnumValueOptions) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{15}
+}
+
+var extRange_EnumValueOptions = []proto.ExtensionRange{
+        {Start: 1000, End: 536870911},
+}
+
+func (*EnumValueOptions) ExtensionRangeArray() []proto.ExtensionRange {
+        return extRange_EnumValueOptions
+}
+
+func (m *EnumValueOptions) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_EnumValueOptions.Unmarshal(m, b)
+}
+func (m *EnumValueOptions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_EnumValueOptions.Marshal(b, m, deterministic)
+}
+func (m *EnumValueOptions) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_EnumValueOptions.Merge(m, src)
+}
+func (m *EnumValueOptions) XXX_Size() int {
+        return xxx_messageInfo_EnumValueOptions.Size(m)
+}
+func (m *EnumValueOptions) XXX_DiscardUnknown() {
+        xxx_messageInfo_EnumValueOptions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_EnumValueOptions proto.InternalMessageInfo
+
+const Default_EnumValueOptions_Deprecated bool = false
+
+func (m *EnumValueOptions) GetDeprecated() bool {
+        if m != nil && m.Deprecated != nil {
+                return *m.Deprecated
+        }
+        return Default_EnumValueOptions_Deprecated
+}
+
+func (m *EnumValueOptions) GetUninterpretedOption() []*UninterpretedOption {
+        if m != nil {
+                return m.UninterpretedOption
+        }
+        return nil
+}
+
+type ServiceOptions struct {
+        // Is this service deprecated?
+        // Depending on the target platform, this can emit Deprecated annotations
+        // for the service, or it will be completely ignored; in the very least,
+        // this is a formalization for deprecating services.
+        Deprecated *bool `protobuf:"varint,33,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+        // The parser stores options it doesn't recognize here. See above.
+        UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
+        XXX_NoUnkeyedLiteral         struct{}               `json:"-"`
+        proto.XXX_InternalExtensions `json:"-"`
+        XXX_unrecognized             []byte `json:"-"`
+        XXX_sizecache                int32  `json:"-"`
+}
+
+func (m *ServiceOptions) Reset()         { *m = ServiceOptions{} }
+func (m *ServiceOptions) String() string { return proto.CompactTextString(m) }
+func (*ServiceOptions) ProtoMessage()    {}
+func (*ServiceOptions) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{16}
+}
+
+var extRange_ServiceOptions = []proto.ExtensionRange{
+        {Start: 1000, End: 536870911},
+}
+
+func (*ServiceOptions) ExtensionRangeArray() []proto.ExtensionRange {
+        return extRange_ServiceOptions
+}
+
+func (m *ServiceOptions) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ServiceOptions.Unmarshal(m, b)
+}
+func (m *ServiceOptions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ServiceOptions.Marshal(b, m, deterministic)
+}
+func (m *ServiceOptions) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ServiceOptions.Merge(m, src)
+}
+func (m *ServiceOptions) XXX_Size() int {
+        return xxx_messageInfo_ServiceOptions.Size(m)
+}
+func (m *ServiceOptions) XXX_DiscardUnknown() {
+        xxx_messageInfo_ServiceOptions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ServiceOptions proto.InternalMessageInfo
+
+const Default_ServiceOptions_Deprecated bool = false
+
+func (m *ServiceOptions) GetDeprecated() bool {
+        if m != nil && m.Deprecated != nil {
+                return *m.Deprecated
+        }
+        return Default_ServiceOptions_Deprecated
+}
+
+func (m *ServiceOptions) GetUninterpretedOption() []*UninterpretedOption {
+        if m != nil {
+                return m.UninterpretedOption
+        }
+        return nil
+}
+
+type MethodOptions struct {
+        // Is this method deprecated?
+        // Depending on the target platform, this can emit Deprecated annotations
+        // for the method, or it will be completely ignored; in the very least,
+        // this is a formalization for deprecating methods.
+        Deprecated       *bool                           `protobuf:"varint,33,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+        IdempotencyLevel *MethodOptions_IdempotencyLevel `protobuf:"varint,34,opt,name=idempotency_level,json=idempotencyLevel,enum=google.protobuf.MethodOptions_IdempotencyLevel,def=0" json:"idempotency_level,omitempty"`
+        // The parser stores options it doesn't recognize here. See above.
+        UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
+        XXX_NoUnkeyedLiteral         struct{}               `json:"-"`
+        proto.XXX_InternalExtensions `json:"-"`
+        XXX_unrecognized             []byte `json:"-"`
+        XXX_sizecache                int32  `json:"-"`
+}
+
+func (m *MethodOptions) Reset()         { *m = MethodOptions{} }
+func (m *MethodOptions) String() string { return proto.CompactTextString(m) }
+func (*MethodOptions) ProtoMessage()    {}
+func (*MethodOptions) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{17}
+}
+
+var extRange_MethodOptions = []proto.ExtensionRange{
+        {Start: 1000, End: 536870911},
+}
+
+func (*MethodOptions) ExtensionRangeArray() []proto.ExtensionRange {
+        return extRange_MethodOptions
+}
+
+func (m *MethodOptions) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_MethodOptions.Unmarshal(m, b)
+}
+func (m *MethodOptions) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_MethodOptions.Marshal(b, m, deterministic)
+}
+func (m *MethodOptions) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_MethodOptions.Merge(m, src)
+}
+func (m *MethodOptions) XXX_Size() int {
+        return xxx_messageInfo_MethodOptions.Size(m)
+}
+func (m *MethodOptions) XXX_DiscardUnknown() {
+        xxx_messageInfo_MethodOptions.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_MethodOptions proto.InternalMessageInfo
+
+const Default_MethodOptions_Deprecated bool = false
+const Default_MethodOptions_IdempotencyLevel MethodOptions_IdempotencyLevel = MethodOptions_IDEMPOTENCY_UNKNOWN
+
+func (m *MethodOptions) GetDeprecated() bool {
+        if m != nil && m.Deprecated != nil {
+                return *m.Deprecated
+        }
+        return Default_MethodOptions_Deprecated
+}
+
+func (m *MethodOptions) GetIdempotencyLevel() MethodOptions_IdempotencyLevel {
+        if m != nil && m.IdempotencyLevel != nil {
+                return *m.IdempotencyLevel
+        }
+        return Default_MethodOptions_IdempotencyLevel
+}
+
+func (m *MethodOptions) GetUninterpretedOption() []*UninterpretedOption {
+        if m != nil {
+                return m.UninterpretedOption
+        }
+        return nil
+}
+
+// A message representing a option the parser does not recognize. This only
+// appears in options protos created by the compiler::Parser class.
+// DescriptorPool resolves these when building Descriptor objects. Therefore,
+// options protos in descriptor objects (e.g. returned by Descriptor::options(),
+// or produced by Descriptor::CopyTo()) will never have UninterpretedOptions
+// in them.
+type UninterpretedOption struct {
+        Name []*UninterpretedOption_NamePart `protobuf:"bytes,2,rep,name=name" json:"name,omitempty"`
+        // The value of the uninterpreted option, in whatever type the tokenizer
+        // identified it as during parsing. Exactly one of these should be set.
+        IdentifierValue      *string  `protobuf:"bytes,3,opt,name=identifier_value,json=identifierValue" json:"identifier_value,omitempty"`
+        PositiveIntValue     *uint64  `protobuf:"varint,4,opt,name=positive_int_value,json=positiveIntValue" json:"positive_int_value,omitempty"`
+        NegativeIntValue     *int64   `protobuf:"varint,5,opt,name=negative_int_value,json=negativeIntValue" json:"negative_int_value,omitempty"`
+        DoubleValue          *float64 `protobuf:"fixed64,6,opt,name=double_value,json=doubleValue" json:"double_value,omitempty"`
+        StringValue          []byte   `protobuf:"bytes,7,opt,name=string_value,json=stringValue" json:"string_value,omitempty"`
+        AggregateValue       *string  `protobuf:"bytes,8,opt,name=aggregate_value,json=aggregateValue" json:"aggregate_value,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *UninterpretedOption) Reset()         { *m = UninterpretedOption{} }
+func (m *UninterpretedOption) String() string { return proto.CompactTextString(m) }
+func (*UninterpretedOption) ProtoMessage()    {}
+func (*UninterpretedOption) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{18}
+}
+
+func (m *UninterpretedOption) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UninterpretedOption.Unmarshal(m, b)
+}
+func (m *UninterpretedOption) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UninterpretedOption.Marshal(b, m, deterministic)
+}
+func (m *UninterpretedOption) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UninterpretedOption.Merge(m, src)
+}
+func (m *UninterpretedOption) XXX_Size() int {
+        return xxx_messageInfo_UninterpretedOption.Size(m)
+}
+func (m *UninterpretedOption) XXX_DiscardUnknown() {
+        xxx_messageInfo_UninterpretedOption.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UninterpretedOption proto.InternalMessageInfo
+
+func (m *UninterpretedOption) GetName() []*UninterpretedOption_NamePart {
+        if m != nil {
+                return m.Name
+        }
+        return nil
+}
+
+func (m *UninterpretedOption) GetIdentifierValue() string {
+        if m != nil && m.IdentifierValue != nil {
+                return *m.IdentifierValue
+        }
+        return ""
+}
+
+func (m *UninterpretedOption) GetPositiveIntValue() uint64 {
+        if m != nil && m.PositiveIntValue != nil {
+                return *m.PositiveIntValue
+        }
+        return 0
+}
+
+func (m *UninterpretedOption) GetNegativeIntValue() int64 {
+        if m != nil && m.NegativeIntValue != nil {
+                return *m.NegativeIntValue
+        }
+        return 0
+}
+
+func (m *UninterpretedOption) GetDoubleValue() float64 {
+        if m != nil && m.DoubleValue != nil {
+                return *m.DoubleValue
+        }
+        return 0
+}
+
+func (m *UninterpretedOption) GetStringValue() []byte {
+        if m != nil {
+                return m.StringValue
+        }
+        return nil
+}
+
+func (m *UninterpretedOption) GetAggregateValue() string {
+        if m != nil && m.AggregateValue != nil {
+                return *m.AggregateValue
+        }
+        return ""
+}
+
+// The name of the uninterpreted option.  Each string represents a segment in
+// a dot-separated name.  is_extension is true iff a segment represents an
+// extension (denoted with parentheses in options specs in .proto files).
+// E.g.,{ ["foo", false], ["bar.baz", true], ["qux", false] } represents
+// "foo.(bar.baz).qux".
+type UninterpretedOption_NamePart struct {
+        NamePart             *string  `protobuf:"bytes,1,req,name=name_part,json=namePart" json:"name_part,omitempty"`
+        IsExtension          *bool    `protobuf:"varint,2,req,name=is_extension,json=isExtension" json:"is_extension,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *UninterpretedOption_NamePart) Reset()         { *m = UninterpretedOption_NamePart{} }
+func (m *UninterpretedOption_NamePart) String() string { return proto.CompactTextString(m) }
+func (*UninterpretedOption_NamePart) ProtoMessage()    {}
+func (*UninterpretedOption_NamePart) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{18, 0}
+}
+
+func (m *UninterpretedOption_NamePart) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UninterpretedOption_NamePart.Unmarshal(m, b)
+}
+func (m *UninterpretedOption_NamePart) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UninterpretedOption_NamePart.Marshal(b, m, deterministic)
+}
+func (m *UninterpretedOption_NamePart) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UninterpretedOption_NamePart.Merge(m, src)
+}
+func (m *UninterpretedOption_NamePart) XXX_Size() int {
+        return xxx_messageInfo_UninterpretedOption_NamePart.Size(m)
+}
+func (m *UninterpretedOption_NamePart) XXX_DiscardUnknown() {
+        xxx_messageInfo_UninterpretedOption_NamePart.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UninterpretedOption_NamePart proto.InternalMessageInfo
+
+func (m *UninterpretedOption_NamePart) GetNamePart() string {
+        if m != nil && m.NamePart != nil {
+                return *m.NamePart
+        }
+        return ""
+}
+
+func (m *UninterpretedOption_NamePart) GetIsExtension() bool {
+        if m != nil && m.IsExtension != nil {
+                return *m.IsExtension
+        }
+        return false
+}
+
+// Encapsulates information about the original source file from which a
+// FileDescriptorProto was generated.
+type SourceCodeInfo struct {
+        // A Location identifies a piece of source code in a .proto file which
+        // corresponds to a particular definition.  This information is intended
+        // to be useful to IDEs, code indexers, documentation generators, and similar
+        // tools.
+        //
+        // For example, say we have a file like:
+        //   message Foo {
+        //     optional string foo = 1;
+        //   }
+        // Let's look at just the field definition:
+        //   optional string foo = 1;
+        //   ^       ^^     ^^  ^  ^^^
+        //   a       bc     de  f  ghi
+        // We have the following locations:
+        //   span   path               represents
+        //   [a,i)  [ 4, 0, 2, 0 ]     The whole field definition.
+        //   [a,b)  [ 4, 0, 2, 0, 4 ]  The label (optional).
+        //   [c,d)  [ 4, 0, 2, 0, 5 ]  The type (string).
+        //   [e,f)  [ 4, 0, 2, 0, 1 ]  The name (foo).
+        //   [g,h)  [ 4, 0, 2, 0, 3 ]  The number (1).
+        //
+        // Notes:
+        // - A location may refer to a repeated field itself (i.e. not to any
+        //   particular index within it).  This is used whenever a set of elements are
+        //   logically enclosed in a single code segment.  For example, an entire
+        //   extend block (possibly containing multiple extension definitions) will
+        //   have an outer location whose path refers to the "extensions" repeated
+        //   field without an index.
+        // - Multiple locations may have the same path.  This happens when a single
+        //   logical declaration is spread out across multiple places.  The most
+        //   obvious example is the "extend" block again -- there may be multiple
+        //   extend blocks in the same scope, each of which will have the same path.
+        // - A location's span is not always a subset of its parent's span.  For
+        //   example, the "extendee" of an extension declaration appears at the
+        //   beginning of the "extend" block and is shared by all extensions within
+        //   the block.
+        // - Just because a location's span is a subset of some other location's span
+        //   does not mean that it is a descendent.  For example, a "group" defines
+        //   both a type and a field in a single declaration.  Thus, the locations
+        //   corresponding to the type and field and their components will overlap.
+        // - Code which tries to interpret locations should probably be designed to
+        //   ignore those that it doesn't understand, as more types of locations could
+        //   be recorded in the future.
+        Location             []*SourceCodeInfo_Location `protobuf:"bytes,1,rep,name=location" json:"location,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}                   `json:"-"`
+        XXX_unrecognized     []byte                     `json:"-"`
+        XXX_sizecache        int32                      `json:"-"`
+}
+
+func (m *SourceCodeInfo) Reset()         { *m = SourceCodeInfo{} }
+func (m *SourceCodeInfo) String() string { return proto.CompactTextString(m) }
+func (*SourceCodeInfo) ProtoMessage()    {}
+func (*SourceCodeInfo) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{19}
+}
+
+func (m *SourceCodeInfo) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_SourceCodeInfo.Unmarshal(m, b)
+}
+func (m *SourceCodeInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_SourceCodeInfo.Marshal(b, m, deterministic)
+}
+func (m *SourceCodeInfo) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_SourceCodeInfo.Merge(m, src)
+}
+func (m *SourceCodeInfo) XXX_Size() int {
+        return xxx_messageInfo_SourceCodeInfo.Size(m)
+}
+func (m *SourceCodeInfo) XXX_DiscardUnknown() {
+        xxx_messageInfo_SourceCodeInfo.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_SourceCodeInfo proto.InternalMessageInfo
+
+func (m *SourceCodeInfo) GetLocation() []*SourceCodeInfo_Location {
+        if m != nil {
+                return m.Location
+        }
+        return nil
+}
+
+type SourceCodeInfo_Location struct {
+        // Identifies which part of the FileDescriptorProto was defined at this
+        // location.
+        //
+        // Each element is a field number or an index.  They form a path from
+        // the root FileDescriptorProto to the place where the definition.  For
+        // example, this path:
+        //   [ 4, 3, 2, 7, 1 ]
+        // refers to:
+        //   file.message_type(3)  // 4, 3
+        //       .field(7)         // 2, 7
+        //       .name()           // 1
+        // This is because FileDescriptorProto.message_type has field number 4:
+        //   repeated DescriptorProto message_type = 4;
+        // and DescriptorProto.field has field number 2:
+        //   repeated FieldDescriptorProto field = 2;
+        // and FieldDescriptorProto.name has field number 1:
+        //   optional string name = 1;
+        //
+        // Thus, the above path gives the location of a field name.  If we removed
+        // the last element:
+        //   [ 4, 3, 2, 7 ]
+        // this path refers to the whole field declaration (from the beginning
+        // of the label to the terminating semicolon).
+        Path []int32 `protobuf:"varint,1,rep,packed,name=path" json:"path,omitempty"`
+        // Always has exactly three or four elements: start line, start column,
+        // end line (optional, otherwise assumed same as start line), end column.
+        // These are packed into a single field for efficiency.  Note that line
+        // and column numbers are zero-based -- typically you will want to add
+        // 1 to each before displaying to a user.
+        Span []int32 `protobuf:"varint,2,rep,packed,name=span" json:"span,omitempty"`
+        // If this SourceCodeInfo represents a complete declaration, these are any
+        // comments appearing before and after the declaration which appear to be
+        // attached to the declaration.
+        //
+        // A series of line comments appearing on consecutive lines, with no other
+        // tokens appearing on those lines, will be treated as a single comment.
+        //
+        // leading_detached_comments will keep paragraphs of comments that appear
+        // before (but not connected to) the current element. Each paragraph,
+        // separated by empty lines, will be one comment element in the repeated
+        // field.
+        //
+        // Only the comment content is provided; comment markers (e.g. //) are
+        // stripped out.  For block comments, leading whitespace and an asterisk
+        // will be stripped from the beginning of each line other than the first.
+        // Newlines are included in the output.
+        //
+        // Examples:
+        //
+        //   optional int32 foo = 1;  // Comment attached to foo.
+        //   // Comment attached to bar.
+        //   optional int32 bar = 2;
+        //
+        //   optional string baz = 3;
+        //   // Comment attached to baz.
+        //   // Another line attached to baz.
+        //
+        //   // Comment attached to qux.
+        //   //
+        //   // Another line attached to qux.
+        //   optional double qux = 4;
+        //
+        //   // Detached comment for corge. This is not leading or trailing comments
+        //   // to qux or corge because there are blank lines separating it from
+        //   // both.
+        //
+        //   // Detached comment for corge paragraph 2.
+        //
+        //   optional string corge = 5;
+        //   /* Block comment attached
+        //    * to corge.  Leading asterisks
+        //    * will be removed. */
+        //   /* Block comment attached to
+        //    * grault. */
+        //   optional int32 grault = 6;
+        //
+        //   // ignored detached comments.
+        LeadingComments         *string  `protobuf:"bytes,3,opt,name=leading_comments,json=leadingComments" json:"leading_comments,omitempty"`
+        TrailingComments        *string  `protobuf:"bytes,4,opt,name=trailing_comments,json=trailingComments" json:"trailing_comments,omitempty"`
+        LeadingDetachedComments []string `protobuf:"bytes,6,rep,name=leading_detached_comments,json=leadingDetachedComments" json:"leading_detached_comments,omitempty"`
+        XXX_NoUnkeyedLiteral    struct{} `json:"-"`
+        XXX_unrecognized        []byte   `json:"-"`
+        XXX_sizecache           int32    `json:"-"`
+}
+
+func (m *SourceCodeInfo_Location) Reset()         { *m = SourceCodeInfo_Location{} }
+func (m *SourceCodeInfo_Location) String() string { return proto.CompactTextString(m) }
+func (*SourceCodeInfo_Location) ProtoMessage()    {}
+func (*SourceCodeInfo_Location) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{19, 0}
+}
+
+func (m *SourceCodeInfo_Location) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_SourceCodeInfo_Location.Unmarshal(m, b)
+}
+func (m *SourceCodeInfo_Location) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_SourceCodeInfo_Location.Marshal(b, m, deterministic)
+}
+func (m *SourceCodeInfo_Location) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_SourceCodeInfo_Location.Merge(m, src)
+}
+func (m *SourceCodeInfo_Location) XXX_Size() int {
+        return xxx_messageInfo_SourceCodeInfo_Location.Size(m)
+}
+func (m *SourceCodeInfo_Location) XXX_DiscardUnknown() {
+        xxx_messageInfo_SourceCodeInfo_Location.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_SourceCodeInfo_Location proto.InternalMessageInfo
+
+func (m *SourceCodeInfo_Location) GetPath() []int32 {
+        if m != nil {
+                return m.Path
+        }
+        return nil
+}
+
+func (m *SourceCodeInfo_Location) GetSpan() []int32 {
+        if m != nil {
+                return m.Span
+        }
+        return nil
+}
+
+func (m *SourceCodeInfo_Location) GetLeadingComments() string {
+        if m != nil && m.LeadingComments != nil {
+                return *m.LeadingComments
+        }
+        return ""
+}
+
+func (m *SourceCodeInfo_Location) GetTrailingComments() string {
+        if m != nil && m.TrailingComments != nil {
+                return *m.TrailingComments
+        }
+        return ""
+}
+
+func (m *SourceCodeInfo_Location) GetLeadingDetachedComments() []string {
+        if m != nil {
+                return m.LeadingDetachedComments
+        }
+        return nil
+}
+
+// Describes the relationship between generated code and its original source
+// file. A GeneratedCodeInfo message is associated with only one generated
+// source file, but may contain references to different source .proto files.
+type GeneratedCodeInfo struct {
+        // An Annotation connects some span of text in generated code to an element
+        // of its generating .proto file.
+        Annotation           []*GeneratedCodeInfo_Annotation `protobuf:"bytes,1,rep,name=annotation" json:"annotation,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}                        `json:"-"`
+        XXX_unrecognized     []byte                          `json:"-"`
+        XXX_sizecache        int32                           `json:"-"`
+}
+
+func (m *GeneratedCodeInfo) Reset()         { *m = GeneratedCodeInfo{} }
+func (m *GeneratedCodeInfo) String() string { return proto.CompactTextString(m) }
+func (*GeneratedCodeInfo) ProtoMessage()    {}
+func (*GeneratedCodeInfo) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{20}
+}
+
+func (m *GeneratedCodeInfo) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GeneratedCodeInfo.Unmarshal(m, b)
+}
+func (m *GeneratedCodeInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GeneratedCodeInfo.Marshal(b, m, deterministic)
+}
+func (m *GeneratedCodeInfo) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GeneratedCodeInfo.Merge(m, src)
+}
+func (m *GeneratedCodeInfo) XXX_Size() int {
+        return xxx_messageInfo_GeneratedCodeInfo.Size(m)
+}
+func (m *GeneratedCodeInfo) XXX_DiscardUnknown() {
+        xxx_messageInfo_GeneratedCodeInfo.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GeneratedCodeInfo proto.InternalMessageInfo
+
+func (m *GeneratedCodeInfo) GetAnnotation() []*GeneratedCodeInfo_Annotation {
+        if m != nil {
+                return m.Annotation
+        }
+        return nil
+}
+
+type GeneratedCodeInfo_Annotation struct {
+        // Identifies the element in the original source .proto file. This field
+        // is formatted the same as SourceCodeInfo.Location.path.
+        Path []int32 `protobuf:"varint,1,rep,packed,name=path" json:"path,omitempty"`
+        // Identifies the filesystem path to the original source .proto.
+        SourceFile *string `protobuf:"bytes,2,opt,name=source_file,json=sourceFile" json:"source_file,omitempty"`
+        // Identifies the starting offset in bytes in the generated code
+        // that relates to the identified object.
+        Begin *int32 `protobuf:"varint,3,opt,name=begin" json:"begin,omitempty"`
+        // Identifies the ending offset in bytes in the generated code that
+        // relates to the identified offset. The end offset should be one past
+        // the last relevant byte (so the length of the text = end - begin).
+        End                  *int32   `protobuf:"varint,4,opt,name=end" json:"end,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GeneratedCodeInfo_Annotation) Reset()         { *m = GeneratedCodeInfo_Annotation{} }
+func (m *GeneratedCodeInfo_Annotation) String() string { return proto.CompactTextString(m) }
+func (*GeneratedCodeInfo_Annotation) ProtoMessage()    {}
+func (*GeneratedCodeInfo_Annotation) Descriptor() ([]byte, []int) {
+        return fileDescriptor_e5baabe45344a177, []int{20, 0}
+}
+
+func (m *GeneratedCodeInfo_Annotation) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GeneratedCodeInfo_Annotation.Unmarshal(m, b)
+}
+func (m *GeneratedCodeInfo_Annotation) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GeneratedCodeInfo_Annotation.Marshal(b, m, deterministic)
+}
+func (m *GeneratedCodeInfo_Annotation) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GeneratedCodeInfo_Annotation.Merge(m, src)
+}
+func (m *GeneratedCodeInfo_Annotation) XXX_Size() int {
+        return xxx_messageInfo_GeneratedCodeInfo_Annotation.Size(m)
+}
+func (m *GeneratedCodeInfo_Annotation) XXX_DiscardUnknown() {
+        xxx_messageInfo_GeneratedCodeInfo_Annotation.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GeneratedCodeInfo_Annotation proto.InternalMessageInfo
+
+func (m *GeneratedCodeInfo_Annotation) GetPath() []int32 {
+        if m != nil {
+                return m.Path
+        }
+        return nil
+}
+
+func (m *GeneratedCodeInfo_Annotation) GetSourceFile() string {
+        if m != nil && m.SourceFile != nil {
+                return *m.SourceFile
+        }
+        return ""
+}
+
+func (m *GeneratedCodeInfo_Annotation) GetBegin() int32 {
+        if m != nil && m.Begin != nil {
+                return *m.Begin
+        }
+        return 0
+}
+
+func (m *GeneratedCodeInfo_Annotation) GetEnd() int32 {
+        if m != nil && m.End != nil {
+                return *m.End
+        }
+        return 0
+}
+
+func init() {
+        proto.RegisterEnum("google.protobuf.FieldDescriptorProto_Type", FieldDescriptorProto_Type_name, FieldDescriptorProto_Type_value)
+        proto.RegisterEnum("google.protobuf.FieldDescriptorProto_Label", FieldDescriptorProto_Label_name, FieldDescriptorProto_Label_value)
+        proto.RegisterEnum("google.protobuf.FileOptions_OptimizeMode", FileOptions_OptimizeMode_name, FileOptions_OptimizeMode_value)
+        proto.RegisterEnum("google.protobuf.FieldOptions_CType", FieldOptions_CType_name, FieldOptions_CType_value)
+        proto.RegisterEnum("google.protobuf.FieldOptions_JSType", FieldOptions_JSType_name, FieldOptions_JSType_value)
+        proto.RegisterEnum("google.protobuf.MethodOptions_IdempotencyLevel", MethodOptions_IdempotencyLevel_name, MethodOptions_IdempotencyLevel_value)
+        proto.RegisterType((*FileDescriptorSet)(nil), "google.protobuf.FileDescriptorSet")
+        proto.RegisterType((*FileDescriptorProto)(nil), "google.protobuf.FileDescriptorProto")
+        proto.RegisterType((*DescriptorProto)(nil), "google.protobuf.DescriptorProto")
+        proto.RegisterType((*DescriptorProto_ExtensionRange)(nil), "google.protobuf.DescriptorProto.ExtensionRange")
+        proto.RegisterType((*DescriptorProto_ReservedRange)(nil), "google.protobuf.DescriptorProto.ReservedRange")
+        proto.RegisterType((*ExtensionRangeOptions)(nil), "google.protobuf.ExtensionRangeOptions")
+        proto.RegisterType((*FieldDescriptorProto)(nil), "google.protobuf.FieldDescriptorProto")
+        proto.RegisterType((*OneofDescriptorProto)(nil), "google.protobuf.OneofDescriptorProto")
+        proto.RegisterType((*EnumDescriptorProto)(nil), "google.protobuf.EnumDescriptorProto")
+        proto.RegisterType((*EnumDescriptorProto_EnumReservedRange)(nil), "google.protobuf.EnumDescriptorProto.EnumReservedRange")
+        proto.RegisterType((*EnumValueDescriptorProto)(nil), "google.protobuf.EnumValueDescriptorProto")
+        proto.RegisterType((*ServiceDescriptorProto)(nil), "google.protobuf.ServiceDescriptorProto")
+        proto.RegisterType((*MethodDescriptorProto)(nil), "google.protobuf.MethodDescriptorProto")
+        proto.RegisterType((*FileOptions)(nil), "google.protobuf.FileOptions")
+        proto.RegisterType((*MessageOptions)(nil), "google.protobuf.MessageOptions")
+        proto.RegisterType((*FieldOptions)(nil), "google.protobuf.FieldOptions")
+        proto.RegisterType((*OneofOptions)(nil), "google.protobuf.OneofOptions")
+        proto.RegisterType((*EnumOptions)(nil), "google.protobuf.EnumOptions")
+        proto.RegisterType((*EnumValueOptions)(nil), "google.protobuf.EnumValueOptions")
+        proto.RegisterType((*ServiceOptions)(nil), "google.protobuf.ServiceOptions")
+        proto.RegisterType((*MethodOptions)(nil), "google.protobuf.MethodOptions")
+        proto.RegisterType((*UninterpretedOption)(nil), "google.protobuf.UninterpretedOption")
+        proto.RegisterType((*UninterpretedOption_NamePart)(nil), "google.protobuf.UninterpretedOption.NamePart")
+        proto.RegisterType((*SourceCodeInfo)(nil), "google.protobuf.SourceCodeInfo")
+        proto.RegisterType((*SourceCodeInfo_Location)(nil), "google.protobuf.SourceCodeInfo.Location")
+        proto.RegisterType((*GeneratedCodeInfo)(nil), "google.protobuf.GeneratedCodeInfo")
+        proto.RegisterType((*GeneratedCodeInfo_Annotation)(nil), "google.protobuf.GeneratedCodeInfo.Annotation")
+}
+
+func init() { proto.RegisterFile("google/protobuf/descriptor.proto", fileDescriptor_e5baabe45344a177) }
+
+var fileDescriptor_e5baabe45344a177 = []byte{
+        // 2589 bytes of a gzipped FileDescriptorProto
+        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x59, 0xdd, 0x8e, 0xdb, 0xc6,
+        0x15, 0x0e, 0xf5, 0xb7, 0xd2, 0x91, 0x56, 0x3b, 0x3b, 0xbb, 0xb1, 0xe9, 0xcd, 0x8f, 0xd7, 0xca,
+        0x8f, 0xd7, 0x4e, 0xac, 0x0d, 0x1c, 0xdb, 0x71, 0xd6, 0x45, 0x5a, 0xad, 0x44, 0x6f, 0xe4, 0xee,
+        0x4a, 0x2a, 0xa5, 0x6d, 0x7e, 0x80, 0x82, 0x98, 0x25, 0x47, 0x12, 0x6d, 0x8a, 0x64, 0x48, 0xca,
+        0xf6, 0x06, 0xbd, 0x30, 0xd0, 0xab, 0x5e, 0x15, 0xe8, 0x55, 0x51, 0x14, 0xbd, 0xe8, 0x4d, 0x80,
+        0x3e, 0x40, 0x81, 0xde, 0xf5, 0x09, 0x0a, 0xe4, 0x0d, 0x8a, 0xb6, 0x40, 0xfb, 0x08, 0xbd, 0x2c,
+        0x66, 0x86, 0xa4, 0x48, 0x49, 0x1b, 0x6f, 0x02, 0xc4, 0xb9, 0x92, 0xe6, 0x3b, 0xdf, 0x39, 0x73,
+        0xe6, 0xcc, 0x99, 0x99, 0x33, 0x43, 0xd8, 0x1e, 0x39, 0xce, 0xc8, 0xa2, 0xbb, 0xae, 0xe7, 0x04,
+        0xce, 0xc9, 0x74, 0xb8, 0x6b, 0x50, 0x5f, 0xf7, 0x4c, 0x37, 0x70, 0xbc, 0x3a, 0xc7, 0xf0, 0x9a,
+        0x60, 0xd4, 0x23, 0x46, 0xed, 0x08, 0xd6, 0xef, 0x9b, 0x16, 0x6d, 0xc5, 0xc4, 0x3e, 0x0d, 0xf0,
+        0x5d, 0xc8, 0x0d, 0x4d, 0x8b, 0xca, 0xd2, 0x76, 0x76, 0xa7, 0x7c, 0xf3, 0xcd, 0xfa, 0x9c, 0x52,
+        0x3d, 0xad, 0xd1, 0x63, 0xb0, 0xca, 0x35, 0x6a, 0xff, 0xce, 0xc1, 0xc6, 0x12, 0x29, 0xc6, 0x90,
+        0xb3, 0xc9, 0x84, 0x59, 0x94, 0x76, 0x4a, 0x2a, 0xff, 0x8f, 0x65, 0x58, 0x71, 0x89, 0xfe, 0x88,
+        0x8c, 0xa8, 0x9c, 0xe1, 0x70, 0xd4, 0xc4, 0xaf, 0x03, 0x18, 0xd4, 0xa5, 0xb6, 0x41, 0x6d, 0xfd,
+        0x54, 0xce, 0x6e, 0x67, 0x77, 0x4a, 0x6a, 0x02, 0xc1, 0xef, 0xc0, 0xba, 0x3b, 0x3d, 0xb1, 0x4c,
+        0x5d, 0x4b, 0xd0, 0x60, 0x3b, 0xbb, 0x93, 0x57, 0x91, 0x10, 0xb4, 0x66, 0xe4, 0xab, 0xb0, 0xf6,
+        0x84, 0x92, 0x47, 0x49, 0x6a, 0x99, 0x53, 0xab, 0x0c, 0x4e, 0x10, 0x9b, 0x50, 0x99, 0x50, 0xdf,
+        0x27, 0x23, 0xaa, 0x05, 0xa7, 0x2e, 0x95, 0x73, 0x7c, 0xf4, 0xdb, 0x0b, 0xa3, 0x9f, 0x1f, 0x79,
+        0x39, 0xd4, 0x1a, 0x9c, 0xba, 0x14, 0x37, 0xa0, 0x44, 0xed, 0xe9, 0x44, 0x58, 0xc8, 0x9f, 0x11,
+        0x3f, 0xc5, 0x9e, 0x4e, 0xe6, 0xad, 0x14, 0x99, 0x5a, 0x68, 0x62, 0xc5, 0xa7, 0xde, 0x63, 0x53,
+        0xa7, 0x72, 0x81, 0x1b, 0xb8, 0xba, 0x60, 0xa0, 0x2f, 0xe4, 0xf3, 0x36, 0x22, 0x3d, 0xdc, 0x84,
+        0x12, 0x7d, 0x1a, 0x50, 0xdb, 0x37, 0x1d, 0x5b, 0x5e, 0xe1, 0x46, 0xde, 0x5a, 0x32, 0x8b, 0xd4,
+        0x32, 0xe6, 0x4d, 0xcc, 0xf4, 0xf0, 0x1d, 0x58, 0x71, 0xdc, 0xc0, 0x74, 0x6c, 0x5f, 0x2e, 0x6e,
+        0x4b, 0x3b, 0xe5, 0x9b, 0xaf, 0x2e, 0x4d, 0x84, 0xae, 0xe0, 0xa8, 0x11, 0x19, 0xb7, 0x01, 0xf9,
+        0xce, 0xd4, 0xd3, 0xa9, 0xa6, 0x3b, 0x06, 0xd5, 0x4c, 0x7b, 0xe8, 0xc8, 0x25, 0x6e, 0xe0, 0xf2,
+        0xe2, 0x40, 0x38, 0xb1, 0xe9, 0x18, 0xb4, 0x6d, 0x0f, 0x1d, 0xb5, 0xea, 0xa7, 0xda, 0xf8, 0x02,
+        0x14, 0xfc, 0x53, 0x3b, 0x20, 0x4f, 0xe5, 0x0a, 0xcf, 0x90, 0xb0, 0x55, 0xfb, 0x6b, 0x01, 0xd6,
+        0xce, 0x93, 0x62, 0xf7, 0x20, 0x3f, 0x64, 0xa3, 0x94, 0x33, 0xdf, 0x26, 0x06, 0x42, 0x27, 0x1d,
+        0xc4, 0xc2, 0x77, 0x0c, 0x62, 0x03, 0xca, 0x36, 0xf5, 0x03, 0x6a, 0x88, 0x8c, 0xc8, 0x9e, 0x33,
+        0xa7, 0x40, 0x28, 0x2d, 0xa6, 0x54, 0xee, 0x3b, 0xa5, 0xd4, 0xa7, 0xb0, 0x16, 0xbb, 0xa4, 0x79,
+        0xc4, 0x1e, 0x45, 0xb9, 0xb9, 0xfb, 0x3c, 0x4f, 0xea, 0x4a, 0xa4, 0xa7, 0x32, 0x35, 0xb5, 0x4a,
+        0x53, 0x6d, 0xdc, 0x02, 0x70, 0x6c, 0xea, 0x0c, 0x35, 0x83, 0xea, 0x96, 0x5c, 0x3c, 0x23, 0x4a,
+        0x5d, 0x46, 0x59, 0x88, 0x92, 0x23, 0x50, 0xdd, 0xc2, 0x1f, 0xce, 0x52, 0x6d, 0xe5, 0x8c, 0x4c,
+        0x39, 0x12, 0x8b, 0x6c, 0x21, 0xdb, 0x8e, 0xa1, 0xea, 0x51, 0x96, 0xf7, 0xd4, 0x08, 0x47, 0x56,
+        0xe2, 0x4e, 0xd4, 0x9f, 0x3b, 0x32, 0x35, 0x54, 0x13, 0x03, 0x5b, 0xf5, 0x92, 0x4d, 0xfc, 0x06,
+        0xc4, 0x80, 0xc6, 0xd3, 0x0a, 0xf8, 0x2e, 0x54, 0x89, 0xc0, 0x0e, 0x99, 0xd0, 0xad, 0x2f, 0xa1,
+        0x9a, 0x0e, 0x0f, 0xde, 0x84, 0xbc, 0x1f, 0x10, 0x2f, 0xe0, 0x59, 0x98, 0x57, 0x45, 0x03, 0x23,
+        0xc8, 0x52, 0xdb, 0xe0, 0xbb, 0x5c, 0x5e, 0x65, 0x7f, 0xf1, 0x4f, 0x66, 0x03, 0xce, 0xf2, 0x01,
+        0xbf, 0xbd, 0x38, 0xa3, 0x29, 0xcb, 0xf3, 0xe3, 0xde, 0xfa, 0x00, 0x56, 0x53, 0x03, 0x38, 0x6f,
+        0xd7, 0xb5, 0x5f, 0xc2, 0xcb, 0x4b, 0x4d, 0xe3, 0x4f, 0x61, 0x73, 0x6a, 0x9b, 0x76, 0x40, 0x3d,
+        0xd7, 0xa3, 0x2c, 0x63, 0x45, 0x57, 0xf2, 0x7f, 0x56, 0xce, 0xc8, 0xb9, 0xe3, 0x24, 0x5b, 0x58,
+        0x51, 0x37, 0xa6, 0x8b, 0xe0, 0xf5, 0x52, 0xf1, 0xbf, 0x2b, 0xe8, 0xd9, 0xb3, 0x67, 0xcf, 0x32,
+        0xb5, 0xdf, 0x15, 0x60, 0x73, 0xd9, 0x9a, 0x59, 0xba, 0x7c, 0x2f, 0x40, 0xc1, 0x9e, 0x4e, 0x4e,
+        0xa8, 0xc7, 0x83, 0x94, 0x57, 0xc3, 0x16, 0x6e, 0x40, 0xde, 0x22, 0x27, 0xd4, 0x92, 0x73, 0xdb,
+        0xd2, 0x4e, 0xf5, 0xe6, 0x3b, 0xe7, 0x5a, 0x95, 0xf5, 0x43, 0xa6, 0xa2, 0x0a, 0x4d, 0xfc, 0x11,
+        0xe4, 0xc2, 0x2d, 0x9a, 0x59, 0xb8, 0x7e, 0x3e, 0x0b, 0x6c, 0x2d, 0xa9, 0x5c, 0x0f, 0xbf, 0x02,
+        0x25, 0xf6, 0x2b, 0x72, 0xa3, 0xc0, 0x7d, 0x2e, 0x32, 0x80, 0xe5, 0x05, 0xde, 0x82, 0x22, 0x5f,
+        0x26, 0x06, 0x8d, 0x8e, 0xb6, 0xb8, 0xcd, 0x12, 0xcb, 0xa0, 0x43, 0x32, 0xb5, 0x02, 0xed, 0x31,
+        0xb1, 0xa6, 0x94, 0x27, 0x7c, 0x49, 0xad, 0x84, 0xe0, 0xcf, 0x19, 0x86, 0x2f, 0x43, 0x59, 0xac,
+        0x2a, 0xd3, 0x36, 0xe8, 0x53, 0xbe, 0x7b, 0xe6, 0x55, 0xb1, 0xd0, 0xda, 0x0c, 0x61, 0xdd, 0x3f,
+        0xf4, 0x1d, 0x3b, 0x4a, 0x4d, 0xde, 0x05, 0x03, 0x78, 0xf7, 0x1f, 0xcc, 0x6f, 0xdc, 0xaf, 0x2d,
+        0x1f, 0xde, 0x7c, 0x4e, 0xd5, 0xfe, 0x92, 0x81, 0x1c, 0xdf, 0x2f, 0xd6, 0xa0, 0x3c, 0xf8, 0xac,
+        0xa7, 0x68, 0xad, 0xee, 0xf1, 0xfe, 0xa1, 0x82, 0x24, 0x5c, 0x05, 0xe0, 0xc0, 0xfd, 0xc3, 0x6e,
+        0x63, 0x80, 0x32, 0x71, 0xbb, 0xdd, 0x19, 0xdc, 0xb9, 0x85, 0xb2, 0xb1, 0xc2, 0xb1, 0x00, 0x72,
+        0x49, 0xc2, 0xfb, 0x37, 0x51, 0x1e, 0x23, 0xa8, 0x08, 0x03, 0xed, 0x4f, 0x95, 0xd6, 0x9d, 0x5b,
+        0xa8, 0x90, 0x46, 0xde, 0xbf, 0x89, 0x56, 0xf0, 0x2a, 0x94, 0x38, 0xb2, 0xdf, 0xed, 0x1e, 0xa2,
+        0x62, 0x6c, 0xb3, 0x3f, 0x50, 0xdb, 0x9d, 0x03, 0x54, 0x8a, 0x6d, 0x1e, 0xa8, 0xdd, 0xe3, 0x1e,
+        0x82, 0xd8, 0xc2, 0x91, 0xd2, 0xef, 0x37, 0x0e, 0x14, 0x54, 0x8e, 0x19, 0xfb, 0x9f, 0x0d, 0x94,
+        0x3e, 0xaa, 0xa4, 0xdc, 0x7a, 0xff, 0x26, 0x5a, 0x8d, 0xbb, 0x50, 0x3a, 0xc7, 0x47, 0xa8, 0x8a,
+        0xd7, 0x61, 0x55, 0x74, 0x11, 0x39, 0xb1, 0x36, 0x07, 0xdd, 0xb9, 0x85, 0xd0, 0xcc, 0x11, 0x61,
+        0x65, 0x3d, 0x05, 0xdc, 0xb9, 0x85, 0x70, 0xad, 0x09, 0x79, 0x9e, 0x5d, 0x18, 0x43, 0xf5, 0xb0,
+        0xb1, 0xaf, 0x1c, 0x6a, 0xdd, 0xde, 0xa0, 0xdd, 0xed, 0x34, 0x0e, 0x91, 0x34, 0xc3, 0x54, 0xe5,
+        0x67, 0xc7, 0x6d, 0x55, 0x69, 0xa1, 0x4c, 0x12, 0xeb, 0x29, 0x8d, 0x81, 0xd2, 0x42, 0xd9, 0x9a,
+        0x0e, 0x9b, 0xcb, 0xf6, 0xc9, 0xa5, 0x2b, 0x23, 0x31, 0xc5, 0x99, 0x33, 0xa6, 0x98, 0xdb, 0x5a,
+        0x98, 0xe2, 0x7f, 0x65, 0x60, 0x63, 0xc9, 0x59, 0xb1, 0xb4, 0x93, 0x1f, 0x43, 0x5e, 0xa4, 0xa8,
+        0x38, 0x3d, 0xaf, 0x2d, 0x3d, 0x74, 0x78, 0xc2, 0x2e, 0x9c, 0xa0, 0x5c, 0x2f, 0x59, 0x41, 0x64,
+        0xcf, 0xa8, 0x20, 0x98, 0x89, 0x85, 0x3d, 0xfd, 0x17, 0x0b, 0x7b, 0xba, 0x38, 0xf6, 0xee, 0x9c,
+        0xe7, 0xd8, 0xe3, 0xd8, 0xb7, 0xdb, 0xdb, 0xf3, 0x4b, 0xf6, 0xf6, 0x7b, 0xb0, 0xbe, 0x60, 0xe8,
+        0xdc, 0x7b, 0xec, 0xaf, 0x24, 0x90, 0xcf, 0x0a, 0xce, 0x73, 0x76, 0xba, 0x4c, 0x6a, 0xa7, 0xbb,
+        0x37, 0x1f, 0xc1, 0x2b, 0x67, 0x4f, 0xc2, 0xc2, 0x5c, 0x7f, 0x25, 0xc1, 0x85, 0xe5, 0x95, 0xe2,
+        0x52, 0x1f, 0x3e, 0x82, 0xc2, 0x84, 0x06, 0x63, 0x27, 0xaa, 0x96, 0xde, 0x5e, 0x72, 0x06, 0x33,
+        0xf1, 0xfc, 0x64, 0x87, 0x5a, 0xc9, 0x43, 0x3c, 0x7b, 0x56, 0xb9, 0x27, 0xbc, 0x59, 0xf0, 0xf4,
+        0xd7, 0x19, 0x78, 0x79, 0xa9, 0xf1, 0xa5, 0x8e, 0xbe, 0x06, 0x60, 0xda, 0xee, 0x34, 0x10, 0x15,
+        0x91, 0xd8, 0x60, 0x4b, 0x1c, 0xe1, 0x9b, 0x17, 0xdb, 0x3c, 0xa7, 0x41, 0x2c, 0xcf, 0x72, 0x39,
+        0x08, 0x88, 0x13, 0xee, 0xce, 0x1c, 0xcd, 0x71, 0x47, 0x5f, 0x3f, 0x63, 0xa4, 0x0b, 0x89, 0xf9,
+        0x1e, 0x20, 0xdd, 0x32, 0xa9, 0x1d, 0x68, 0x7e, 0xe0, 0x51, 0x32, 0x31, 0xed, 0x11, 0x3f, 0x41,
+        0x8a, 0x7b, 0xf9, 0x21, 0xb1, 0x7c, 0xaa, 0xae, 0x09, 0x71, 0x3f, 0x92, 0x32, 0x0d, 0x9e, 0x40,
+        0x5e, 0x42, 0xa3, 0x90, 0xd2, 0x10, 0xe2, 0x58, 0xa3, 0xf6, 0xdb, 0x12, 0x94, 0x13, 0x75, 0x35,
+        0xbe, 0x02, 0x95, 0x87, 0xe4, 0x31, 0xd1, 0xa2, 0xbb, 0x92, 0x88, 0x44, 0x99, 0x61, 0xbd, 0xf0,
+        0xbe, 0xf4, 0x1e, 0x6c, 0x72, 0x8a, 0x33, 0x0d, 0xa8, 0xa7, 0xe9, 0x16, 0xf1, 0x7d, 0x1e, 0xb4,
+        0x22, 0xa7, 0x62, 0x26, 0xeb, 0x32, 0x51, 0x33, 0x92, 0xe0, 0xdb, 0xb0, 0xc1, 0x35, 0x26, 0x53,
+        0x2b, 0x30, 0x5d, 0x8b, 0x6a, 0xec, 0xf6, 0xe6, 0xf3, 0x93, 0x24, 0xf6, 0x6c, 0x9d, 0x31, 0x8e,
+        0x42, 0x02, 0xf3, 0xc8, 0xc7, 0x2d, 0x78, 0x8d, 0xab, 0x8d, 0xa8, 0x4d, 0x3d, 0x12, 0x50, 0x8d,
+        0x7e, 0x31, 0x25, 0x96, 0xaf, 0x11, 0xdb, 0xd0, 0xc6, 0xc4, 0x1f, 0xcb, 0x9b, 0xcc, 0xc0, 0x7e,
+        0x46, 0x96, 0xd4, 0x4b, 0x8c, 0x78, 0x10, 0xf2, 0x14, 0x4e, 0x6b, 0xd8, 0xc6, 0xc7, 0xc4, 0x1f,
+        0xe3, 0x3d, 0xb8, 0xc0, 0xad, 0xf8, 0x81, 0x67, 0xda, 0x23, 0x4d, 0x1f, 0x53, 0xfd, 0x91, 0x36,
+        0x0d, 0x86, 0x77, 0xe5, 0x57, 0x92, 0xfd, 0x73, 0x0f, 0xfb, 0x9c, 0xd3, 0x64, 0x94, 0xe3, 0x60,
+        0x78, 0x17, 0xf7, 0xa1, 0xc2, 0x26, 0x63, 0x62, 0x7e, 0x49, 0xb5, 0xa1, 0xe3, 0xf1, 0xa3, 0xb1,
+        0xba, 0x64, 0x6b, 0x4a, 0x44, 0xb0, 0xde, 0x0d, 0x15, 0x8e, 0x1c, 0x83, 0xee, 0xe5, 0xfb, 0x3d,
+        0x45, 0x69, 0xa9, 0xe5, 0xc8, 0xca, 0x7d, 0xc7, 0x63, 0x09, 0x35, 0x72, 0xe2, 0x00, 0x97, 0x45,
+        0x42, 0x8d, 0x9c, 0x28, 0xbc, 0xb7, 0x61, 0x43, 0xd7, 0xc5, 0x98, 0x4d, 0x5d, 0x0b, 0xef, 0x58,
+        0xbe, 0x8c, 0x52, 0xc1, 0xd2, 0xf5, 0x03, 0x41, 0x08, 0x73, 0xdc, 0xc7, 0x1f, 0xc2, 0xcb, 0xb3,
+        0x60, 0x25, 0x15, 0xd7, 0x17, 0x46, 0x39, 0xaf, 0x7a, 0x1b, 0x36, 0xdc, 0xd3, 0x45, 0x45, 0x9c,
+        0xea, 0xd1, 0x3d, 0x9d, 0x57, 0xfb, 0x00, 0x36, 0xdd, 0xb1, 0xbb, 0xa8, 0x77, 0x3d, 0xa9, 0x87,
+        0xdd, 0xb1, 0x3b, 0xaf, 0xf8, 0x16, 0xbf, 0x70, 0x7b, 0x54, 0x27, 0x01, 0x35, 0xe4, 0x8b, 0x49,
+        0x7a, 0x42, 0x80, 0x77, 0x01, 0xe9, 0xba, 0x46, 0x6d, 0x72, 0x62, 0x51, 0x8d, 0x78, 0xd4, 0x26,
+        0xbe, 0x7c, 0x39, 0x49, 0xae, 0xea, 0xba, 0xc2, 0xa5, 0x0d, 0x2e, 0xc4, 0xd7, 0x61, 0xdd, 0x39,
+        0x79, 0xa8, 0x8b, 0x94, 0xd4, 0x5c, 0x8f, 0x0e, 0xcd, 0xa7, 0xf2, 0x9b, 0x3c, 0xbe, 0x6b, 0x4c,
+        0xc0, 0x13, 0xb2, 0xc7, 0x61, 0x7c, 0x0d, 0x90, 0xee, 0x8f, 0x89, 0xe7, 0xf2, 0x3d, 0xd9, 0x77,
+        0x89, 0x4e, 0xe5, 0xb7, 0x04, 0x55, 0xe0, 0x9d, 0x08, 0x66, 0x4b, 0xc2, 0x7f, 0x62, 0x0e, 0x83,
+        0xc8, 0xe2, 0x55, 0xb1, 0x24, 0x38, 0x16, 0x5a, 0xdb, 0x01, 0xc4, 0x42, 0x91, 0xea, 0x78, 0x87,
+        0xd3, 0xaa, 0xee, 0xd8, 0x4d, 0xf6, 0xfb, 0x06, 0xac, 0x32, 0xe6, 0xac, 0xd3, 0x6b, 0xa2, 0x20,
+        0x73, 0xc7, 0x89, 0x1e, 0x6f, 0xc1, 0x05, 0x46, 0x9a, 0xd0, 0x80, 0x18, 0x24, 0x20, 0x09, 0xf6,
+        0xbb, 0x9c, 0xcd, 0xe2, 0x7e, 0x14, 0x0a, 0x53, 0x7e, 0x7a, 0xd3, 0x93, 0xd3, 0x38, 0xb3, 0x6e,
+        0x08, 0x3f, 0x19, 0x16, 0xe5, 0xd6, 0xf7, 0x56, 0x74, 0xd7, 0xf6, 0xa0, 0x92, 0x4c, 0x7c, 0x5c,
+        0x02, 0x91, 0xfa, 0x48, 0x62, 0x55, 0x50, 0xb3, 0xdb, 0x62, 0xf5, 0xcb, 0xe7, 0x0a, 0xca, 0xb0,
+        0x3a, 0xea, 0xb0, 0x3d, 0x50, 0x34, 0xf5, 0xb8, 0x33, 0x68, 0x1f, 0x29, 0x28, 0x9b, 0x28, 0xd8,
+        0x1f, 0xe4, 0x8a, 0x6f, 0xa3, 0xab, 0xb5, 0xaf, 0x33, 0x50, 0x4d, 0xdf, 0xc0, 0xf0, 0x8f, 0xe0,
+        0x62, 0xf4, 0x5c, 0xe2, 0xd3, 0x40, 0x7b, 0x62, 0x7a, 0x7c, 0x45, 0x4e, 0x88, 0x38, 0x1d, 0xe3,
+        0x9c, 0xd8, 0x0c, 0x59, 0x7d, 0x1a, 0x7c, 0x62, 0x7a, 0x6c, 0xbd, 0x4d, 0x48, 0x80, 0x0f, 0xe1,
+        0xb2, 0xed, 0x68, 0x7e, 0x40, 0x6c, 0x83, 0x78, 0x86, 0x36, 0x7b, 0xa8, 0xd2, 0x88, 0xae, 0x53,
+        0xdf, 0x77, 0xc4, 0x49, 0x18, 0x5b, 0x79, 0xd5, 0x76, 0xfa, 0x21, 0x79, 0x76, 0x44, 0x34, 0x42,
+        0xea, 0x5c, 0xfe, 0x66, 0xcf, 0xca, 0xdf, 0x57, 0xa0, 0x34, 0x21, 0xae, 0x46, 0xed, 0xc0, 0x3b,
+        0xe5, 0x75, 0x77, 0x51, 0x2d, 0x4e, 0x88, 0xab, 0xb0, 0xf6, 0x0b, 0xb9, 0xfe, 0x3c, 0xc8, 0x15,
+        0x8b, 0xa8, 0xf4, 0x20, 0x57, 0x2c, 0x21, 0xa8, 0xfd, 0x33, 0x0b, 0x95, 0x64, 0x1d, 0xce, 0xae,
+        0x35, 0x3a, 0x3f, 0xb2, 0x24, 0xbe, 0xa9, 0xbd, 0xf1, 0x8d, 0x55, 0x7b, 0xbd, 0xc9, 0xce, 0xb2,
+        0xbd, 0x82, 0xa8, 0x8e, 0x55, 0xa1, 0xc9, 0xea, 0x08, 0x96, 0x6c, 0x54, 0x54, 0x23, 0x45, 0x35,
+        0x6c, 0xe1, 0x03, 0x28, 0x3c, 0xf4, 0xb9, 0xed, 0x02, 0xb7, 0xfd, 0xe6, 0x37, 0xdb, 0x7e, 0xd0,
+        0xe7, 0xc6, 0x4b, 0x0f, 0xfa, 0x5a, 0xa7, 0xab, 0x1e, 0x35, 0x0e, 0xd5, 0x50, 0x1d, 0x5f, 0x82,
+        0x9c, 0x45, 0xbe, 0x3c, 0x4d, 0x9f, 0x7a, 0x1c, 0x3a, 0xef, 0x24, 0x5c, 0x82, 0xdc, 0x13, 0x4a,
+        0x1e, 0xa5, 0xcf, 0x1a, 0x0e, 0x7d, 0x8f, 0x8b, 0x61, 0x17, 0xf2, 0x3c, 0x5e, 0x18, 0x20, 0x8c,
+        0x18, 0x7a, 0x09, 0x17, 0x21, 0xd7, 0xec, 0xaa, 0x6c, 0x41, 0x20, 0xa8, 0x08, 0x54, 0xeb, 0xb5,
+        0x95, 0xa6, 0x82, 0x32, 0xb5, 0xdb, 0x50, 0x10, 0x41, 0x60, 0x8b, 0x25, 0x0e, 0x03, 0x7a, 0x29,
+        0x6c, 0x86, 0x36, 0xa4, 0x48, 0x7a, 0x7c, 0xb4, 0xaf, 0xa8, 0x28, 0x93, 0x9e, 0xea, 0x1c, 0xca,
+        0xd7, 0x7c, 0xa8, 0x24, 0x0b, 0xf1, 0x17, 0x73, 0xc9, 0xfe, 0x9b, 0x04, 0xe5, 0x44, 0x61, 0xcd,
+        0x2a, 0x22, 0x62, 0x59, 0xce, 0x13, 0x8d, 0x58, 0x26, 0xf1, 0xc3, 0xd4, 0x00, 0x0e, 0x35, 0x18,
+        0x72, 0xde, 0xa9, 0x7b, 0x41, 0x4b, 0x24, 0x8f, 0x0a, 0xb5, 0x3f, 0x4a, 0x80, 0xe6, 0x2b, 0xdb,
+        0x39, 0x37, 0xa5, 0x1f, 0xd2, 0xcd, 0xda, 0x1f, 0x24, 0xa8, 0xa6, 0xcb, 0xd9, 0x39, 0xf7, 0xae,
+        0xfc, 0xa0, 0xee, 0xfd, 0x23, 0x03, 0xab, 0xa9, 0x22, 0xf6, 0xbc, 0xde, 0x7d, 0x01, 0xeb, 0xa6,
+        0x41, 0x27, 0xae, 0x13, 0x50, 0x5b, 0x3f, 0xd5, 0x2c, 0xfa, 0x98, 0x5a, 0x72, 0x8d, 0x6f, 0x1a,
+        0xbb, 0xdf, 0x5c, 0x26, 0xd7, 0xdb, 0x33, 0xbd, 0x43, 0xa6, 0xb6, 0xb7, 0xd1, 0x6e, 0x29, 0x47,
+        0xbd, 0xee, 0x40, 0xe9, 0x34, 0x3f, 0xd3, 0x8e, 0x3b, 0x3f, 0xed, 0x74, 0x3f, 0xe9, 0xa8, 0xc8,
+        0x9c, 0xa3, 0x7d, 0x8f, 0xcb, 0xbe, 0x07, 0x68, 0xde, 0x29, 0x7c, 0x11, 0x96, 0xb9, 0x85, 0x5e,
+        0xc2, 0x1b, 0xb0, 0xd6, 0xe9, 0x6a, 0xfd, 0x76, 0x4b, 0xd1, 0x94, 0xfb, 0xf7, 0x95, 0xe6, 0xa0,
+        0x2f, 0x1e, 0x3e, 0x62, 0xf6, 0x20, 0xb5, 0xc0, 0x6b, 0xbf, 0xcf, 0xc2, 0xc6, 0x12, 0x4f, 0x70,
+        0x23, 0xbc, 0xb2, 0x88, 0x5b, 0xd4, 0x8d, 0xf3, 0x78, 0x5f, 0x67, 0x35, 0x43, 0x8f, 0x78, 0x41,
+        0x78, 0xc3, 0xb9, 0x06, 0x2c, 0x4a, 0x76, 0x60, 0x0e, 0x4d, 0xea, 0x85, 0xef, 0x44, 0xe2, 0x1e,
+        0xb3, 0x36, 0xc3, 0xc5, 0x53, 0xd1, 0xbb, 0x80, 0x5d, 0xc7, 0x37, 0x03, 0xf3, 0x31, 0xd5, 0x4c,
+        0x3b, 0x7a, 0x54, 0x62, 0xf7, 0x9a, 0x9c, 0x8a, 0x22, 0x49, 0xdb, 0x0e, 0x62, 0xb6, 0x4d, 0x47,
+        0x64, 0x8e, 0xcd, 0x36, 0xf3, 0xac, 0x8a, 0x22, 0x49, 0xcc, 0xbe, 0x02, 0x15, 0xc3, 0x99, 0xb2,
+        0x62, 0x4f, 0xf0, 0xd8, 0xd9, 0x21, 0xa9, 0x65, 0x81, 0xc5, 0x94, 0xb0, 0x8c, 0x9f, 0xbd, 0x66,
+        0x55, 0xd4, 0xb2, 0xc0, 0x04, 0xe5, 0x2a, 0xac, 0x91, 0xd1, 0xc8, 0x63, 0xc6, 0x23, 0x43, 0xe2,
+        0x62, 0x52, 0x8d, 0x61, 0x4e, 0xdc, 0x7a, 0x00, 0xc5, 0x28, 0x0e, 0xec, 0xa8, 0x66, 0x91, 0xd0,
+        0x5c, 0x71, 0xdb, 0xce, 0xec, 0x94, 0xd4, 0xa2, 0x1d, 0x09, 0xaf, 0x40, 0xc5, 0xf4, 0xb5, 0xd9,
+        0xe3, 0x7c, 0x66, 0x3b, 0xb3, 0x53, 0x54, 0xcb, 0xa6, 0x1f, 0x3f, 0x6c, 0xd6, 0xbe, 0xca, 0x40,
+        0x35, 0xfd, 0x71, 0x01, 0xb7, 0xa0, 0x68, 0x39, 0x3a, 0xe1, 0xa9, 0x25, 0xbe, 0x6c, 0xed, 0x3c,
+        0xe7, 0x7b, 0x44, 0xfd, 0x30, 0xe4, 0xab, 0xb1, 0xe6, 0xd6, 0xdf, 0x25, 0x28, 0x46, 0x30, 0xbe,
+        0x00, 0x39, 0x97, 0x04, 0x63, 0x6e, 0x2e, 0xbf, 0x9f, 0x41, 0x92, 0xca, 0xdb, 0x0c, 0xf7, 0x5d,
+        0x62, 0xf3, 0x14, 0x08, 0x71, 0xd6, 0x66, 0xf3, 0x6a, 0x51, 0x62, 0xf0, 0x5b, 0x8f, 0x33, 0x99,
+        0x50, 0x3b, 0xf0, 0xa3, 0x79, 0x0d, 0xf1, 0x66, 0x08, 0xe3, 0x77, 0x60, 0x3d, 0xf0, 0x88, 0x69,
+        0xa5, 0xb8, 0x39, 0xce, 0x45, 0x91, 0x20, 0x26, 0xef, 0xc1, 0xa5, 0xc8, 0xae, 0x41, 0x03, 0xa2,
+        0x8f, 0xa9, 0x31, 0x53, 0x2a, 0xf0, 0xd7, 0x8d, 0x8b, 0x21, 0xa1, 0x15, 0xca, 0x23, 0xdd, 0xda,
+        0xd7, 0x12, 0xac, 0x47, 0xf7, 0x34, 0x23, 0x0e, 0xd6, 0x11, 0x00, 0xb1, 0x6d, 0x27, 0x48, 0x86,
+        0x6b, 0x31, 0x95, 0x17, 0xf4, 0xea, 0x8d, 0x58, 0x49, 0x4d, 0x18, 0xd8, 0x9a, 0x00, 0xcc, 0x24,
+        0x67, 0x86, 0xed, 0x32, 0x94, 0xc3, 0x2f, 0x47, 0xfc, 0xf3, 0xa3, 0xb8, 0xd9, 0x83, 0x80, 0xd8,
+        0x85, 0x0e, 0x6f, 0x42, 0xfe, 0x84, 0x8e, 0x4c, 0x3b, 0x7c, 0x0f, 0x16, 0x8d, 0xe8, 0xfd, 0x25,
+        0x17, 0xbf, 0xbf, 0xec, 0xff, 0x46, 0x82, 0x0d, 0xdd, 0x99, 0xcc, 0xfb, 0xbb, 0x8f, 0xe6, 0x9e,
+        0x17, 0xfc, 0x8f, 0xa5, 0xcf, 0x3f, 0x1a, 0x99, 0xc1, 0x78, 0x7a, 0x52, 0xd7, 0x9d, 0xc9, 0xee,
+        0xc8, 0xb1, 0x88, 0x3d, 0x9a, 0x7d, 0x3f, 0xe5, 0x7f, 0xf4, 0x1b, 0x23, 0x6a, 0xdf, 0x18, 0x39,
+        0x89, 0xaf, 0xa9, 0xf7, 0x66, 0x7f, 0xff, 0x27, 0x49, 0x7f, 0xca, 0x64, 0x0f, 0x7a, 0xfb, 0x7f,
+        0xce, 0x6c, 0x1d, 0x88, 0xee, 0x7a, 0x51, 0x78, 0x54, 0x3a, 0xb4, 0xa8, 0xce, 0x86, 0xfc, 0xff,
+        0x00, 0x00, 0x00, 0xff, 0xff, 0x3e, 0xe8, 0xef, 0xc4, 0x9b, 0x1d, 0x00, 0x00,
+}
diff --git a/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.proto b/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.proto
new file mode 100644
index 0000000..ed08fcb
--- /dev/null
+++ b/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.proto
@@ -0,0 +1,883 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Author: kenton@google.com (Kenton Varda)
+//  Based on original Protocol Buffers design by
+//  Sanjay Ghemawat, Jeff Dean, and others.
+//
+// The messages in this file describe the definitions found in .proto files.
+// A valid .proto file can be translated directly to a FileDescriptorProto
+// without any other information (e.g. without reading its imports).
+
+
+syntax = "proto2";
+
+package google.protobuf;
+option go_package = "github.com/golang/protobuf/protoc-gen-go/descriptor;descriptor";
+option java_package = "com.google.protobuf";
+option java_outer_classname = "DescriptorProtos";
+option csharp_namespace = "Google.Protobuf.Reflection";
+option objc_class_prefix = "GPB";
+option cc_enable_arenas = true;
+
+// descriptor.proto must be optimized for speed because reflection-based
+// algorithms don't work during bootstrapping.
+option optimize_for = SPEED;
+
+// The protocol compiler can output a FileDescriptorSet containing the .proto
+// files it parses.
+message FileDescriptorSet {
+  repeated FileDescriptorProto file = 1;
+}
+
+// Describes a complete .proto file.
+message FileDescriptorProto {
+  optional string name = 1;       // file name, relative to root of source tree
+  optional string package = 2;    // e.g. "foo", "foo.bar", etc.
+
+  // Names of files imported by this file.
+  repeated string dependency = 3;
+  // Indexes of the public imported files in the dependency list above.
+  repeated int32 public_dependency = 10;
+  // Indexes of the weak imported files in the dependency list.
+  // For Google-internal migration only. Do not use.
+  repeated int32 weak_dependency = 11;
+
+  // All top-level definitions in this file.
+  repeated DescriptorProto message_type = 4;
+  repeated EnumDescriptorProto enum_type = 5;
+  repeated ServiceDescriptorProto service = 6;
+  repeated FieldDescriptorProto extension = 7;
+
+  optional FileOptions options = 8;
+
+  // This field contains optional information about the original source code.
+  // You may safely remove this entire field without harming runtime
+  // functionality of the descriptors -- the information is needed only by
+  // development tools.
+  optional SourceCodeInfo source_code_info = 9;
+
+  // The syntax of the proto file.
+  // The supported values are "proto2" and "proto3".
+  optional string syntax = 12;
+}
+
+// Describes a message type.
+message DescriptorProto {
+  optional string name = 1;
+
+  repeated FieldDescriptorProto field = 2;
+  repeated FieldDescriptorProto extension = 6;
+
+  repeated DescriptorProto nested_type = 3;
+  repeated EnumDescriptorProto enum_type = 4;
+
+  message ExtensionRange {
+    optional int32 start = 1;
+    optional int32 end = 2;
+
+    optional ExtensionRangeOptions options = 3;
+  }
+  repeated ExtensionRange extension_range = 5;
+
+  repeated OneofDescriptorProto oneof_decl = 8;
+
+  optional MessageOptions options = 7;
+
+  // Range of reserved tag numbers. Reserved tag numbers may not be used by
+  // fields or extension ranges in the same message. Reserved ranges may
+  // not overlap.
+  message ReservedRange {
+    optional int32 start = 1; // Inclusive.
+    optional int32 end = 2;   // Exclusive.
+  }
+  repeated ReservedRange reserved_range = 9;
+  // Reserved field names, which may not be used by fields in the same message.
+  // A given name may only be reserved once.
+  repeated string reserved_name = 10;
+}
+
+message ExtensionRangeOptions {
+  // The parser stores options it doesn't recognize here. See above.
+  repeated UninterpretedOption uninterpreted_option = 999;
+
+  // Clients can define custom options in extensions of this message. See above.
+  extensions 1000 to max;
+}
+
+// Describes a field within a message.
+message FieldDescriptorProto {
+  enum Type {
+    // 0 is reserved for errors.
+    // Order is weird for historical reasons.
+    TYPE_DOUBLE         = 1;
+    TYPE_FLOAT          = 2;
+    // Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT64 if
+    // negative values are likely.
+    TYPE_INT64          = 3;
+    TYPE_UINT64         = 4;
+    // Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT32 if
+    // negative values are likely.
+    TYPE_INT32          = 5;
+    TYPE_FIXED64        = 6;
+    TYPE_FIXED32        = 7;
+    TYPE_BOOL           = 8;
+    TYPE_STRING         = 9;
+    // Tag-delimited aggregate.
+    // Group type is deprecated and not supported in proto3. However, Proto3
+    // implementations should still be able to parse the group wire format and
+    // treat group fields as unknown fields.
+    TYPE_GROUP          = 10;
+    TYPE_MESSAGE        = 11;  // Length-delimited aggregate.
+
+    // New in version 2.
+    TYPE_BYTES          = 12;
+    TYPE_UINT32         = 13;
+    TYPE_ENUM           = 14;
+    TYPE_SFIXED32       = 15;
+    TYPE_SFIXED64       = 16;
+    TYPE_SINT32         = 17;  // Uses ZigZag encoding.
+    TYPE_SINT64         = 18;  // Uses ZigZag encoding.
+  };
+
+  enum Label {
+    // 0 is reserved for errors
+    LABEL_OPTIONAL      = 1;
+    LABEL_REQUIRED      = 2;
+    LABEL_REPEATED      = 3;
+  };
+
+  optional string name = 1;
+  optional int32 number = 3;
+  optional Label label = 4;
+
+  // If type_name is set, this need not be set.  If both this and type_name
+  // are set, this must be one of TYPE_ENUM, TYPE_MESSAGE or TYPE_GROUP.
+  optional Type type = 5;
+
+  // For message and enum types, this is the name of the type.  If the name
+  // starts with a '.', it is fully-qualified.  Otherwise, C++-like scoping
+  // rules are used to find the type (i.e. first the nested types within this
+  // message are searched, then within the parent, on up to the root
+  // namespace).
+  optional string type_name = 6;
+
+  // For extensions, this is the name of the type being extended.  It is
+  // resolved in the same manner as type_name.
+  optional string extendee = 2;
+
+  // For numeric types, contains the original text representation of the value.
+  // For booleans, "true" or "false".
+  // For strings, contains the default text contents (not escaped in any way).
+  // For bytes, contains the C escaped value.  All bytes >= 128 are escaped.
+  // TODO(kenton):  Base-64 encode?
+  optional string default_value = 7;
+
+  // If set, gives the index of a oneof in the containing type's oneof_decl
+  // list.  This field is a member of that oneof.
+  optional int32 oneof_index = 9;
+
+  // JSON name of this field. The value is set by protocol compiler. If the
+  // user has set a "json_name" option on this field, that option's value
+  // will be used. Otherwise, it's deduced from the field's name by converting
+  // it to camelCase.
+  optional string json_name = 10;
+
+  optional FieldOptions options = 8;
+}
+
+// Describes a oneof.
+message OneofDescriptorProto {
+  optional string name = 1;
+  optional OneofOptions options = 2;
+}
+
+// Describes an enum type.
+message EnumDescriptorProto {
+  optional string name = 1;
+
+  repeated EnumValueDescriptorProto value = 2;
+
+  optional EnumOptions options = 3;
+
+  // Range of reserved numeric values. Reserved values may not be used by
+  // entries in the same enum. Reserved ranges may not overlap.
+  //
+  // Note that this is distinct from DescriptorProto.ReservedRange in that it
+  // is inclusive such that it can appropriately represent the entire int32
+  // domain.
+  message EnumReservedRange {
+    optional int32 start = 1; // Inclusive.
+    optional int32 end = 2;   // Inclusive.
+  }
+
+  // Range of reserved numeric values. Reserved numeric values may not be used
+  // by enum values in the same enum declaration. Reserved ranges may not
+  // overlap.
+  repeated EnumReservedRange reserved_range = 4;
+
+  // Reserved enum value names, which may not be reused. A given name may only
+  // be reserved once.
+  repeated string reserved_name = 5;
+}
+
+// Describes a value within an enum.
+message EnumValueDescriptorProto {
+  optional string name = 1;
+  optional int32 number = 2;
+
+  optional EnumValueOptions options = 3;
+}
+
+// Describes a service.
+message ServiceDescriptorProto {
+  optional string name = 1;
+  repeated MethodDescriptorProto method = 2;
+
+  optional ServiceOptions options = 3;
+}
+
+// Describes a method of a service.
+message MethodDescriptorProto {
+  optional string name = 1;
+
+  // Input and output type names.  These are resolved in the same way as
+  // FieldDescriptorProto.type_name, but must refer to a message type.
+  optional string input_type = 2;
+  optional string output_type = 3;
+
+  optional MethodOptions options = 4;
+
+  // Identifies if client streams multiple client messages
+  optional bool client_streaming = 5 [default=false];
+  // Identifies if server streams multiple server messages
+  optional bool server_streaming = 6 [default=false];
+}
+
+
+// ===================================================================
+// Options
+
+// Each of the definitions above may have "options" attached.  These are
+// just annotations which may cause code to be generated slightly differently
+// or may contain hints for code that manipulates protocol messages.
+//
+// Clients may define custom options as extensions of the *Options messages.
+// These extensions may not yet be known at parsing time, so the parser cannot
+// store the values in them.  Instead it stores them in a field in the *Options
+// message called uninterpreted_option. This field must have the same name
+// across all *Options messages. We then use this field to populate the
+// extensions when we build a descriptor, at which point all protos have been
+// parsed and so all extensions are known.
+//
+// Extension numbers for custom options may be chosen as follows:
+// * For options which will only be used within a single application or
+//   organization, or for experimental options, use field numbers 50000
+//   through 99999.  It is up to you to ensure that you do not use the
+//   same number for multiple options.
+// * For options which will be published and used publicly by multiple
+//   independent entities, e-mail protobuf-global-extension-registry@google.com
+//   to reserve extension numbers. Simply provide your project name (e.g.
+//   Objective-C plugin) and your project website (if available) -- there's no
+//   need to explain how you intend to use them. Usually you only need one
+//   extension number. You can declare multiple options with only one extension
+//   number by putting them in a sub-message. See the Custom Options section of
+//   the docs for examples:
+//   https://developers.google.com/protocol-buffers/docs/proto#options
+//   If this turns out to be popular, a web service will be set up
+//   to automatically assign option numbers.
+
+
+message FileOptions {
+
+  // Sets the Java package where classes generated from this .proto will be
+  // placed.  By default, the proto package is used, but this is often
+  // inappropriate because proto packages do not normally start with backwards
+  // domain names.
+  optional string java_package = 1;
+
+
+  // If set, all the classes from the .proto file are wrapped in a single
+  // outer class with the given name.  This applies to both Proto1
+  // (equivalent to the old "--one_java_file" option) and Proto2 (where
+  // a .proto always translates to a single class, but you may want to
+  // explicitly choose the class name).
+  optional string java_outer_classname = 8;
+
+  // If set true, then the Java code generator will generate a separate .java
+  // file for each top-level message, enum, and service defined in the .proto
+  // file.  Thus, these types will *not* be nested inside the outer class
+  // named by java_outer_classname.  However, the outer class will still be
+  // generated to contain the file's getDescriptor() method as well as any
+  // top-level extensions defined in the file.
+  optional bool java_multiple_files = 10 [default=false];
+
+  // This option does nothing.
+  optional bool java_generate_equals_and_hash = 20 [deprecated=true];
+
+  // If set true, then the Java2 code generator will generate code that
+  // throws an exception whenever an attempt is made to assign a non-UTF-8
+  // byte sequence to a string field.
+  // Message reflection will do the same.
+  // However, an extension field still accepts non-UTF-8 byte sequences.
+  // This option has no effect on when used with the lite runtime.
+  optional bool java_string_check_utf8 = 27 [default=false];
+
+
+  // Generated classes can be optimized for speed or code size.
+  enum OptimizeMode {
+    SPEED = 1;        // Generate complete code for parsing, serialization,
+                      // etc.
+    CODE_SIZE = 2;    // Use ReflectionOps to implement these methods.
+    LITE_RUNTIME = 3; // Generate code using MessageLite and the lite runtime.
+  }
+  optional OptimizeMode optimize_for = 9 [default=SPEED];
+
+  // Sets the Go package where structs generated from this .proto will be
+  // placed. If omitted, the Go package will be derived from the following:
+  //   - The basename of the package import path, if provided.
+  //   - Otherwise, the package statement in the .proto file, if present.
+  //   - Otherwise, the basename of the .proto file, without extension.
+  optional string go_package = 11;
+
+
+
+  // Should generic services be generated in each language?  "Generic" services
+  // are not specific to any particular RPC system.  They are generated by the
+  // main code generators in each language (without additional plugins).
+  // Generic services were the only kind of service generation supported by
+  // early versions of google.protobuf.
+  //
+  // Generic services are now considered deprecated in favor of using plugins
+  // that generate code specific to your particular RPC system.  Therefore,
+  // these default to false.  Old code which depends on generic services should
+  // explicitly set them to true.
+  optional bool cc_generic_services = 16 [default=false];
+  optional bool java_generic_services = 17 [default=false];
+  optional bool py_generic_services = 18 [default=false];
+  optional bool php_generic_services = 42 [default=false];
+
+  // Is this file deprecated?
+  // Depending on the target platform, this can emit Deprecated annotations
+  // for everything in the file, or it will be completely ignored; in the very
+  // least, this is a formalization for deprecating files.
+  optional bool deprecated = 23 [default=false];
+
+  // Enables the use of arenas for the proto messages in this file. This applies
+  // only to generated classes for C++.
+  optional bool cc_enable_arenas = 31 [default=false];
+
+
+  // Sets the objective c class prefix which is prepended to all objective c
+  // generated classes from this .proto. There is no default.
+  optional string objc_class_prefix = 36;
+
+  // Namespace for generated classes; defaults to the package.
+  optional string csharp_namespace = 37;
+
+  // By default Swift generators will take the proto package and CamelCase it
+  // replacing '.' with underscore and use that to prefix the types/symbols
+  // defined. When this options is provided, they will use this value instead
+  // to prefix the types/symbols defined.
+  optional string swift_prefix = 39;
+
+  // Sets the php class prefix which is prepended to all php generated classes
+  // from this .proto. Default is empty.
+  optional string php_class_prefix = 40;
+
+  // Use this option to change the namespace of php generated classes. Default
+  // is empty. When this option is empty, the package name will be used for
+  // determining the namespace.
+  optional string php_namespace = 41;
+
+
+  // Use this option to change the namespace of php generated metadata classes.
+  // Default is empty. When this option is empty, the proto file name will be used
+  // for determining the namespace.
+  optional string php_metadata_namespace = 44;
+
+  // Use this option to change the package of ruby generated classes. Default
+  // is empty. When this option is not set, the package name will be used for
+  // determining the ruby package.
+  optional string ruby_package = 45;
+
+  // The parser stores options it doesn't recognize here.
+  // See the documentation for the "Options" section above.
+  repeated UninterpretedOption uninterpreted_option = 999;
+
+  // Clients can define custom options in extensions of this message.
+  // See the documentation for the "Options" section above.
+  extensions 1000 to max;
+
+  reserved 38;
+}
+
+message MessageOptions {
+  // Set true to use the old proto1 MessageSet wire format for extensions.
+  // This is provided for backwards-compatibility with the MessageSet wire
+  // format.  You should not use this for any other reason:  It's less
+  // efficient, has fewer features, and is more complicated.
+  //
+  // The message must be defined exactly as follows:
+  //   message Foo {
+  //     option message_set_wire_format = true;
+  //     extensions 4 to max;
+  //   }
+  // Note that the message cannot have any defined fields; MessageSets only
+  // have extensions.
+  //
+  // All extensions of your type must be singular messages; e.g. they cannot
+  // be int32s, enums, or repeated messages.
+  //
+  // Because this is an option, the above two restrictions are not enforced by
+  // the protocol compiler.
+  optional bool message_set_wire_format = 1 [default=false];
+
+  // Disables the generation of the standard "descriptor()" accessor, which can
+  // conflict with a field of the same name.  This is meant to make migration
+  // from proto1 easier; new code should avoid fields named "descriptor".
+  optional bool no_standard_descriptor_accessor = 2 [default=false];
+
+  // Is this message deprecated?
+  // Depending on the target platform, this can emit Deprecated annotations
+  // for the message, or it will be completely ignored; in the very least,
+  // this is a formalization for deprecating messages.
+  optional bool deprecated = 3 [default=false];
+
+  // Whether the message is an automatically generated map entry type for the
+  // maps field.
+  //
+  // For maps fields:
+  //     map<KeyType, ValueType> map_field = 1;
+  // The parsed descriptor looks like:
+  //     message MapFieldEntry {
+  //         option map_entry = true;
+  //         optional KeyType key = 1;
+  //         optional ValueType value = 2;
+  //     }
+  //     repeated MapFieldEntry map_field = 1;
+  //
+  // Implementations may choose not to generate the map_entry=true message, but
+  // use a native map in the target language to hold the keys and values.
+  // The reflection APIs in such implementions still need to work as
+  // if the field is a repeated message field.
+  //
+  // NOTE: Do not set the option in .proto files. Always use the maps syntax
+  // instead. The option should only be implicitly set by the proto compiler
+  // parser.
+  optional bool map_entry = 7;
+
+  reserved 8;  // javalite_serializable
+  reserved 9;  // javanano_as_lite
+
+  // The parser stores options it doesn't recognize here. See above.
+  repeated UninterpretedOption uninterpreted_option = 999;
+
+  // Clients can define custom options in extensions of this message. See above.
+  extensions 1000 to max;
+}
+
+message FieldOptions {
+  // The ctype option instructs the C++ code generator to use a different
+  // representation of the field than it normally would.  See the specific
+  // options below.  This option is not yet implemented in the open source
+  // release -- sorry, we'll try to include it in a future version!
+  optional CType ctype = 1 [default = STRING];
+  enum CType {
+    // Default mode.
+    STRING = 0;
+
+    CORD = 1;
+
+    STRING_PIECE = 2;
+  }
+  // The packed option can be enabled for repeated primitive fields to enable
+  // a more efficient representation on the wire. Rather than repeatedly
+  // writing the tag and type for each element, the entire array is encoded as
+  // a single length-delimited blob. In proto3, only explicit setting it to
+  // false will avoid using packed encoding.
+  optional bool packed = 2;
+
+  // The jstype option determines the JavaScript type used for values of the
+  // field.  The option is permitted only for 64 bit integral and fixed types
+  // (int64, uint64, sint64, fixed64, sfixed64).  A field with jstype JS_STRING
+  // is represented as JavaScript string, which avoids loss of precision that
+  // can happen when a large value is converted to a floating point JavaScript.
+  // Specifying JS_NUMBER for the jstype causes the generated JavaScript code to
+  // use the JavaScript "number" type.  The behavior of the default option
+  // JS_NORMAL is implementation dependent.
+  //
+  // This option is an enum to permit additional types to be added, e.g.
+  // goog.math.Integer.
+  optional JSType jstype = 6 [default = JS_NORMAL];
+  enum JSType {
+    // Use the default type.
+    JS_NORMAL = 0;
+
+    // Use JavaScript strings.
+    JS_STRING = 1;
+
+    // Use JavaScript numbers.
+    JS_NUMBER = 2;
+  }
+
+  // Should this field be parsed lazily?  Lazy applies only to message-type
+  // fields.  It means that when the outer message is initially parsed, the
+  // inner message's contents will not be parsed but instead stored in encoded
+  // form.  The inner message will actually be parsed when it is first accessed.
+  //
+  // This is only a hint.  Implementations are free to choose whether to use
+  // eager or lazy parsing regardless of the value of this option.  However,
+  // setting this option true suggests that the protocol author believes that
+  // using lazy parsing on this field is worth the additional bookkeeping
+  // overhead typically needed to implement it.
+  //
+  // This option does not affect the public interface of any generated code;
+  // all method signatures remain the same.  Furthermore, thread-safety of the
+  // interface is not affected by this option; const methods remain safe to
+  // call from multiple threads concurrently, while non-const methods continue
+  // to require exclusive access.
+  //
+  //
+  // Note that implementations may choose not to check required fields within
+  // a lazy sub-message.  That is, calling IsInitialized() on the outer message
+  // may return true even if the inner message has missing required fields.
+  // This is necessary because otherwise the inner message would have to be
+  // parsed in order to perform the check, defeating the purpose of lazy
+  // parsing.  An implementation which chooses not to check required fields
+  // must be consistent about it.  That is, for any particular sub-message, the
+  // implementation must either *always* check its required fields, or *never*
+  // check its required fields, regardless of whether or not the message has
+  // been parsed.
+  optional bool lazy = 5 [default=false];
+
+  // Is this field deprecated?
+  // Depending on the target platform, this can emit Deprecated annotations
+  // for accessors, or it will be completely ignored; in the very least, this
+  // is a formalization for deprecating fields.
+  optional bool deprecated = 3 [default=false];
+
+  // For Google-internal migration only. Do not use.
+  optional bool weak = 10 [default=false];
+
+
+  // The parser stores options it doesn't recognize here. See above.
+  repeated UninterpretedOption uninterpreted_option = 999;
+
+  // Clients can define custom options in extensions of this message. See above.
+  extensions 1000 to max;
+
+  reserved 4;  // removed jtype
+}
+
+message OneofOptions {
+  // The parser stores options it doesn't recognize here. See above.
+  repeated UninterpretedOption uninterpreted_option = 999;
+
+  // Clients can define custom options in extensions of this message. See above.
+  extensions 1000 to max;
+}
+
+message EnumOptions {
+
+  // Set this option to true to allow mapping different tag names to the same
+  // value.
+  optional bool allow_alias = 2;
+
+  // Is this enum deprecated?
+  // Depending on the target platform, this can emit Deprecated annotations
+  // for the enum, or it will be completely ignored; in the very least, this
+  // is a formalization for deprecating enums.
+  optional bool deprecated = 3 [default=false];
+
+  reserved 5;  // javanano_as_lite
+
+  // The parser stores options it doesn't recognize here. See above.
+  repeated UninterpretedOption uninterpreted_option = 999;
+
+  // Clients can define custom options in extensions of this message. See above.
+  extensions 1000 to max;
+}
+
+message EnumValueOptions {
+  // Is this enum value deprecated?
+  // Depending on the target platform, this can emit Deprecated annotations
+  // for the enum value, or it will be completely ignored; in the very least,
+  // this is a formalization for deprecating enum values.
+  optional bool deprecated = 1 [default=false];
+
+  // The parser stores options it doesn't recognize here. See above.
+  repeated UninterpretedOption uninterpreted_option = 999;
+
+  // Clients can define custom options in extensions of this message. See above.
+  extensions 1000 to max;
+}
+
+message ServiceOptions {
+
+  // Note:  Field numbers 1 through 32 are reserved for Google's internal RPC
+  //   framework.  We apologize for hoarding these numbers to ourselves, but
+  //   we were already using them long before we decided to release Protocol
+  //   Buffers.
+
+  // Is this service deprecated?
+  // Depending on the target platform, this can emit Deprecated annotations
+  // for the service, or it will be completely ignored; in the very least,
+  // this is a formalization for deprecating services.
+  optional bool deprecated = 33 [default=false];
+
+  // The parser stores options it doesn't recognize here. See above.
+  repeated UninterpretedOption uninterpreted_option = 999;
+
+  // Clients can define custom options in extensions of this message. See above.
+  extensions 1000 to max;
+}
+
+message MethodOptions {
+
+  // Note:  Field numbers 1 through 32 are reserved for Google's internal RPC
+  //   framework.  We apologize for hoarding these numbers to ourselves, but
+  //   we were already using them long before we decided to release Protocol
+  //   Buffers.
+
+  // Is this method deprecated?
+  // Depending on the target platform, this can emit Deprecated annotations
+  // for the method, or it will be completely ignored; in the very least,
+  // this is a formalization for deprecating methods.
+  optional bool deprecated = 33 [default=false];
+
+  // Is this method side-effect-free (or safe in HTTP parlance), or idempotent,
+  // or neither? HTTP based RPC implementation may choose GET verb for safe
+  // methods, and PUT verb for idempotent methods instead of the default POST.
+  enum IdempotencyLevel {
+    IDEMPOTENCY_UNKNOWN = 0;
+    NO_SIDE_EFFECTS     = 1; // implies idempotent
+    IDEMPOTENT          = 2; // idempotent, but may have side effects
+  }
+  optional IdempotencyLevel idempotency_level =
+      34 [default=IDEMPOTENCY_UNKNOWN];
+
+  // The parser stores options it doesn't recognize here. See above.
+  repeated UninterpretedOption uninterpreted_option = 999;
+
+  // Clients can define custom options in extensions of this message. See above.
+  extensions 1000 to max;
+}
+
+
+// A message representing a option the parser does not recognize. This only
+// appears in options protos created by the compiler::Parser class.
+// DescriptorPool resolves these when building Descriptor objects. Therefore,
+// options protos in descriptor objects (e.g. returned by Descriptor::options(),
+// or produced by Descriptor::CopyTo()) will never have UninterpretedOptions
+// in them.
+message UninterpretedOption {
+  // The name of the uninterpreted option.  Each string represents a segment in
+  // a dot-separated name.  is_extension is true iff a segment represents an
+  // extension (denoted with parentheses in options specs in .proto files).
+  // E.g.,{ ["foo", false], ["bar.baz", true], ["qux", false] } represents
+  // "foo.(bar.baz).qux".
+  message NamePart {
+    required string name_part = 1;
+    required bool is_extension = 2;
+  }
+  repeated NamePart name = 2;
+
+  // The value of the uninterpreted option, in whatever type the tokenizer
+  // identified it as during parsing. Exactly one of these should be set.
+  optional string identifier_value = 3;
+  optional uint64 positive_int_value = 4;
+  optional int64 negative_int_value = 5;
+  optional double double_value = 6;
+  optional bytes string_value = 7;
+  optional string aggregate_value = 8;
+}
+
+// ===================================================================
+// Optional source code info
+
+// Encapsulates information about the original source file from which a
+// FileDescriptorProto was generated.
+message SourceCodeInfo {
+  // A Location identifies a piece of source code in a .proto file which
+  // corresponds to a particular definition.  This information is intended
+  // to be useful to IDEs, code indexers, documentation generators, and similar
+  // tools.
+  //
+  // For example, say we have a file like:
+  //   message Foo {
+  //     optional string foo = 1;
+  //   }
+  // Let's look at just the field definition:
+  //   optional string foo = 1;
+  //   ^       ^^     ^^  ^  ^^^
+  //   a       bc     de  f  ghi
+  // We have the following locations:
+  //   span   path               represents
+  //   [a,i)  [ 4, 0, 2, 0 ]     The whole field definition.
+  //   [a,b)  [ 4, 0, 2, 0, 4 ]  The label (optional).
+  //   [c,d)  [ 4, 0, 2, 0, 5 ]  The type (string).
+  //   [e,f)  [ 4, 0, 2, 0, 1 ]  The name (foo).
+  //   [g,h)  [ 4, 0, 2, 0, 3 ]  The number (1).
+  //
+  // Notes:
+  // - A location may refer to a repeated field itself (i.e. not to any
+  //   particular index within it).  This is used whenever a set of elements are
+  //   logically enclosed in a single code segment.  For example, an entire
+  //   extend block (possibly containing multiple extension definitions) will
+  //   have an outer location whose path refers to the "extensions" repeated
+  //   field without an index.
+  // - Multiple locations may have the same path.  This happens when a single
+  //   logical declaration is spread out across multiple places.  The most
+  //   obvious example is the "extend" block again -- there may be multiple
+  //   extend blocks in the same scope, each of which will have the same path.
+  // - A location's span is not always a subset of its parent's span.  For
+  //   example, the "extendee" of an extension declaration appears at the
+  //   beginning of the "extend" block and is shared by all extensions within
+  //   the block.
+  // - Just because a location's span is a subset of some other location's span
+  //   does not mean that it is a descendent.  For example, a "group" defines
+  //   both a type and a field in a single declaration.  Thus, the locations
+  //   corresponding to the type and field and their components will overlap.
+  // - Code which tries to interpret locations should probably be designed to
+  //   ignore those that it doesn't understand, as more types of locations could
+  //   be recorded in the future.
+  repeated Location location = 1;
+  message Location {
+    // Identifies which part of the FileDescriptorProto was defined at this
+    // location.
+    //
+    // Each element is a field number or an index.  They form a path from
+    // the root FileDescriptorProto to the place where the definition.  For
+    // example, this path:
+    //   [ 4, 3, 2, 7, 1 ]
+    // refers to:
+    //   file.message_type(3)  // 4, 3
+    //       .field(7)         // 2, 7
+    //       .name()           // 1
+    // This is because FileDescriptorProto.message_type has field number 4:
+    //   repeated DescriptorProto message_type = 4;
+    // and DescriptorProto.field has field number 2:
+    //   repeated FieldDescriptorProto field = 2;
+    // and FieldDescriptorProto.name has field number 1:
+    //   optional string name = 1;
+    //
+    // Thus, the above path gives the location of a field name.  If we removed
+    // the last element:
+    //   [ 4, 3, 2, 7 ]
+    // this path refers to the whole field declaration (from the beginning
+    // of the label to the terminating semicolon).
+    repeated int32 path = 1 [packed=true];
+
+    // Always has exactly three or four elements: start line, start column,
+    // end line (optional, otherwise assumed same as start line), end column.
+    // These are packed into a single field for efficiency.  Note that line
+    // and column numbers are zero-based -- typically you will want to add
+    // 1 to each before displaying to a user.
+    repeated int32 span = 2 [packed=true];
+
+    // If this SourceCodeInfo represents a complete declaration, these are any
+    // comments appearing before and after the declaration which appear to be
+    // attached to the declaration.
+    //
+    // A series of line comments appearing on consecutive lines, with no other
+    // tokens appearing on those lines, will be treated as a single comment.
+    //
+    // leading_detached_comments will keep paragraphs of comments that appear
+    // before (but not connected to) the current element. Each paragraph,
+    // separated by empty lines, will be one comment element in the repeated
+    // field.
+    //
+    // Only the comment content is provided; comment markers (e.g. //) are
+    // stripped out.  For block comments, leading whitespace and an asterisk
+    // will be stripped from the beginning of each line other than the first.
+    // Newlines are included in the output.
+    //
+    // Examples:
+    //
+    //   optional int32 foo = 1;  // Comment attached to foo.
+    //   // Comment attached to bar.
+    //   optional int32 bar = 2;
+    //
+    //   optional string baz = 3;
+    //   // Comment attached to baz.
+    //   // Another line attached to baz.
+    //
+    //   // Comment attached to qux.
+    //   //
+    //   // Another line attached to qux.
+    //   optional double qux = 4;
+    //
+    //   // Detached comment for corge. This is not leading or trailing comments
+    //   // to qux or corge because there are blank lines separating it from
+    //   // both.
+    //
+    //   // Detached comment for corge paragraph 2.
+    //
+    //   optional string corge = 5;
+    //   /* Block comment attached
+    //    * to corge.  Leading asterisks
+    //    * will be removed. */
+    //   /* Block comment attached to
+    //    * grault. */
+    //   optional int32 grault = 6;
+    //
+    //   // ignored detached comments.
+    optional string leading_comments = 3;
+    optional string trailing_comments = 4;
+    repeated string leading_detached_comments = 6;
+  }
+}
+
+// Describes the relationship between generated code and its original source
+// file. A GeneratedCodeInfo message is associated with only one generated
+// source file, but may contain references to different source .proto files.
+message GeneratedCodeInfo {
+  // An Annotation connects some span of text in generated code to an element
+  // of its generating .proto file.
+  repeated Annotation annotation = 1;
+  message Annotation {
+    // Identifies the element in the original source .proto file. This field
+    // is formatted the same as SourceCodeInfo.Location.path.
+    repeated int32 path = 1 [packed=true];
+
+    // Identifies the filesystem path to the original source .proto.
+    optional string source_file = 2;
+
+    // Identifies the starting offset in bytes in the generated code
+    // that relates to the identified object.
+    optional int32 begin = 3;
+
+    // Identifies the ending offset in bytes in the generated code that
+    // relates to the identified offset. The end offset should be one past
+    // the last relevant byte (so the length of the text = end - begin).
+    optional int32 end = 4;
+  }
+}
diff --git a/vendor/github.com/golang/protobuf/ptypes/any/any.pb.go b/vendor/github.com/golang/protobuf/ptypes/any/any.pb.go
index e3c56d3..78ee523 100644
--- a/vendor/github.com/golang/protobuf/ptypes/any/any.pb.go
+++ b/vendor/github.com/golang/protobuf/ptypes/any/any.pb.go
@@ -1,11 +1,13 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // source: google/protobuf/any.proto
 
-package any // import "github.com/golang/protobuf/ptypes/any"
+package any
 
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
+import (
+        fmt "fmt"
+        proto "github.com/golang/protobuf/proto"
+        math "math"
+)
 
 // Reference imports to suppress errors if they are not otherwise used.
 var _ = proto.Marshal
@@ -16,7 +18,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
 
 // `Any` contains an arbitrary serialized protocol buffer message along with a
 // URL that describes the type of the serialized message.
@@ -99,17 +101,18 @@ const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 //     }
 //
 type Any struct {
-        // A URL/resource name whose content describes the type of the
-        // serialized protocol buffer message.
+        // A URL/resource name that uniquely identifies the type of the serialized
+        // protocol buffer message. The last segment of the URL's path must represent
+        // the fully qualified name of the type (as in
+        // `path/google.protobuf.Duration`). The name should be in a canonical form
+        // (e.g., leading "." is not accepted).
         //
-        // For URLs which use the scheme `http`, `https`, or no scheme, the
-        // following restrictions and interpretations apply:
+        // In practice, teams usually precompile into the binary all types that they
+        // expect it to use in the context of Any. However, for URLs which use the
+        // scheme `http`, `https`, or no scheme, one can optionally set up a type
+        // server that maps type URLs to message definitions as follows:
         //
         // * If no scheme is provided, `https` is assumed.
-        // * The last segment of the URL's path must represent the fully
-        //   qualified name of the type (as in `path/google.protobuf.Duration`).
-        //   The name should be in a canonical form (e.g., leading "." is
-        //   not accepted).
         // * An HTTP GET on the URL must yield a [google.protobuf.Type][]
         //   value in binary format, or produce an error.
         // * Applications are allowed to cache lookup results based on the
@@ -118,6 +121,10 @@ type Any struct {
         //   on changes to types. (Use versioned type names to manage
         //   breaking changes.)
         //
+        // Note: this functionality is not currently available in the official
+        // protobuf release, and it is not used for type URLs beginning with
+        // type.googleapis.com.
+        //
         // Schemes other than `http`, `https` (or the empty scheme) might be
         // used with implementation specific semantics.
         //
@@ -133,17 +140,19 @@ func (m *Any) Reset()         { *m = Any{} }
 func (m *Any) String() string { return proto.CompactTextString(m) }
 func (*Any) ProtoMessage()    {}
 func (*Any) Descriptor() ([]byte, []int) {
-        return fileDescriptor_any_744b9ca530f228db, []int{0}
+        return fileDescriptor_b53526c13ae22eb4, []int{0}
 }
+
 func (*Any) XXX_WellKnownType() string { return "Any" }
+
 func (m *Any) XXX_Unmarshal(b []byte) error {
         return xxx_messageInfo_Any.Unmarshal(m, b)
 }
 func (m *Any) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
         return xxx_messageInfo_Any.Marshal(b, m, deterministic)
 }
-func (dst *Any) XXX_Merge(src proto.Message) {
-        xxx_messageInfo_Any.Merge(dst, src)
+func (m *Any) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Any.Merge(m, src)
 }
 func (m *Any) XXX_Size() int {
         return xxx_messageInfo_Any.Size(m)
@@ -172,9 +181,9 @@ func init() {
         proto.RegisterType((*Any)(nil), "google.protobuf.Any")
 }
 
-func init() { proto.RegisterFile("google/protobuf/any.proto", fileDescriptor_any_744b9ca530f228db) }
+func init() { proto.RegisterFile("google/protobuf/any.proto", fileDescriptor_b53526c13ae22eb4) }
 
-var fileDescriptor_any_744b9ca530f228db = []byte{
+var fileDescriptor_b53526c13ae22eb4 = []byte{
         // 185 bytes of a gzipped FileDescriptorProto
         0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4c, 0xcf, 0xcf, 0x4f,
         0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0xcc, 0xab, 0xd4,
diff --git a/vendor/github.com/golang/protobuf/ptypes/any/any.proto b/vendor/github.com/golang/protobuf/ptypes/any/any.proto
index c748667..4932942 100644
--- a/vendor/github.com/golang/protobuf/ptypes/any/any.proto
+++ b/vendor/github.com/golang/protobuf/ptypes/any/any.proto
@@ -120,17 +120,18 @@ option objc_class_prefix = "GPB";
 //     }
 //
 message Any {
-  // A URL/resource name whose content describes the type of the
-  // serialized protocol buffer message.
+  // A URL/resource name that uniquely identifies the type of the serialized
+  // protocol buffer message. The last segment of the URL's path must represent
+  // the fully qualified name of the type (as in
+  // `path/google.protobuf.Duration`). The name should be in a canonical form
+  // (e.g., leading "." is not accepted).
   //
-  // For URLs which use the scheme `http`, `https`, or no scheme, the
-  // following restrictions and interpretations apply:
+  // In practice, teams usually precompile into the binary all types that they
+  // expect it to use in the context of Any. However, for URLs which use the
+  // scheme `http`, `https`, or no scheme, one can optionally set up a type
+  // server that maps type URLs to message definitions as follows:
   //
   // * If no scheme is provided, `https` is assumed.
-  // * The last segment of the URL's path must represent the fully
-  //   qualified name of the type (as in `path/google.protobuf.Duration`).
-  //   The name should be in a canonical form (e.g., leading "." is
-  //   not accepted).
   // * An HTTP GET on the URL must yield a [google.protobuf.Type][]
   //   value in binary format, or produce an error.
   // * Applications are allowed to cache lookup results based on the
@@ -139,6 +140,10 @@ message Any {
   //   on changes to types. (Use versioned type names to manage
   //   breaking changes.)
   //
+  // Note: this functionality is not currently available in the official
+  // protobuf release, and it is not used for type URLs beginning with
+  // type.googleapis.com.
+  //
   // Schemes other than `http`, `https` (or the empty scheme) might be
   // used with implementation specific semantics.
   //
diff --git a/vendor/github.com/golang/protobuf/ptypes/duration.go b/vendor/github.com/golang/protobuf/ptypes/duration.go
index 65cb0f8..26d1ca2 100644
--- a/vendor/github.com/golang/protobuf/ptypes/duration.go
+++ b/vendor/github.com/golang/protobuf/ptypes/duration.go
@@ -82,7 +82,7 @@ func Duration(p *durpb.Duration) (time.Duration, error) {
                 return 0, fmt.Errorf("duration: %v is out of range for time.Duration", p)
         }
         if p.Nanos != 0 {
-                d += time.Duration(p.Nanos)
+                d += time.Duration(p.Nanos) * time.Nanosecond
                 if (d < 0) != (p.Nanos < 0) {
                         return 0, fmt.Errorf("duration: %v is out of range for time.Duration", p)
                 }
diff --git a/vendor/github.com/golang/protobuf/ptypes/duration/duration.pb.go b/vendor/github.com/golang/protobuf/ptypes/duration/duration.pb.go
index a7beb2c..0d681ee 100644
--- a/vendor/github.com/golang/protobuf/ptypes/duration/duration.pb.go
+++ b/vendor/github.com/golang/protobuf/ptypes/duration/duration.pb.go
@@ -1,11 +1,13 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // source: google/protobuf/duration.proto
 
-package duration // import "github.com/golang/protobuf/ptypes/duration"
+package duration
 
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
+import (
+        fmt "fmt"
+        proto "github.com/golang/protobuf/proto"
+        math "math"
+)
 
 // Reference imports to suppress errors if they are not otherwise used.
 var _ = proto.Marshal
@@ -16,7 +18,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
 
 // A Duration represents a signed, fixed-length span of time represented
 // as a count of seconds and fractions of seconds at nanosecond
@@ -99,17 +101,19 @@ func (m *Duration) Reset()         { *m = Duration{} }
 func (m *Duration) String() string { return proto.CompactTextString(m) }
 func (*Duration) ProtoMessage()    {}
 func (*Duration) Descriptor() ([]byte, []int) {
-        return fileDescriptor_duration_e7d612259e3f0613, []int{0}
+        return fileDescriptor_23597b2ebd7ac6c5, []int{0}
 }
+
 func (*Duration) XXX_WellKnownType() string { return "Duration" }
+
 func (m *Duration) XXX_Unmarshal(b []byte) error {
         return xxx_messageInfo_Duration.Unmarshal(m, b)
 }
 func (m *Duration) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
         return xxx_messageInfo_Duration.Marshal(b, m, deterministic)
 }
-func (dst *Duration) XXX_Merge(src proto.Message) {
-        xxx_messageInfo_Duration.Merge(dst, src)
+func (m *Duration) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Duration.Merge(m, src)
 }
 func (m *Duration) XXX_Size() int {
         return xxx_messageInfo_Duration.Size(m)
@@ -138,11 +142,9 @@ func init() {
         proto.RegisterType((*Duration)(nil), "google.protobuf.Duration")
 }
 
-func init() {
-        proto.RegisterFile("google/protobuf/duration.proto", fileDescriptor_duration_e7d612259e3f0613)
-}
+func init() { proto.RegisterFile("google/protobuf/duration.proto", fileDescriptor_23597b2ebd7ac6c5) }
 
-var fileDescriptor_duration_e7d612259e3f0613 = []byte{
+var fileDescriptor_23597b2ebd7ac6c5 = []byte{
         // 190 bytes of a gzipped FileDescriptorProto
         0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4b, 0xcf, 0xcf, 0x4f,
         0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0x29, 0x2d, 0x4a,
diff --git a/vendor/github.com/golang/protobuf/ptypes/timestamp.go b/vendor/github.com/golang/protobuf/ptypes/timestamp.go
index 47f10db..8da0df0 100644
--- a/vendor/github.com/golang/protobuf/ptypes/timestamp.go
+++ b/vendor/github.com/golang/protobuf/ptypes/timestamp.go
@@ -111,11 +111,9 @@ func TimestampNow() *tspb.Timestamp {
 // TimestampProto converts the time.Time to a google.protobuf.Timestamp proto.
 // It returns an error if the resulting Timestamp is invalid.
 func TimestampProto(t time.Time) (*tspb.Timestamp, error) {
-        seconds := t.Unix()
-        nanos := int32(t.Sub(time.Unix(seconds, 0)))
         ts := &tspb.Timestamp{
-                Seconds: seconds,
-                Nanos:   nanos,
+                Seconds: t.Unix(),
+                Nanos:   int32(t.Nanosecond()),
         }
         if err := validateTimestamp(ts); err != nil {
                 return nil, err
diff --git a/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.pb.go b/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.pb.go
index 8e76ae9..31cd846 100644
--- a/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.pb.go
+++ b/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.pb.go
@@ -1,11 +1,13 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // source: google/protobuf/timestamp.proto
 
-package timestamp // import "github.com/golang/protobuf/ptypes/timestamp"
+package timestamp
 
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
+import (
+        fmt "fmt"
+        proto "github.com/golang/protobuf/proto"
+        math "math"
+)
 
 // Reference imports to suppress errors if they are not otherwise used.
 var _ = proto.Marshal
@@ -16,7 +18,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
 
 // A Timestamp represents a point in time independent of any time zone
 // or calendar, represented as seconds and fractions of seconds at
@@ -81,7 +83,9 @@ const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 // {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
 // seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
 // are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
-// is required, though only UTC (as indicated by "Z") is presently supported.
+// is required. A proto3 JSON serializer should always use UTC (as indicated by
+// "Z") when printing the Timestamp type and a proto3 JSON parser should be
+// able to accept both UTC and other timezones (as indicated by an offset).
 //
 // For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
 // 01:30 UTC on January 15, 2017.
@@ -92,8 +96,8 @@ const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 // to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime)
 // with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one
 // can use the Joda Time's [`ISODateTimeFormat.dateTime()`](
-// http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime--)
-// to obtain a formatter capable of generating timestamps in this format.
+// http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime--
+// ) to obtain a formatter capable of generating timestamps in this format.
 //
 //
 type Timestamp struct {
@@ -115,17 +119,19 @@ func (m *Timestamp) Reset()         { *m = Timestamp{} }
 func (m *Timestamp) String() string { return proto.CompactTextString(m) }
 func (*Timestamp) ProtoMessage()    {}
 func (*Timestamp) Descriptor() ([]byte, []int) {
-        return fileDescriptor_timestamp_b826e8e5fba671a8, []int{0}
+        return fileDescriptor_292007bbfe81227e, []int{0}
 }
+
 func (*Timestamp) XXX_WellKnownType() string { return "Timestamp" }
+
 func (m *Timestamp) XXX_Unmarshal(b []byte) error {
         return xxx_messageInfo_Timestamp.Unmarshal(m, b)
 }
 func (m *Timestamp) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
         return xxx_messageInfo_Timestamp.Marshal(b, m, deterministic)
 }
-func (dst *Timestamp) XXX_Merge(src proto.Message) {
-        xxx_messageInfo_Timestamp.Merge(dst, src)
+func (m *Timestamp) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Timestamp.Merge(m, src)
 }
 func (m *Timestamp) XXX_Size() int {
         return xxx_messageInfo_Timestamp.Size(m)
@@ -154,11 +160,9 @@ func init() {
         proto.RegisterType((*Timestamp)(nil), "google.protobuf.Timestamp")
 }
 
-func init() {
-        proto.RegisterFile("google/protobuf/timestamp.proto", fileDescriptor_timestamp_b826e8e5fba671a8)
-}
+func init() { proto.RegisterFile("google/protobuf/timestamp.proto", fileDescriptor_292007bbfe81227e) }
 
-var fileDescriptor_timestamp_b826e8e5fba671a8 = []byte{
+var fileDescriptor_292007bbfe81227e = []byte{
         // 191 bytes of a gzipped FileDescriptorProto
         0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4f, 0xcf, 0xcf, 0x4f,
         0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x2f, 0xc9, 0xcc, 0x4d,
diff --git a/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.proto b/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.proto
index 06750ab..eafb3fa 100644
--- a/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.proto
+++ b/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.proto
@@ -103,7 +103,9 @@ option objc_class_prefix = "GPB";
 // {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
 // seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
 // are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
-// is required, though only UTC (as indicated by "Z") is presently supported.
+// is required. A proto3 JSON serializer should always use UTC (as indicated by
+// "Z") when printing the Timestamp type and a proto3 JSON parser should be
+// able to accept both UTC and other timezones (as indicated by an offset).
 //
 // For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
 // 01:30 UTC on January 15, 2017.
@@ -114,8 +116,8 @@ option objc_class_prefix = "GPB";
 // to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime)
 // with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one
 // can use the Joda Time's [`ISODateTimeFormat.dateTime()`](
-// http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime--)
-// to obtain a formatter capable of generating timestamps in this format.
+// http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime--
+// ) to obtain a formatter capable of generating timestamps in this format.
 //
 //
 message Timestamp {
diff --git a/vendor/github.com/google/go-cmp/LICENSE b/vendor/github.com/google/go-cmp/LICENSE
new file mode 100644
index 0000000..32017f8
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/LICENSE
@@ -0,0 +1,27 @@
+Copyright (c) 2017 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/google/go-cmp/cmp/compare.go b/vendor/github.com/google/go-cmp/cmp/compare.go
new file mode 100644
index 0000000..7e215f2
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/compare.go
@@ -0,0 +1,553 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+// Package cmp determines equality of values.
+//
+// This package is intended to be a more powerful and safer alternative to
+// reflect.DeepEqual for comparing whether two values are semantically equal.
+//
+// The primary features of cmp are:
+//
+// • When the default behavior of equality does not suit the needs of the test,
+// custom equality functions can override the equality operation.
+// For example, an equality function may report floats as equal so long as they
+// are within some tolerance of each other.
+//
+// • Types that have an Equal method may use that method to determine equality.
+// This allows package authors to determine the equality operation for the types
+// that they define.
+//
+// • If no custom equality functions are used and no Equal method is defined,
+// equality is determined by recursively comparing the primitive kinds on both
+// values, much like reflect.DeepEqual. Unlike reflect.DeepEqual, unexported
+// fields are not compared by default; they result in panics unless suppressed
+// by using an Ignore option (see cmpopts.IgnoreUnexported) or explicitly compared
+// using the AllowUnexported option.
+package cmp
+
+import (
+        "fmt"
+        "reflect"
+
+        "github.com/google/go-cmp/cmp/internal/diff"
+        "github.com/google/go-cmp/cmp/internal/function"
+        "github.com/google/go-cmp/cmp/internal/value"
+)
+
+// BUG(dsnet): Maps with keys containing NaN values cannot be properly compared due to
+// the reflection package's inability to retrieve such entries. Equal will panic
+// anytime it comes across a NaN key, but this behavior may change.
+//
+// See https://golang.org/issue/11104 for more details.
+
+var nothing = reflect.Value{}
+
+// Equal reports whether x and y are equal by recursively applying the
+// following rules in the given order to x and y and all of their sub-values:
+//
+// • If two values are not of the same type, then they are never equal
+// and the overall result is false.
+//
+// • Let S be the set of all Ignore, Transformer, and Comparer options that
+// remain after applying all path filters, value filters, and type filters.
+// If at least one Ignore exists in S, then the comparison is ignored.
+// If the number of Transformer and Comparer options in S is greater than one,
+// then Equal panics because it is ambiguous which option to use.
+// If S contains a single Transformer, then use that to transform the current
+// values and recursively call Equal on the output values.
+// If S contains a single Comparer, then use that to compare the current values.
+// Otherwise, evaluation proceeds to the next rule.
+//
+// • If the values have an Equal method of the form "(T) Equal(T) bool" or
+// "(T) Equal(I) bool" where T is assignable to I, then use the result of
+// x.Equal(y) even if x or y is nil.
+// Otherwise, no such method exists and evaluation proceeds to the next rule.
+//
+// • Lastly, try to compare x and y based on their basic kinds.
+// Simple kinds like booleans, integers, floats, complex numbers, strings, and
+// channels are compared using the equivalent of the == operator in Go.
+// Functions are only equal if they are both nil, otherwise they are unequal.
+// Pointers are equal if the underlying values they point to are also equal.
+// Interfaces are equal if their underlying concrete values are also equal.
+//
+// Structs are equal if all of their fields are equal. If a struct contains
+// unexported fields, Equal panics unless the AllowUnexported option is used or
+// an Ignore option (e.g., cmpopts.IgnoreUnexported) ignores that field.
+//
+// Arrays, slices, and maps are equal if they are both nil or both non-nil
+// with the same length and the elements at each index or key are equal.
+// Note that a non-nil empty slice and a nil slice are not equal.
+// To equate empty slices and maps, consider using cmpopts.EquateEmpty.
+// Map keys are equal according to the == operator.
+// To use custom comparisons for map keys, consider using cmpopts.SortMaps.
+func Equal(x, y interface{}, opts ...Option) bool {
+        s := newState(opts)
+        s.compareAny(reflect.ValueOf(x), reflect.ValueOf(y))
+        return s.result.Equal()
+}
+
+// Diff returns a human-readable report of the differences between two values.
+// It returns an empty string if and only if Equal returns true for the same
+// input values and options. The output string will use the "-" symbol to
+// indicate elements removed from x, and the "+" symbol to indicate elements
+// added to y.
+//
+// Do not depend on this output being stable.
+func Diff(x, y interface{}, opts ...Option) string {
+        r := new(defaultReporter)
+        opts = Options{Options(opts), r}
+        eq := Equal(x, y, opts...)
+        d := r.String()
+        if (d == "") != eq {
+                panic("inconsistent difference and equality results")
+        }
+        return d
+}
+
+type state struct {
+        // These fields represent the "comparison state".
+        // Calling statelessCompare must not result in observable changes to these.
+        result   diff.Result // The current result of comparison
+        curPath  Path        // The current path in the value tree
+        reporter reporter    // Optional reporter used for difference formatting
+
+        // dynChecker triggers pseudo-random checks for option correctness.
+        // It is safe for statelessCompare to mutate this value.
+        dynChecker dynChecker
+
+        // These fields, once set by processOption, will not change.
+        exporters map[reflect.Type]bool // Set of structs with unexported field visibility
+        opts      Options               // List of all fundamental and filter options
+}
+
+func newState(opts []Option) *state {
+        s := new(state)
+        for _, opt := range opts {
+                s.processOption(opt)
+        }
+        return s
+}
+
+func (s *state) processOption(opt Option) {
+        switch opt := opt.(type) {
+        case nil:
+        case Options:
+                for _, o := range opt {
+                        s.processOption(o)
+                }
+        case coreOption:
+                type filtered interface {
+                        isFiltered() bool
+                }
+                if fopt, ok := opt.(filtered); ok && !fopt.isFiltered() {
+                        panic(fmt.Sprintf("cannot use an unfiltered option: %v", opt))
+                }
+                s.opts = append(s.opts, opt)
+        case visibleStructs:
+                if s.exporters == nil {
+                        s.exporters = make(map[reflect.Type]bool)
+                }
+                for t := range opt {
+                        s.exporters[t] = true
+                }
+        case reporter:
+                if s.reporter != nil {
+                        panic("difference reporter already registered")
+                }
+                s.reporter = opt
+        default:
+                panic(fmt.Sprintf("unknown option %T", opt))
+        }
+}
+
+// statelessCompare compares two values and returns the result.
+// This function is stateless in that it does not alter the current result,
+// or output to any registered reporters.
+func (s *state) statelessCompare(vx, vy reflect.Value) diff.Result {
+        // We do not save and restore the curPath because all of the compareX
+        // methods should properly push and pop from the path.
+        // It is an implementation bug if the contents of curPath differs from
+        // when calling this function to when returning from it.
+
+        oldResult, oldReporter := s.result, s.reporter
+        s.result = diff.Result{} // Reset result
+        s.reporter = nil         // Remove reporter to avoid spurious printouts
+        s.compareAny(vx, vy)
+        res := s.result
+        s.result, s.reporter = oldResult, oldReporter
+        return res
+}
+
+func (s *state) compareAny(vx, vy reflect.Value) {
+        // TODO: Support cyclic data structures.
+
+        // Rule 0: Differing types are never equal.
+        if !vx.IsValid() || !vy.IsValid() {
+                s.report(vx.IsValid() == vy.IsValid(), vx, vy)
+                return
+        }
+        if vx.Type() != vy.Type() {
+                s.report(false, vx, vy) // Possible for path to be empty
+                return
+        }
+        t := vx.Type()
+        if len(s.curPath) == 0 {
+                s.curPath.push(&pathStep{typ: t})
+                defer s.curPath.pop()
+        }
+        vx, vy = s.tryExporting(vx, vy)
+
+        // Rule 1: Check whether an option applies on this node in the value tree.
+        if s.tryOptions(vx, vy, t) {
+                return
+        }
+
+        // Rule 2: Check whether the type has a valid Equal method.
+        if s.tryMethod(vx, vy, t) {
+                return
+        }
+
+        // Rule 3: Recursively descend into each value's underlying kind.
+        switch t.Kind() {
+        case reflect.Bool:
+                s.report(vx.Bool() == vy.Bool(), vx, vy)
+                return
+        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+                s.report(vx.Int() == vy.Int(), vx, vy)
+                return
+        case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+                s.report(vx.Uint() == vy.Uint(), vx, vy)
+                return
+        case reflect.Float32, reflect.Float64:
+                s.report(vx.Float() == vy.Float(), vx, vy)
+                return
+        case reflect.Complex64, reflect.Complex128:
+                s.report(vx.Complex() == vy.Complex(), vx, vy)
+                return
+        case reflect.String:
+                s.report(vx.String() == vy.String(), vx, vy)
+                return
+        case reflect.Chan, reflect.UnsafePointer:
+                s.report(vx.Pointer() == vy.Pointer(), vx, vy)
+                return
+        case reflect.Func:
+                s.report(vx.IsNil() && vy.IsNil(), vx, vy)
+                return
+        case reflect.Ptr:
+                if vx.IsNil() || vy.IsNil() {
+                        s.report(vx.IsNil() && vy.IsNil(), vx, vy)
+                        return
+                }
+                s.curPath.push(&indirect{pathStep{t.Elem()}})
+                defer s.curPath.pop()
+                s.compareAny(vx.Elem(), vy.Elem())
+                return
+        case reflect.Interface:
+                if vx.IsNil() || vy.IsNil() {
+                        s.report(vx.IsNil() && vy.IsNil(), vx, vy)
+                        return
+                }
+                if vx.Elem().Type() != vy.Elem().Type() {
+                        s.report(false, vx.Elem(), vy.Elem())
+                        return
+                }
+                s.curPath.push(&typeAssertion{pathStep{vx.Elem().Type()}})
+                defer s.curPath.pop()
+                s.compareAny(vx.Elem(), vy.Elem())
+                return
+        case reflect.Slice:
+                if vx.IsNil() || vy.IsNil() {
+                        s.report(vx.IsNil() && vy.IsNil(), vx, vy)
+                        return
+                }
+                fallthrough
+        case reflect.Array:
+                s.compareArray(vx, vy, t)
+                return
+        case reflect.Map:
+                s.compareMap(vx, vy, t)
+                return
+        case reflect.Struct:
+                s.compareStruct(vx, vy, t)
+                return
+        default:
+                panic(fmt.Sprintf("%v kind not handled", t.Kind()))
+        }
+}
+
+func (s *state) tryExporting(vx, vy reflect.Value) (reflect.Value, reflect.Value) {
+        if sf, ok := s.curPath[len(s.curPath)-1].(*structField); ok && sf.unexported {
+                if sf.force {
+                        // Use unsafe pointer arithmetic to get read-write access to an
+                        // unexported field in the struct.
+                        vx = unsafeRetrieveField(sf.pvx, sf.field)
+                        vy = unsafeRetrieveField(sf.pvy, sf.field)
+                } else {
+                        // We are not allowed to export the value, so invalidate them
+                        // so that tryOptions can panic later if not explicitly ignored.
+                        vx = nothing
+                        vy = nothing
+                }
+        }
+        return vx, vy
+}
+
+func (s *state) tryOptions(vx, vy reflect.Value, t reflect.Type) bool {
+        // If there were no FilterValues, we will not detect invalid inputs,
+        // so manually check for them and append invalid if necessary.
+        // We still evaluate the options since an ignore can override invalid.
+        opts := s.opts
+        if !vx.IsValid() || !vy.IsValid() {
+                opts = Options{opts, invalid{}}
+        }
+
+        // Evaluate all filters and apply the remaining options.
+        if opt := opts.filter(s, vx, vy, t); opt != nil {
+                opt.apply(s, vx, vy)
+                return true
+        }
+        return false
+}
+
+func (s *state) tryMethod(vx, vy reflect.Value, t reflect.Type) bool {
+        // Check if this type even has an Equal method.
+        m, ok := t.MethodByName("Equal")
+        if !ok || !function.IsType(m.Type, function.EqualAssignable) {
+                return false
+        }
+
+        eq := s.callTTBFunc(m.Func, vx, vy)
+        s.report(eq, vx, vy)
+        return true
+}
+
+func (s *state) callTRFunc(f, v reflect.Value) reflect.Value {
+        v = sanitizeValue(v, f.Type().In(0))
+        if !s.dynChecker.Next() {
+                return f.Call([]reflect.Value{v})[0]
+        }
+
+        // Run the function twice and ensure that we get the same results back.
+        // We run in goroutines so that the race detector (if enabled) can detect
+        // unsafe mutations to the input.
+        c := make(chan reflect.Value)
+        go detectRaces(c, f, v)
+        want := f.Call([]reflect.Value{v})[0]
+        if got := <-c; !s.statelessCompare(got, want).Equal() {
+                // To avoid false-positives with non-reflexive equality operations,
+                // we sanity check whether a value is equal to itself.
+                if !s.statelessCompare(want, want).Equal() {
+                        return want
+                }
+                fn := getFuncName(f.Pointer())
+                panic(fmt.Sprintf("non-deterministic function detected: %s", fn))
+        }
+        return want
+}
+
+func (s *state) callTTBFunc(f, x, y reflect.Value) bool {
+        x = sanitizeValue(x, f.Type().In(0))
+        y = sanitizeValue(y, f.Type().In(1))
+        if !s.dynChecker.Next() {
+                return f.Call([]reflect.Value{x, y})[0].Bool()
+        }
+
+        // Swapping the input arguments is sufficient to check that
+        // f is symmetric and deterministic.
+        // We run in goroutines so that the race detector (if enabled) can detect
+        // unsafe mutations to the input.
+        c := make(chan reflect.Value)
+        go detectRaces(c, f, y, x)
+        want := f.Call([]reflect.Value{x, y})[0].Bool()
+        if got := <-c; !got.IsValid() || got.Bool() != want {
+                fn := getFuncName(f.Pointer())
+                panic(fmt.Sprintf("non-deterministic or non-symmetric function detected: %s", fn))
+        }
+        return want
+}
+
+func detectRaces(c chan<- reflect.Value, f reflect.Value, vs ...reflect.Value) {
+        var ret reflect.Value
+        defer func() {
+                recover() // Ignore panics, let the other call to f panic instead
+                c <- ret
+        }()
+        ret = f.Call(vs)[0]
+}
+
+// sanitizeValue converts nil interfaces of type T to those of type R,
+// assuming that T is assignable to R.
+// Otherwise, it returns the input value as is.
+func sanitizeValue(v reflect.Value, t reflect.Type) reflect.Value {
+        // TODO(dsnet): Remove this hacky workaround.
+        // See https://golang.org/issue/22143
+        if v.Kind() == reflect.Interface && v.IsNil() && v.Type() != t {
+                return reflect.New(t).Elem()
+        }
+        return v
+}
+
+func (s *state) compareArray(vx, vy reflect.Value, t reflect.Type) {
+        step := &sliceIndex{pathStep{t.Elem()}, 0, 0}
+        s.curPath.push(step)
+
+        // Compute an edit-script for slices vx and vy.
+        es := diff.Difference(vx.Len(), vy.Len(), func(ix, iy int) diff.Result {
+                step.xkey, step.ykey = ix, iy
+                return s.statelessCompare(vx.Index(ix), vy.Index(iy))
+        })
+
+        // Report the entire slice as is if the arrays are of primitive kind,
+        // and the arrays are different enough.
+        isPrimitive := false
+        switch t.Elem().Kind() {
+        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+                reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr,
+                reflect.Bool, reflect.Float32, reflect.Float64, reflect.Complex64, reflect.Complex128:
+                isPrimitive = true
+        }
+        if isPrimitive && es.Dist() > (vx.Len()+vy.Len())/4 {
+                s.curPath.pop() // Pop first since we are reporting the whole slice
+                s.report(false, vx, vy)
+                return
+        }
+
+        // Replay the edit-script.
+        var ix, iy int
+        for _, e := range es {
+                switch e {
+                case diff.UniqueX:
+                        step.xkey, step.ykey = ix, -1
+                        s.report(false, vx.Index(ix), nothing)
+                        ix++
+                case diff.UniqueY:
+                        step.xkey, step.ykey = -1, iy
+                        s.report(false, nothing, vy.Index(iy))
+                        iy++
+                default:
+                        step.xkey, step.ykey = ix, iy
+                        if e == diff.Identity {
+                                s.report(true, vx.Index(ix), vy.Index(iy))
+                        } else {
+                                s.compareAny(vx.Index(ix), vy.Index(iy))
+                        }
+                        ix++
+                        iy++
+                }
+        }
+        s.curPath.pop()
+        return
+}
+
+func (s *state) compareMap(vx, vy reflect.Value, t reflect.Type) {
+        if vx.IsNil() || vy.IsNil() {
+                s.report(vx.IsNil() && vy.IsNil(), vx, vy)
+                return
+        }
+
+        // We combine and sort the two map keys so that we can perform the
+        // comparisons in a deterministic order.
+        step := &mapIndex{pathStep: pathStep{t.Elem()}}
+        s.curPath.push(step)
+        defer s.curPath.pop()
+        for _, k := range value.SortKeys(append(vx.MapKeys(), vy.MapKeys()...)) {
+                step.key = k
+                vvx := vx.MapIndex(k)
+                vvy := vy.MapIndex(k)
+                switch {
+                case vvx.IsValid() && vvy.IsValid():
+                        s.compareAny(vvx, vvy)
+                case vvx.IsValid() && !vvy.IsValid():
+                        s.report(false, vvx, nothing)
+                case !vvx.IsValid() && vvy.IsValid():
+                        s.report(false, nothing, vvy)
+                default:
+                        // It is possible for both vvx and vvy to be invalid if the
+                        // key contained a NaN value in it. There is no way in
+                        // reflection to be able to retrieve these values.
+                        // See https://golang.org/issue/11104
+                        panic(fmt.Sprintf("%#v has map key with NaNs", s.curPath))
+                }
+        }
+}
+
+func (s *state) compareStruct(vx, vy reflect.Value, t reflect.Type) {
+        var vax, vay reflect.Value // Addressable versions of vx and vy
+
+        step := &structField{}
+        s.curPath.push(step)
+        defer s.curPath.pop()
+        for i := 0; i < t.NumField(); i++ {
+                vvx := vx.Field(i)
+                vvy := vy.Field(i)
+                step.typ = t.Field(i).Type
+                step.name = t.Field(i).Name
+                step.idx = i
+                step.unexported = !isExported(step.name)
+                if step.unexported {
+                        // Defer checking of unexported fields until later to give an
+                        // Ignore a chance to ignore the field.
+                        if !vax.IsValid() || !vay.IsValid() {
+                                // For unsafeRetrieveField to work, the parent struct must
+                                // be addressable. Create a new copy of the values if
+                                // necessary to make them addressable.
+                                vax = makeAddressable(vx)
+                                vay = makeAddressable(vy)
+                        }
+                        step.force = s.exporters[t]
+                        step.pvx = vax
+                        step.pvy = vay
+                        step.field = t.Field(i)
+                }
+                s.compareAny(vvx, vvy)
+        }
+}
+
+// report records the result of a single comparison.
+// It also calls Report if any reporter is registered.
+func (s *state) report(eq bool, vx, vy reflect.Value) {
+        if eq {
+                s.result.NSame++
+        } else {
+                s.result.NDiff++
+        }
+        if s.reporter != nil {
+                s.reporter.Report(vx, vy, eq, s.curPath)
+        }
+}
+
+// dynChecker tracks the state needed to periodically perform checks that
+// user provided functions are symmetric and deterministic.
+// The zero value is safe for immediate use.
+type dynChecker struct{ curr, next int }
+
+// Next increments the state and reports whether a check should be performed.
+//
+// Checks occur every Nth function call, where N is a triangular number:
+//      0 1 3 6 10 15 21 28 36 45 55 66 78 91 105 120 136 153 171 190 ...
+// See https://en.wikipedia.org/wiki/Triangular_number
+//
+// This sequence ensures that the cost of checks drops significantly as
+// the number of functions calls grows larger.
+func (dc *dynChecker) Next() bool {
+        ok := dc.curr == dc.next
+        if ok {
+                dc.curr = 0
+                dc.next++
+        }
+        dc.curr++
+        return ok
+}
+
+// makeAddressable returns a value that is always addressable.
+// It returns the input verbatim if it is already addressable,
+// otherwise it creates a new value and returns an addressable copy.
+func makeAddressable(v reflect.Value) reflect.Value {
+        if v.CanAddr() {
+                return v
+        }
+        vc := reflect.New(v.Type()).Elem()
+        vc.Set(v)
+        return vc
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/internal/diff/debug_disable.go b/vendor/github.com/google/go-cmp/cmp/internal/diff/debug_disable.go
new file mode 100644
index 0000000..42afa49
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/internal/diff/debug_disable.go
@@ -0,0 +1,17 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+// +build !debug
+
+package diff
+
+var debug debugger
+
+type debugger struct{}
+
+func (debugger) Begin(_, _ int, f EqualFunc, _, _ *EditScript) EqualFunc {
+        return f
+}
+func (debugger) Update() {}
+func (debugger) Finish() {}
diff --git a/vendor/github.com/google/go-cmp/cmp/internal/diff/debug_enable.go b/vendor/github.com/google/go-cmp/cmp/internal/diff/debug_enable.go
new file mode 100644
index 0000000..fd9f7f1
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/internal/diff/debug_enable.go
@@ -0,0 +1,122 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+// +build debug
+
+package diff
+
+import (
+        "fmt"
+        "strings"
+        "sync"
+        "time"
+)
+
+// The algorithm can be seen running in real-time by enabling debugging:
+//      go test -tags=debug -v
+//
+// Example output:
+//      === RUN   TestDifference/#34
+//      ┌───────────────────────────────┐
+//      │ \ · · · · · · · · · · · · · · │
+//      │ · # · · · · · · · · · · · · · │
+//      │ · \ · · · · · · · · · · · · · │
+//      │ · · \ · · · · · · · · · · · · │
+//      │ · · · X # · · · · · · · · · · │
+//      │ · · · # \ · · · · · · · · · · │
+//      │ · · · · · # # · · · · · · · · │
+//      │ · · · · · # \ · · · · · · · · │
+//      │ · · · · · · · \ · · · · · · · │
+//      │ · · · · · · · · \ · · · · · · │
+//      │ · · · · · · · · · \ · · · · · │
+//      │ · · · · · · · · · · \ · · # · │
+//      │ · · · · · · · · · · · \ # # · │
+//      │ · · · · · · · · · · · # # # · │
+//      │ · · · · · · · · · · # # # # · │
+//      │ · · · · · · · · · # # # # # · │
+//      │ · · · · · · · · · · · · · · \ │
+//      └───────────────────────────────┘
+//      [.Y..M.XY......YXYXY.|]
+//
+// The grid represents the edit-graph where the horizontal axis represents
+// list X and the vertical axis represents list Y. The start of the two lists
+// is the top-left, while the ends are the bottom-right. The '·' represents
+// an unexplored node in the graph. The '\' indicates that the two symbols
+// from list X and Y are equal. The 'X' indicates that two symbols are similar
+// (but not exactly equal) to each other. The '#' indicates that the two symbols
+// are different (and not similar). The algorithm traverses this graph trying to
+// make the paths starting in the top-left and the bottom-right connect.
+//
+// The series of '.', 'X', 'Y', and 'M' characters at the bottom represents
+// the currently established path from the forward and reverse searches,
+// separated by a '|' character.
+
+const (
+        updateDelay  = 100 * time.Millisecond
+        finishDelay  = 500 * time.Millisecond
+        ansiTerminal = true // ANSI escape codes used to move terminal cursor
+)
+
+var debug debugger
+
+type debugger struct {
+        sync.Mutex
+        p1, p2           EditScript
+        fwdPath, revPath *EditScript
+        grid             []byte
+        lines            int
+}
+
+func (dbg *debugger) Begin(nx, ny int, f EqualFunc, p1, p2 *EditScript) EqualFunc {
+        dbg.Lock()
+        dbg.fwdPath, dbg.revPath = p1, p2
+        top := "┌─" + strings.Repeat("──", nx) + "┐\n"
+        row := "│ " + strings.Repeat("· ", nx) + "│\n"
+        btm := "└─" + strings.Repeat("──", nx) + "┘\n"
+        dbg.grid = []byte(top + strings.Repeat(row, ny) + btm)
+        dbg.lines = strings.Count(dbg.String(), "\n")
+        fmt.Print(dbg)
+
+        // Wrap the EqualFunc so that we can intercept each result.
+        return func(ix, iy int) (r Result) {
+                cell := dbg.grid[len(top)+iy*len(row):][len("│ ")+len("· ")*ix:][:len("·")]
+                for i := range cell {
+                        cell[i] = 0 // Zero out the multiple bytes of UTF-8 middle-dot
+                }
+                switch r = f(ix, iy); {
+                case r.Equal():
+                        cell[0] = '\\'
+                case r.Similar():
+                        cell[0] = 'X'
+                default:
+                        cell[0] = '#'
+                }
+                return
+        }
+}
+
+func (dbg *debugger) Update() {
+        dbg.print(updateDelay)
+}
+
+func (dbg *debugger) Finish() {
+        dbg.print(finishDelay)
+        dbg.Unlock()
+}
+
+func (dbg *debugger) String() string {
+        dbg.p1, dbg.p2 = *dbg.fwdPath, dbg.p2[:0]
+        for i := len(*dbg.revPath) - 1; i >= 0; i-- {
+                dbg.p2 = append(dbg.p2, (*dbg.revPath)[i])
+        }
+        return fmt.Sprintf("%s[%v|%v]\n\n", dbg.grid, dbg.p1, dbg.p2)
+}
+
+func (dbg *debugger) print(d time.Duration) {
+        if ansiTerminal {
+                fmt.Printf("\x1b[%dA", dbg.lines) // Reset terminal cursor
+        }
+        fmt.Print(dbg)
+        time.Sleep(d)
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/internal/diff/diff.go b/vendor/github.com/google/go-cmp/cmp/internal/diff/diff.go
new file mode 100644
index 0000000..260befe
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/internal/diff/diff.go
@@ -0,0 +1,363 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+// Package diff implements an algorithm for producing edit-scripts.
+// The edit-script is a sequence of operations needed to transform one list
+// of symbols into another (or vice-versa). The edits allowed are insertions,
+// deletions, and modifications. The summation of all edits is called the
+// Levenshtein distance as this problem is well-known in computer science.
+//
+// This package prioritizes performance over accuracy. That is, the run time
+// is more important than obtaining a minimal Levenshtein distance.
+package diff
+
+// EditType represents a single operation within an edit-script.
+type EditType uint8
+
+const (
+        // Identity indicates that a symbol pair is identical in both list X and Y.
+        Identity EditType = iota
+        // UniqueX indicates that a symbol only exists in X and not Y.
+        UniqueX
+        // UniqueY indicates that a symbol only exists in Y and not X.
+        UniqueY
+        // Modified indicates that a symbol pair is a modification of each other.
+        Modified
+)
+
+// EditScript represents the series of differences between two lists.
+type EditScript []EditType
+
+// String returns a human-readable string representing the edit-script where
+// Identity, UniqueX, UniqueY, and Modified are represented by the
+// '.', 'X', 'Y', and 'M' characters, respectively.
+func (es EditScript) String() string {
+        b := make([]byte, len(es))
+        for i, e := range es {
+                switch e {
+                case Identity:
+                        b[i] = '.'
+                case UniqueX:
+                        b[i] = 'X'
+                case UniqueY:
+                        b[i] = 'Y'
+                case Modified:
+                        b[i] = 'M'
+                default:
+                        panic("invalid edit-type")
+                }
+        }
+        return string(b)
+}
+
+// stats returns a histogram of the number of each type of edit operation.
+func (es EditScript) stats() (s struct{ NI, NX, NY, NM int }) {
+        for _, e := range es {
+                switch e {
+                case Identity:
+                        s.NI++
+                case UniqueX:
+                        s.NX++
+                case UniqueY:
+                        s.NY++
+                case Modified:
+                        s.NM++
+                default:
+                        panic("invalid edit-type")
+                }
+        }
+        return
+}
+
+// Dist is the Levenshtein distance and is guaranteed to be 0 if and only if
+// lists X and Y are equal.
+func (es EditScript) Dist() int { return len(es) - es.stats().NI }
+
+// LenX is the length of the X list.
+func (es EditScript) LenX() int { return len(es) - es.stats().NY }
+
+// LenY is the length of the Y list.
+func (es EditScript) LenY() int { return len(es) - es.stats().NX }
+
+// EqualFunc reports whether the symbols at indexes ix and iy are equal.
+// When called by Difference, the index is guaranteed to be within nx and ny.
+type EqualFunc func(ix int, iy int) Result
+
+// Result is the result of comparison.
+// NSame is the number of sub-elements that are equal.
+// NDiff is the number of sub-elements that are not equal.
+type Result struct{ NSame, NDiff int }
+
+// Equal indicates whether the symbols are equal. Two symbols are equal
+// if and only if NDiff == 0. If Equal, then they are also Similar.
+func (r Result) Equal() bool { return r.NDiff == 0 }
+
+// Similar indicates whether two symbols are similar and may be represented
+// by using the Modified type. As a special case, we consider binary comparisons
+// (i.e., those that return Result{1, 0} or Result{0, 1}) to be similar.
+//
+// The exact ratio of NSame to NDiff to determine similarity may change.
+func (r Result) Similar() bool {
+        // Use NSame+1 to offset NSame so that binary comparisons are similar.
+        return r.NSame+1 >= r.NDiff
+}
+
+// Difference reports whether two lists of lengths nx and ny are equal
+// given the definition of equality provided as f.
+//
+// This function returns an edit-script, which is a sequence of operations
+// needed to convert one list into the other. The following invariants for
+// the edit-script are maintained:
+//      • eq == (es.Dist()==0)
+//      • nx == es.LenX()
+//      • ny == es.LenY()
+//
+// This algorithm is not guaranteed to be an optimal solution (i.e., one that
+// produces an edit-script with a minimal Levenshtein distance). This algorithm
+// favors performance over optimality. The exact output is not guaranteed to
+// be stable and may change over time.
+func Difference(nx, ny int, f EqualFunc) (es EditScript) {
+        // This algorithm is based on traversing what is known as an "edit-graph".
+        // See Figure 1 from "An O(ND) Difference Algorithm and Its Variations"
+        // by Eugene W. Myers. Since D can be as large as N itself, this is
+        // effectively O(N^2). Unlike the algorithm from that paper, we are not
+        // interested in the optimal path, but at least some "decent" path.
+        //
+        // For example, let X and Y be lists of symbols:
+        //      X = [A B C A B B A]
+        //      Y = [C B A B A C]
+        //
+        // The edit-graph can be drawn as the following:
+        //         A B C A B B A
+        //        ┌─────────────┐
+        //      C │_|_|\|_|_|_|_│ 0
+        //      B │_|\|_|_|\|\|_│ 1
+        //      A │\|_|_|\|_|_|\│ 2
+        //      B │_|\|_|_|\|\|_│ 3
+        //      A │\|_|_|\|_|_|\│ 4
+        //      C │ | |\| | | | │ 5
+        //        └─────────────┘ 6
+        //         0 1 2 3 4 5 6 7
+        //
+        // List X is written along the horizontal axis, while list Y is written
+        // along the vertical axis. At any point on this grid, if the symbol in
+        // list X matches the corresponding symbol in list Y, then a '\' is drawn.
+        // The goal of any minimal edit-script algorithm is to find a path from the
+        // top-left corner to the bottom-right corner, while traveling through the
+        // fewest horizontal or vertical edges.
+        // A horizontal edge is equivalent to inserting a symbol from list X.
+        // A vertical edge is equivalent to inserting a symbol from list Y.
+        // A diagonal edge is equivalent to a matching symbol between both X and Y.
+
+        // Invariants:
+        //      • 0 ≤ fwdPath.X ≤ (fwdFrontier.X, revFrontier.X) ≤ revPath.X ≤ nx
+        //      • 0 ≤ fwdPath.Y ≤ (fwdFrontier.Y, revFrontier.Y) ≤ revPath.Y ≤ ny
+        //
+        // In general:
+        //      • fwdFrontier.X < revFrontier.X
+        //      • fwdFrontier.Y < revFrontier.Y
+        // Unless, it is time for the algorithm to terminate.
+        fwdPath := path{+1, point{0, 0}, make(EditScript, 0, (nx+ny)/2)}
+        revPath := path{-1, point{nx, ny}, make(EditScript, 0)}
+        fwdFrontier := fwdPath.point // Forward search frontier
+        revFrontier := revPath.point // Reverse search frontier
+
+        // Search budget bounds the cost of searching for better paths.
+        // The longest sequence of non-matching symbols that can be tolerated is
+        // approximately the square-root of the search budget.
+        searchBudget := 4 * (nx + ny) // O(n)
+
+        // The algorithm below is a greedy, meet-in-the-middle algorithm for
+        // computing sub-optimal edit-scripts between two lists.
+        //
+        // The algorithm is approximately as follows:
+        //      • Searching for differences switches back-and-forth between
+        //      a search that starts at the beginning (the top-left corner), and
+        //      a search that starts at the end (the bottom-right corner). The goal of
+        //      the search is connect with the search from the opposite corner.
+        //      • As we search, we build a path in a greedy manner, where the first
+        //      match seen is added to the path (this is sub-optimal, but provides a
+        //      decent result in practice). When matches are found, we try the next pair
+        //      of symbols in the lists and follow all matches as far as possible.
+        //      • When searching for matches, we search along a diagonal going through
+        //      through the "frontier" point. If no matches are found, we advance the
+        //      frontier towards the opposite corner.
+        //      • This algorithm terminates when either the X coordinates or the
+        //      Y coordinates of the forward and reverse frontier points ever intersect.
+        //
+        // This algorithm is correct even if searching only in the forward direction
+        // or in the reverse direction. We do both because it is commonly observed
+        // that two lists commonly differ because elements were added to the front
+        // or end of the other list.
+        //
+        // Running the tests with the "debug" build tag prints a visualization of
+        // the algorithm running in real-time. This is educational for understanding
+        // how the algorithm works. See debug_enable.go.
+        f = debug.Begin(nx, ny, f, &fwdPath.es, &revPath.es)
+        for {
+                // Forward search from the beginning.
+                if fwdFrontier.X >= revFrontier.X || fwdFrontier.Y >= revFrontier.Y || searchBudget == 0 {
+                        break
+                }
+                for stop1, stop2, i := false, false, 0; !(stop1 && stop2) && searchBudget > 0; i++ {
+                        // Search in a diagonal pattern for a match.
+                        z := zigzag(i)
+                        p := point{fwdFrontier.X + z, fwdFrontier.Y - z}
+                        switch {
+                        case p.X >= revPath.X || p.Y < fwdPath.Y:
+                                stop1 = true // Hit top-right corner
+                        case p.Y >= revPath.Y || p.X < fwdPath.X:
+                                stop2 = true // Hit bottom-left corner
+                        case f(p.X, p.Y).Equal():
+                                // Match found, so connect the path to this point.
+                                fwdPath.connect(p, f)
+                                fwdPath.append(Identity)
+                                // Follow sequence of matches as far as possible.
+                                for fwdPath.X < revPath.X && fwdPath.Y < revPath.Y {
+                                        if !f(fwdPath.X, fwdPath.Y).Equal() {
+                                                break
+                                        }
+                                        fwdPath.append(Identity)
+                                }
+                                fwdFrontier = fwdPath.point
+                                stop1, stop2 = true, true
+                        default:
+                                searchBudget-- // Match not found
+                        }
+                        debug.Update()
+                }
+                // Advance the frontier towards reverse point.
+                if revPath.X-fwdFrontier.X >= revPath.Y-fwdFrontier.Y {
+                        fwdFrontier.X++
+                } else {
+                        fwdFrontier.Y++
+                }
+
+                // Reverse search from the end.
+                if fwdFrontier.X >= revFrontier.X || fwdFrontier.Y >= revFrontier.Y || searchBudget == 0 {
+                        break
+                }
+                for stop1, stop2, i := false, false, 0; !(stop1 && stop2) && searchBudget > 0; i++ {
+                        // Search in a diagonal pattern for a match.
+                        z := zigzag(i)
+                        p := point{revFrontier.X - z, revFrontier.Y + z}
+                        switch {
+                        case fwdPath.X >= p.X || revPath.Y < p.Y:
+                                stop1 = true // Hit bottom-left corner
+                        case fwdPath.Y >= p.Y || revPath.X < p.X:
+                                stop2 = true // Hit top-right corner
+                        case f(p.X-1, p.Y-1).Equal():
+                                // Match found, so connect the path to this point.
+                                revPath.connect(p, f)
+                                revPath.append(Identity)
+                                // Follow sequence of matches as far as possible.
+                                for fwdPath.X < revPath.X && fwdPath.Y < revPath.Y {
+                                        if !f(revPath.X-1, revPath.Y-1).Equal() {
+                                                break
+                                        }
+                                        revPath.append(Identity)
+                                }
+                                revFrontier = revPath.point
+                                stop1, stop2 = true, true
+                        default:
+                                searchBudget-- // Match not found
+                        }
+                        debug.Update()
+                }
+                // Advance the frontier towards forward point.
+                if revFrontier.X-fwdPath.X >= revFrontier.Y-fwdPath.Y {
+                        revFrontier.X--
+                } else {
+                        revFrontier.Y--
+                }
+        }
+
+        // Join the forward and reverse paths and then append the reverse path.
+        fwdPath.connect(revPath.point, f)
+        for i := len(revPath.es) - 1; i >= 0; i-- {
+                t := revPath.es[i]
+                revPath.es = revPath.es[:i]
+                fwdPath.append(t)
+        }
+        debug.Finish()
+        return fwdPath.es
+}
+
+type path struct {
+        dir   int // +1 if forward, -1 if reverse
+        point     // Leading point of the EditScript path
+        es    EditScript
+}
+
+// connect appends any necessary Identity, Modified, UniqueX, or UniqueY types
+// to the edit-script to connect p.point to dst.
+func (p *path) connect(dst point, f EqualFunc) {
+        if p.dir > 0 {
+                // Connect in forward direction.
+                for dst.X > p.X && dst.Y > p.Y {
+                        switch r := f(p.X, p.Y); {
+                        case r.Equal():
+                                p.append(Identity)
+                        case r.Similar():
+                                p.append(Modified)
+                        case dst.X-p.X >= dst.Y-p.Y:
+                                p.append(UniqueX)
+                        default:
+                                p.append(UniqueY)
+                        }
+                }
+                for dst.X > p.X {
+                        p.append(UniqueX)
+                }
+                for dst.Y > p.Y {
+                        p.append(UniqueY)
+                }
+        } else {
+                // Connect in reverse direction.
+                for p.X > dst.X && p.Y > dst.Y {
+                        switch r := f(p.X-1, p.Y-1); {
+                        case r.Equal():
+                                p.append(Identity)
+                        case r.Similar():
+                                p.append(Modified)
+                        case p.Y-dst.Y >= p.X-dst.X:
+                                p.append(UniqueY)
+                        default:
+                                p.append(UniqueX)
+                        }
+                }
+                for p.X > dst.X {
+                        p.append(UniqueX)
+                }
+                for p.Y > dst.Y {
+                        p.append(UniqueY)
+                }
+        }
+}
+
+func (p *path) append(t EditType) {
+        p.es = append(p.es, t)
+        switch t {
+        case Identity, Modified:
+                p.add(p.dir, p.dir)
+        case UniqueX:
+                p.add(p.dir, 0)
+        case UniqueY:
+                p.add(0, p.dir)
+        }
+        debug.Update()
+}
+
+type point struct{ X, Y int }
+
+func (p *point) add(dx, dy int) { p.X += dx; p.Y += dy }
+
+// zigzag maps a consecutive sequence of integers to a zig-zag sequence.
+//      [0 1 2 3 4 5 ...] => [0 -1 +1 -2 +2 ...]
+func zigzag(x int) int {
+        if x&1 != 0 {
+                x = ^x
+        }
+        return x >> 1
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/internal/function/func.go b/vendor/github.com/google/go-cmp/cmp/internal/function/func.go
new file mode 100644
index 0000000..4c35ff1
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/internal/function/func.go
@@ -0,0 +1,49 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+// Package function identifies function types.
+package function
+
+import "reflect"
+
+type funcType int
+
+const (
+        _ funcType = iota
+
+        ttbFunc // func(T, T) bool
+        tibFunc // func(T, I) bool
+        trFunc  // func(T) R
+
+        Equal           = ttbFunc // func(T, T) bool
+        EqualAssignable = tibFunc // func(T, I) bool; encapsulates func(T, T) bool
+        Transformer     = trFunc  // func(T) R
+        ValueFilter     = ttbFunc // func(T, T) bool
+        Less            = ttbFunc // func(T, T) bool
+)
+
+var boolType = reflect.TypeOf(true)
+
+// IsType reports whether the reflect.Type is of the specified function type.
+func IsType(t reflect.Type, ft funcType) bool {
+        if t == nil || t.Kind() != reflect.Func || t.IsVariadic() {
+                return false
+        }
+        ni, no := t.NumIn(), t.NumOut()
+        switch ft {
+        case ttbFunc: // func(T, T) bool
+                if ni == 2 && no == 1 && t.In(0) == t.In(1) && t.Out(0) == boolType {
+                        return true
+                }
+        case tibFunc: // func(T, I) bool
+                if ni == 2 && no == 1 && t.In(0).AssignableTo(t.In(1)) && t.Out(0) == boolType {
+                        return true
+                }
+        case trFunc: // func(T) R
+                if ni == 1 && no == 1 {
+                        return true
+                }
+        }
+        return false
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/internal/value/format.go b/vendor/github.com/google/go-cmp/cmp/internal/value/format.go
new file mode 100644
index 0000000..657e508
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/internal/value/format.go
@@ -0,0 +1,277 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+// Package value provides functionality for reflect.Value types.
+package value
+
+import (
+        "fmt"
+        "reflect"
+        "strconv"
+        "strings"
+        "unicode"
+)
+
+var stringerIface = reflect.TypeOf((*fmt.Stringer)(nil)).Elem()
+
+// Format formats the value v as a string.
+//
+// This is similar to fmt.Sprintf("%+v", v) except this:
+//      * Prints the type unless it can be elided
+//      * Avoids printing struct fields that are zero
+//      * Prints a nil-slice as being nil, not empty
+//      * Prints map entries in deterministic order
+func Format(v reflect.Value, conf FormatConfig) string {
+        conf.printType = true
+        conf.followPointers = true
+        conf.realPointers = true
+        return formatAny(v, conf, nil)
+}
+
+type FormatConfig struct {
+        UseStringer        bool // Should the String method be used if available?
+        printType          bool // Should we print the type before the value?
+        PrintPrimitiveType bool // Should we print the type of primitives?
+        followPointers     bool // Should we recursively follow pointers?
+        realPointers       bool // Should we print the real address of pointers?
+}
+
+func formatAny(v reflect.Value, conf FormatConfig, visited map[uintptr]bool) string {
+        // TODO: Should this be a multi-line printout in certain situations?
+
+        if !v.IsValid() {
+                return "<non-existent>"
+        }
+        if conf.UseStringer && v.Type().Implements(stringerIface) && v.CanInterface() {
+                if (v.Kind() == reflect.Ptr || v.Kind() == reflect.Interface) && v.IsNil() {
+                        return "<nil>"
+                }
+
+                const stringerPrefix = "s" // Indicates that the String method was used
+                s := v.Interface().(fmt.Stringer).String()
+                return stringerPrefix + formatString(s)
+        }
+
+        switch v.Kind() {
+        case reflect.Bool:
+                return formatPrimitive(v.Type(), v.Bool(), conf)
+        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+                return formatPrimitive(v.Type(), v.Int(), conf)
+        case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+                if v.Type().PkgPath() == "" || v.Kind() == reflect.Uintptr {
+                        // Unnamed uints are usually bytes or words, so use hexadecimal.
+                        return formatPrimitive(v.Type(), formatHex(v.Uint()), conf)
+                }
+                return formatPrimitive(v.Type(), v.Uint(), conf)
+        case reflect.Float32, reflect.Float64:
+                return formatPrimitive(v.Type(), v.Float(), conf)
+        case reflect.Complex64, reflect.Complex128:
+                return formatPrimitive(v.Type(), v.Complex(), conf)
+        case reflect.String:
+                return formatPrimitive(v.Type(), formatString(v.String()), conf)
+        case reflect.UnsafePointer, reflect.Chan, reflect.Func:
+                return formatPointer(v, conf)
+        case reflect.Ptr:
+                if v.IsNil() {
+                        if conf.printType {
+                                return fmt.Sprintf("(%v)(nil)", v.Type())
+                        }
+                        return "<nil>"
+                }
+                if visited[v.Pointer()] || !conf.followPointers {
+                        return formatPointer(v, conf)
+                }
+                visited = insertPointer(visited, v.Pointer())
+                return "&" + formatAny(v.Elem(), conf, visited)
+        case reflect.Interface:
+                if v.IsNil() {
+                        if conf.printType {
+                                return fmt.Sprintf("%v(nil)", v.Type())
+                        }
+                        return "<nil>"
+                }
+                return formatAny(v.Elem(), conf, visited)
+        case reflect.Slice:
+                if v.IsNil() {
+                        if conf.printType {
+                                return fmt.Sprintf("%v(nil)", v.Type())
+                        }
+                        return "<nil>"
+                }
+                if visited[v.Pointer()] {
+                        return formatPointer(v, conf)
+                }
+                visited = insertPointer(visited, v.Pointer())
+                fallthrough
+        case reflect.Array:
+                var ss []string
+                subConf := conf
+                subConf.printType = v.Type().Elem().Kind() == reflect.Interface
+                for i := 0; i < v.Len(); i++ {
+                        s := formatAny(v.Index(i), subConf, visited)
+                        ss = append(ss, s)
+                }
+                s := fmt.Sprintf("{%s}", strings.Join(ss, ", "))
+                if conf.printType {
+                        return v.Type().String() + s
+                }
+                return s
+        case reflect.Map:
+                if v.IsNil() {
+                        if conf.printType {
+                                return fmt.Sprintf("%v(nil)", v.Type())
+                        }
+                        return "<nil>"
+                }
+                if visited[v.Pointer()] {
+                        return formatPointer(v, conf)
+                }
+                visited = insertPointer(visited, v.Pointer())
+
+                var ss []string
+                keyConf, valConf := conf, conf
+                keyConf.printType = v.Type().Key().Kind() == reflect.Interface
+                keyConf.followPointers = false
+                valConf.printType = v.Type().Elem().Kind() == reflect.Interface
+                for _, k := range SortKeys(v.MapKeys()) {
+                        sk := formatAny(k, keyConf, visited)
+                        sv := formatAny(v.MapIndex(k), valConf, visited)
+                        ss = append(ss, fmt.Sprintf("%s: %s", sk, sv))
+                }
+                s := fmt.Sprintf("{%s}", strings.Join(ss, ", "))
+                if conf.printType {
+                        return v.Type().String() + s
+                }
+                return s
+        case reflect.Struct:
+                var ss []string
+                subConf := conf
+                subConf.printType = true
+                for i := 0; i < v.NumField(); i++ {
+                        vv := v.Field(i)
+                        if isZero(vv) {
+                                continue // Elide zero value fields
+                        }
+                        name := v.Type().Field(i).Name
+                        subConf.UseStringer = conf.UseStringer
+                        s := formatAny(vv, subConf, visited)
+                        ss = append(ss, fmt.Sprintf("%s: %s", name, s))
+                }
+                s := fmt.Sprintf("{%s}", strings.Join(ss, ", "))
+                if conf.printType {
+                        return v.Type().String() + s
+                }
+                return s
+        default:
+                panic(fmt.Sprintf("%v kind not handled", v.Kind()))
+        }
+}
+
+func formatString(s string) string {
+        // Use quoted string if it the same length as a raw string literal.
+        // Otherwise, attempt to use the raw string form.
+        qs := strconv.Quote(s)
+        if len(qs) == 1+len(s)+1 {
+                return qs
+        }
+
+        // Disallow newlines to ensure output is a single line.
+        // Only allow printable runes for readability purposes.
+        rawInvalid := func(r rune) bool {
+                return r == '`' || r == '\n' || !unicode.IsPrint(r)
+        }
+        if strings.IndexFunc(s, rawInvalid) < 0 {
+                return "`" + s + "`"
+        }
+        return qs
+}
+
+func formatPrimitive(t reflect.Type, v interface{}, conf FormatConfig) string {
+        if conf.printType && (conf.PrintPrimitiveType || t.PkgPath() != "") {
+                return fmt.Sprintf("%v(%v)", t, v)
+        }
+        return fmt.Sprintf("%v", v)
+}
+
+func formatPointer(v reflect.Value, conf FormatConfig) string {
+        p := v.Pointer()
+        if !conf.realPointers {
+                p = 0 // For deterministic printing purposes
+        }
+        s := formatHex(uint64(p))
+        if conf.printType {
+                return fmt.Sprintf("(%v)(%s)", v.Type(), s)
+        }
+        return s
+}
+
+func formatHex(u uint64) string {
+        var f string
+        switch {
+        case u <= 0xff:
+                f = "0x%02x"
+        case u <= 0xffff:
+                f = "0x%04x"
+        case u <= 0xffffff:
+                f = "0x%06x"
+        case u <= 0xffffffff:
+                f = "0x%08x"
+        case u <= 0xffffffffff:
+                f = "0x%010x"
+        case u <= 0xffffffffffff:
+                f = "0x%012x"
+        case u <= 0xffffffffffffff:
+                f = "0x%014x"
+        case u <= 0xffffffffffffffff:
+                f = "0x%016x"
+        }
+        return fmt.Sprintf(f, u)
+}
+
+// insertPointer insert p into m, allocating m if necessary.
+func insertPointer(m map[uintptr]bool, p uintptr) map[uintptr]bool {
+        if m == nil {
+                m = make(map[uintptr]bool)
+        }
+        m[p] = true
+        return m
+}
+
+// isZero reports whether v is the zero value.
+// This does not rely on Interface and so can be used on unexported fields.
+func isZero(v reflect.Value) bool {
+        switch v.Kind() {
+        case reflect.Bool:
+                return v.Bool() == false
+        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+                return v.Int() == 0
+        case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+                return v.Uint() == 0
+        case reflect.Float32, reflect.Float64:
+                return v.Float() == 0
+        case reflect.Complex64, reflect.Complex128:
+                return v.Complex() == 0
+        case reflect.String:
+                return v.String() == ""
+        case reflect.UnsafePointer:
+                return v.Pointer() == 0
+        case reflect.Chan, reflect.Func, reflect.Interface, reflect.Ptr, reflect.Map, reflect.Slice:
+                return v.IsNil()
+        case reflect.Array:
+                for i := 0; i < v.Len(); i++ {
+                        if !isZero(v.Index(i)) {
+                                return false
+                        }
+                }
+                return true
+        case reflect.Struct:
+                for i := 0; i < v.NumField(); i++ {
+                        if !isZero(v.Field(i)) {
+                                return false
+                        }
+                }
+                return true
+        }
+        return false
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/internal/value/sort.go b/vendor/github.com/google/go-cmp/cmp/internal/value/sort.go
new file mode 100644
index 0000000..fe8aa27
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/internal/value/sort.go
@@ -0,0 +1,111 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+package value
+
+import (
+        "fmt"
+        "math"
+        "reflect"
+        "sort"
+)
+
+// SortKeys sorts a list of map keys, deduplicating keys if necessary.
+// The type of each value must be comparable.
+func SortKeys(vs []reflect.Value) []reflect.Value {
+        if len(vs) == 0 {
+                return vs
+        }
+
+        // Sort the map keys.
+        sort.Sort(valueSorter(vs))
+
+        // Deduplicate keys (fails for NaNs).
+        vs2 := vs[:1]
+        for _, v := range vs[1:] {
+                if isLess(vs2[len(vs2)-1], v) {
+                        vs2 = append(vs2, v)
+                }
+        }
+        return vs2
+}
+
+// TODO: Use sort.Slice once Google AppEngine is on Go1.8 or above.
+type valueSorter []reflect.Value
+
+func (vs valueSorter) Len() int           { return len(vs) }
+func (vs valueSorter) Less(i, j int) bool { return isLess(vs[i], vs[j]) }
+func (vs valueSorter) Swap(i, j int)      { vs[i], vs[j] = vs[j], vs[i] }
+
+// isLess is a generic function for sorting arbitrary map keys.
+// The inputs must be of the same type and must be comparable.
+func isLess(x, y reflect.Value) bool {
+        switch x.Type().Kind() {
+        case reflect.Bool:
+                return !x.Bool() && y.Bool()
+        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+                return x.Int() < y.Int()
+        case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+                return x.Uint() < y.Uint()
+        case reflect.Float32, reflect.Float64:
+                fx, fy := x.Float(), y.Float()
+                return fx < fy || math.IsNaN(fx) && !math.IsNaN(fy)
+        case reflect.Complex64, reflect.Complex128:
+                cx, cy := x.Complex(), y.Complex()
+                rx, ix, ry, iy := real(cx), imag(cx), real(cy), imag(cy)
+                if rx == ry || (math.IsNaN(rx) && math.IsNaN(ry)) {
+                        return ix < iy || math.IsNaN(ix) && !math.IsNaN(iy)
+                }
+                return rx < ry || math.IsNaN(rx) && !math.IsNaN(ry)
+        case reflect.Ptr, reflect.UnsafePointer, reflect.Chan:
+                return x.Pointer() < y.Pointer()
+        case reflect.String:
+                return x.String() < y.String()
+        case reflect.Array:
+                for i := 0; i < x.Len(); i++ {
+                        if isLess(x.Index(i), y.Index(i)) {
+                                return true
+                        }
+                        if isLess(y.Index(i), x.Index(i)) {
+                                return false
+                        }
+                }
+                return false
+        case reflect.Struct:
+                for i := 0; i < x.NumField(); i++ {
+                        if isLess(x.Field(i), y.Field(i)) {
+                                return true
+                        }
+                        if isLess(y.Field(i), x.Field(i)) {
+                                return false
+                        }
+                }
+                return false
+        case reflect.Interface:
+                vx, vy := x.Elem(), y.Elem()
+                if !vx.IsValid() || !vy.IsValid() {
+                        return !vx.IsValid() && vy.IsValid()
+                }
+                tx, ty := vx.Type(), vy.Type()
+                if tx == ty {
+                        return isLess(x.Elem(), y.Elem())
+                }
+                if tx.Kind() != ty.Kind() {
+                        return vx.Kind() < vy.Kind()
+                }
+                if tx.String() != ty.String() {
+                        return tx.String() < ty.String()
+                }
+                if tx.PkgPath() != ty.PkgPath() {
+                        return tx.PkgPath() < ty.PkgPath()
+                }
+                // This can happen in rare situations, so we fallback to just comparing
+                // the unique pointer for a reflect.Type. This guarantees deterministic
+                // ordering within a program, but it is obviously not stable.
+                return reflect.ValueOf(vx.Type()).Pointer() < reflect.ValueOf(vy.Type()).Pointer()
+        default:
+                // Must be Func, Map, or Slice; which are not comparable.
+                panic(fmt.Sprintf("%T is not comparable", x.Type()))
+        }
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/options.go b/vendor/github.com/google/go-cmp/cmp/options.go
new file mode 100644
index 0000000..91d4b06
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/options.go
@@ -0,0 +1,453 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+package cmp
+
+import (
+        "fmt"
+        "reflect"
+        "runtime"
+        "strings"
+
+        "github.com/google/go-cmp/cmp/internal/function"
+)
+
+// Option configures for specific behavior of Equal and Diff. In particular,
+// the fundamental Option functions (Ignore, Transformer, and Comparer),
+// configure how equality is determined.
+//
+// The fundamental options may be composed with filters (FilterPath and
+// FilterValues) to control the scope over which they are applied.
+//
+// The cmp/cmpopts package provides helper functions for creating options that
+// may be used with Equal and Diff.
+type Option interface {
+        // filter applies all filters and returns the option that remains.
+        // Each option may only read s.curPath and call s.callTTBFunc.
+        //
+        // An Options is returned only if multiple comparers or transformers
+        // can apply simultaneously and will only contain values of those types
+        // or sub-Options containing values of those types.
+        filter(s *state, vx, vy reflect.Value, t reflect.Type) applicableOption
+}
+
+// applicableOption represents the following types:
+//      Fundamental: ignore | invalid | *comparer | *transformer
+//      Grouping:    Options
+type applicableOption interface {
+        Option
+
+        // apply executes the option, which may mutate s or panic.
+        apply(s *state, vx, vy reflect.Value)
+}
+
+// coreOption represents the following types:
+//      Fundamental: ignore | invalid | *comparer | *transformer
+//      Filters:     *pathFilter | *valuesFilter
+type coreOption interface {
+        Option
+        isCore()
+}
+
+type core struct{}
+
+func (core) isCore() {}
+
+// Options is a list of Option values that also satisfies the Option interface.
+// Helper comparison packages may return an Options value when packing multiple
+// Option values into a single Option. When this package processes an Options,
+// it will be implicitly expanded into a flat list.
+//
+// Applying a filter on an Options is equivalent to applying that same filter
+// on all individual options held within.
+type Options []Option
+
+func (opts Options) filter(s *state, vx, vy reflect.Value, t reflect.Type) (out applicableOption) {
+        for _, opt := range opts {
+                switch opt := opt.filter(s, vx, vy, t); opt.(type) {
+                case ignore:
+                        return ignore{} // Only ignore can short-circuit evaluation
+                case invalid:
+                        out = invalid{} // Takes precedence over comparer or transformer
+                case *comparer, *transformer, Options:
+                        switch out.(type) {
+                        case nil:
+                                out = opt
+                        case invalid:
+                                // Keep invalid
+                        case *comparer, *transformer, Options:
+                                out = Options{out, opt} // Conflicting comparers or transformers
+                        }
+                }
+        }
+        return out
+}
+
+func (opts Options) apply(s *state, _, _ reflect.Value) {
+        const warning = "ambiguous set of applicable options"
+        const help = "consider using filters to ensure at most one Comparer or Transformer may apply"
+        var ss []string
+        for _, opt := range flattenOptions(nil, opts) {
+                ss = append(ss, fmt.Sprint(opt))
+        }
+        set := strings.Join(ss, "\n\t")
+        panic(fmt.Sprintf("%s at %#v:\n\t%s\n%s", warning, s.curPath, set, help))
+}
+
+func (opts Options) String() string {
+        var ss []string
+        for _, opt := range opts {
+                ss = append(ss, fmt.Sprint(opt))
+        }
+        return fmt.Sprintf("Options{%s}", strings.Join(ss, ", "))
+}
+
+// FilterPath returns a new Option where opt is only evaluated if filter f
+// returns true for the current Path in the value tree.
+//
+// The option passed in may be an Ignore, Transformer, Comparer, Options, or
+// a previously filtered Option.
+func FilterPath(f func(Path) bool, opt Option) Option {
+        if f == nil {
+                panic("invalid path filter function")
+        }
+        if opt := normalizeOption(opt); opt != nil {
+                return &pathFilter{fnc: f, opt: opt}
+        }
+        return nil
+}
+
+type pathFilter struct {
+        core
+        fnc func(Path) bool
+        opt Option
+}
+
+func (f pathFilter) filter(s *state, vx, vy reflect.Value, t reflect.Type) applicableOption {
+        if f.fnc(s.curPath) {
+                return f.opt.filter(s, vx, vy, t)
+        }
+        return nil
+}
+
+func (f pathFilter) String() string {
+        fn := getFuncName(reflect.ValueOf(f.fnc).Pointer())
+        return fmt.Sprintf("FilterPath(%s, %v)", fn, f.opt)
+}
+
+// FilterValues returns a new Option where opt is only evaluated if filter f,
+// which is a function of the form "func(T, T) bool", returns true for the
+// current pair of values being compared. If the type of the values is not
+// assignable to T, then this filter implicitly returns false.
+//
+// The filter function must be
+// symmetric (i.e., agnostic to the order of the inputs) and
+// deterministic (i.e., produces the same result when given the same inputs).
+// If T is an interface, it is possible that f is called with two values with
+// different concrete types that both implement T.
+//
+// The option passed in may be an Ignore, Transformer, Comparer, Options, or
+// a previously filtered Option.
+func FilterValues(f interface{}, opt Option) Option {
+        v := reflect.ValueOf(f)
+        if !function.IsType(v.Type(), function.ValueFilter) || v.IsNil() {
+                panic(fmt.Sprintf("invalid values filter function: %T", f))
+        }
+        if opt := normalizeOption(opt); opt != nil {
+                vf := &valuesFilter{fnc: v, opt: opt}
+                if ti := v.Type().In(0); ti.Kind() != reflect.Interface || ti.NumMethod() > 0 {
+                        vf.typ = ti
+                }
+                return vf
+        }
+        return nil
+}
+
+type valuesFilter struct {
+        core
+        typ reflect.Type  // T
+        fnc reflect.Value // func(T, T) bool
+        opt Option
+}
+
+func (f valuesFilter) filter(s *state, vx, vy reflect.Value, t reflect.Type) applicableOption {
+        if !vx.IsValid() || !vy.IsValid() {
+                return invalid{}
+        }
+        if (f.typ == nil || t.AssignableTo(f.typ)) && s.callTTBFunc(f.fnc, vx, vy) {
+                return f.opt.filter(s, vx, vy, t)
+        }
+        return nil
+}
+
+func (f valuesFilter) String() string {
+        fn := getFuncName(f.fnc.Pointer())
+        return fmt.Sprintf("FilterValues(%s, %v)", fn, f.opt)
+}
+
+// Ignore is an Option that causes all comparisons to be ignored.
+// This value is intended to be combined with FilterPath or FilterValues.
+// It is an error to pass an unfiltered Ignore option to Equal.
+func Ignore() Option { return ignore{} }
+
+type ignore struct{ core }
+
+func (ignore) isFiltered() bool                                                     { return false }
+func (ignore) filter(_ *state, _, _ reflect.Value, _ reflect.Type) applicableOption { return ignore{} }
+func (ignore) apply(_ *state, _, _ reflect.Value)                                   { return }
+func (ignore) String() string                                                       { return "Ignore()" }
+
+// invalid is a sentinel Option type to indicate that some options could not
+// be evaluated due to unexported fields.
+type invalid struct{ core }
+
+func (invalid) filter(_ *state, _, _ reflect.Value, _ reflect.Type) applicableOption { return invalid{} }
+func (invalid) apply(s *state, _, _ reflect.Value) {
+        const help = "consider using AllowUnexported or cmpopts.IgnoreUnexported"
+        panic(fmt.Sprintf("cannot handle unexported field: %#v\n%s", s.curPath, help))
+}
+
+// Transformer returns an Option that applies a transformation function that
+// converts values of a certain type into that of another.
+//
+// The transformer f must be a function "func(T) R" that converts values of
+// type T to those of type R and is implicitly filtered to input values
+// assignable to T. The transformer must not mutate T in any way.
+//
+// To help prevent some cases of infinite recursive cycles applying the
+// same transform to the output of itself (e.g., in the case where the
+// input and output types are the same), an implicit filter is added such that
+// a transformer is applicable only if that exact transformer is not already
+// in the tail of the Path since the last non-Transform step.
+//
+// The name is a user provided label that is used as the Transform.Name in the
+// transformation PathStep. If empty, an arbitrary name is used.
+func Transformer(name string, f interface{}) Option {
+        v := reflect.ValueOf(f)
+        if !function.IsType(v.Type(), function.Transformer) || v.IsNil() {
+                panic(fmt.Sprintf("invalid transformer function: %T", f))
+        }
+        if name == "" {
+                name = "λ" // Lambda-symbol as place-holder for anonymous transformer
+        }
+        if !isValid(name) {
+                panic(fmt.Sprintf("invalid name: %q", name))
+        }
+        tr := &transformer{name: name, fnc: reflect.ValueOf(f)}
+        if ti := v.Type().In(0); ti.Kind() != reflect.Interface || ti.NumMethod() > 0 {
+                tr.typ = ti
+        }
+        return tr
+}
+
+type transformer struct {
+        core
+        name string
+        typ  reflect.Type  // T
+        fnc  reflect.Value // func(T) R
+}
+
+func (tr *transformer) isFiltered() bool { return tr.typ != nil }
+
+func (tr *transformer) filter(s *state, _, _ reflect.Value, t reflect.Type) applicableOption {
+        for i := len(s.curPath) - 1; i >= 0; i-- {
+                if t, ok := s.curPath[i].(*transform); !ok {
+                        break // Hit most recent non-Transform step
+                } else if tr == t.trans {
+                        return nil // Cannot directly use same Transform
+                }
+        }
+        if tr.typ == nil || t.AssignableTo(tr.typ) {
+                return tr
+        }
+        return nil
+}
+
+func (tr *transformer) apply(s *state, vx, vy reflect.Value) {
+        // Update path before calling the Transformer so that dynamic checks
+        // will use the updated path.
+        s.curPath.push(&transform{pathStep{tr.fnc.Type().Out(0)}, tr})
+        defer s.curPath.pop()
+
+        vx = s.callTRFunc(tr.fnc, vx)
+        vy = s.callTRFunc(tr.fnc, vy)
+        s.compareAny(vx, vy)
+}
+
+func (tr transformer) String() string {
+        return fmt.Sprintf("Transformer(%s, %s)", tr.name, getFuncName(tr.fnc.Pointer()))
+}
+
+// Comparer returns an Option that determines whether two values are equal
+// to each other.
+//
+// The comparer f must be a function "func(T, T) bool" and is implicitly
+// filtered to input values assignable to T. If T is an interface, it is
+// possible that f is called with two values of different concrete types that
+// both implement T.
+//
+// The equality function must be:
+//      • Symmetric: equal(x, y) == equal(y, x)
+//      • Deterministic: equal(x, y) == equal(x, y)
+//      • Pure: equal(x, y) does not modify x or y
+func Comparer(f interface{}) Option {
+        v := reflect.ValueOf(f)
+        if !function.IsType(v.Type(), function.Equal) || v.IsNil() {
+                panic(fmt.Sprintf("invalid comparer function: %T", f))
+        }
+        cm := &comparer{fnc: v}
+        if ti := v.Type().In(0); ti.Kind() != reflect.Interface || ti.NumMethod() > 0 {
+                cm.typ = ti
+        }
+        return cm
+}
+
+type comparer struct {
+        core
+        typ reflect.Type  // T
+        fnc reflect.Value // func(T, T) bool
+}
+
+func (cm *comparer) isFiltered() bool { return cm.typ != nil }
+
+func (cm *comparer) filter(_ *state, _, _ reflect.Value, t reflect.Type) applicableOption {
+        if cm.typ == nil || t.AssignableTo(cm.typ) {
+                return cm
+        }
+        return nil
+}
+
+func (cm *comparer) apply(s *state, vx, vy reflect.Value) {
+        eq := s.callTTBFunc(cm.fnc, vx, vy)
+        s.report(eq, vx, vy)
+}
+
+func (cm comparer) String() string {
+        return fmt.Sprintf("Comparer(%s)", getFuncName(cm.fnc.Pointer()))
+}
+
+// AllowUnexported returns an Option that forcibly allows operations on
+// unexported fields in certain structs, which are specified by passing in a
+// value of each struct type.
+//
+// Users of this option must understand that comparing on unexported fields
+// from external packages is not safe since changes in the internal
+// implementation of some external package may cause the result of Equal
+// to unexpectedly change. However, it may be valid to use this option on types
+// defined in an internal package where the semantic meaning of an unexported
+// field is in the control of the user.
+//
+// For some cases, a custom Comparer should be used instead that defines
+// equality as a function of the public API of a type rather than the underlying
+// unexported implementation.
+//
+// For example, the reflect.Type documentation defines equality to be determined
+// by the == operator on the interface (essentially performing a shallow pointer
+// comparison) and most attempts to compare *regexp.Regexp types are interested
+// in only checking that the regular expression strings are equal.
+// Both of these are accomplished using Comparers:
+//
+//      Comparer(func(x, y reflect.Type) bool { return x == y })
+//      Comparer(func(x, y *regexp.Regexp) bool { return x.String() == y.String() })
+//
+// In other cases, the cmpopts.IgnoreUnexported option can be used to ignore
+// all unexported fields on specified struct types.
+func AllowUnexported(types ...interface{}) Option {
+        if !supportAllowUnexported {
+                panic("AllowUnexported is not supported on purego builds, Google App Engine Standard, or GopherJS")
+        }
+        m := make(map[reflect.Type]bool)
+        for _, typ := range types {
+                t := reflect.TypeOf(typ)
+                if t.Kind() != reflect.Struct {
+                        panic(fmt.Sprintf("invalid struct type: %T", typ))
+                }
+                m[t] = true
+        }
+        return visibleStructs(m)
+}
+
+type visibleStructs map[reflect.Type]bool
+
+func (visibleStructs) filter(_ *state, _, _ reflect.Value, _ reflect.Type) applicableOption {
+        panic("not implemented")
+}
+
+// reporter is an Option that configures how differences are reported.
+type reporter interface {
+        // TODO: Not exported yet.
+        //
+        // Perhaps add PushStep and PopStep and change Report to only accept
+        // a PathStep instead of the full-path? Adding a PushStep and PopStep makes
+        // it clear that we are traversing the value tree in a depth-first-search
+        // manner, which has an effect on how values are printed.
+
+        Option
+
+        // Report is called for every comparison made and will be provided with
+        // the two values being compared, the equality result, and the
+        // current path in the value tree. It is possible for x or y to be an
+        // invalid reflect.Value if one of the values is non-existent;
+        // which is possible with maps and slices.
+        Report(x, y reflect.Value, eq bool, p Path)
+}
+
+// normalizeOption normalizes the input options such that all Options groups
+// are flattened and groups with a single element are reduced to that element.
+// Only coreOptions and Options containing coreOptions are allowed.
+func normalizeOption(src Option) Option {
+        switch opts := flattenOptions(nil, Options{src}); len(opts) {
+        case 0:
+                return nil
+        case 1:
+                return opts[0]
+        default:
+                return opts
+        }
+}
+
+// flattenOptions copies all options in src to dst as a flat list.
+// Only coreOptions and Options containing coreOptions are allowed.
+func flattenOptions(dst, src Options) Options {
+        for _, opt := range src {
+                switch opt := opt.(type) {
+                case nil:
+                        continue
+                case Options:
+                        dst = flattenOptions(dst, opt)
+                case coreOption:
+                        dst = append(dst, opt)
+                default:
+                        panic(fmt.Sprintf("invalid option type: %T", opt))
+                }
+        }
+        return dst
+}
+
+// getFuncName returns a short function name from the pointer.
+// The string parsing logic works up until Go1.9.
+func getFuncName(p uintptr) string {
+        fnc := runtime.FuncForPC(p)
+        if fnc == nil {
+                return "<unknown>"
+        }
+        name := fnc.Name() // E.g., "long/path/name/mypkg.(mytype).(long/path/name/mypkg.myfunc)-fm"
+        if strings.HasSuffix(name, ")-fm") || strings.HasSuffix(name, ")·fm") {
+                // Strip the package name from method name.
+                name = strings.TrimSuffix(name, ")-fm")
+                name = strings.TrimSuffix(name, ")·fm")
+                if i := strings.LastIndexByte(name, '('); i >= 0 {
+                        methodName := name[i+1:] // E.g., "long/path/name/mypkg.myfunc"
+                        if j := strings.LastIndexByte(methodName, '.'); j >= 0 {
+                                methodName = methodName[j+1:] // E.g., "myfunc"
+                        }
+                        name = name[:i] + methodName // E.g., "long/path/name/mypkg.(mytype)." + "myfunc"
+                }
+        }
+        if i := strings.LastIndexByte(name, '/'); i >= 0 {
+                // Strip the package name.
+                name = name[i+1:] // E.g., "mypkg.(mytype).myfunc"
+        }
+        return name
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/path.go b/vendor/github.com/google/go-cmp/cmp/path.go
new file mode 100644
index 0000000..c08a3cf
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/path.go
@@ -0,0 +1,309 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+package cmp
+
+import (
+        "fmt"
+        "reflect"
+        "strings"
+        "unicode"
+        "unicode/utf8"
+)
+
+type (
+        // Path is a list of PathSteps describing the sequence of operations to get
+        // from some root type to the current position in the value tree.
+        // The first Path element is always an operation-less PathStep that exists
+        // simply to identify the initial type.
+        //
+        // When traversing structs with embedded structs, the embedded struct will
+        // always be accessed as a field before traversing the fields of the
+        // embedded struct themselves. That is, an exported field from the
+        // embedded struct will never be accessed directly from the parent struct.
+        Path []PathStep
+
+        // PathStep is a union-type for specific operations to traverse
+        // a value's tree structure. Users of this package never need to implement
+        // these types as values of this type will be returned by this package.
+        PathStep interface {
+                String() string
+                Type() reflect.Type // Resulting type after performing the path step
+                isPathStep()
+        }
+
+        // SliceIndex is an index operation on a slice or array at some index Key.
+        SliceIndex interface {
+                PathStep
+                Key() int // May return -1 if in a split state
+
+                // SplitKeys returns the indexes for indexing into slices in the
+                // x and y values, respectively. These indexes may differ due to the
+                // insertion or removal of an element in one of the slices, causing
+                // all of the indexes to be shifted. If an index is -1, then that
+                // indicates that the element does not exist in the associated slice.
+                //
+                // Key is guaranteed to return -1 if and only if the indexes returned
+                // by SplitKeys are not the same. SplitKeys will never return -1 for
+                // both indexes.
+                SplitKeys() (x int, y int)
+
+                isSliceIndex()
+        }
+        // MapIndex is an index operation on a map at some index Key.
+        MapIndex interface {
+                PathStep
+                Key() reflect.Value
+                isMapIndex()
+        }
+        // TypeAssertion represents a type assertion on an interface.
+        TypeAssertion interface {
+                PathStep
+                isTypeAssertion()
+        }
+        // StructField represents a struct field access on a field called Name.
+        StructField interface {
+                PathStep
+                Name() string
+                Index() int
+                isStructField()
+        }
+        // Indirect represents pointer indirection on the parent type.
+        Indirect interface {
+                PathStep
+                isIndirect()
+        }
+        // Transform is a transformation from the parent type to the current type.
+        Transform interface {
+                PathStep
+                Name() string
+                Func() reflect.Value
+
+                // Option returns the originally constructed Transformer option.
+                // The == operator can be used to detect the exact option used.
+                Option() Option
+
+                isTransform()
+        }
+)
+
+func (pa *Path) push(s PathStep) {
+        *pa = append(*pa, s)
+}
+
+func (pa *Path) pop() {
+        *pa = (*pa)[:len(*pa)-1]
+}
+
+// Last returns the last PathStep in the Path.
+// If the path is empty, this returns a non-nil PathStep that reports a nil Type.
+func (pa Path) Last() PathStep {
+        return pa.Index(-1)
+}
+
+// Index returns the ith step in the Path and supports negative indexing.
+// A negative index starts counting from the tail of the Path such that -1
+// refers to the last step, -2 refers to the second-to-last step, and so on.
+// If index is invalid, this returns a non-nil PathStep that reports a nil Type.
+func (pa Path) Index(i int) PathStep {
+        if i < 0 {
+                i = len(pa) + i
+        }
+        if i < 0 || i >= len(pa) {
+                return pathStep{}
+        }
+        return pa[i]
+}
+
+// String returns the simplified path to a node.
+// The simplified path only contains struct field accesses.
+//
+// For example:
+//      MyMap.MySlices.MyField
+func (pa Path) String() string {
+        var ss []string
+        for _, s := range pa {
+                if _, ok := s.(*structField); ok {
+                        ss = append(ss, s.String())
+                }
+        }
+        return strings.TrimPrefix(strings.Join(ss, ""), ".")
+}
+
+// GoString returns the path to a specific node using Go syntax.
+//
+// For example:
+//      (*root.MyMap["key"].(*mypkg.MyStruct).MySlices)[2][3].MyField
+func (pa Path) GoString() string {
+        var ssPre, ssPost []string
+        var numIndirect int
+        for i, s := range pa {
+                var nextStep PathStep
+                if i+1 < len(pa) {
+                        nextStep = pa[i+1]
+                }
+                switch s := s.(type) {
+                case *indirect:
+                        numIndirect++
+                        pPre, pPost := "(", ")"
+                        switch nextStep.(type) {
+                        case *indirect:
+                                continue // Next step is indirection, so let them batch up
+                        case *structField:
+                                numIndirect-- // Automatic indirection on struct fields
+                        case nil:
+                                pPre, pPost = "", "" // Last step; no need for parenthesis
+                        }
+                        if numIndirect > 0 {
+                                ssPre = append(ssPre, pPre+strings.Repeat("*", numIndirect))
+                                ssPost = append(ssPost, pPost)
+                        }
+                        numIndirect = 0
+                        continue
+                case *transform:
+                        ssPre = append(ssPre, s.trans.name+"(")
+                        ssPost = append(ssPost, ")")
+                        continue
+                case *typeAssertion:
+                        // As a special-case, elide type assertions on anonymous types
+                        // since they are typically generated dynamically and can be very
+                        // verbose. For example, some transforms return interface{} because
+                        // of Go's lack of generics, but typically take in and return the
+                        // exact same concrete type.
+                        if s.Type().PkgPath() == "" {
+                                continue
+                        }
+                }
+                ssPost = append(ssPost, s.String())
+        }
+        for i, j := 0, len(ssPre)-1; i < j; i, j = i+1, j-1 {
+                ssPre[i], ssPre[j] = ssPre[j], ssPre[i]
+        }
+        return strings.Join(ssPre, "") + strings.Join(ssPost, "")
+}
+
+type (
+        pathStep struct {
+                typ reflect.Type
+        }
+
+        sliceIndex struct {
+                pathStep
+                xkey, ykey int
+        }
+        mapIndex struct {
+                pathStep
+                key reflect.Value
+        }
+        typeAssertion struct {
+                pathStep
+        }
+        structField struct {
+                pathStep
+                name string
+                idx  int
+
+                // These fields are used for forcibly accessing an unexported field.
+                // pvx, pvy, and field are only valid if unexported is true.
+                unexported bool
+                force      bool                // Forcibly allow visibility
+                pvx, pvy   reflect.Value       // Parent values
+                field      reflect.StructField // Field information
+        }
+        indirect struct {
+                pathStep
+        }
+        transform struct {
+                pathStep
+                trans *transformer
+        }
+)
+
+func (ps pathStep) Type() reflect.Type { return ps.typ }
+func (ps pathStep) String() string {
+        if ps.typ == nil {
+                return "<nil>"
+        }
+        s := ps.typ.String()
+        if s == "" || strings.ContainsAny(s, "{}\n") {
+                return "root" // Type too simple or complex to print
+        }
+        return fmt.Sprintf("{%s}", s)
+}
+
+func (si sliceIndex) String() string {
+        switch {
+        case si.xkey == si.ykey:
+                return fmt.Sprintf("[%d]", si.xkey)
+        case si.ykey == -1:
+                // [5->?] means "I don't know where X[5] went"
+                return fmt.Sprintf("[%d->?]", si.xkey)
+        case si.xkey == -1:
+                // [?->3] means "I don't know where Y[3] came from"
+                return fmt.Sprintf("[?->%d]", si.ykey)
+        default:
+                // [5->3] means "X[5] moved to Y[3]"
+                return fmt.Sprintf("[%d->%d]", si.xkey, si.ykey)
+        }
+}
+func (mi mapIndex) String() string      { return fmt.Sprintf("[%#v]", mi.key) }
+func (ta typeAssertion) String() string { return fmt.Sprintf(".(%v)", ta.typ) }
+func (sf structField) String() string   { return fmt.Sprintf(".%s", sf.name) }
+func (in indirect) String() string      { return "*" }
+func (tf transform) String() string     { return fmt.Sprintf("%s()", tf.trans.name) }
+
+func (si sliceIndex) Key() int {
+        if si.xkey != si.ykey {
+                return -1
+        }
+        return si.xkey
+}
+func (si sliceIndex) SplitKeys() (x, y int) { return si.xkey, si.ykey }
+func (mi mapIndex) Key() reflect.Value      { return mi.key }
+func (sf structField) Name() string         { return sf.name }
+func (sf structField) Index() int           { return sf.idx }
+func (tf transform) Name() string           { return tf.trans.name }
+func (tf transform) Func() reflect.Value    { return tf.trans.fnc }
+func (tf transform) Option() Option         { return tf.trans }
+
+func (pathStep) isPathStep()           {}
+func (sliceIndex) isSliceIndex()       {}
+func (mapIndex) isMapIndex()           {}
+func (typeAssertion) isTypeAssertion() {}
+func (structField) isStructField()     {}
+func (indirect) isIndirect()           {}
+func (transform) isTransform()         {}
+
+var (
+        _ SliceIndex    = sliceIndex{}
+        _ MapIndex      = mapIndex{}
+        _ TypeAssertion = typeAssertion{}
+        _ StructField   = structField{}
+        _ Indirect      = indirect{}
+        _ Transform     = transform{}
+
+        _ PathStep = sliceIndex{}
+        _ PathStep = mapIndex{}
+        _ PathStep = typeAssertion{}
+        _ PathStep = structField{}
+        _ PathStep = indirect{}
+        _ PathStep = transform{}
+)
+
+// isExported reports whether the identifier is exported.
+func isExported(id string) bool {
+        r, _ := utf8.DecodeRuneInString(id)
+        return unicode.IsUpper(r)
+}
+
+// isValid reports whether the identifier is valid.
+// Empty and underscore-only strings are not valid.
+func isValid(id string) bool {
+        ok := id != "" && id != "_"
+        for j, c := range id {
+                ok = ok && (j > 0 || !unicode.IsDigit(c))
+                ok = ok && (c == '_' || unicode.IsLetter(c) || unicode.IsDigit(c))
+        }
+        return ok
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/reporter.go b/vendor/github.com/google/go-cmp/cmp/reporter.go
new file mode 100644
index 0000000..20e9f18
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/reporter.go
@@ -0,0 +1,53 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+package cmp
+
+import (
+        "fmt"
+        "reflect"
+        "strings"
+
+        "github.com/google/go-cmp/cmp/internal/value"
+)
+
+type defaultReporter struct {
+        Option
+        diffs  []string // List of differences, possibly truncated
+        ndiffs int      // Total number of differences
+        nbytes int      // Number of bytes in diffs
+        nlines int      // Number of lines in diffs
+}
+
+var _ reporter = (*defaultReporter)(nil)
+
+func (r *defaultReporter) Report(x, y reflect.Value, eq bool, p Path) {
+        if eq {
+                return // Ignore equal results
+        }
+        const maxBytes = 4096
+        const maxLines = 256
+        r.ndiffs++
+        if r.nbytes < maxBytes && r.nlines < maxLines {
+                sx := value.Format(x, value.FormatConfig{UseStringer: true})
+                sy := value.Format(y, value.FormatConfig{UseStringer: true})
+                if sx == sy {
+                        // Unhelpful output, so use more exact formatting.
+                        sx = value.Format(x, value.FormatConfig{PrintPrimitiveType: true})
+                        sy = value.Format(y, value.FormatConfig{PrintPrimitiveType: true})
+                }
+                s := fmt.Sprintf("%#v:\n\t-: %s\n\t+: %s\n", p, sx, sy)
+                r.diffs = append(r.diffs, s)
+                r.nbytes += len(s)
+                r.nlines += strings.Count(s, "\n")
+        }
+}
+
+func (r *defaultReporter) String() string {
+        s := strings.Join(r.diffs, "")
+        if r.ndiffs == len(r.diffs) {
+                return s
+        }
+        return fmt.Sprintf("%s... %d more differences ...", s, r.ndiffs-len(r.diffs))
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/unsafe_panic.go b/vendor/github.com/google/go-cmp/cmp/unsafe_panic.go
new file mode 100644
index 0000000..d1518eb
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/unsafe_panic.go
@@ -0,0 +1,15 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+// +build purego appengine js
+
+package cmp
+
+import "reflect"
+
+const supportAllowUnexported = false
+
+func unsafeRetrieveField(reflect.Value, reflect.StructField) reflect.Value {
+        panic("unsafeRetrieveField is not implemented")
+}
diff --git a/vendor/github.com/google/go-cmp/cmp/unsafe_reflect.go b/vendor/github.com/google/go-cmp/cmp/unsafe_reflect.go
new file mode 100644
index 0000000..579b655
--- /dev/null
+++ b/vendor/github.com/google/go-cmp/cmp/unsafe_reflect.go
@@ -0,0 +1,23 @@
+// Copyright 2017, The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE.md file.
+
+// +build !purego,!appengine,!js
+
+package cmp
+
+import (
+        "reflect"
+        "unsafe"
+)
+
+const supportAllowUnexported = true
+
+// unsafeRetrieveField uses unsafe to forcibly retrieve any field from a struct
+// such that the value has read-write permissions.
+//
+// The parent struct, v, must be addressable, while f must be a StructField
+// describing the field to retrieve.
+func unsafeRetrieveField(v reflect.Value, f reflect.StructField) reflect.Value {
+        return reflect.NewAt(f.Type, unsafe.Pointer(v.UnsafeAddr()+f.Offset)).Elem()
+}
diff --git a/vendor/github.com/googleapis/gax-go/v2/LICENSE b/vendor/github.com/googleapis/gax-go/v2/LICENSE
new file mode 100644
index 0000000..6d16b65
--- /dev/null
+++ b/vendor/github.com/googleapis/gax-go/v2/LICENSE
@@ -0,0 +1,27 @@
+Copyright 2016, Google Inc.
+All rights reserved.
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/googleapis/gax-go/v2/call_option.go b/vendor/github.com/googleapis/gax-go/v2/call_option.go
new file mode 100644
index 0000000..b1d53dd
--- /dev/null
+++ b/vendor/github.com/googleapis/gax-go/v2/call_option.go
@@ -0,0 +1,161 @@
+// Copyright 2016, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package gax
+
+import (
+        "math/rand"
+        "time"
+
+        "google.golang.org/grpc"
+        "google.golang.org/grpc/codes"
+        "google.golang.org/grpc/status"
+)
+
+// CallOption is an option used by Invoke to control behaviors of RPC calls.
+// CallOption works by modifying relevant fields of CallSettings.
+type CallOption interface {
+        // Resolve applies the option by modifying cs.
+        Resolve(cs *CallSettings)
+}
+
+// Retryer is used by Invoke to determine retry behavior.
+type Retryer interface {
+        // Retry reports whether a request should be retriedand how long to pause before retrying
+        // if the previous attempt returned with err. Invoke never calls Retry with nil error.
+        Retry(err error) (pause time.Duration, shouldRetry bool)
+}
+
+type retryerOption func() Retryer
+
+func (o retryerOption) Resolve(s *CallSettings) {
+        s.Retry = o
+}
+
+// WithRetry sets CallSettings.Retry to fn.
+func WithRetry(fn func() Retryer) CallOption {
+        return retryerOption(fn)
+}
+
+// OnCodes returns a Retryer that retries if and only if
+// the previous attempt returns a GRPC error whose error code is stored in cc.
+// Pause times between retries are specified by bo.
+//
+// bo is only used for its parameters; each Retryer has its own copy.
+func OnCodes(cc []codes.Code, bo Backoff) Retryer {
+        return &boRetryer{
+                backoff: bo,
+                codes:   append([]codes.Code(nil), cc...),
+        }
+}
+
+type boRetryer struct {
+        backoff Backoff
+        codes   []codes.Code
+}
+
+func (r *boRetryer) Retry(err error) (time.Duration, bool) {
+        st, ok := status.FromError(err)
+        if !ok {
+                return 0, false
+        }
+        c := st.Code()
+        for _, rc := range r.codes {
+                if c == rc {
+                        return r.backoff.Pause(), true
+                }
+        }
+        return 0, false
+}
+
+// Backoff implements exponential backoff.
+// The wait time between retries is a random value between 0 and the "retry envelope".
+// The envelope starts at Initial and increases by the factor of Multiplier every retry,
+// but is capped at Max.
+type Backoff struct {
+        // Initial is the initial value of the retry envelope, defaults to 1 second.
+        Initial time.Duration
+
+        // Max is the maximum value of the retry envelope, defaults to 30 seconds.
+        Max time.Duration
+
+        // Multiplier is the factor by which the retry envelope increases.
+        // It should be greater than 1 and defaults to 2.
+        Multiplier float64
+
+        // cur is the current retry envelope
+        cur time.Duration
+}
+
+// Pause returns the next time.Duration that the caller should use to backoff.
+func (bo *Backoff) Pause() time.Duration {
+        if bo.Initial == 0 {
+                bo.Initial = time.Second
+        }
+        if bo.cur == 0 {
+                bo.cur = bo.Initial
+        }
+        if bo.Max == 0 {
+                bo.Max = 30 * time.Second
+        }
+        if bo.Multiplier < 1 {
+                bo.Multiplier = 2
+        }
+        // Select a duration between 1ns and the current max. It might seem
+        // counterintuitive to have so much jitter, but
+        // https://www.awsarchitectureblog.com/2015/03/backoff.html argues that
+        // that is the best strategy.
+        d := time.Duration(1 + rand.Int63n(int64(bo.cur)))
+        bo.cur = time.Duration(float64(bo.cur) * bo.Multiplier)
+        if bo.cur > bo.Max {
+                bo.cur = bo.Max
+        }
+        return d
+}
+
+type grpcOpt []grpc.CallOption
+
+func (o grpcOpt) Resolve(s *CallSettings) {
+        s.GRPC = o
+}
+
+// WithGRPCOptions allows passing gRPC call options during client creation.
+func WithGRPCOptions(opt ...grpc.CallOption) CallOption {
+        return grpcOpt(append([]grpc.CallOption(nil), opt...))
+}
+
+// CallSettings allow fine-grained control over how calls are made.
+type CallSettings struct {
+        // Retry returns a Retryer to be used to control retry logic of a method call.
+        // If Retry is nil or the returned Retryer is nil, the call will not be retried.
+        Retry func() Retryer
+
+        // CallOptions to be forwarded to GRPC.
+        GRPC []grpc.CallOption
+}
diff --git a/vendor/github.com/googleapis/gax-go/v2/gax.go b/vendor/github.com/googleapis/gax-go/v2/gax.go
new file mode 100644
index 0000000..8040dcb
--- /dev/null
+++ b/vendor/github.com/googleapis/gax-go/v2/gax.go
@@ -0,0 +1,39 @@
+// Copyright 2016, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Package gax contains a set of modules which aid the development of APIs
+// for clients and servers based on gRPC and Google API conventions.
+//
+// Application code will rarely need to use this library directly.
+// However, code generated automatically from API definition files can use it
+// to simplify code generation and to provide more convenient and idiomatic API surfaces.
+package gax
+
+// Version specifies the gax-go version being used.
+const Version = "2.0.3"
diff --git a/vendor/github.com/googleapis/gax-go/v2/go.mod b/vendor/github.com/googleapis/gax-go/v2/go.mod
new file mode 100644
index 0000000..c88c205
--- /dev/null
+++ b/vendor/github.com/googleapis/gax-go/v2/go.mod
@@ -0,0 +1,3 @@
+module github.com/googleapis/gax-go/v2
+
+require google.golang.org/grpc v1.16.0
diff --git a/vendor/github.com/googleapis/gax-go/v2/go.sum b/vendor/github.com/googleapis/gax-go/v2/go.sum
new file mode 100644
index 0000000..bad34ab
--- /dev/null
+++ b/vendor/github.com/googleapis/gax-go/v2/go.sum
@@ -0,0 +1,26 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+golang.org/x/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d h1:g9qWBGx4puODJTMVyoPrpoxPFgVGd+z1DZwjfRu4d0I=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f h1:wMNYb4v58l5UBM7MYRLPG6ZhfOqbKu7X5eyFl8ZhKvA=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522 h1:Ve1ORMCxvRmSXBwJK+t3Oy+V2vRW2OetUQBq4rJIkZE=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/grpc v1.16.0 h1:dz5IJGuC2BB7qXR5AyHNwAUBhZscK2xVez7mznh72sY=
+google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
+honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/vendor/github.com/googleapis/gax-go/v2/header.go b/vendor/github.com/googleapis/gax-go/v2/header.go
new file mode 100644
index 0000000..139371a
--- /dev/null
+++ b/vendor/github.com/googleapis/gax-go/v2/header.go
@@ -0,0 +1,53 @@
+// Copyright 2018, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package gax
+
+import "bytes"
+
+// XGoogHeader is for use by the Google Cloud Libraries only.
+//
+// XGoogHeader formats key-value pairs.
+// The resulting string is suitable for x-goog-api-client header.
+func XGoogHeader(keyval ...string) string {
+        if len(keyval) == 0 {
+                return ""
+        }
+        if len(keyval)%2 != 0 {
+                panic("gax.Header: odd argument count")
+        }
+        var buf bytes.Buffer
+        for i := 0; i < len(keyval); i += 2 {
+                buf.WriteByte(' ')
+                buf.WriteString(keyval[i])
+                buf.WriteByte('/')
+                buf.WriteString(keyval[i+1])
+        }
+        return buf.String()[1:]
+}
diff --git a/vendor/github.com/googleapis/gax-go/v2/invoke.go b/vendor/github.com/googleapis/gax-go/v2/invoke.go
new file mode 100644
index 0000000..fe31dd0
--- /dev/null
+++ b/vendor/github.com/googleapis/gax-go/v2/invoke.go
@@ -0,0 +1,99 @@
+// Copyright 2016, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package gax
+
+import (
+        "context"
+        "strings"
+        "time"
+)
+
+// APICall is a user defined call stub.
+type APICall func(context.Context, CallSettings) error
+
+// Invoke calls the given APICall,
+// performing retries as specified by opts, if any.
+func Invoke(ctx context.Context, call APICall, opts ...CallOption) error {
+        var settings CallSettings
+        for _, opt := range opts {
+                opt.Resolve(&settings)
+        }
+        return invoke(ctx, call, settings, Sleep)
+}
+
+// Sleep is similar to time.Sleep, but it can be interrupted by ctx.Done() closing.
+// If interrupted, Sleep returns ctx.Err().
+func Sleep(ctx context.Context, d time.Duration) error {
+        t := time.NewTimer(d)
+        select {
+        case <-ctx.Done():
+                t.Stop()
+                return ctx.Err()
+        case <-t.C:
+                return nil
+        }
+}
+
+type sleeper func(ctx context.Context, d time.Duration) error
+
+// invoke implements Invoke, taking an additional sleeper argument for testing.
+func invoke(ctx context.Context, call APICall, settings CallSettings, sp sleeper) error {
+        var retryer Retryer
+        for {
+                err := call(ctx, settings)
+                if err == nil {
+                        return nil
+                }
+                if settings.Retry == nil {
+                        return err
+                }
+                // Never retry permanent certificate errors. (e.x. if ca-certificates
+                // are not installed). We should only make very few, targeted
+                // exceptions: many (other) status=Unavailable should be retried, such
+                // as if there's a network hiccup, or the internet goes out for a
+                // minute. This is also why here we are doing string parsing instead of
+                // simply making Unavailable a non-retried code elsewhere.
+                if strings.Contains(err.Error(), "x509: certificate signed by unknown authority") {
+                        return err
+                }
+                if retryer == nil {
+                        if r := settings.Retry(); r != nil {
+                                retryer = r
+                        } else {
+                                return err
+                        }
+                }
+                if d, ok := retryer.Retry(err); !ok {
+                        return err
+                } else if err = sp(ctx, d); err != nil {
+                        return err
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/errwrap/README.md b/vendor/github.com/hashicorp/errwrap/README.md
index 1c95f59..444df08 100644
--- a/vendor/github.com/hashicorp/errwrap/README.md
+++ b/vendor/github.com/hashicorp/errwrap/README.md
@@ -48,7 +48,7 @@ func main() {
         // We can use the Contains helpers to check if an error contains
         // another error. It is safe to do this with a nil error, or with
         // an error that doesn't even use the errwrap package.
-        if errwrap.Contains(err, ErrNotExist) {
+        if errwrap.Contains(err, "does not exist") {
                 // Do something
         }
         if errwrap.ContainsType(err, new(os.PathError)) {
diff --git a/vendor/github.com/hashicorp/errwrap/go.mod b/vendor/github.com/hashicorp/errwrap/go.mod
new file mode 100644
index 0000000..c9b8402
--- /dev/null
+++ b/vendor/github.com/hashicorp/errwrap/go.mod
@@ -0,0 +1 @@
+module github.com/hashicorp/errwrap
diff --git a/vendor/github.com/hashicorp/go-getter/.travis.yml b/vendor/github.com/hashicorp/go-getter/.travis.yml
index da804c2..4fe9176 100644
--- a/vendor/github.com/hashicorp/go-getter/.travis.yml
+++ b/vendor/github.com/hashicorp/go-getter/.travis.yml
@@ -9,15 +9,16 @@ addons:
 
 language: go
 
+os:
+  - linux
+  - osx
+
 go:
-  - 1.8.x
-  - 1.9.x
-  - master
+  - "1.11.x"
+
+before_script:
+  - go build ./cmd/go-getter
 
 branches:
   only:
     - master
-
-matrix:
-  allow_failures:
-    - go: master
diff --git a/vendor/github.com/hashicorp/go-getter/README.md b/vendor/github.com/hashicorp/go-getter/README.md
index 40ace74..ba4df6f 100644
--- a/vendor/github.com/hashicorp/go-getter/README.md
+++ b/vendor/github.com/hashicorp/go-getter/README.md
@@ -71,6 +71,7 @@ can be augmented at runtime by implementing the `Getter` interface.
   * Mercurial
   * HTTP
   * Amazon S3
+  * Google GCP
 
 In addition to the above protocols, go-getter has what are called "detectors."
 These take a URL and attempt to automatically choose the best protocol for
@@ -97,7 +98,7 @@ would download the given HTTP URL using the Git protocol.
 
 Forced protocols will also override any detectors.
 
-In the absense of a forced protocol, detectors may be run on the URL, transforming
+In the absence of a forced protocol, detectors may be run on the URL, transforming
 the protocol anyways. The above example would've used the Git protocol either
 way since the Git detector would've detected it was a GitHub URL.
 
@@ -155,20 +156,44 @@ For file downloads of any protocol, go-getter can automatically verify
 a checksum for you. Note that checksumming only works for downloading files,
 not directories, but checksumming will work for any protocol.
 
-To checksum a file, append a `checksum` query parameter to the URL.
-The paramter value should be in the format of `type:value`, where
-type is "md5", "sha1", "sha256", or "sha512". The "value" should be
-the actual checksum value. go-getter will parse out this query parameter
-automatically and use it to verify the checksum. An example URL
-is shown below:
+To checksum a file, append a `checksum` query parameter to the URL. go-getter
+will parse out this query parameter automatically and use it to verify the
+checksum. The parameter value can be in the format of `type:value` or just
+`value`, where type is "md5", "sha1", "sha256", "sha512" or "file" . The
+"value" should be the actual checksum value or download URL for "file". When
+`type` part is omitted, type will be guessed based on the length of the
+checksum string. Examples:
 
 ```
 ./foo.txt?checksum=md5:b7d96c89d09d9e204f5fedc4d5d55b21
 ```
 
+```
+./foo.txt?checksum=b7d96c89d09d9e204f5fedc4d5d55b21
+```
+
+```
+./foo.txt?checksum=file:./foo.txt.sha256sum
+```
+ 
+When checksumming from a file - ex: with `checksum=file:url` - go-getter will
+get the file linked in the URL after `file:` using the same configuration. For
+example, in `file:http://releases.ubuntu.com/cosmic/MD5SUMS` go-getter will
+download a checksum file under the aforementioned url using the http protocol.
+All protocols supported by go-getter can be used. The checksum file will be
+downloaded in a temporary file then parsed. The destination of the temporary
+file can be changed by setting system specific environment variables: `TMPDIR`
+for unix; `TMP`, `TEMP` or `USERPROFILE` on windows. Read godoc of
+[os.TempDir](https://golang.org/pkg/os/#TempDir) for more information on the
+temporary directory selection. Content of files are expected to be BSD or GNU
+style. Once go-getter is done with the checksum file; it is deleted.
+
 The checksum query parameter is never sent to the backend protocol
 implementation. It is used at a higher level by go-getter itself.
 
+If the destination file exists and the checksums match: download
+will be skipped.
+
 ### Unarchiving
 
 go-getter will automatically unarchive files into a file or directory
@@ -215,11 +240,12 @@ from the URL before going to the final protocol downloader.
 
 ## Protocol-Specific Options
 
-This section documents the protocol-specific options that can be specified
-for go-getter. These options should be appended to the input as normal query
-parameters. Depending on the usage of go-getter, applications may provide
-alternate ways of inputting options. For example, [Nomad](https://www.nomadproject.io)
-provides a nice options block for specifying options rather than in the URL.
+This section documents the protocol-specific options that can be specified for
+go-getter. These options should be appended to the input as normal query
+parameters ([HTTP headers](#headers) are an exception to this, however).
+Depending on the usage of go-getter, applications may provide alternate ways of
+inputting options. For example, [Nomad](https://www.nomadproject.io) provides a
+nice options block for specifying options rather than in the URL.
 
 ## General (All Protocols)
 
@@ -250,6 +276,19 @@ None
     from a private key file on disk, you would run `base64 -w0 <file>`.
 
     **Note**: Git 2.3+ is required to use this feature.
+  
+  * `depth` - The Git clone depth. The provided number specifies the last `n`
+    revisions to clone from the repository.
+
+
+The `git` getter accepts both URL-style SSH addresses like
+`git::ssh://git@example.com/foo/bar`, and "scp-style" addresses like
+`git::git@example.com/foo/bar`. In the latter case, omitting the `git::`
+force prefix is allowed if the username prefix is exactly `git@`.
+
+The "scp-style" addresses _cannot_ be used in conjunction with the `ssh://`
+scheme prefix, because in that case the colon is used to mark an optional
+port number to connect on, rather than to delimit the path from the host.
 
 ### Mercurial (`hg`)
 
@@ -263,6 +302,13 @@ To use HTTP basic authentication with go-getter, simply prepend `username:passwo
 hostname in the URL such as `https://Aladdin:OpenSesame@www.example.com/index.html`. All special
 characters, including the username and password, must be URL encoded.
 
+#### Headers
+
+Optional request headers can be added by supplying them in a custom
+[`HttpGetter`](https://godoc.org/github.com/hashicorp/go-getter#HttpGetter)
+(_not_ as query parameters like most other options). These headers will be sent
+out on every request the getter in question makes.
+
 ### S3 (`s3`)
 
 S3 takes various access configurations in the URL. Note that it will also
@@ -299,3 +345,14 @@ Some examples for these addressing schemes:
 - bucket.s3-eu-west-1.amazonaws.com/foo/bar
 - "s3::http://127.0.0.1:9000/test-bucket/hello.txt?aws_access_key_id=KEYID&aws_access_key_secret=SECRETKEY&region=us-east-2"
 
+### GCS (`gcs`)
+
+#### GCS Authentication
+
+In order to access to GCS, authentication credentials should be provided. More information can be found [here](https://cloud.google.com/docs/authentication/getting-started)
+
+#### GCS Bucket Examples
+
+- gcs::https://www.googleapis.com/storage/v1/bucket
+- gcs::https://www.googleapis.com/storage/v1/bucket/foo.zip
+- www.googleapis.com/storage/v1/bucket/foo
diff --git a/vendor/github.com/hashicorp/go-getter/appveyor.yml b/vendor/github.com/hashicorp/go-getter/appveyor.yml
index ec48d45..1e8718e 100644
--- a/vendor/github.com/hashicorp/go-getter/appveyor.yml
+++ b/vendor/github.com/hashicorp/go-getter/appveyor.yml
@@ -13,4 +13,4 @@ install:
 
     go get -d -v -t ./...
 build_script:
-- cmd: go test -v ./...
+- cmd: go test ./...
diff --git a/vendor/github.com/hashicorp/go-getter/checksum.go b/vendor/github.com/hashicorp/go-getter/checksum.go
new file mode 100644
index 0000000..bea7ed1
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/checksum.go
@@ -0,0 +1,314 @@
+package getter
+
+import (
+        "bufio"
+        "bytes"
+        "crypto/md5"
+        "crypto/sha1"
+        "crypto/sha256"
+        "crypto/sha512"
+        "encoding/hex"
+        "fmt"
+        "hash"
+        "io"
+        "net/url"
+        "os"
+        "path/filepath"
+        "strings"
+
+        urlhelper "github.com/hashicorp/go-getter/helper/url"
+)
+
+// fileChecksum helps verifying the checksum for a file.
+type fileChecksum struct {
+        Type     string
+        Hash     hash.Hash
+        Value    []byte
+        Filename string
+}
+
+// A ChecksumError is returned when a checksum differs
+type ChecksumError struct {
+        Hash     hash.Hash
+        Actual   []byte
+        Expected []byte
+        File     string
+}
+
+func (cerr *ChecksumError) Error() string {
+        if cerr == nil {
+                return "<nil>"
+        }
+        return fmt.Sprintf(
+                "Checksums did not match for %s.\nExpected: %s\nGot: %s\n%T",
+                cerr.File,
+                hex.EncodeToString(cerr.Expected),
+                hex.EncodeToString(cerr.Actual),
+                cerr.Hash, // ex: *sha256.digest
+        )
+}
+
+// checksum is a simple method to compute the checksum of a source file
+// and compare it to the given expected value.
+func (c *fileChecksum) checksum(source string) error {
+        f, err := os.Open(source)
+        if err != nil {
+                return fmt.Errorf("Failed to open file for checksum: %s", err)
+        }
+        defer f.Close()
+
+        c.Hash.Reset()
+        if _, err := io.Copy(c.Hash, f); err != nil {
+                return fmt.Errorf("Failed to hash: %s", err)
+        }
+
+        if actual := c.Hash.Sum(nil); !bytes.Equal(actual, c.Value) {
+                return &ChecksumError{
+                        Hash:     c.Hash,
+                        Actual:   actual,
+                        Expected: c.Value,
+                        File:     source,
+                }
+        }
+
+        return nil
+}
+
+// extractChecksum will return a fileChecksum based on the 'checksum'
+// parameter of u.
+// ex:
+//  http://hashicorp.com/terraform?checksum=<checksumValue>
+//  http://hashicorp.com/terraform?checksum=<checksumType>:<checksumValue>
+//  http://hashicorp.com/terraform?checksum=file:<checksum_url>
+// when checksumming from a file, extractChecksum will go get checksum_url
+// in a temporary directory, parse the content of the file then delete it.
+// Content of files are expected to be BSD style or GNU style.
+//
+// BSD-style checksum:
+//  MD5 (file1) = <checksum>
+//  MD5 (file2) = <checksum>
+//
+// GNU-style:
+//  <checksum>  file1
+//  <checksum> *file2
+//
+// see parseChecksumLine for more detail on checksum file parsing
+func (c *Client) extractChecksum(u *url.URL) (*fileChecksum, error) {
+        q := u.Query()
+        v := q.Get("checksum")
+
+        if v == "" {
+                return nil, nil
+        }
+
+        vs := strings.SplitN(v, ":", 2)
+        switch len(vs) {
+        case 2:
+                break // good
+        default:
+                // here, we try to guess the checksum from it's length
+                // if the type was not passed
+                return newChecksumFromValue(v, filepath.Base(u.EscapedPath()))
+        }
+
+        checksumType, checksumValue := vs[0], vs[1]
+
+        switch checksumType {
+        case "file":
+                return c.checksumFromFile(checksumValue, u)
+        default:
+                return newChecksumFromType(checksumType, checksumValue, filepath.Base(u.EscapedPath()))
+        }
+}
+
+func newChecksum(checksumValue, filename string) (*fileChecksum, error) {
+        c := &fileChecksum{
+                Filename: filename,
+        }
+        var err error
+        c.Value, err = hex.DecodeString(checksumValue)
+        if err != nil {
+                return nil, fmt.Errorf("invalid checksum: %s", err)
+        }
+        return c, nil
+}
+
+func newChecksumFromType(checksumType, checksumValue, filename string) (*fileChecksum, error) {
+        c, err := newChecksum(checksumValue, filename)
+        if err != nil {
+                return nil, err
+        }
+
+        c.Type = strings.ToLower(checksumType)
+        switch c.Type {
+        case "md5":
+                c.Hash = md5.New()
+        case "sha1":
+                c.Hash = sha1.New()
+        case "sha256":
+                c.Hash = sha256.New()
+        case "sha512":
+                c.Hash = sha512.New()
+        default:
+                return nil, fmt.Errorf(
+                        "unsupported checksum type: %s", checksumType)
+        }
+
+        return c, nil
+}
+
+func newChecksumFromValue(checksumValue, filename string) (*fileChecksum, error) {
+        c, err := newChecksum(checksumValue, filename)
+        if err != nil {
+                return nil, err
+        }
+
+        switch len(c.Value) {
+        case md5.Size:
+                c.Hash = md5.New()
+                c.Type = "md5"
+        case sha1.Size:
+                c.Hash = sha1.New()
+                c.Type = "sha1"
+        case sha256.Size:
+                c.Hash = sha256.New()
+                c.Type = "sha256"
+        case sha512.Size:
+                c.Hash = sha512.New()
+                c.Type = "sha512"
+        default:
+                return nil, fmt.Errorf("Unknown type for checksum %s", checksumValue)
+        }
+
+        return c, nil
+}
+
+// checksumsFromFile will return all the fileChecksums found in file
+//
+// checksumsFromFile will try to guess the hashing algorithm based on content
+// of checksum file
+//
+// checksumsFromFile will only return checksums for files that match file
+// behind src
+func (c *Client) checksumFromFile(checksumFile string, src *url.URL) (*fileChecksum, error) {
+        checksumFileURL, err := urlhelper.Parse(checksumFile)
+        if err != nil {
+                return nil, err
+        }
+
+        tempfile, err := tmpFile("", filepath.Base(checksumFileURL.Path))
+        if err != nil {
+                return nil, err
+        }
+        defer os.Remove(tempfile)
+
+        c2 := &Client{
+                Ctx:              c.Ctx,
+                Getters:          c.Getters,
+                Decompressors:    c.Decompressors,
+                Detectors:        c.Detectors,
+                Pwd:              c.Pwd,
+                Dir:              false,
+                Src:              checksumFile,
+                Dst:              tempfile,
+                ProgressListener: c.ProgressListener,
+        }
+        if err = c2.Get(); err != nil {
+                return nil, fmt.Errorf(
+                        "Error downloading checksum file: %s", err)
+        }
+
+        filename := filepath.Base(src.Path)
+        absPath, err := filepath.Abs(src.Path)
+        if err != nil {
+                return nil, err
+        }
+        checksumFileDir := filepath.Dir(checksumFileURL.Path)
+        relpath, err := filepath.Rel(checksumFileDir, absPath)
+        switch {
+        case err == nil ||
+                err.Error() == "Rel: can't make "+absPath+" relative to "+checksumFileDir:
+                // ex: on windows C:\gopath\...\content.txt cannot be relative to \
+                // which is okay, may be another expected path will work.
+                break
+        default:
+                return nil, err
+        }
+
+        // possible file identifiers:
+        options := []string{
+                filename,       // ubuntu-14.04.1-server-amd64.iso
+                "*" + filename, // *ubuntu-14.04.1-server-amd64.iso  Standard checksum
+                "?" + filename, // ?ubuntu-14.04.1-server-amd64.iso  shasum -p
+                relpath,        // dir/ubuntu-14.04.1-server-amd64.iso
+                "./" + relpath, // ./dir/ubuntu-14.04.1-server-amd64.iso
+                absPath,        // fullpath; set if local
+        }
+
+        f, err := os.Open(tempfile)
+        if err != nil {
+                return nil, fmt.Errorf(
+                        "Error opening downloaded file: %s", err)
+        }
+        defer f.Close()
+        rd := bufio.NewReader(f)
+        for {
+                line, err := rd.ReadString('\n')
+                if err != nil {
+                        if err != io.EOF {
+                                return nil, fmt.Errorf(
+                                        "Error reading checksum file: %s", err)
+                        }
+                        break
+                }
+                checksum, err := parseChecksumLine(line)
+                if err != nil || checksum == nil {
+                        continue
+                }
+                if checksum.Filename == "" {
+                        // filename not sure, let's try
+                        return checksum, nil
+                }
+                // make sure the checksum is for the right file
+                for _, option := range options {
+                        if option != "" && checksum.Filename == option {
+                                // any checksum will work so we return the first one
+                                return checksum, nil
+                        }
+                }
+        }
+        return nil, fmt.Errorf("no checksum found in: %s", checksumFile)
+}
+
+// parseChecksumLine takes a line from a checksum file and returns
+// checksumType, checksumValue and filename parseChecksumLine guesses the style
+// of the checksum BSD vs GNU by splitting the line and by counting the parts.
+// of a line.
+// for BSD type sums parseChecksumLine guesses the hashing algorithm
+// by checking the length of the checksum.
+func parseChecksumLine(line string) (*fileChecksum, error) {
+        parts := strings.Fields(line)
+
+        switch len(parts) {
+        case 4:
+                // BSD-style checksum:
+                //  MD5 (file1) = <checksum>
+                //  MD5 (file2) = <checksum>
+                if len(parts[1]) <= 2 ||
+                        parts[1][0] != '(' || parts[1][len(parts[1])-1] != ')' {
+                        return nil, fmt.Errorf(
+                                "Unexpected BSD-style-checksum filename format: %s", line)
+                }
+                filename := parts[1][1 : len(parts[1])-1]
+                return newChecksumFromType(parts[0], parts[3], filename)
+        case 2:
+                // GNU-style:
+                //  <checksum>  file1
+                //  <checksum> *file2
+                return newChecksumFromValue(parts[0], parts[1])
+        case 0:
+                return nil, nil // empty line
+        default:
+                return newChecksumFromValue(parts[0], "")
+        }
+}
diff --git a/vendor/github.com/hashicorp/go-getter/client.go b/vendor/github.com/hashicorp/go-getter/client.go
index 300301c..007a78b 100644
--- a/vendor/github.com/hashicorp/go-getter/client.go
+++ b/vendor/github.com/hashicorp/go-getter/client.go
@@ -1,15 +1,8 @@
 package getter
 
 import (
-        "bytes"
-        "crypto/md5"
-        "crypto/sha1"
-        "crypto/sha256"
-        "crypto/sha512"
-        "encoding/hex"
+        "context"
         "fmt"
-        "hash"
-        "io"
         "io/ioutil"
         "os"
         "path/filepath"
@@ -17,7 +10,7 @@ import (
         "strings"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
-        "github.com/hashicorp/go-safetemp"
+        safetemp "github.com/hashicorp/go-safetemp"
 )
 
 // Client is a client for downloading things.
@@ -26,6 +19,9 @@ import (
 // Using a client directly allows more fine-grained control over how downloading
 // is done, as well as customizing the protocols supported.
 type Client struct {
+        // Ctx for cancellation
+        Ctx context.Context
+
         // Src is the source URL to get.
         //
         // Dst is the path to save the downloaded thing as. If Dir is set to
@@ -62,10 +58,20 @@ type Client struct {
         //
         // WARNING: deprecated. If Mode is set, that will take precedence.
         Dir bool
+
+        // ProgressListener allows to track file downloads.
+        // By default a no op progress listener is used.
+        ProgressListener ProgressTracker
+
+        Options []ClientOption
 }
 
 // Get downloads the configured source to the destination.
 func (c *Client) Get() error {
+        if err := c.Configure(c.Options...); err != nil {
+                return err
+        }
+
         // Store this locally since there are cases we swap this
         mode := c.Mode
         if mode == ClientModeInvalid {
@@ -76,18 +82,7 @@ func (c *Client) Get() error {
                 }
         }
 
-        // Default decompressor value
-        decompressors := c.Decompressors
-        if decompressors == nil {
-                decompressors = Decompressors
-        }
-
-        // Detect the URL. This is safe if it is already detected.
-        detectors := c.Detectors
-        if detectors == nil {
-                detectors = Detectors
-        }
-        src, err := Detect(c.Src, c.Pwd, detectors)
+        src, err := Detect(c.Src, c.Pwd, c.Detectors)
         if err != nil {
                 return err
         }
@@ -119,12 +114,7 @@ func (c *Client) Get() error {
                 force = u.Scheme
         }
 
-        getters := c.Getters
-        if getters == nil {
-                getters = Getters
-        }
-
-        g, ok := getters[force]
+        g, ok := c.Getters[force]
         if !ok {
                 return fmt.Errorf(
                         "download not supported for scheme '%s'", force)
@@ -150,7 +140,7 @@ func (c *Client) Get() error {
         if archiveV == "" {
                 // We don't appear to... but is it part of the filename?
                 matchingLen := 0
-                for k, _ := range decompressors {
+                for k := range c.Decompressors {
                         if strings.HasSuffix(u.Path, "."+k) && len(k) > matchingLen {
                                 archiveV = k
                                 matchingLen = len(k)
@@ -163,7 +153,7 @@ func (c *Client) Get() error {
         // real path.
         var decompressDst string
         var decompressDir bool
-        decompressor := decompressors[archiveV]
+        decompressor := c.Decompressors[archiveV]
         if decompressor != nil {
                 // Create a temporary directory to store our archive. We delete
                 // this at the end of everything.
@@ -182,44 +172,16 @@ func (c *Client) Get() error {
                 mode = ClientModeFile
         }
 
-        // Determine if we have a checksum
-        var checksumHash hash.Hash
-        var checksumValue []byte
-        if v := q.Get("checksum"); v != "" {
-                // Delete the query parameter if we have it.
-                q.Del("checksum")
-                u.RawQuery = q.Encode()
-
-                // Determine the checksum hash type
-                checksumType := ""
-                idx := strings.Index(v, ":")
-                if idx > -1 {
-                        checksumType = v[:idx]
-                }
-                switch checksumType {
-                case "md5":
-                        checksumHash = md5.New()
-                case "sha1":
-                        checksumHash = sha1.New()
-                case "sha256":
-                        checksumHash = sha256.New()
-                case "sha512":
-                        checksumHash = sha512.New()
-                default:
-                        return fmt.Errorf(
-                                "unsupported checksum type: %s", checksumType)
-                }
-
-                // Get the remainder of the value and parse it into bytes
-                b, err := hex.DecodeString(v[idx+1:])
-                if err != nil {
-                        return fmt.Errorf("invalid checksum: %s", err)
-                }
-
-                // Set our value
-                checksumValue = b
+        // Determine checksum if we have one
+        checksum, err := c.extractChecksum(u)
+        if err != nil {
+                return fmt.Errorf("invalid checksum: %s", err)
         }
 
+        // Delete the query parameter if we have it.
+        q.Del("checksum")
+        u.RawQuery = q.Encode()
+
         if mode == ClientModeAny {
                 // Ask the getter which client mode to use
                 mode, err = g.ClientMode(u)
@@ -248,15 +210,24 @@ func (c *Client) Get() error {
         // If we're not downloading a directory, then just download the file
         // and return.
         if mode == ClientModeFile {
-                err := g.GetFile(dst, u)
-                if err != nil {
-                        return err
+                getFile := true
+                if checksum != nil {
+                        if err := checksum.checksum(dst); err == nil {
+                                // don't get the file if the checksum of dst is correct
+                                getFile = false
+                        }
                 }
-
-                if checksumHash != nil {
-                        if err := checksum(dst, checksumHash, checksumValue); err != nil {
+                if getFile {
+                        err := g.GetFile(dst, u)
+                        if err != nil {
                                 return err
                         }
+
+                        if checksum != nil {
+                                if err := checksum.checksum(dst); err != nil {
+                                        return err
+                                }
+                        }
                 }
 
                 if decompressor != nil {
@@ -291,7 +262,7 @@ func (c *Client) Get() error {
         if decompressor == nil {
                 // If we're getting a directory, then this is an error. You cannot
                 // checksum a directory. TODO: test
-                if checksumHash != nil {
+                if checksum != nil {
                         return fmt.Errorf(
                                 "checksum cannot be specified for directory download")
                 }
@@ -320,30 +291,7 @@ func (c *Client) Get() error {
                         return err
                 }
 
-                return copyDir(realDst, subDir, false)
-        }
-
-        return nil
-}
-
-// checksum is a simple method to compute the checksum of a source file
-// and compare it to the given expected value.
-func checksum(source string, h hash.Hash, v []byte) error {
-        f, err := os.Open(source)
-        if err != nil {
-                return fmt.Errorf("Failed to open file for checksum: %s", err)
-        }
-        defer f.Close()
-
-        if _, err := io.Copy(h, f); err != nil {
-                return fmt.Errorf("Failed to hash: %s", err)
-        }
-
-        if actual := h.Sum(nil); !bytes.Equal(actual, v) {
-                return fmt.Errorf(
-                        "Checksums did not match.\nExpected: %s\nGot: %s",
-                        hex.EncodeToString(v),
-                        hex.EncodeToString(actual))
+                return copyDir(c.Ctx, realDst, subDir, false)
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/go-getter/client_option.go b/vendor/github.com/hashicorp/go-getter/client_option.go
new file mode 100644
index 0000000..c1ee413
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/client_option.go
@@ -0,0 +1,46 @@
+package getter
+
+import "context"
+
+// A ClientOption allows to configure a client
+type ClientOption func(*Client) error
+
+// Configure configures a client with options.
+func (c *Client) Configure(opts ...ClientOption) error {
+        if c.Ctx == nil {
+                c.Ctx = context.Background()
+        }
+        c.Options = opts
+        for _, opt := range opts {
+                err := opt(c)
+                if err != nil {
+                        return err
+                }
+        }
+        // Default decompressor values
+        if c.Decompressors == nil {
+                c.Decompressors = Decompressors
+        }
+        // Default detector values
+        if c.Detectors == nil {
+                c.Detectors = Detectors
+        }
+        // Default getter values
+        if c.Getters == nil {
+                c.Getters = Getters
+        }
+
+        for _, getter := range c.Getters {
+                getter.SetClient(c)
+        }
+        return nil
+}
+
+// WithContext allows to pass a context to operation
+// in order to be able to cancel a download in progress.
+func WithContext(ctx context.Context) func(*Client) error {
+        return func(c *Client) error {
+                c.Ctx = ctx
+                return nil
+        }
+}
diff --git a/vendor/github.com/hashicorp/go-getter/client_option_progress.go b/vendor/github.com/hashicorp/go-getter/client_option_progress.go
new file mode 100644
index 0000000..9b185f7
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/client_option_progress.go
@@ -0,0 +1,38 @@
+package getter
+
+import (
+        "io"
+)
+
+// WithProgress allows for a user to track
+// the progress of a download.
+// For example by displaying a progress bar with
+// current download.
+// Not all getters have progress support yet.
+func WithProgress(pl ProgressTracker) func(*Client) error {
+        return func(c *Client) error {
+                c.ProgressListener = pl
+                return nil
+        }
+}
+
+// ProgressTracker allows to track the progress of downloads.
+type ProgressTracker interface {
+        // TrackProgress should be called when
+        // a new object is being downloaded.
+        // src is the location the file is
+        // downloaded from.
+        // currentSize is the current size of
+        // the file in case it is a partial
+        // download.
+        // totalSize is the total size in bytes,
+        // size can be zero if the file size
+        // is not known.
+        // stream is the file being downloaded, every
+        // written byte will add up to processed size.
+        //
+        // TrackProgress returns a ReadCloser that wraps the
+        // download in progress ( stream ).
+        // When the download is finished, body shall be closed.
+        TrackProgress(src string, currentSize, totalSize int64, stream io.ReadCloser) (body io.ReadCloser)
+}
diff --git a/vendor/github.com/hashicorp/go-getter/common.go b/vendor/github.com/hashicorp/go-getter/common.go
new file mode 100644
index 0000000..d2afd8a
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/common.go
@@ -0,0 +1,14 @@
+package getter
+
+import (
+        "io/ioutil"
+)
+
+func tmpFile(dir, pattern string) (string, error) {
+        f, err := ioutil.TempFile(dir, pattern)
+        if err != nil {
+                return "", err
+        }
+        f.Close()
+        return f.Name(), nil
+}
diff --git a/vendor/github.com/hashicorp/go-getter/copy_dir.go b/vendor/github.com/hashicorp/go-getter/copy_dir.go
index 2f58e8a..641fe6d 100644
--- a/vendor/github.com/hashicorp/go-getter/copy_dir.go
+++ b/vendor/github.com/hashicorp/go-getter/copy_dir.go
@@ -1,7 +1,7 @@
 package getter
 
 import (
-        "io"
+        "context"
         "os"
         "path/filepath"
         "strings"
@@ -11,7 +11,7 @@ import (
 // should already exist.
 //
 // If ignoreDot is set to true, then dot-prefixed files/folders are ignored.
-func copyDir(dst string, src string, ignoreDot bool) error {
+func copyDir(ctx context.Context, dst string, src string, ignoreDot bool) error {
         src, err := filepath.EvalSymlinks(src)
         if err != nil {
                 return err
@@ -66,7 +66,7 @@ func copyDir(dst string, src string, ignoreDot bool) error {
                 }
                 defer dstF.Close()
 
-                if _, err := io.Copy(dstF, srcF); err != nil {
+                if _, err := Copy(ctx, dstF, srcF); err != nil {
                         return err
                 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tar.go b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
index 39cb392..b6986a2 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tar.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
@@ -6,6 +6,7 @@ import (
         "io"
         "os"
         "path/filepath"
+        "time"
 )
 
 // untar is a shared helper for untarring an archive. The reader should provide
@@ -14,6 +15,7 @@ func untar(input io.Reader, dst, src string, dir bool) error {
         tarR := tar.NewReader(input)
         done := false
         dirHdrs := []*tar.Header{}
+        now := time.Now()
         for {
                 hdr, err := tarR.Next()
                 if err == io.EOF {
@@ -95,17 +97,37 @@ func untar(input io.Reader, dst, src string, dir bool) error {
                         return err
                 }
 
-                // Set the access and modification time
-                if err := os.Chtimes(path, hdr.AccessTime, hdr.ModTime); err != nil {
+                // Set the access and modification time if valid, otherwise default to current time
+                aTime := now
+                mTime := now
+                if hdr.AccessTime.Unix() > 0 {
+                        aTime = hdr.AccessTime
+                }
+                if hdr.ModTime.Unix() > 0 {
+                        mTime = hdr.ModTime
+                }
+                if err := os.Chtimes(path, aTime, mTime); err != nil {
                         return err
                 }
         }
 
-        // Adding a file or subdirectory changes the mtime of a directory
-        // We therefore wait until we've extracted everything and then set the mtime and atime attributes
+        // Perform a final pass over extracted directories to update metadata
         for _, dirHdr := range dirHdrs {
                 path := filepath.Join(dst, dirHdr.Name)
-                if err := os.Chtimes(path, dirHdr.AccessTime, dirHdr.ModTime); err != nil {
+                // Chmod the directory since they might be created before we know the mode flags
+                if err := os.Chmod(path, dirHdr.FileInfo().Mode()); err != nil {
+                        return err
+                }
+                // Set the mtime/atime attributes since they would have been changed during extraction
+                aTime := now
+                mTime := now
+                if dirHdr.AccessTime.Unix() > 0 {
+                        aTime = dirHdr.AccessTime
+                }
+                if dirHdr.ModTime.Unix() > 0 {
+                        mTime = dirHdr.ModTime
+                }
+                if err := os.Chtimes(path, aTime, mTime); err != nil {
                         return err
                 }
         }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_testing.go b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
index 91cf33d..b2f662a 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_testing.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
@@ -18,16 +18,18 @@ import (
 
 // TestDecompressCase is a single test case for testing decompressors
 type TestDecompressCase struct {
-        Input   string   // Input is the complete path to the input file
-        Dir     bool     // Dir is whether or not we're testing directory mode
-        Err     bool     // Err is whether we expect an error or not
-        DirList []string // DirList is the list of files for Dir mode
-        FileMD5 string   // FileMD5 is the expected MD5 for a single file
-        Mtime *time.Time // Mtime is the optionally expected mtime for a single file (or all files if in Dir mode)
+        Input   string     // Input is the complete path to the input file
+        Dir     bool       // Dir is whether or not we're testing directory mode
+        Err     bool       // Err is whether we expect an error or not
+        DirList []string   // DirList is the list of files for Dir mode
+        FileMD5 string     // FileMD5 is the expected MD5 for a single file
+        Mtime   *time.Time // Mtime is the optionally expected mtime for a single file (or all files if in Dir mode)
 }
 
 // TestDecompressor is a helper function for testing generic decompressors.
 func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
+        t.Helper()
+
         for _, tc := range cases {
                 t.Logf("Testing: %s", tc.Input)
 
@@ -72,9 +74,13 @@ func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
 
                                 if tc.Mtime != nil {
                                         actual := fi.ModTime()
-                                        expected := *tc.Mtime
-                                        if actual != expected {
-                                                t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), dst, actual.String())
+                                        if tc.Mtime.Unix() > 0 {
+                                                expected := *tc.Mtime
+                                                if actual != expected {
+                                                        t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), dst, actual.String())
+                                                }
+                                        } else if actual.Unix() <= 0 {
+                                                t.Fatalf("err %s: expected mtime to be > 0, got '%s'", actual.String())
                                         }
                                 }
 
@@ -103,10 +109,15 @@ func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
                                                 t.Fatalf("err: %s", err)
                                         }
                                         actual := fi.ModTime()
-                                        expected := *tc.Mtime
-                                        if actual != expected {
-                                                t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), path, actual.String())
+                                        if tc.Mtime.Unix() > 0 {
+                                                expected := *tc.Mtime
+                                                if actual != expected {
+                                                        t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), path, actual.String())
+                                                }
+                                        } else if actual.Unix() < 0 {
+                                                t.Fatalf("err %s: expected mtime to be > 0, got '%s'", actual.String())
                                         }
+
                                 }
                         }
                 }()
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_zip.go b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
index b0e70ca..0830f79 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_zip.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
@@ -9,7 +9,7 @@ import (
 )
 
 // ZipDecompressor is an implementation of Decompressor that can
-// decompress tar.gzip files.
+// decompress zip files.
 type ZipDecompressor struct{}
 
 func (d *ZipDecompressor) Decompress(dst, src string, dir bool) error {
diff --git a/vendor/github.com/hashicorp/go-getter/detect.go b/vendor/github.com/hashicorp/go-getter/detect.go
index c369551..5bb750c 100644
--- a/vendor/github.com/hashicorp/go-getter/detect.go
+++ b/vendor/github.com/hashicorp/go-getter/detect.go
@@ -23,8 +23,10 @@ var Detectors []Detector
 func init() {
         Detectors = []Detector{
                 new(GitHubDetector),
+                new(GitDetector),
                 new(BitBucketDetector),
                 new(S3Detector),
+                new(GCSDetector),
                 new(FileDetector),
         }
 }
diff --git a/vendor/github.com/hashicorp/go-getter/detect_gcs.go b/vendor/github.com/hashicorp/go-getter/detect_gcs.go
new file mode 100644
index 0000000..1136373
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/detect_gcs.go
@@ -0,0 +1,43 @@
+package getter
+
+import (
+        "fmt"
+        "net/url"
+        "strings"
+)
+
+// GCSDetector implements Detector to detect GCS URLs and turn
+// them into URLs that the GCSGetter can understand.
+type GCSDetector struct{}
+
+func (d *GCSDetector) Detect(src, _ string) (string, bool, error) {
+        if len(src) == 0 {
+                return "", false, nil
+        }
+
+        if strings.Contains(src, "googleapis.com/") {
+                return d.detectHTTP(src)
+        }
+
+        return "", false, nil
+}
+
+func (d *GCSDetector) detectHTTP(src string) (string, bool, error) {
+
+        parts := strings.Split(src, "/")
+        if len(parts) < 5 {
+                return "", false, fmt.Errorf(
+                        "URL is not a valid GCS URL")
+        }
+        version := parts[2]
+        bucket := parts[3]
+        object := strings.Join(parts[4:], "/")
+
+        url, err := url.Parse(fmt.Sprintf("https://www.googleapis.com/storage/%s/%s/%s",
+                version, bucket, object))
+        if err != nil {
+                return "", false, fmt.Errorf("error parsing GCS URL: %s", err)
+        }
+
+        return "gcs::" + url.String(), true, nil
+}
diff --git a/vendor/github.com/hashicorp/go-getter/detect_git.go b/vendor/github.com/hashicorp/go-getter/detect_git.go
new file mode 100644
index 0000000..eeb8a04
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/detect_git.go
@@ -0,0 +1,26 @@
+package getter
+
+// GitDetector implements Detector to detect Git SSH URLs such as
+// git@host.com:dir1/dir2 and converts them to proper URLs.
+type GitDetector struct{}
+
+func (d *GitDetector) Detect(src, _ string) (string, bool, error) {
+        if len(src) == 0 {
+                return "", false, nil
+        }
+
+        u, err := detectSSH(src)
+        if err != nil {
+                return "", true, err
+        }
+        if u == nil {
+                return "", false, nil
+        }
+
+        // We require the username to be "git" to assume that this is a Git URL
+        if u.User.Username() != "git" {
+                return "", false, nil
+        }
+
+        return "git::" + u.String(), true, nil
+}
diff --git a/vendor/github.com/hashicorp/go-getter/detect_github.go b/vendor/github.com/hashicorp/go-getter/detect_github.go
index c084ad9..4bf4daf 100644
--- a/vendor/github.com/hashicorp/go-getter/detect_github.go
+++ b/vendor/github.com/hashicorp/go-getter/detect_github.go
@@ -17,8 +17,6 @@ func (d *GitHubDetector) Detect(src, _ string) (string, bool, error) {
 
         if strings.HasPrefix(src, "github.com/") {
                 return d.detectHTTP(src)
-        } else if strings.HasPrefix(src, "git@github.com:") {
-                return d.detectSSH(src)
         }
 
         return "", false, nil
@@ -47,27 +45,3 @@ func (d *GitHubDetector) detectHTTP(src string) (string, bool, error) {
 
         return "git::" + url.String(), true, nil
 }
-
-func (d *GitHubDetector) detectSSH(src string) (string, bool, error) {
-        idx := strings.Index(src, ":")
-        qidx := strings.Index(src, "?")
-        if qidx == -1 {
-                qidx = len(src)
-        }
-
-        var u url.URL
-        u.Scheme = "ssh"
-        u.User = url.User("git")
-        u.Host = "github.com"
-        u.Path = src[idx+1 : qidx]
-        if qidx < len(src) {
-                q, err := url.ParseQuery(src[qidx+1:])
-                if err != nil {
-                        return "", true, fmt.Errorf("error parsing GitHub SSH URL: %s", err)
-                }
-
-                u.RawQuery = q.Encode()
-        }
-
-        return "git::" + u.String(), true, nil
-}
diff --git a/vendor/github.com/hashicorp/go-getter/detect_ssh.go b/vendor/github.com/hashicorp/go-getter/detect_ssh.go
new file mode 100644
index 0000000..c0dbe9d
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/detect_ssh.go
@@ -0,0 +1,49 @@
+package getter
+
+import (
+        "fmt"
+        "net/url"
+        "regexp"
+        "strings"
+)
+
+// Note that we do not have an SSH-getter currently so this file serves
+// only to hold the detectSSH helper that is used by other detectors.
+
+// sshPattern matches SCP-like SSH patterns (user@host:path)
+var sshPattern = regexp.MustCompile("^(?:([^@]+)@)?([^:]+):/?(.+)$")
+
+// detectSSH determines if the src string matches an SSH-like URL and
+// converts it into a net.URL compatible string. This returns nil if the
+// string doesn't match the SSH pattern.
+//
+// This function is tested indirectly via detect_git_test.go
+func detectSSH(src string) (*url.URL, error) {
+        matched := sshPattern.FindStringSubmatch(src)
+        if matched == nil {
+                return nil, nil
+        }
+
+        user := matched[1]
+        host := matched[2]
+        path := matched[3]
+        qidx := strings.Index(path, "?")
+        if qidx == -1 {
+                qidx = len(path)
+        }
+
+        var u url.URL
+        u.Scheme = "ssh"
+        u.User = url.User(user)
+        u.Host = host
+        u.Path = path[0:qidx]
+        if qidx < len(path) {
+                q, err := url.ParseQuery(path[qidx+1:])
+                if err != nil {
+                        return nil, fmt.Errorf("error parsing GitHub SSH URL: %s", err)
+                }
+                u.RawQuery = q.Encode()
+        }
+
+        return &u, nil
+}
diff --git a/vendor/github.com/hashicorp/go-getter/get.go b/vendor/github.com/hashicorp/go-getter/get.go
index e6053d9..c233763 100644
--- a/vendor/github.com/hashicorp/go-getter/get.go
+++ b/vendor/github.com/hashicorp/go-getter/get.go
@@ -41,6 +41,11 @@ type Getter interface {
         // ClientMode returns the mode based on the given URL. This is used to
         // allow clients to let the getters decide which mode to use.
         ClientMode(*url.URL) (ClientMode, error)
+
+        // SetClient allows a getter to know it's client
+        // in order to access client's Get functions or
+        // progress tracking.
+        SetClient(*Client)
 }
 
 // Getters is the mapping of scheme to the Getter implementation that will
@@ -62,6 +67,7 @@ func init() {
         Getters = map[string]Getter{
                 "file":  new(FileGetter),
                 "git":   new(GitGetter),
+                "gcs":   new(GCSGetter),
                 "hg":    new(HgGetter),
                 "s3":    new(S3Getter),
                 "http":  httpGetter,
@@ -74,12 +80,12 @@ func init() {
 //
 // src is a URL, whereas dst is always just a file path to a folder. This
 // folder doesn't need to exist. It will be created if it doesn't exist.
-func Get(dst, src string) error {
+func Get(dst, src string, opts ...ClientOption) error {
         return (&Client{
                 Src:     src,
                 Dst:     dst,
                 Dir:     true,
-                Getters: Getters,
+                Options: opts,
         }).Get()
 }
 
@@ -89,23 +95,23 @@ func Get(dst, src string) error {
 // dst must be a directory. If src is a file, it will be downloaded
 // into dst with the basename of the URL. If src is a directory or
 // archive, it will be unpacked directly into dst.
-func GetAny(dst, src string) error {
+func GetAny(dst, src string, opts ...ClientOption) error {
         return (&Client{
                 Src:     src,
                 Dst:     dst,
                 Mode:    ClientModeAny,
-                Getters: Getters,
+                Options: opts,
         }).Get()
 }
 
 // GetFile downloads the file specified by src into the path specified by
 // dst.
-func GetFile(dst, src string) error {
+func GetFile(dst, src string, opts ...ClientOption) error {
         return (&Client{
                 Src:     src,
                 Dst:     dst,
                 Dir:     false,
-                Getters: Getters,
+                Options: opts,
         }).Get()
 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/get_base.go b/vendor/github.com/hashicorp/go-getter/get_base.go
new file mode 100644
index 0000000..09e9b63
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/get_base.go
@@ -0,0 +1,20 @@
+package getter
+
+import "context"
+
+// getter is our base getter; it regroups
+// fields all getters have in common.
+type getter struct {
+        client *Client
+}
+
+func (g *getter) SetClient(c *Client) { g.client = c }
+
+// Context tries to returns the Contex from the getter's
+// client. otherwise context.Background() is returned.
+func (g *getter) Context() context.Context {
+        if g == nil || g.client == nil {
+                return context.Background()
+        }
+        return g.client.Ctx
+}
diff --git a/vendor/github.com/hashicorp/go-getter/get_file.go b/vendor/github.com/hashicorp/go-getter/get_file.go
index e5d2d61..7866083 100644
--- a/vendor/github.com/hashicorp/go-getter/get_file.go
+++ b/vendor/github.com/hashicorp/go-getter/get_file.go
@@ -8,7 +8,11 @@ import (
 // FileGetter is a Getter implementation that will download a module from
 // a file scheme.
 type FileGetter struct {
-        // Copy, if set to true, will copy data instead of using a symlink
+        getter
+
+        // Copy, if set to true, will copy data instead of using a symlink. If
+        // false, attempts to symlink to speed up the operation and to lower the
+        // disk space usage. If the symlink fails, may attempt to copy on windows.
         Copy bool
 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/get_file_copy.go b/vendor/github.com/hashicorp/go-getter/get_file_copy.go
new file mode 100644
index 0000000..d70fb49
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/get_file_copy.go
@@ -0,0 +1,29 @@
+package getter
+
+import (
+        "context"
+        "io"
+)
+
+// readerFunc is syntactic sugar for read interface.
+type readerFunc func(p []byte) (n int, err error)
+
+func (rf readerFunc) Read(p []byte) (n int, err error) { return rf(p) }
+
+// Copy is a io.Copy cancellable by context
+func Copy(ctx context.Context, dst io.Writer, src io.Reader) (int64, error) {
+        // Copy will call the Reader and Writer interface multiple time, in order
+        // to copy by chunk (avoiding loading the whole file in memory).
+        return io.Copy(dst, readerFunc(func(p []byte) (int, error) {
+
+                select {
+                case <-ctx.Done():
+                        // context has been canceled
+                        // stop process and propagate "context canceled" error
+                        return 0, ctx.Err()
+                default:
+                        // otherwise just run default io.Reader implementation
+                        return src.Read(p)
+                }
+        }))
+}
diff --git a/vendor/github.com/hashicorp/go-getter/get_file_unix.go b/vendor/github.com/hashicorp/go-getter/get_file_unix.go
index c89a2d5..c3b28ae 100644
--- a/vendor/github.com/hashicorp/go-getter/get_file_unix.go
+++ b/vendor/github.com/hashicorp/go-getter/get_file_unix.go
@@ -4,7 +4,6 @@ package getter
 
 import (
         "fmt"
-        "io"
         "net/url"
         "os"
         "path/filepath"
@@ -50,6 +49,7 @@ func (g *FileGetter) Get(dst string, u *url.URL) error {
 }
 
 func (g *FileGetter) GetFile(dst string, u *url.URL) error {
+        ctx := g.Context()
         path := u.Path
         if u.RawPath != "" {
                 path = u.RawPath
@@ -98,6 +98,6 @@ func (g *FileGetter) GetFile(dst string, u *url.URL) error {
         }
         defer dstF.Close()
 
-        _, err = io.Copy(dstF, srcF)
+        _, err = Copy(ctx, dstF, srcF)
         return err
 }
diff --git a/vendor/github.com/hashicorp/go-getter/get_file_windows.go b/vendor/github.com/hashicorp/go-getter/get_file_windows.go
index f87ed0a..24f1acb 100644
--- a/vendor/github.com/hashicorp/go-getter/get_file_windows.go
+++ b/vendor/github.com/hashicorp/go-getter/get_file_windows.go
@@ -4,15 +4,16 @@ package getter
 
 import (
         "fmt"
-        "io"
         "net/url"
         "os"
         "os/exec"
         "path/filepath"
         "strings"
+        "syscall"
 )
 
 func (g *FileGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
         path := u.Path
         if u.RawPath != "" {
                 path = u.RawPath
@@ -51,7 +52,7 @@ func (g *FileGetter) Get(dst string, u *url.URL) error {
         sourcePath := toBackslash(path)
 
         // Use mklink to create a junction point
-        output, err := exec.Command("cmd", "/c", "mklink", "/J", dst, sourcePath).CombinedOutput()
+        output, err := exec.CommandContext(ctx, "cmd", "/c", "mklink", "/J", dst, sourcePath).CombinedOutput()
         if err != nil {
                 return fmt.Errorf("failed to run mklink %v %v: %v %q", dst, sourcePath, err, output)
         }
@@ -60,6 +61,7 @@ func (g *FileGetter) Get(dst string, u *url.URL) error {
 }
 
 func (g *FileGetter) GetFile(dst string, u *url.URL) error {
+        ctx := g.Context()
         path := u.Path
         if u.RawPath != "" {
                 path = u.RawPath
@@ -92,7 +94,21 @@ func (g *FileGetter) GetFile(dst string, u *url.URL) error {
 
         // If we're not copying, just symlink and we're done
         if !g.Copy {
-                return os.Symlink(path, dst)
+                if err = os.Symlink(path, dst); err == nil {
+                        return err
+                }
+                lerr, ok := err.(*os.LinkError)
+                if !ok {
+                        return err
+                }
+                switch lerr.Err {
+                case syscall.ERROR_PRIVILEGE_NOT_HELD:
+                        // no symlink privilege, let's
+                        // fallback to a copy to avoid an error.
+                        break
+                default:
+                        return err
+                }
         }
 
         // Copy
@@ -108,7 +124,7 @@ func (g *FileGetter) GetFile(dst string, u *url.URL) error {
         }
         defer dstF.Close()
 
-        _, err = io.Copy(dstF, srcF)
+        _, err = Copy(ctx, dstF, srcF)
         return err
 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/get_gcs.go b/vendor/github.com/hashicorp/go-getter/get_gcs.go
new file mode 100644
index 0000000..6faa70f
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/get_gcs.go
@@ -0,0 +1,172 @@
+package getter
+
+import (
+        "context"
+        "fmt"
+        "net/url"
+        "os"
+        "path/filepath"
+        "strings"
+
+        "cloud.google.com/go/storage"
+        "google.golang.org/api/iterator"
+)
+
+// GCSGetter is a Getter implementation that will download a module from
+// a GCS bucket.
+type GCSGetter struct {
+        getter
+}
+
+func (g *GCSGetter) ClientMode(u *url.URL) (ClientMode, error) {
+        ctx := g.Context()
+
+        // Parse URL
+        bucket, object, err := g.parseURL(u)
+        if err != nil {
+                return 0, err
+        }
+
+        client, err := storage.NewClient(ctx)
+        if err != nil {
+                return 0, err
+        }
+        iter := client.Bucket(bucket).Objects(ctx, &storage.Query{Prefix: object})
+        for {
+                obj, err := iter.Next()
+                if err != nil && err != iterator.Done {
+                        return 0, err
+                }
+
+                if err == iterator.Done {
+                        break
+                }
+                if strings.HasSuffix(obj.Name, "/") {
+                        // A directory matched the prefix search, so this must be a directory
+                        return ClientModeDir, nil
+                } else if obj.Name != object {
+                        // A file matched the prefix search and doesn't have the same name
+                        // as the query, so this must be a directory
+                        return ClientModeDir, nil
+                }
+        }
+        // There are no directories or subdirectories, and if a match was returned,
+        // it was exactly equal to the prefix search. So return File mode
+        return ClientModeFile, nil
+}
+
+func (g *GCSGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
+
+        // Parse URL
+        bucket, object, err := g.parseURL(u)
+        if err != nil {
+                return err
+        }
+
+        // Remove destination if it already exists
+        _, err = os.Stat(dst)
+        if err != nil && !os.IsNotExist(err) {
+                return err
+        }
+        if err == nil {
+                // Remove the destination
+                if err := os.RemoveAll(dst); err != nil {
+                        return err
+                }
+        }
+
+        // Create all the parent directories
+        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+                return err
+        }
+
+        client, err := storage.NewClient(ctx)
+        if err != nil {
+                return err
+        }
+
+        // Iterate through all matching objects.
+        iter := client.Bucket(bucket).Objects(ctx, &storage.Query{Prefix: object})
+        for {
+                obj, err := iter.Next()
+                if err != nil && err != iterator.Done {
+                        return err
+                }
+                if err == iterator.Done {
+                        break
+                }
+
+                if !strings.HasSuffix(obj.Name, "/") {
+                        // Get the object destination path
+                        objDst, err := filepath.Rel(object, obj.Name)
+                        if err != nil {
+                                return err
+                        }
+                        objDst = filepath.Join(dst, objDst)
+                        // Download the matching object.
+                        err = g.getObject(ctx, client, objDst, bucket, obj.Name)
+                        if err != nil {
+                                return err
+                        }
+                }
+        }
+        return nil
+}
+
+func (g *GCSGetter) GetFile(dst string, u *url.URL) error {
+        ctx := g.Context()
+
+        // Parse URL
+        bucket, object, err := g.parseURL(u)
+        if err != nil {
+                return err
+        }
+
+        client, err := storage.NewClient(ctx)
+        if err != nil {
+                return err
+        }
+        return g.getObject(ctx, client, dst, bucket, object)
+}
+
+func (g *GCSGetter) getObject(ctx context.Context, client *storage.Client, dst, bucket, object string) error {
+        rc, err := client.Bucket(bucket).Object(object).NewReader(ctx)
+        if err != nil {
+                return err
+        }
+        defer rc.Close()
+
+        // Create all the parent directories
+        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+                return err
+        }
+
+        f, err := os.Create(dst)
+        if err != nil {
+                return err
+        }
+        defer f.Close()
+
+        _, err = Copy(ctx, f, rc)
+        return err
+}
+
+func (g *GCSGetter) parseURL(u *url.URL) (bucket, path string, err error) {
+        if strings.Contains(u.Host, "googleapis.com") {
+                hostParts := strings.Split(u.Host, ".")
+                if len(hostParts) != 3 {
+                        err = fmt.Errorf("URL is not a valid GCS URL")
+                        return
+                }
+
+                pathParts := strings.SplitN(u.Path, "/", 5)
+                if len(pathParts) != 5 {
+                        err = fmt.Errorf("URL is not a valid GCS URL")
+                        return
+                }
+                bucket = pathParts[3]
+                path = pathParts[4]
+        }
+        return
+}
diff --git a/vendor/github.com/hashicorp/go-getter/get_git.go b/vendor/github.com/hashicorp/go-getter/get_git.go
index cb1d029..67e8b2f 100644
--- a/vendor/github.com/hashicorp/go-getter/get_git.go
+++ b/vendor/github.com/hashicorp/go-getter/get_git.go
@@ -1,6 +1,7 @@
 package getter
 
 import (
+        "context"
         "encoding/base64"
         "fmt"
         "io/ioutil"
@@ -8,28 +9,43 @@ import (
         "os"
         "os/exec"
         "path/filepath"
+        "runtime"
+        "strconv"
         "strings"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
-        "github.com/hashicorp/go-safetemp"
-        "github.com/hashicorp/go-version"
+        safetemp "github.com/hashicorp/go-safetemp"
+        version "github.com/hashicorp/go-version"
 )
 
 // GitGetter is a Getter implementation that will download a module from
 // a git repository.
-type GitGetter struct{}
+type GitGetter struct {
+        getter
+}
 
 func (g *GitGetter) ClientMode(_ *url.URL) (ClientMode, error) {
         return ClientModeDir, nil
 }
 
 func (g *GitGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
         if _, err := exec.LookPath("git"); err != nil {
                 return fmt.Errorf("git must be available and on the PATH")
         }
 
+        // The port number must be parseable as an integer. If not, the user
+        // was probably trying to use a scp-style address, in which case the
+        // ssh:// prefix must be removed to indicate that.
+        if portStr := u.Port(); portStr != "" {
+                if _, err := strconv.ParseUint(portStr, 10, 16); err != nil {
+                        return fmt.Errorf("invalid port number %q; if using the \"scp-like\" git address scheme where a colon introduces the path instead, remove the ssh:// portion and use just the git:: prefix", portStr)
+                }
+        }
+
         // Extract some query parameters we use
         var ref, sshKey string
+        var depth int
         q := u.Query()
         if len(q) > 0 {
                 ref = q.Get("ref")
@@ -38,6 +54,11 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
                 sshKey = q.Get("sshkey")
                 q.Del("sshkey")
 
+                if n, err := strconv.Atoi(q.Get("depth")); err == nil {
+                        depth = n
+                }
+                q.Del("depth")
+
                 // Copy the URL
                 var newU url.URL = *u
                 u = &newU
@@ -84,9 +105,9 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
                 return err
         }
         if err == nil {
-                err = g.update(dst, sshKeyFile, ref)
+                err = g.update(ctx, dst, sshKeyFile, ref, depth)
         } else {
-                err = g.clone(dst, sshKeyFile, u)
+                err = g.clone(ctx, dst, sshKeyFile, u, depth)
         }
         if err != nil {
                 return err
@@ -100,7 +121,7 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
         }
 
         // Lastly, download any/all submodules.
-        return g.fetchSubmodules(dst, sshKeyFile)
+        return g.fetchSubmodules(ctx, dst, sshKeyFile, depth)
 }
 
 // GetFile for Git doesn't support updating at this time. It will download
@@ -138,16 +159,23 @@ func (g *GitGetter) checkout(dst string, ref string) error {
         return getRunCommand(cmd)
 }
 
-func (g *GitGetter) clone(dst, sshKeyFile string, u *url.URL) error {
-        cmd := exec.Command("git", "clone", u.String(), dst)
+func (g *GitGetter) clone(ctx context.Context, dst, sshKeyFile string, u *url.URL, depth int) error {
+        args := []string{"clone"}
+
+        if depth > 0 {
+                args = append(args, "--depth", strconv.Itoa(depth))
+        }
+
+        args = append(args, u.String(), dst)
+        cmd := exec.CommandContext(ctx, "git", args...)
         setupGitEnv(cmd, sshKeyFile)
         return getRunCommand(cmd)
 }
 
-func (g *GitGetter) update(dst, sshKeyFile, ref string) error {
+func (g *GitGetter) update(ctx context.Context, dst, sshKeyFile, ref string, depth int) error {
         // Determine if we're a branch. If we're NOT a branch, then we just
         // switch to master prior to checking out
-        cmd := exec.Command("git", "show-ref", "-q", "--verify", "refs/heads/"+ref)
+        cmd := exec.CommandContext(ctx, "git", "show-ref", "-q", "--verify", "refs/heads/"+ref)
         cmd.Dir = dst
 
         if getRunCommand(cmd) != nil {
@@ -162,15 +190,24 @@ func (g *GitGetter) update(dst, sshKeyFile, ref string) error {
                 return err
         }
 
-        cmd = exec.Command("git", "pull", "--ff-only")
+        if depth > 0 {
+                cmd = exec.Command("git", "pull", "--depth", strconv.Itoa(depth), "--ff-only")
+        } else {
+                cmd = exec.Command("git", "pull", "--ff-only")
+        }
+
         cmd.Dir = dst
         setupGitEnv(cmd, sshKeyFile)
         return getRunCommand(cmd)
 }
 
 // fetchSubmodules downloads any configured submodules recursively.
-func (g *GitGetter) fetchSubmodules(dst, sshKeyFile string) error {
-        cmd := exec.Command("git", "submodule", "update", "--init", "--recursive")
+func (g *GitGetter) fetchSubmodules(ctx context.Context, dst, sshKeyFile string, depth int) error {
+        args := []string{"submodule", "update", "--init", "--recursive"}
+        if depth > 0 {
+                args = append(args, "--depth", strconv.Itoa(depth))
+        }
+        cmd := exec.CommandContext(ctx, "git", args...)
         cmd.Dir = dst
         setupGitEnv(cmd, sshKeyFile)
         return getRunCommand(cmd)
@@ -187,7 +224,7 @@ func setupGitEnv(cmd *exec.Cmd, sshKeyFile string) {
         // with versions of Go < 1.9.
         env := os.Environ()
         for i, v := range env {
-                if strings.HasPrefix(v, gitSSHCommand) {
+                if strings.HasPrefix(v, gitSSHCommand) && len(v) > len(gitSSHCommand) {
                         sshCmd = []string{v}
 
                         env[i], env[len(env)-1] = env[len(env)-1], env[i]
@@ -202,6 +239,9 @@ func setupGitEnv(cmd *exec.Cmd, sshKeyFile string) {
 
         if sshKeyFile != "" {
                 // We have an SSH key temp file configured, tell ssh about this.
+                if runtime.GOOS == "windows" {
+                        sshKeyFile = strings.Replace(sshKeyFile, `\`, `/`, -1)
+                }
                 sshCmd = append(sshCmd, "-i", sshKeyFile)
         }
 
@@ -224,11 +264,20 @@ func checkGitVersion(min string) error {
         }
 
         fields := strings.Fields(string(out))
-        if len(fields) != 3 {
+        if len(fields) < 3 {
                 return fmt.Errorf("Unexpected 'git version' output: %q", string(out))
         }
+        v := fields[2]
+        if runtime.GOOS == "windows" && strings.Contains(v, ".windows.") {
+                // on windows, git version will return for example:
+                // git version 2.20.1.windows.1
+                // Which does not follow the semantic versionning specs
+                // https://semver.org. We remove that part in order for
+                // go-version to not error.
+                v = v[:strings.Index(v, ".windows.")]
+        }
 
-        have, err := version.NewVersion(fields[2])
+        have, err := version.NewVersion(v)
         if err != nil {
                 return err
         }
diff --git a/vendor/github.com/hashicorp/go-getter/get_hg.go b/vendor/github.com/hashicorp/go-getter/get_hg.go
index f386922..290649c 100644
--- a/vendor/github.com/hashicorp/go-getter/get_hg.go
+++ b/vendor/github.com/hashicorp/go-getter/get_hg.go
@@ -1,6 +1,7 @@
 package getter
 
 import (
+        "context"
         "fmt"
         "net/url"
         "os"
@@ -9,18 +10,21 @@ import (
         "runtime"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
-        "github.com/hashicorp/go-safetemp"
+        safetemp "github.com/hashicorp/go-safetemp"
 )
 
 // HgGetter is a Getter implementation that will download a module from
 // a Mercurial repository.
-type HgGetter struct{}
+type HgGetter struct {
+        getter
+}
 
 func (g *HgGetter) ClientMode(_ *url.URL) (ClientMode, error) {
         return ClientModeDir, nil
 }
 
 func (g *HgGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
         if _, err := exec.LookPath("hg"); err != nil {
                 return fmt.Errorf("hg must be available and on the PATH")
         }
@@ -58,7 +62,7 @@ func (g *HgGetter) Get(dst string, u *url.URL) error {
                 return err
         }
 
-        return g.update(dst, newURL, rev)
+        return g.update(ctx, dst, newURL, rev)
 }
 
 // GetFile for Hg doesn't support updating at this time. It will download
@@ -93,7 +97,7 @@ func (g *HgGetter) GetFile(dst string, u *url.URL) error {
                 return err
         }
 
-        fg := &FileGetter{Copy: true}
+        fg := &FileGetter{Copy: true, getter: g.getter}
         return fg.GetFile(dst, u)
 }
 
@@ -108,13 +112,13 @@ func (g *HgGetter) pull(dst string, u *url.URL) error {
         return getRunCommand(cmd)
 }
 
-func (g *HgGetter) update(dst string, u *url.URL, rev string) error {
+func (g *HgGetter) update(ctx context.Context, dst string, u *url.URL, rev string) error {
         args := []string{"update"}
         if rev != "" {
                 args = append(args, rev)
         }
 
-        cmd := exec.Command("hg", args...)
+        cmd := exec.CommandContext(ctx, "hg", args...)
         cmd.Dir = dst
         return getRunCommand(cmd)
 }
diff --git a/vendor/github.com/hashicorp/go-getter/get_http.go b/vendor/github.com/hashicorp/go-getter/get_http.go
index d2e2879..7c4541c 100644
--- a/vendor/github.com/hashicorp/go-getter/get_http.go
+++ b/vendor/github.com/hashicorp/go-getter/get_http.go
@@ -1,6 +1,7 @@
 package getter
 
 import (
+        "context"
         "encoding/xml"
         "fmt"
         "io"
@@ -8,9 +9,10 @@ import (
         "net/url"
         "os"
         "path/filepath"
+        "strconv"
         "strings"
 
-        "github.com/hashicorp/go-safetemp"
+        safetemp "github.com/hashicorp/go-safetemp"
 )
 
 // HttpGetter is a Getter implementation that will download from an HTTP
@@ -18,7 +20,7 @@ import (
 //
 // For file downloads, HTTP is used directly.
 //
-// The protocol for downloading a directory from an HTTP endpoing is as follows:
+// The protocol for downloading a directory from an HTTP endpoint is as follows:
 //
 // An HTTP GET request is made to the URL with the additional GET parameter
 // "terraform-get=1". This lets you handle that scenario specially if you
@@ -34,6 +36,8 @@ import (
 // formed URL. The shorthand syntax of "github.com/foo/bar" or relative
 // paths are not allowed.
 type HttpGetter struct {
+        getter
+
         // Netrc, if true, will lookup and use auth information found
         // in the user's netrc file if available.
         Netrc bool
@@ -41,6 +45,12 @@ type HttpGetter struct {
         // Client is the http.Client to use for Get requests.
         // This defaults to a cleanhttp.DefaultClient if left unset.
         Client *http.Client
+
+        // Header contains optional request header fields that should be included
+        // with every HTTP request. Note that the zero value of this field is nil,
+        // and as such it needs to be initialized before use, via something like
+        // make(http.Header).
+        Header http.Header
 }
 
 func (g *HttpGetter) ClientMode(u *url.URL) (ClientMode, error) {
@@ -51,6 +61,7 @@ func (g *HttpGetter) ClientMode(u *url.URL) (ClientMode, error) {
 }
 
 func (g *HttpGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
         // Copy the URL so we can modify it
         var newU url.URL = *u
         u = &newU
@@ -72,10 +83,17 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
         u.RawQuery = q.Encode()
 
         // Get the URL
-        resp, err := g.Client.Get(u.String())
+        req, err := http.NewRequest("GET", u.String(), nil)
         if err != nil {
                 return err
         }
+
+        req.Header = g.Header
+        resp, err := g.Client.Do(req)
+        if err != nil {
+                return err
+        }
+
         defer resp.Body.Close()
         if resp.StatusCode < 200 || resp.StatusCode >= 300 {
                 return fmt.Errorf("bad response code: %d", resp.StatusCode)
@@ -99,57 +117,107 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
         // into a temporary directory, then copy over the proper subdir.
         source, subDir := SourceDirSubdir(source)
         if subDir == "" {
-                return Get(dst, source)
+                var opts []ClientOption
+                if g.client != nil {
+                        opts = g.client.Options
+                }
+                return Get(dst, source, opts...)
         }
 
         // We have a subdir, time to jump some hoops
-        return g.getSubdir(dst, source, subDir)
+        return g.getSubdir(ctx, dst, source, subDir)
 }
 
-func (g *HttpGetter) GetFile(dst string, u *url.URL) error {
+func (g *HttpGetter) GetFile(dst string, src *url.URL) error {
+        ctx := g.Context()
         if g.Netrc {
                 // Add auth from netrc if we can
-                if err := addAuthFromNetrc(u); err != nil {
+                if err := addAuthFromNetrc(src); err != nil {
                         return err
                 }
         }
 
-        if g.Client == nil {
-                g.Client = httpClient
+        // Create all the parent directories if needed
+        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+                return err
         }
 
-        resp, err := g.Client.Get(u.String())
+        f, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE, os.FileMode(0666))
         if err != nil {
                 return err
         }
-        defer resp.Body.Close()
-        if resp.StatusCode != 200 {
-                return fmt.Errorf("bad response code: %d", resp.StatusCode)
+        defer f.Close()
+
+        if g.Client == nil {
+                g.Client = httpClient
         }
 
-        // Create all the parent directories
-        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+        var currentFileSize int64
+
+        // We first make a HEAD request so we can check
+        // if the server supports range queries. If the server/URL doesn't
+        // support HEAD requests, we just fall back to GET.
+        req, err := http.NewRequest("HEAD", src.String(), nil)
+        if err != nil {
                 return err
         }
+        if g.Header != nil {
+                req.Header = g.Header
+        }
+        headResp, err := g.Client.Do(req)
+        if err == nil && headResp != nil {
+                headResp.Body.Close()
+                if headResp.StatusCode == 200 {
+                        // If the HEAD request succeeded, then attempt to set the range
+                        // query if we can.
+                        if headResp.Header.Get("Accept-Ranges") == "bytes" {
+                                if fi, err := f.Stat(); err == nil {
+                                        if _, err = f.Seek(0, os.SEEK_END); err == nil {
+                                                req.Header.Set("Range", fmt.Sprintf("bytes=%d-", fi.Size()))
+                                                currentFileSize = fi.Size()
+                                                totalFileSize, _ := strconv.ParseInt(headResp.Header.Get("Content-Length"), 10, 64)
+                                                if currentFileSize >= totalFileSize {
+                                                        // file already present
+                                                        return nil
+                                                }
+                                        }
+                                }
+                        }
+                }
+        }
+        req.Method = "GET"
 
-        f, err := os.Create(dst)
+        resp, err := g.Client.Do(req)
         if err != nil {
                 return err
         }
+        switch resp.StatusCode {
+        case http.StatusOK, http.StatusPartialContent:
+                // all good
+        default:
+                resp.Body.Close()
+                return fmt.Errorf("bad response code: %d", resp.StatusCode)
+        }
+
+        body := resp.Body
 
-        n, err := io.Copy(f, resp.Body)
+        if g.client != nil && g.client.ProgressListener != nil {
+                // track download
+                fn := filepath.Base(src.EscapedPath())
+                body = g.client.ProgressListener.TrackProgress(fn, currentFileSize, currentFileSize+resp.ContentLength, resp.Body)
+        }
+        defer body.Close()
+
+        n, err := Copy(ctx, f, body)
         if err == nil && n < resp.ContentLength {
                 err = io.ErrShortWrite
         }
-        if err1 := f.Close(); err == nil {
-                err = err1
-        }
         return err
 }
 
 // getSubdir downloads the source into the destination, but with
 // the proper subdir.
-func (g *HttpGetter) getSubdir(dst, source, subDir string) error {
+func (g *HttpGetter) getSubdir(ctx context.Context, dst, source, subDir string) error {
         // Create a temporary directory to store the full source. This has to be
         // a non-existent directory.
         td, tdcloser, err := safetemp.Dir("", "getter")
@@ -158,8 +226,12 @@ func (g *HttpGetter) getSubdir(dst, source, subDir string) error {
         }
         defer tdcloser.Close()
 
+        var opts []ClientOption
+        if g.client != nil {
+                opts = g.client.Options
+        }
         // Download that into the given directory
-        if err := Get(td, source); err != nil {
+        if err := Get(td, source, opts...); err != nil {
                 return err
         }
 
@@ -185,7 +257,7 @@ func (g *HttpGetter) getSubdir(dst, source, subDir string) error {
                 return err
         }
 
-        return copyDir(dst, sourcePath, false)
+        return copyDir(ctx, dst, sourcePath, false)
 }
 
 // parseMeta looks for the first meta tag in the given reader that
diff --git a/vendor/github.com/hashicorp/go-getter/get_mock.go b/vendor/github.com/hashicorp/go-getter/get_mock.go
index 882e694..e2a98ea 100644
--- a/vendor/github.com/hashicorp/go-getter/get_mock.go
+++ b/vendor/github.com/hashicorp/go-getter/get_mock.go
@@ -6,6 +6,8 @@ import (
 
 // MockGetter is an implementation of Getter that can be used for tests.
 type MockGetter struct {
+        getter
+
         // Proxy, if set, will be called after recording the calls below.
         // If it isn't set, then the *Err values will be returned.
         Proxy Getter
diff --git a/vendor/github.com/hashicorp/go-getter/get_s3.go b/vendor/github.com/hashicorp/go-getter/get_s3.go
index ebb3217..93eeb0b 100644
--- a/vendor/github.com/hashicorp/go-getter/get_s3.go
+++ b/vendor/github.com/hashicorp/go-getter/get_s3.go
@@ -1,8 +1,8 @@
 package getter
 
 import (
+        "context"
         "fmt"
-        "io"
         "net/url"
         "os"
         "path/filepath"
@@ -18,7 +18,9 @@ import (
 
 // S3Getter is a Getter implementation that will download a module from
 // a S3 bucket.
-type S3Getter struct{}
+type S3Getter struct {
+        getter
+}
 
 func (g *S3Getter) ClientMode(u *url.URL) (ClientMode, error) {
         // Parse URL
@@ -60,6 +62,8 @@ func (g *S3Getter) ClientMode(u *url.URL) (ClientMode, error) {
 }
 
 func (g *S3Getter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
+
         // Parse URL
         region, bucket, path, _, creds, err := g.parseUrl(u)
         if err != nil {
@@ -124,7 +128,7 @@ func (g *S3Getter) Get(dst string, u *url.URL) error {
                         }
                         objDst = filepath.Join(dst, objDst)
 
-                        if err := g.getObject(client, objDst, bucket, objPath, ""); err != nil {
+                        if err := g.getObject(ctx, client, objDst, bucket, objPath, ""); err != nil {
                                 return err
                         }
                 }
@@ -134,6 +138,7 @@ func (g *S3Getter) Get(dst string, u *url.URL) error {
 }
 
 func (g *S3Getter) GetFile(dst string, u *url.URL) error {
+        ctx := g.Context()
         region, bucket, path, version, creds, err := g.parseUrl(u)
         if err != nil {
                 return err
@@ -142,10 +147,10 @@ func (g *S3Getter) GetFile(dst string, u *url.URL) error {
         config := g.getAWSConfig(region, u, creds)
         sess := session.New(config)
         client := s3.New(sess)
-        return g.getObject(client, dst, bucket, path, version)
+        return g.getObject(ctx, client, dst, bucket, path, version)
 }
 
-func (g *S3Getter) getObject(client *s3.S3, dst, bucket, key, version string) error {
+func (g *S3Getter) getObject(ctx context.Context, client *s3.S3, dst, bucket, key, version string) error {
         req := &s3.GetObjectInput{
                 Bucket: aws.String(bucket),
                 Key:    aws.String(key),
@@ -170,7 +175,7 @@ func (g *S3Getter) getObject(client *s3.S3, dst, bucket, key, version string) er
         }
         defer f.Close()
 
-        _, err = io.Copy(f, resp.Body)
+        _, err = Copy(ctx, f, resp.Body)
         return err
 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/go.mod b/vendor/github.com/hashicorp/go-getter/go.mod
new file mode 100644
index 0000000..807c0a2
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/go.mod
@@ -0,0 +1,22 @@
+module github.com/hashicorp/go-getter
+
+require (
+        cloud.google.com/go v0.36.0
+        github.com/aws/aws-sdk-go v1.15.78
+        github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d
+        github.com/cheggaaa/pb v1.0.27
+        github.com/fatih/color v1.7.0 // indirect
+        github.com/hashicorp/go-cleanhttp v0.5.0
+        github.com/hashicorp/go-safetemp v1.0.0
+        github.com/hashicorp/go-version v1.1.0
+        github.com/mattn/go-colorable v0.0.9 // indirect
+        github.com/mattn/go-isatty v0.0.4 // indirect
+        github.com/mattn/go-runewidth v0.0.4 // indirect
+        github.com/mitchellh/go-homedir v1.0.0
+        github.com/mitchellh/go-testing-interface v1.0.0
+        github.com/ulikunitz/xz v0.5.5
+        golang.org/x/net v0.0.0-20181114220301-adae6a3d119a // indirect
+        golang.org/x/sys v0.0.0-20181213200352-4d1cda033e06 // indirect
+        google.golang.org/api v0.1.0
+        gopkg.in/cheggaaa/pb.v1 v1.0.27 // indirect
+)
diff --git a/vendor/github.com/hashicorp/go-getter/go.sum b/vendor/github.com/hashicorp/go-getter/go.sum
new file mode 100644
index 0000000..0fc5088
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/go.sum
@@ -0,0 +1,182 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.31.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.36.0 h1:+aCSj7tOo2LODWVEuZDZeGCckdt6MlSF+X/rB3wUiS8=
+cloud.google.com/go v0.36.0/go.mod h1:RUoy9p/M4ge0HzT8L+SDZ8jg+Q6fth0CiBuhFJpSV40=
+dmitri.shuralyov.com/app/changes v0.0.0-20180602232624-0a106ad413e3/go.mod h1:Yl+fi1br7+Rr3LqpNJf1/uxUdtRUV+Tnj0o93V2B9MU=
+dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBrvjyP0v+ecvNYvCpyZgu5/xkfAUhi6wJj28eUfSU=
+dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
+dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
+git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
+github.com/aws/aws-sdk-go v1.15.78 h1:LaXy6lWR0YK7LKyuU0QWy2ws/LWTPfYV/UgfiBu4tvY=
+github.com/aws/aws-sdk-go v1.15.78/go.mod h1:E3/ieXAlvM0XWO57iftYVDLLvQ824smPP3ATZkfNZeM=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
+github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
+github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
+github.com/cheggaaa/pb v1.0.27 h1:wIkZHkNfC7R6GI5w7l/PdAdzXzlrbcI3p8OAlnkTsnc=
+github.com/cheggaaa/pb v1.0.27/go.mod h1:pQciLPpbU0oxA0h+VJYYLxO+XeDQb5pZijXscXHm81s=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/coreos/go-systemd v0.0.0-20181012123002-c6f51f82210d/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
+github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/googleapis/gax-go v2.0.0+incompatible h1:j0GKcs05QVmm7yesiZq2+9cxHkNK9YM6zKx4D2qucQU=
+github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
+github.com/googleapis/gax-go/v2 v2.0.3 h1:siORttZ36U2R/WjiJuDz8znElWBiAlO9rVt+mqJt0Cc=
+github.com/googleapis/gax-go/v2 v2.0.3/go.mod h1:LLvjysVCY1JZeum8Z6l8qUty8fiNwE08qbEPm1M08qg=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
+github.com/hashicorp/go-cleanhttp v0.5.0 h1:wvCrVc9TjDls6+YGAF2hAifE1E5U1+b4tH6KdvN3Gig=
+github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
+github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
+github.com/hashicorp/go-version v1.1.0 h1:bPIoEKD27tNdebFGGxxYwcL4nepeY4j1QP23PFRGzg0=
+github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/jellevandenhooff/dkim v0.0.0-20150330215556-f50fe3d243e1/go.mod h1:E0B/fFc00Y+Rasa88328GlI/XbtyysCtTHZS8h7IrBU=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8 h1:12VvqtR6Aowv3l/EQUlocDHW2Cp4G9WJVH7uyH8QFJE=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.4 h1:bnP0vzxcAdeI1zdubAl5PjU6zsERjGZb7raWodagDYs=
+github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-runewidth v0.0.4 h1:2BvfKmzob6Bmd4YsL0zygOqfdFnK7GR4QL06Do4/p7Y=
+github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
+github.com/mitchellh/go-homedir v1.0.0 h1:vKb8ShqSby24Yrqr/yDYkuFz8d0WUjys40rvnGC8aR0=
+github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
+github.com/neelance/sourcemap v0.0.0-20151028013722-8c68805598ab/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
+github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.8.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
+github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
+github.com/shurcooL/component v0.0.0-20170202220835-f88ec8f54cc4/go.mod h1:XhFIlyj5a1fBNx5aJTbKoIq0mNaPvOagO+HjB3EtxrY=
+github.com/shurcooL/events v0.0.0-20181021180414-410e4ca65f48/go.mod h1:5u70Mqkb5O5cxEA8nxTsgrgLehJeAw6Oc4Ab1c/P1HM=
+github.com/shurcooL/github_flavored_markdown v0.0.0-20181002035957-2122de532470/go.mod h1:2dOwnU2uBioM+SGy2aZoq1f/Sd1l9OkAeAUvjSyvgU0=
+github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
+github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
+github.com/shurcooL/gofontwoff v0.0.0-20180329035133-29b52fc0a18d/go.mod h1:05UtEgK5zq39gLST6uB0cf3NEHjETfB4Fgr3Gx5R9Vw=
+github.com/shurcooL/gopherjslib v0.0.0-20160914041154-feb6d3990c2c/go.mod h1:8d3azKNyqcHP1GaQE/c6dDgjkgSx2BZ4IoEi4F1reUI=
+github.com/shurcooL/highlight_diff v0.0.0-20170515013008-09bb4053de1b/go.mod h1:ZpfEhSmds4ytuByIcDnOLkTHGUI6KNqRNPDLHDk+mUU=
+github.com/shurcooL/highlight_go v0.0.0-20181028180052-98c3abbbae20/go.mod h1:UDKB5a1T23gOMUJrI+uSuH0VRDStOiUVSjBTRDVBVag=
+github.com/shurcooL/home v0.0.0-20181020052607-80b7ffcb30f9/go.mod h1:+rgNQw2P9ARFAs37qieuu7ohDNQ3gds9msbT2yn85sg=
+github.com/shurcooL/htmlg v0.0.0-20170918183704-d01228ac9e50/go.mod h1:zPn1wHpTIePGnXSHpsVPWEktKXHr6+SS6x/IKRb7cpw=
+github.com/shurcooL/httperror v0.0.0-20170206035902-86b7830d14cc/go.mod h1:aYMfkZ6DWSJPJ6c4Wwz3QtW22G7mf/PEgaB9k/ik5+Y=
+github.com/shurcooL/httpfs v0.0.0-20171119174359-809beceb2371/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
+github.com/shurcooL/httpgzip v0.0.0-20180522190206-b1c53ac65af9/go.mod h1:919LwcH0M7/W4fcZ0/jy0qGght1GIhqyS/EgWGH2j5Q=
+github.com/shurcooL/issues v0.0.0-20181008053335-6292fdc1e191/go.mod h1:e2qWDig5bLteJ4fwvDAc2NHzqFEthkqn7aOZAOpj+PQ=
+github.com/shurcooL/issuesapp v0.0.0-20180602232740-048589ce2241/go.mod h1:NPpHK2TI7iSaM0buivtFUc9offApnI0Alt/K8hcHy0I=
+github.com/shurcooL/notifications v0.0.0-20181007000457-627ab5aea122/go.mod h1:b5uSkrEVM1jQUspwbixRBhaIjIzL2xazXp6kntxYle0=
+github.com/shurcooL/octicon v0.0.0-20181028054416-fa4f57f9efb2/go.mod h1:eWdoE5JD4R5UVWDucdOPg1g2fqQRq78IQa9zlOV1vpQ=
+github.com/shurcooL/reactions v0.0.0-20181006231557-f2e0b4ca5b82/go.mod h1:TCR1lToEk4d2s07G3XGfz2QrgHXg4RJBvjrOozvoWfk=
+github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/shurcooL/users v0.0.0-20180125191416-49c67e49c537/go.mod h1:QJTqeLYEDaXHZDBsXlPCDqdhQuJkuw4NOtaxYe3xii4=
+github.com/shurcooL/webdavfs v0.0.0-20170829043945-18c3829fa133/go.mod h1:hKmq5kWdCj2z2KEozexVbfEZIWiTjhE0+UjmZgPqehw=
+github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE=
+github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA=
+github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
+github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
+github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
+go.opencensus.io v0.18.0 h1:Mk5rgZcggtbvtAun5aJzAtjKKN/t0R3jJPlWILlv938=
+go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA=
+go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
+golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw=
+golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181029044818-c44066c5c816/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181106065722-10aee1819953/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a h1:gOpx8G595UYyvj8UK4+OFyY4rx037g3fmfhe5SasG3U=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890 h1:uESlIz09WIHT2I+pasSXcpLYqYK8wHcdCetU3VuMBJE=
+golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f h1:Bl/8QSvNqXvPGPGXa2z5xUTmV7VDcZyvRZ+QQXkXTZQ=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181029174526-d69651ed3497/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181213200352-4d1cda033e06 h1:0oC8rFnE+74kEmuHZ46F6KHsMr5Gx2gUQPuNz28iQZM=
+golang.org/x/sys v0.0.0-20181213200352-4d1cda033e06/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2 h1:z99zHgr7hKfrUcX/KsoJk5FJfjTceCKIp96+biqP4To=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030000716-a0a13e073c7b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+google.golang.org/api v0.0.0-20180910000450-7ca32eb868bf/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
+google.golang.org/api v0.0.0-20181030000543-1d582fd0359e/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
+google.golang.org/api v0.1.0 h1:K6z2u68e86TPdSdefXdzvXgR1zEMa+459vBSfWYAZkI=
+google.golang.org/api v0.1.0/go.mod h1:UGEZY7KEX120AnNLIHFMKIo4obdJhkp2tPbaPlQx13Y=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.3.0 h1:FBSsiFRMz3LBeXIomRnVzrQwSDj4ibvcRexLG0LZGQk=
+google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20180831171423-11092d34479b/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20181029155118-b69ba1387ce2/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20181202183823-bd91e49a0898/go.mod h1:7Ep/1NZk928CDR8SjdVbjWNpdIf6nzjE3BTgJDr2Atg=
+google.golang.org/genproto v0.0.0-20190201180003-4b09977fb922 h1:mBVYJnbrXLA/ZCBTCe7PtEgAUP+1bg92qTaFoPHdz+8=
+google.golang.org/genproto v0.0.0-20190201180003-4b09977fb922/go.mod h1:L3J43x8/uS+qIUoksaLKe6OS3nUKxOKuIFz1sl2/jx4=
+google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
+google.golang.org/grpc v1.17.0 h1:TRJYBgMclJvGYn2rIMjj+h9KtMt5r1Ij7ODVRIZkwhk=
+google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/cheggaaa/pb.v1 v1.0.27 h1:kJdccidYzt3CaHD1crCFTS1hxyhSi059NhOFUf03YFo=
+gopkg.in/cheggaaa/pb.v1 v1.0.27/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+grpc.go4.org v0.0.0-20170609214715-11d0a25b4919/go.mod h1:77eQGdRu53HpSqPFJFmuJdjuHRquDANNeA4x7B8WQ9o=
+honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck=
+sourcegraph.com/sqs/pbtypes v0.0.0-20180604144634-d3ebe8f20ae4/go.mod h1:ketZ/q3QxT9HOBeFhu6RdvsftgpsbFHBF5Cas6cDKZ0=
diff --git a/vendor/github.com/hashicorp/go-getter/helper/url/url_windows.go b/vendor/github.com/hashicorp/go-getter/helper/url/url_windows.go
index 4655226..4280ec5 100644
--- a/vendor/github.com/hashicorp/go-getter/helper/url/url_windows.go
+++ b/vendor/github.com/hashicorp/go-getter/helper/url/url_windows.go
@@ -11,19 +11,18 @@ func parse(rawURL string) (*url.URL, error) {
         // Make sure we're using "/" since URLs are "/"-based.
         rawURL = filepath.ToSlash(rawURL)
 
+        if len(rawURL) > 1 && rawURL[1] == ':' {
+                // Assume we're dealing with a drive letter. In which case we
+                // force the 'file' scheme to avoid "net/url" URL.String() prepending
+                // our url with "./".
+                rawURL = "file://" + rawURL
+        }
+
         u, err := url.Parse(rawURL)
         if err != nil {
                 return nil, err
         }
 
-        if len(rawURL) > 1 && rawURL[1] == ':' {
-                // Assume we're dealing with a drive letter file path where the drive
-                // letter has been parsed into the URL Scheme, and the rest of the path
-                // has been parsed into the URL Path without the leading ':' character.
-                u.Path = fmt.Sprintf("%s:%s", string(rawURL[0]), u.Path)
-                u.Scheme = ""
-        }
-
         if len(u.Host) > 1 && u.Host[1] == ':' && strings.HasPrefix(rawURL, "file://") {
                 // Assume we're dealing with a drive letter file path where the drive
                 // letter has been parsed into the URL Host.
diff --git a/vendor/github.com/hashicorp/go-getter/source.go b/vendor/github.com/hashicorp/go-getter/source.go
index c63f2bb..dab6d40 100644
--- a/vendor/github.com/hashicorp/go-getter/source.go
+++ b/vendor/github.com/hashicorp/go-getter/source.go
@@ -6,18 +6,31 @@ import (
         "strings"
 )
 
-// SourceDirSubdir takes a source and returns a tuple of the URL without
-// the subdir and the URL with the subdir.
+// SourceDirSubdir takes a source URL and returns a tuple of the URL without
+// the subdir and the subdir.
+//
+// ex:
+//   dom.com/path/?q=p               => dom.com/path/?q=p, ""
+//   proto://dom.com/path//*?q=p     => proto://dom.com/path?q=p, "*"
+//   proto://dom.com/path//path2?q=p => proto://dom.com/path?q=p, "path2"
+//
 func SourceDirSubdir(src string) (string, string) {
-        // Calcaulate an offset to avoid accidentally marking the scheme
+
+        // URL might contains another url in query parameters
+        stop := len(src)
+        if idx := strings.Index(src, "?"); idx > -1 {
+                stop = idx
+        }
+
+        // Calculate an offset to avoid accidentally marking the scheme
         // as the dir.
         var offset int
-        if idx := strings.Index(src, "://"); idx > -1 {
+        if idx := strings.Index(src[:stop], "://"); idx > -1 {
                 offset = idx + 3
         }
 
         // First see if we even have an explicit subdir
-        idx := strings.Index(src[offset:], "//")
+        idx := strings.Index(src[offset:stop], "//")
         if idx == -1 {
                 return src, ""
         }
diff --git a/vendor/github.com/hashicorp/go-hclog/.gitignore b/vendor/github.com/hashicorp/go-hclog/.gitignore
new file mode 100644
index 0000000..42cc410
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/.gitignore
@@ -0,0 +1 @@
+.idea*
\ No newline at end of file
diff --git a/vendor/github.com/hashicorp/go-hclog/README.md b/vendor/github.com/hashicorp/go-hclog/README.md
index 614342b..1153e28 100644
--- a/vendor/github.com/hashicorp/go-hclog/README.md
+++ b/vendor/github.com/hashicorp/go-hclog/README.md
@@ -10,8 +10,7 @@ interface for use in development and production environments.
 It provides logging levels that provide decreased output based upon the
 desired amount of output, unlike the standard library `log` package.
 
-It does not provide `Printf` style logging, only key/value logging that is
-exposed as arguments to the logging functions for simplicity.
+It provides `Printf` style logging of values via `hclog.Fmt()`.
 
 It provides a human readable output mode for use in development as well as
 JSON output mode for production.
@@ -100,6 +99,17 @@ requestLogger.Info("we are transporting a request")
 This allows sub Loggers to be context specific without having to thread that
 into all the callers.
 
+### Using `hclog.Fmt()`
+
+```go
+var int totalBandwidth = 200
+appLogger.Info("total bandwidth exceeded", "bandwidth", hclog.Fmt("%d GB/s", totalBandwidth))
+```
+
+```text
+... [INFO ] my-app: total bandwidth exceeded: bandwidth="200 GB/s"
+```
+
 ### Use this with code that uses the standard library logger
 
 If you want to use the standard library's `log.Logger` interface you can wrap
diff --git a/vendor/github.com/hashicorp/go-hclog/go.mod b/vendor/github.com/hashicorp/go-hclog/go.mod
new file mode 100644
index 0000000..0d079a6
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/go.mod
@@ -0,0 +1,7 @@
+module github.com/hashicorp/go-hclog
+
+require (
+        github.com/davecgh/go-spew v1.1.1 // indirect
+        github.com/pmezard/go-difflib v1.0.0 // indirect
+        github.com/stretchr/testify v1.2.2
+)
diff --git a/vendor/github.com/hashicorp/go-hclog/go.sum b/vendor/github.com/hashicorp/go-hclog/go.sum
new file mode 100644
index 0000000..e03ee77
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/go.sum
@@ -0,0 +1,6 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
diff --git a/vendor/github.com/hashicorp/go-hclog/int.go b/vendor/github.com/hashicorp/go-hclog/int.go
index 9f90c28..2aaa1f8 100644
--- a/vendor/github.com/hashicorp/go-hclog/int.go
+++ b/vendor/github.com/hashicorp/go-hclog/int.go
@@ -2,14 +2,19 @@ package hclog
 
 import (
         "bufio"
+        "bytes"
+        "encoding"
         "encoding/json"
         "fmt"
         "log"
         "os"
+        "reflect"
         "runtime"
+        "sort"
         "strconv"
         "strings"
         "sync"
+        "sync/atomic"
         "time"
 )
 
@@ -17,8 +22,8 @@ var (
         _levelToBracket = map[Level]string{
                 Debug: "[DEBUG]",
                 Trace: "[TRACE]",
-                Info:  "[INFO ]",
-                Warn:  "[WARN ]",
+                Info:  "[INFO] ",
+                Warn:  "[WARN] ",
                 Error: "[ERROR]",
         }
 )
@@ -39,28 +44,40 @@ func New(opts *LoggerOptions) Logger {
                 level = DefaultLevel
         }
 
-        return &intLogger{
-                m:      new(sync.Mutex),
-                json:   opts.JSONFormat,
-                caller: opts.IncludeLocation,
-                name:   opts.Name,
-                w:      bufio.NewWriter(output),
-                level:  level,
+        mtx := opts.Mutex
+        if mtx == nil {
+                mtx = new(sync.Mutex)
         }
+
+        ret := &intLogger{
+                m:          mtx,
+                json:       opts.JSONFormat,
+                caller:     opts.IncludeLocation,
+                name:       opts.Name,
+                timeFormat: TimeFormat,
+                w:          bufio.NewWriter(output),
+                level:      new(int32),
+        }
+        if opts.TimeFormat != "" {
+                ret.timeFormat = opts.TimeFormat
+        }
+        atomic.StoreInt32(ret.level, int32(level))
+        return ret
 }
 
 // The internal logger implementation. Internal in that it is defined entirely
 // by this package.
 type intLogger struct {
-        json   bool
-        caller bool
-        name   string
+        json       bool
+        caller     bool
+        name       string
+        timeFormat string
 
         // this is a pointer so that it's shared by any derived loggers, since
         // those derived loggers share the bufio.Writer as well.
         m     *sync.Mutex
         w     *bufio.Writer
-        level Level
+        level *int32
 
         implied []interface{}
 }
@@ -75,7 +92,7 @@ const TimeFormat = "2006-01-02T15:04:05.000Z0700"
 // Log a message and a set of key/value pairs if the given level is at
 // or more severe that the threshold configured in the Logger.
 func (z *intLogger) Log(level Level, msg string, args ...interface{}) {
-        if level < z.level {
+        if level < Level(atomic.LoadInt32(z.level)) {
                 return
         }
 
@@ -126,14 +143,14 @@ func trimCallerPath(path string) string {
 
 // Non-JSON logging format function
 func (z *intLogger) log(t time.Time, level Level, msg string, args ...interface{}) {
-        z.w.WriteString(t.Format(TimeFormat))
+        z.w.WriteString(t.Format(z.timeFormat))
         z.w.WriteByte(' ')
 
         s, ok := _levelToBracket[level]
         if ok {
                 z.w.WriteString(s)
         } else {
-                z.w.WriteString("[UNKN ]")
+                z.w.WriteString("[?????]")
         }
 
         if z.caller {
@@ -174,7 +191,10 @@ func (z *intLogger) log(t time.Time, level Level, msg string, args ...interface{
 
         FOR:
                 for i := 0; i < len(args); i = i + 2 {
-                        var val string
+                        var (
+                                val string
+                                raw bool
+                        )
 
                         switch st := args[i+1].(type) {
                         case string:
@@ -202,15 +222,23 @@ func (z *intLogger) log(t time.Time, level Level, msg string, args ...interface{
                         case CapturedStacktrace:
                                 stacktrace = st
                                 continue FOR
+                        case Format:
+                                val = fmt.Sprintf(st[0].(string), st[1:]...)
                         default:
-                                val = fmt.Sprintf("%v", st)
+                                v := reflect.ValueOf(st)
+                                if v.Kind() == reflect.Slice {
+                                        val = z.renderSlice(v)
+                                        raw = true
+                                } else {
+                                        val = fmt.Sprintf("%v", st)
+                                }
                         }
 
                         z.w.WriteByte(' ')
                         z.w.WriteString(args[i].(string))
                         z.w.WriteByte('=')
 
-                        if strings.ContainsAny(val, " \t\n\r") {
+                        if !raw && strings.ContainsAny(val, " \t\n\r") {
                                 z.w.WriteByte('"')
                                 z.w.WriteString(val)
                                 z.w.WriteByte('"')
@@ -227,6 +255,45 @@ func (z *intLogger) log(t time.Time, level Level, msg string, args ...interface{
         }
 }
 
+func (z *intLogger) renderSlice(v reflect.Value) string {
+        var buf bytes.Buffer
+
+        buf.WriteRune('[')
+
+        for i := 0; i < v.Len(); i++ {
+                if i > 0 {
+                        buf.WriteString(", ")
+                }
+
+                sv := v.Index(i)
+
+                var val string
+
+                switch sv.Kind() {
+                case reflect.String:
+                        val = sv.String()
+                case reflect.Int, reflect.Int16, reflect.Int32, reflect.Int64:
+                        val = strconv.FormatInt(sv.Int(), 10)
+                case reflect.Uint, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+                        val = strconv.FormatUint(sv.Uint(), 10)
+                default:
+                        val = fmt.Sprintf("%v", sv.Interface())
+                }
+
+                if strings.ContainsAny(val, " \t\n\r") {
+                        buf.WriteByte('"')
+                        buf.WriteString(val)
+                        buf.WriteByte('"')
+                } else {
+                        buf.WriteString(val)
+                }
+        }
+
+        buf.WriteRune(']')
+
+        return buf.String()
+}
+
 // JSON logging function
 func (z *intLogger) logJson(t time.Time, level Level, msg string, args ...interface{}) {
         vals := map[string]interface{}{
@@ -262,6 +329,8 @@ func (z *intLogger) logJson(t time.Time, level Level, msg string, args ...interf
                 }
         }
 
+        args = append(z.implied, args...)
+
         if args != nil && len(args) > 0 {
                 if len(args)%2 != 0 {
                         cs, ok := args[len(args)-1].(CapturedStacktrace)
@@ -279,7 +348,22 @@ func (z *intLogger) logJson(t time.Time, level Level, msg string, args ...interf
                                 // without injecting into logs...
                                 continue
                         }
-                        vals[args[i].(string)] = args[i+1]
+                        val := args[i+1]
+                        switch sv := val.(type) {
+                        case error:
+                                // Check if val is of type error. If error type doesn't
+                                // implement json.Marshaler or encoding.TextMarshaler
+                                // then set val to err.Error() so that it gets marshaled
+                                switch sv.(type) {
+                                case json.Marshaler, encoding.TextMarshaler:
+                                default:
+                                        val = sv.Error()
+                                }
+                        case Format:
+                                val = fmt.Sprintf(sv[0].(string), sv[1:]...)
+                        }
+
+                        vals[args[i].(string)] = val
                 }
         }
 
@@ -316,36 +400,66 @@ func (z *intLogger) Error(msg string, args ...interface{}) {
 
 // Indicate that the logger would emit TRACE level logs
 func (z *intLogger) IsTrace() bool {
-        return z.level == Trace
+        return Level(atomic.LoadInt32(z.level)) == Trace
 }
 
 // Indicate that the logger would emit DEBUG level logs
 func (z *intLogger) IsDebug() bool {
-        return z.level <= Debug
+        return Level(atomic.LoadInt32(z.level)) <= Debug
 }
 
 // Indicate that the logger would emit INFO level logs
 func (z *intLogger) IsInfo() bool {
-        return z.level <= Info
+        return Level(atomic.LoadInt32(z.level)) <= Info
 }
 
 // Indicate that the logger would emit WARN level logs
 func (z *intLogger) IsWarn() bool {
-        return z.level <= Warn
+        return Level(atomic.LoadInt32(z.level)) <= Warn
 }
 
 // Indicate that the logger would emit ERROR level logs
 func (z *intLogger) IsError() bool {
-        return z.level <= Error
+        return Level(atomic.LoadInt32(z.level)) <= Error
 }
 
 // Return a sub-Logger for which every emitted log message will contain
 // the given key/value pairs. This is used to create a context specific
 // Logger.
 func (z *intLogger) With(args ...interface{}) Logger {
+        if len(args)%2 != 0 {
+                panic("With() call requires paired arguments")
+        }
+
         var nz intLogger = *z
 
-        nz.implied = append(nz.implied, args...)
+        result := make(map[string]interface{}, len(z.implied)+len(args))
+        keys := make([]string, 0, len(z.implied)+len(args))
+
+        // Read existing args, store map and key for consistent sorting
+        for i := 0; i < len(z.implied); i += 2 {
+                key := z.implied[i].(string)
+                keys = append(keys, key)
+                result[key] = z.implied[i+1]
+        }
+        // Read new args, store map and key for consistent sorting
+        for i := 0; i < len(args); i += 2 {
+                key := args[i].(string)
+                _, exists := result[key]
+                if !exists {
+                        keys = append(keys, key)
+                }
+                result[key] = args[i+1]
+        }
+
+        // Sort keys to be consistent
+        sort.Strings(keys)
+
+        nz.implied = make([]interface{}, 0, len(z.implied)+len(args))
+        for _, k := range keys {
+                nz.implied = append(nz.implied, k)
+                nz.implied = append(nz.implied, result[k])
+        }
 
         return &nz
 }
@@ -357,6 +471,8 @@ func (z *intLogger) Named(name string) Logger {
 
         if nz.name != "" {
                 nz.name = nz.name + "." + name
+        } else {
+                nz.name = name
         }
 
         return &nz
@@ -373,6 +489,12 @@ func (z *intLogger) ResetNamed(name string) Logger {
         return &nz
 }
 
+// Update the logging level on-the-fly. This will affect all subloggers as
+// well.
+func (z *intLogger) SetLevel(level Level) {
+        atomic.StoreInt32(z.level, int32(level))
+}
+
 // Create a *log.Logger that will send it's data through this Logger. This
 // allows packages that expect to be using the standard library log to actually
 // use this logger.
diff --git a/vendor/github.com/hashicorp/go-hclog/log.go b/vendor/github.com/hashicorp/go-hclog/log.go
index 6bb16ba..d98714e 100644
--- a/vendor/github.com/hashicorp/go-hclog/log.go
+++ b/vendor/github.com/hashicorp/go-hclog/log.go
@@ -5,6 +5,7 @@ import (
         "log"
         "os"
         "strings"
+        "sync"
 )
 
 var (
@@ -12,7 +13,7 @@ var (
         DefaultLevel  = Info
 )
 
-type Level int
+type Level int32
 
 const (
         // This is a special level used to indicate that no level has been
@@ -36,6 +37,18 @@ const (
         Error Level = 5
 )
 
+// When processing a value of this type, the logger automatically treats the first
+// argument as a Printf formatting string and passes the rest as the values to be
+// formatted. For example: L.Info(Fmt{"%d beans/day", beans}). This is a simple
+// convience type for when formatting is required.
+type Format []interface{}
+
+// Fmt returns a Format type. This is a convience function for creating a Format
+// type.
+func Fmt(str string, args ...interface{}) Format {
+        return append(Format{str}, args...)
+}
+
 // LevelFromString returns a Level type for the named log level, or "NoLevel" if
 // the level string is invalid. This facilitates setting the log level via
 // config or environment variable by name in a predictable way.
@@ -108,6 +121,10 @@ type Logger interface {
         // the current name as well.
         ResetNamed(name string) Logger
 
+        // Updates the level. This should affect all sub-loggers as well. If an
+        // implementation cannot update the level on the fly, it should no-op.
+        SetLevel(level Level)
+
         // Return a value that conforms to the stdlib log.Logger interface
         StandardLogger(opts *StandardLoggerOptions) *log.Logger
 }
@@ -127,12 +144,18 @@ type LoggerOptions struct {
         // The threshold for the logger. Anything less severe is supressed
         Level Level
 
-        // Where to write the logs to. Defaults to os.Stdout if nil
+        // Where to write the logs to. Defaults to os.Stderr if nil
         Output io.Writer
 
+        // An optional mutex pointer in case Output is shared
+        Mutex *sync.Mutex
+
         // Control if the output should be in JSON.
         JSONFormat bool
 
-        // Intclude file and line information in each log line
+        // Include file and line information in each log line
         IncludeLocation bool
+
+        // The time format to use instead of the default
+        TimeFormat string
 }
diff --git a/vendor/github.com/hashicorp/go-hclog/nulllogger.go b/vendor/github.com/hashicorp/go-hclog/nulllogger.go
new file mode 100644
index 0000000..0942361
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/nulllogger.go
@@ -0,0 +1,47 @@
+package hclog
+
+import (
+        "io/ioutil"
+        "log"
+)
+
+// NewNullLogger instantiates a Logger for which all calls
+// will succeed without doing anything.
+// Useful for testing purposes.
+func NewNullLogger() Logger {
+        return &nullLogger{}
+}
+
+type nullLogger struct{}
+
+func (l *nullLogger) Trace(msg string, args ...interface{}) {}
+
+func (l *nullLogger) Debug(msg string, args ...interface{}) {}
+
+func (l *nullLogger) Info(msg string, args ...interface{}) {}
+
+func (l *nullLogger) Warn(msg string, args ...interface{}) {}
+
+func (l *nullLogger) Error(msg string, args ...interface{}) {}
+
+func (l *nullLogger) IsTrace() bool { return false }
+
+func (l *nullLogger) IsDebug() bool { return false }
+
+func (l *nullLogger) IsInfo() bool { return false }
+
+func (l *nullLogger) IsWarn() bool { return false }
+
+func (l *nullLogger) IsError() bool { return false }
+
+func (l *nullLogger) With(args ...interface{}) Logger { return l }
+
+func (l *nullLogger) Named(name string) Logger { return l }
+
+func (l *nullLogger) ResetNamed(name string) Logger { return l }
+
+func (l *nullLogger) SetLevel(level Level) {}
+
+func (l *nullLogger) StandardLogger(opts *StandardLoggerOptions) *log.Logger {
+        return log.New(ioutil.Discard, "", log.LstdFlags)
+}
diff --git a/vendor/github.com/hashicorp/go-multierror/.travis.yml b/vendor/github.com/hashicorp/go-multierror/.travis.yml
new file mode 100644
index 0000000..304a835
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/.travis.yml
@@ -0,0 +1,12 @@
+sudo: false
+
+language: go
+
+go:
+  - 1.x
+
+branches:
+  only:
+    - master
+
+script: make test testrace
diff --git a/vendor/github.com/hashicorp/go-multierror/Makefile b/vendor/github.com/hashicorp/go-multierror/Makefile
new file mode 100644
index 0000000..b97cd6e
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/Makefile
@@ -0,0 +1,31 @@
+TEST?=./...
+
+default: test
+
+# test runs the test suite and vets the code.
+test: generate
+        @echo "==> Running tests..."
+        @go list $(TEST) \
+                | grep -v "/vendor/" \
+                | xargs -n1 go test -timeout=60s -parallel=10 ${TESTARGS}
+
+# testrace runs the race checker
+testrace: generate
+        @echo "==> Running tests (race)..."
+        @go list $(TEST) \
+                | grep -v "/vendor/" \
+                | xargs -n1 go test -timeout=60s -race ${TESTARGS}
+
+# updatedeps installs all the dependencies needed to run and build.
+updatedeps:
+        @sh -c "'${CURDIR}/scripts/deps.sh' '${NAME}'"
+
+# generate runs `go generate` to build the dynamically generated source files.
+generate:
+        @echo "==> Generating..."
+        @find . -type f -name '.DS_Store' -delete
+        @go list ./... \
+                | grep -v "/vendor/" \
+                | xargs -n1 go generate
+
+.PHONY: default test testrace updatedeps generate
diff --git a/vendor/github.com/hashicorp/go-multierror/README.md b/vendor/github.com/hashicorp/go-multierror/README.md
index e81be50..ead5830 100644
--- a/vendor/github.com/hashicorp/go-multierror/README.md
+++ b/vendor/github.com/hashicorp/go-multierror/README.md
@@ -1,5 +1,11 @@
 # go-multierror
 
+[![Build Status](http://img.shields.io/travis/hashicorp/go-multierror.svg?style=flat-square)][travis]
+[![Go Documentation](http://img.shields.io/badge/go-documentation-blue.svg?style=flat-square)][godocs]
+
+[travis]: https://travis-ci.org/hashicorp/go-multierror
+[godocs]: https://godoc.org/github.com/hashicorp/go-multierror
+
 `go-multierror` is a package for Go that provides a mechanism for
 representing a list of `error` values as a single `error`.
 
diff --git a/vendor/github.com/hashicorp/go-multierror/append.go b/vendor/github.com/hashicorp/go-multierror/append.go
index 00afa9b..775b6e7 100644
--- a/vendor/github.com/hashicorp/go-multierror/append.go
+++ b/vendor/github.com/hashicorp/go-multierror/append.go
@@ -18,9 +18,13 @@ func Append(err error, errs ...error) *Error {
                 for _, e := range errs {
                         switch e := e.(type) {
                         case *Error:
-                                err.Errors = append(err.Errors, e.Errors...)
+                                if e != nil {
+                                        err.Errors = append(err.Errors, e.Errors...)
+                                }
                         default:
-                                err.Errors = append(err.Errors, e)
+                                if e != nil {
+                                        err.Errors = append(err.Errors, e)
+                                }
                         }
                 }
 
diff --git a/vendor/github.com/hashicorp/go-multierror/format.go b/vendor/github.com/hashicorp/go-multierror/format.go
index bb65a12..47f13c4 100644
--- a/vendor/github.com/hashicorp/go-multierror/format.go
+++ b/vendor/github.com/hashicorp/go-multierror/format.go
@@ -12,12 +12,16 @@ type ErrorFormatFunc func([]error) string
 // ListFormatFunc is a basic formatter that outputs the number of errors
 // that occurred along with a bullet point list of the errors.
 func ListFormatFunc(es []error) string {
+        if len(es) == 1 {
+                return fmt.Sprintf("1 error occurred:\n\t* %s\n\n", es[0])
+        }
+
         points := make([]string, len(es))
         for i, err := range es {
                 points[i] = fmt.Sprintf("* %s", err)
         }
 
         return fmt.Sprintf(
-                "%d error(s) occurred:\n\n%s",
-                len(es), strings.Join(points, "\n"))
+                "%d errors occurred:\n\t%s\n\n",
+                len(es), strings.Join(points, "\n\t"))
 }
diff --git a/vendor/github.com/hashicorp/go-multierror/go.mod b/vendor/github.com/hashicorp/go-multierror/go.mod
new file mode 100644
index 0000000..2534331
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/go.mod
@@ -0,0 +1,3 @@
+module github.com/hashicorp/go-multierror
+
+require github.com/hashicorp/errwrap v1.0.0
diff --git a/vendor/github.com/hashicorp/go-multierror/go.sum b/vendor/github.com/hashicorp/go-multierror/go.sum
new file mode 100644
index 0000000..85b1f8f
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/go.sum
@@ -0,0 +1,4 @@
+github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce h1:prjrVgOk2Yg6w+PflHoszQNLTUh4kaByUcEWM/9uin4=
+github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
diff --git a/vendor/github.com/hashicorp/go-multierror/multierror.go b/vendor/github.com/hashicorp/go-multierror/multierror.go
index 2ea0827..89b1422 100644
--- a/vendor/github.com/hashicorp/go-multierror/multierror.go
+++ b/vendor/github.com/hashicorp/go-multierror/multierror.go
@@ -40,11 +40,11 @@ func (e *Error) GoString() string {
 }
 
 // WrappedErrors returns the list of errors that this Error is wrapping.
-// It is an implementatin of the errwrap.Wrapper interface so that
+// It is an implementation of the errwrap.Wrapper interface so that
 // multierror.Error can be used with that library.
 //
 // This method is not safe to be called concurrently and is no different
-// than accessing the Errors field directly. It is implementd only to
+// than accessing the Errors field directly. It is implemented only to
 // satisfy the errwrap.Wrapper interface.
 func (e *Error) WrappedErrors() []error {
         return e.Errors
diff --git a/vendor/github.com/hashicorp/go-multierror/sort.go b/vendor/github.com/hashicorp/go-multierror/sort.go
new file mode 100644
index 0000000..fecb14e
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/sort.go
@@ -0,0 +1,16 @@
+package multierror
+
+// Len implements sort.Interface function for length
+func (err Error) Len() int {
+        return len(err.Errors)
+}
+
+// Swap implements sort.Interface function for swapping elements
+func (err Error) Swap(i, j int) {
+        err.Errors[i], err.Errors[j] = err.Errors[j], err.Errors[i]
+}
+
+// Less implements sort.Interface function for determining order
+func (err Error) Less(i, j int) bool {
+        return err.Errors[i].Error() < err.Errors[j].Error()
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/README.md b/vendor/github.com/hashicorp/go-plugin/README.md
index e4558db..fe305ad 100644
--- a/vendor/github.com/hashicorp/go-plugin/README.md
+++ b/vendor/github.com/hashicorp/go-plugin/README.md
@@ -109,7 +109,7 @@ high-level steps that must be done. Examples are available in the
   1. Choose the interface(s) you want to expose for plugins.
 
   2. For each interface, implement an implementation of that interface
-     that communicates over a `net/rpc` connection or other a
+     that communicates over a `net/rpc` connection or over a
      [gRPC](http://www.grpc.io) connection or both. You'll have to implement
      both a client and server implementation.
 
@@ -150,19 +150,19 @@ user experience.
 
 When we started using plugins (late 2012, early 2013), plugins over RPC
 were the only option since Go didn't support dynamic library loading. Today,
-Go still doesn't support dynamic library loading, but they do intend to.
-Since 2012, our plugin system has stabilized from millions of users using it,
-and has many benefits we've come to value greatly.
-
-For example, we intend to use this plugin system in
-[Vault](https://www.vaultproject.io), and dynamic library loading will
-simply never be acceptable in Vault for security reasons. That is an extreme
+Go supports the [plugin](https://golang.org/pkg/plugin/) standard library with
+a number of  limitations. Since 2012, our plugin system has stabilized 
+from tens of millions of users using it, and has many benefits we've come to 
+value greatly.
+
+For example, we use this plugin system in
+[Vault](https://www.vaultproject.io) where dynamic library loading is
+not acceptable for security reasons. That is an extreme
 example, but we believe our library system has more upsides than downsides
 over dynamic library loading and since we've had it built and tested for years,
-we'll likely continue to use it.
+we'll continue to use it.
 
 Shared libraries have one major advantage over our system which is much
 higher performance. In real world scenarios across our various tools,
 we've never required any more performance out of our plugin system and it
 has seen very high throughput, so this isn't a concern for us at the moment.
-
diff --git a/vendor/github.com/hashicorp/go-plugin/client.go b/vendor/github.com/hashicorp/go-plugin/client.go
index b3e3b78..679e10a 100644
--- a/vendor/github.com/hashicorp/go-plugin/client.go
+++ b/vendor/github.com/hashicorp/go-plugin/client.go
@@ -5,12 +5,13 @@ import (
         "context"
         "crypto/subtle"
         "crypto/tls"
+        "crypto/x509"
+        "encoding/base64"
         "errors"
         "fmt"
         "hash"
         "io"
         "io/ioutil"
-        "log"
         "net"
         "os"
         "os/exec"
@@ -20,7 +21,6 @@ import (
         "sync"
         "sync/atomic"
         "time"
-        "unicode"
 
         hclog "github.com/hashicorp/go-hclog"
 )
@@ -71,16 +71,31 @@ var (
 //
 // See NewClient and ClientConfig for using a Client.
 type Client struct {
-        config      *ClientConfig
-        exited      bool
-        doneLogging chan struct{}
-        l           sync.Mutex
-        address     net.Addr
-        process     *os.Process
-        client      ClientProtocol
-        protocol    Protocol
-        logger      hclog.Logger
-        doneCtx     context.Context
+        config            *ClientConfig
+        exited            bool
+        l                 sync.Mutex
+        address           net.Addr
+        process           *os.Process
+        client            ClientProtocol
+        protocol          Protocol
+        logger            hclog.Logger
+        doneCtx           context.Context
+        ctxCancel         context.CancelFunc
+        negotiatedVersion int
+
+        // clientWaitGroup is used to manage the lifecycle of the plugin management
+        // goroutines.
+        clientWaitGroup sync.WaitGroup
+
+        // processKilled is used for testing only, to flag when the process was
+        // forcefully killed.
+        processKilled bool
+}
+
+// NegotiatedVersion returns the protocol version negotiated with the server.
+// This is only valid after Start() is called.
+func (c *Client) NegotiatedVersion() int {
+        return c.negotiatedVersion
 }
 
 // ClientConfig is the configuration used to initialize a new
@@ -91,7 +106,13 @@ type ClientConfig struct {
         HandshakeConfig
 
         // Plugins are the plugins that can be consumed.
-        Plugins map[string]Plugin
+        // The implied version of this PluginSet is the Handshake.ProtocolVersion.
+        Plugins PluginSet
+
+        // VersionedPlugins is a map of PluginSets for specific protocol versions.
+        // These can be used to negotiate a compatible version between client and
+        // server. If this is set, Handshake.ProtocolVersion is not required.
+        VersionedPlugins map[int]PluginSet
 
         // One of the following must be set, but not both.
         //
@@ -158,6 +179,29 @@ type ClientConfig struct {
         // Logger is the logger that the client will used. If none is provided,
         // it will default to hclog's default logger.
         Logger hclog.Logger
+
+        // AutoMTLS has the client and server automatically negotiate mTLS for
+        // transport authentication. This ensures that only the original client will
+        // be allowed to connect to the server, and all other connections will be
+        // rejected. The client will also refuse to connect to any server that isn't
+        // the original instance started by the client.
+        //
+        // In this mode of operation, the client generates a one-time use tls
+        // certificate, sends the public x.509 certificate to the new server, and
+        // the server generates a one-time use tls certificate, and sends the public
+        // x.509 certificate back to the client. These are used to authenticate all
+        // rpc connections between the client and server.
+        //
+        // Setting AutoMTLS to true implies that the server must support the
+        // protocol, and correctly negotiate the tls certificates, or a connection
+        // failure will result.
+        //
+        // The client should not set TLSConfig, nor should the server set a
+        // TLSProvider, because AutoMTLS implies that a new certificate and tls
+        // configuration will be generated at startup.
+        //
+        // You cannot Reattach to a server with this option enabled.
+        AutoMTLS bool
 }
 
 // ReattachConfig is used to configure a client to reattach to an
@@ -234,7 +278,6 @@ func CleanupClients() {
         }
         managedClientsLock.Unlock()
 
-        log.Println("[DEBUG] plugin: waiting for all plugin processes to complete...")
         wg.Wait()
 }
 
@@ -333,6 +376,14 @@ func (c *Client) Exited() bool {
         return c.exited
 }
 
+// killed is used in tests to check if a process failed to exit gracefully, and
+// needed to be killed.
+func (c *Client) killed() bool {
+        c.l.Lock()
+        defer c.l.Unlock()
+        return c.processKilled
+}
+
 // End the executing subprocess (if it is running) and perform any cleanup
 // tasks necessary such as capturing any remaining logs and so on.
 //
@@ -344,14 +395,24 @@ func (c *Client) Kill() {
         c.l.Lock()
         process := c.process
         addr := c.address
-        doneCh := c.doneLogging
         c.l.Unlock()
 
-        // If there is no process, we never started anything. Nothing to kill.
+        // If there is no process, there is nothing to kill.
         if process == nil {
                 return
         }
 
+        defer func() {
+                // Wait for the all client goroutines to finish.
+                c.clientWaitGroup.Wait()
+
+                // Make sure there is no reference to the old process after it has been
+                // killed.
+                c.l.Lock()
+                c.process = nil
+                c.l.Unlock()
+        }()
+
         // We need to check for address here. It is possible that the plugin
         // started (process != nil) but has no address (addr == nil) if the
         // plugin failed at startup. If we do have an address, we need to close
@@ -372,6 +433,8 @@ func (c *Client) Kill() {
                                 // kill in a moment anyways.
                                 c.logger.Warn("error closing client during Kill", "err", err)
                         }
+                } else {
+                        c.logger.Error("client", "error", err)
                 }
         }
 
@@ -380,17 +443,20 @@ func (c *Client) Kill() {
         // doneCh which would be closed if the process exits.
         if graceful {
                 select {
-                case <-doneCh:
+                case <-c.doneCtx.Done():
+                        c.logger.Debug("plugin exited")
                         return
-                case <-time.After(250 * time.Millisecond):
+                case <-time.After(2 * time.Second):
                 }
         }
 
         // If graceful exiting failed, just kill it
+        c.logger.Warn("plugin failed to exit gracefully")
         process.Kill()
 
-        // Wait for the client to finish logging so we have a complete log
-        <-doneCh
+        c.l.Lock()
+        c.processKilled = true
+        c.l.Unlock()
 }
 
 // Starts the underlying subprocess, communicating with it to negotiate
@@ -409,7 +475,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
         // If one of cmd or reattach isn't set, then it is an error. We wrap
         // this in a {} for scoping reasons, and hopeful that the escape
-        // analysis will pop the stock here.
+        // analysis will pop the stack here.
         {
                 cmdSet := c.config.Cmd != nil
                 attachSet := c.config.Reattach != nil
@@ -423,77 +489,49 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 }
         }
 
-        // Create the logging channel for when we kill
-        c.doneLogging = make(chan struct{})
-        // Create a context for when we kill
-        var ctxCancel context.CancelFunc
-        c.doneCtx, ctxCancel = context.WithCancel(context.Background())
-
         if c.config.Reattach != nil {
-                // Verify the process still exists. If not, then it is an error
-                p, err := os.FindProcess(c.config.Reattach.Pid)
-                if err != nil {
-                        return nil, err
-                }
+                return c.reattach()
+        }
 
-                // Attempt to connect to the addr since on Unix systems FindProcess
-                // doesn't actually return an error if it can't find the process.
-                conn, err := net.Dial(
-                        c.config.Reattach.Addr.Network(),
-                        c.config.Reattach.Addr.String())
-                if err != nil {
-                        p.Kill()
-                        return nil, ErrProcessNotFound
-                }
-                conn.Close()
-
-                // Goroutine to mark exit status
-                go func(pid int) {
-                        // Wait for the process to die
-                        pidWait(pid)
-
-                        // Log so we can see it
-                        c.logger.Debug("reattached plugin process exited")
-
-                        // Mark it
-                        c.l.Lock()
-                        defer c.l.Unlock()
-                        c.exited = true
-
-                        // Close the logging channel since that doesn't work on reattach
-                        close(c.doneLogging)
-
-                        // Cancel the context
-                        ctxCancel()
-                }(p.Pid)
-
-                // Set the address and process
-                c.address = c.config.Reattach.Addr
-                c.process = p
-                c.protocol = c.config.Reattach.Protocol
-                if c.protocol == "" {
-                        // Default the protocol to net/rpc for backwards compatibility
-                        c.protocol = ProtocolNetRPC
-                }
+        if c.config.VersionedPlugins == nil {
+                c.config.VersionedPlugins = make(map[int]PluginSet)
+        }
 
-                return c.address, nil
+        // handle all plugins as versioned, using the handshake config as the default.
+        version := int(c.config.ProtocolVersion)
+
+        // Make sure we're not overwriting a real version 0. If ProtocolVersion was
+        // non-zero, then we have to just assume the user made sure that
+        // VersionedPlugins doesn't conflict.
+        if _, ok := c.config.VersionedPlugins[version]; !ok && c.config.Plugins != nil {
+                c.config.VersionedPlugins[version] = c.config.Plugins
+        }
+
+        var versionStrings []string
+        for v := range c.config.VersionedPlugins {
+                versionStrings = append(versionStrings, strconv.Itoa(v))
         }
 
         env := []string{
                 fmt.Sprintf("%s=%s", c.config.MagicCookieKey, c.config.MagicCookieValue),
                 fmt.Sprintf("PLUGIN_MIN_PORT=%d", c.config.MinPort),
                 fmt.Sprintf("PLUGIN_MAX_PORT=%d", c.config.MaxPort),
+                fmt.Sprintf("PLUGIN_PROTOCOL_VERSIONS=%s", strings.Join(versionStrings, ",")),
         }
 
-        stdout_r, stdout_w := io.Pipe()
-        stderr_r, stderr_w := io.Pipe()
-
         cmd := c.config.Cmd
         cmd.Env = append(cmd.Env, os.Environ()...)
         cmd.Env = append(cmd.Env, env...)
         cmd.Stdin = os.Stdin
-        cmd.Stderr = stderr_w
-        cmd.Stdout = stdout_w
+
+        cmdStdout, err := cmd.StdoutPipe()
+        if err != nil {
+                return nil, err
+        }
+        cmdStderr, err := cmd.StderrPipe()
+        if err != nil {
+                return nil, err
+        }
 
         if c.config.SecureConfig != nil {
                 if ok, err := c.config.SecureConfig.Check(cmd.Path); err != nil {
@@ -503,6 +541,29 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 }
         }
 
+        // Setup a temporary certificate for client/server mtls, and send the public
+        // certificate to the plugin.
+        if c.config.AutoMTLS {
+                c.logger.Info("configuring client automatic mTLS")
+                certPEM, keyPEM, err := generateCert()
+                if err != nil {
+                        c.logger.Error("failed to generate client certificate", "error", err)
+                        return nil, err
+                }
+                cert, err := tls.X509KeyPair(certPEM, keyPEM)
+                if err != nil {
+                        c.logger.Error("failed to parse client certificate", "error", err)
+                        return nil, err
+                }
+
+                cmd.Env = append(cmd.Env, fmt.Sprintf("PLUGIN_CLIENT_CERT=%s", certPEM))
+
+                c.config.TLSConfig = &tls.Config{
+                        Certificates: []tls.Certificate{cert},
+                        ServerName:   "localhost",
+                }
+        }
+
         c.logger.Debug("starting plugin", "path", cmd.Path, "args", cmd.Args)
         err = cmd.Start()
         if err != nil {
@@ -511,6 +572,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
         // Set the process
         c.process = cmd.Process
+        c.logger.Debug("plugin started", "path", cmd.Path, "pid", c.process.Pid)
 
         // Make sure the command is properly cleaned up if there is an error
         defer func() {
@@ -525,27 +587,37 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 }
         }()
 
-        // Start goroutine to wait for process to exit
-        exitCh := make(chan struct{})
+        // Create a context for when we kill
+        c.doneCtx, c.ctxCancel = context.WithCancel(context.Background())
+
+        c.clientWaitGroup.Add(1)
         go func() {
-                // Make sure we close the write end of our stderr/stdout so
-                // that the readers send EOF properly.
-                defer stderr_w.Close()
-                defer stdout_w.Close()
+                // ensure the context is cancelled when we're done
+                defer c.ctxCancel()
+
+                defer c.clientWaitGroup.Done()
+
+                // get the cmd info early, since the process information will be removed
+                // in Kill.
+                pid := c.process.Pid
+                path := cmd.Path
 
                 // Wait for the command to end.
-                cmd.Wait()
+                err := cmd.Wait()
+
+                debugMsgArgs := []interface{}{
+                        "path", path,
+                        "pid", pid,
+                }
+                if err != nil {
+                        debugMsgArgs = append(debugMsgArgs,
+                                []interface{}{"error", err.Error()}...)
+                }
 
                 // Log and make sure to flush the logs write away
-                c.logger.Debug("plugin process exited", "path", cmd.Path)
+                c.logger.Debug("plugin process exited", debugMsgArgs...)
                 os.Stderr.Sync()
 
-                // Mark that we exited
-                close(exitCh)
-
-                // Cancel the context, marking that we exited
-                ctxCancel()
-
                 // Set that we exited, which takes a lock
                 c.l.Lock()
                 defer c.l.Unlock()
@@ -553,32 +625,33 @@ func (c *Client) Start() (addr net.Addr, err error) {
         }()
 
         // Start goroutine that logs the stderr
-        go c.logStderr(stderr_r)
+        c.clientWaitGroup.Add(1)
+        // logStderr calls Done()
+        go c.logStderr(cmdStderr)
 
         // Start a goroutine that is going to be reading the lines
         // out of stdout
-        linesCh := make(chan []byte)
+        linesCh := make(chan string)
+        c.clientWaitGroup.Add(1)
         go func() {
+                defer c.clientWaitGroup.Done()
                 defer close(linesCh)
 
-                buf := bufio.NewReader(stdout_r)
-                for {
-                        line, err := buf.ReadBytes('\n')
-                        if line != nil {
-                                linesCh <- line
-                        }
-
-                        if err == io.EOF {
-                                return
-                        }
+                scanner := bufio.NewScanner(cmdStdout)
+                for scanner.Scan() {
+                        linesCh <- scanner.Text()
                 }
         }()
 
         // Make sure after we exit we read the lines from stdout forever
-        // so they don't block since it is an io.Pipe
+        // so they don't block since it is a pipe.
+        // The scanner goroutine above will close this, but track it with a wait
+        // group for completeness.
+        c.clientWaitGroup.Add(1)
         defer func() {
                 go func() {
-                        for _ = range linesCh {
+                        defer c.clientWaitGroup.Done()
+                        for range linesCh {
                         }
                 }()
         }()
@@ -591,12 +664,12 @@ func (c *Client) Start() (addr net.Addr, err error) {
         select {
         case <-timeout:
                 err = errors.New("timeout while waiting for plugin to start")
-        case <-exitCh:
+        case <-c.doneCtx.Done():
                 err = errors.New("plugin exited before we could connect")
-        case lineBytes := <-linesCh:
+        case line := <-linesCh:
                 // Trim the line and split by "|" in order to get the parts of
                 // the output.
-                line := strings.TrimSpace(string(lineBytes))
+                line = strings.TrimSpace(line)
                 parts := strings.SplitN(line, "|", 6)
                 if len(parts) < 4 {
                         err = fmt.Errorf(
@@ -624,20 +697,18 @@ func (c *Client) Start() (addr net.Addr, err error) {
                         }
                 }
 
-                // Parse the protocol version
-                var protocol int64
-                protocol, err = strconv.ParseInt(parts[1], 10, 0)
+                // Test the API version
+                version, pluginSet, err := c.checkProtoVersion(parts[1])
                 if err != nil {
-                        err = fmt.Errorf("Error parsing protocol version: %s", err)
-                        return
+                        return addr, err
                 }
 
-                // Test the API version
-                if uint(protocol) != c.config.ProtocolVersion {
-                        err = fmt.Errorf("Incompatible API version with plugin. "+
-                                "Plugin version: %s, Core version: %d", parts[1], c.config.ProtocolVersion)
-                        return
-                }
+                // set the Plugins value to the compatible set, so the version
+                // doesn't need to be passed through to the ClientProtocol
+                // implementation.
+                c.config.Plugins = pluginSet
+                c.negotiatedVersion = version
+                c.logger.Debug("using plugin", "version", version)
 
                 switch parts[2] {
                 case "tcp":
@@ -665,15 +736,125 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 if !found {
                         err = fmt.Errorf("Unsupported plugin protocol %q. Supported: %v",
                                 c.protocol, c.config.AllowedProtocols)
-                        return
+                        return addr, err
                 }
 
+                // See if we have a TLS certificate from the server.
+                // Checking if the length is > 50 rules out catching the unused "extra"
+                // data returned from some older implementations.
+                if len(parts) >= 6 && len(parts[5]) > 50 {
+                        err := c.loadServerCert(parts[5])
+                        if err != nil {
+                                return nil, fmt.Errorf("error parsing server cert: %s", err)
+                        }
+                }
         }
 
         c.address = addr
         return
 }
 
+// loadServerCert is used by AutoMTLS to read an x.509 cert returned by the
+// server, and load it as the RootCA for the client TLSConfig.
+func (c *Client) loadServerCert(cert string) error {
+        certPool := x509.NewCertPool()
+
+        asn1, err := base64.RawStdEncoding.DecodeString(cert)
+        if err != nil {
+                return err
+        }
+
+        x509Cert, err := x509.ParseCertificate([]byte(asn1))
+        if err != nil {
+                return err
+        }
+
+        certPool.AddCert(x509Cert)
+
+        c.config.TLSConfig.RootCAs = certPool
+        return nil
+}
+
+func (c *Client) reattach() (net.Addr, error) {
+        // Verify the process still exists. If not, then it is an error
+        p, err := os.FindProcess(c.config.Reattach.Pid)
+        if err != nil {
+                return nil, err
+        }
+
+        // Attempt to connect to the addr since on Unix systems FindProcess
+        // doesn't actually return an error if it can't find the process.
+        conn, err := net.Dial(
+                c.config.Reattach.Addr.Network(),
+                c.config.Reattach.Addr.String())
+        if err != nil {
+                p.Kill()
+                return nil, ErrProcessNotFound
+        }
+        conn.Close()
+
+        // Create a context for when we kill
+        c.doneCtx, c.ctxCancel = context.WithCancel(context.Background())
+
+        c.clientWaitGroup.Add(1)
+        // Goroutine to mark exit status
+        go func(pid int) {
+                defer c.clientWaitGroup.Done()
+
+                // ensure the context is cancelled when we're done
+                defer c.ctxCancel()
+
+                // Wait for the process to die
+                pidWait(pid)
+
+                // Log so we can see it
+                c.logger.Debug("reattached plugin process exited")
+
+                // Mark it
+                c.l.Lock()
+                defer c.l.Unlock()
+                c.exited = true
+        }(p.Pid)
+
+        // Set the address and process
+        c.address = c.config.Reattach.Addr
+        c.process = p
+        c.protocol = c.config.Reattach.Protocol
+        if c.protocol == "" {
+                // Default the protocol to net/rpc for backwards compatibility
+                c.protocol = ProtocolNetRPC
+        }
+
+        return c.address, nil
+}
+
+// checkProtoVersion returns the negotiated version and PluginSet.
+// This returns an error if the server returned an incompatible protocol
+// version, or an invalid handshake response.
+func (c *Client) checkProtoVersion(protoVersion string) (int, PluginSet, error) {
+        serverVersion, err := strconv.Atoi(protoVersion)
+        if err != nil {
+                return 0, nil, fmt.Errorf("Error parsing protocol version %q: %s", protoVersion, err)
+        }
+
+        // record these for the error message
+        var clientVersions []int
+
+        // all versions, including the legacy ProtocolVersion have been added to
+        // the versions set
+        for version, plugins := range c.config.VersionedPlugins {
+                clientVersions = append(clientVersions, version)
+
+                if serverVersion != version {
+                        continue
+                }
+                return version, plugins, nil
+        }
+
+        return 0, nil, fmt.Errorf("Incompatible API version with plugin. "+
+                "Plugin version: %d, Client versions: %d", serverVersion, clientVersions)
+}
+
 // ReattachConfig returns the information that must be provided to NewClient
 // to reattach to the plugin process that this client started. This is
 // useful for plugins that detach from their parent process.
@@ -751,44 +932,84 @@ func (c *Client) dialer(_ string, timeout time.Duration) (net.Conn, error) {
         return conn, nil
 }
 
+var stdErrBufferSize = 64 * 1024
+
 func (c *Client) logStderr(r io.Reader) {
-        bufR := bufio.NewReader(r)
+        defer c.clientWaitGroup.Done()
+        l := c.logger.Named(filepath.Base(c.config.Cmd.Path))
+
+        reader := bufio.NewReaderSize(r, stdErrBufferSize)
+        // continuation indicates the previous line was a prefix
+        continuation := false
+
         for {
-                line, err := bufR.ReadString('\n')
-                if line != "" {
-                        c.config.Stderr.Write([]byte(line))
-                        line = strings.TrimRightFunc(line, unicode.IsSpace)
+                line, isPrefix, err := reader.ReadLine()
+                switch {
+                case err == io.EOF:
+                        return
+                case err != nil:
+                        l.Error("reading plugin stderr", "error", err)
+                        return
+                }
 
-                        l := c.logger.Named(filepath.Base(c.config.Cmd.Path))
+                c.config.Stderr.Write(line)
 
-                        entry, err := parseJSON(line)
-                        // If output is not JSON format, print directly to Debug
-                        if err != nil {
-                                l.Debug(line)
-                        } else {
-                                out := flattenKVPairs(entry.KVPairs)
-
-                                l = l.With("timestamp", entry.Timestamp.Format(hclog.TimeFormat))
-                                switch hclog.LevelFromString(entry.Level) {
-                                case hclog.Trace:
-                                        l.Trace(entry.Message, out...)
-                                case hclog.Debug:
-                                        l.Debug(entry.Message, out...)
-                                case hclog.Info:
-                                        l.Info(entry.Message, out...)
-                                case hclog.Warn:
-                                        l.Warn(entry.Message, out...)
-                                case hclog.Error:
-                                        l.Error(entry.Message, out...)
-                                }
+                // The line was longer than our max token size, so it's likely
+                // incomplete and won't unmarshal.
+                if isPrefix || continuation {
+                        l.Debug(string(line))
+
+                        // if we're finishing a continued line, add the newline back in
+                        if !isPrefix {
+                                c.config.Stderr.Write([]byte{'\n'})
                         }
+
+                        continuation = isPrefix
+                        continue
                 }
 
-                if err == io.EOF {
-                        break
+                c.config.Stderr.Write([]byte{'\n'})
+
+                entry, err := parseJSON(line)
+                // If output is not JSON format, print directly to Debug
+                if err != nil {
+                        // Attempt to infer the desired log level from the commonly used
+                        // string prefixes
+                        switch line := string(line); {
+                        case strings.HasPrefix(line, "[TRACE]"):
+                                l.Trace(line)
+                        case strings.HasPrefix(line, "[DEBUG]"):
+                                l.Debug(line)
+                        case strings.HasPrefix(line, "[INFO]"):
+                                l.Info(line)
+                        case strings.HasPrefix(line, "[WARN]"):
+                                l.Warn(line)
+                        case strings.HasPrefix(line, "[ERROR]"):
+                                l.Error(line)
+                        default:
+                                l.Debug(line)
+                        }
+                } else {
+                        out := flattenKVPairs(entry.KVPairs)
+
+                        out = append(out, "timestamp", entry.Timestamp.Format(hclog.TimeFormat))
+                        switch hclog.LevelFromString(entry.Level) {
+                        case hclog.Trace:
+                                l.Trace(entry.Message, out...)
+                        case hclog.Debug:
+                                l.Debug(entry.Message, out...)
+                        case hclog.Info:
+                                l.Info(entry.Message, out...)
+                        case hclog.Warn:
+                                l.Warn(entry.Message, out...)
+                        case hclog.Error:
+                                l.Error(entry.Message, out...)
+                        default:
+                                // if there was no log level, it's likely this is unexpected
+                                // json from something other than hclog, and we should output
+                                // it verbatim.
+                                l.Debug(string(line))
+                        }
                 }
         }
-
-        // Flag that we've completed logging for others
-        close(c.doneLogging)
 }
diff --git a/vendor/github.com/hashicorp/go-plugin/go.mod b/vendor/github.com/hashicorp/go-plugin/go.mod
new file mode 100644
index 0000000..f3ddf44
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/go.mod
@@ -0,0 +1,17 @@
+module github.com/hashicorp/go-plugin
+
+require (
+        github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b // indirect
+        github.com/golang/protobuf v1.2.0
+        github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd
+        github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb
+        github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77
+        github.com/oklog/run v1.0.0
+        github.com/stretchr/testify v1.3.0 // indirect
+        golang.org/x/net v0.0.0-20180826012351-8a410e7b638d
+        golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 // indirect
+        golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc // indirect
+        golang.org/x/text v0.3.0 // indirect
+        google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 // indirect
+        google.golang.org/grpc v1.14.0
+)
diff --git a/vendor/github.com/hashicorp/go-plugin/go.sum b/vendor/github.com/hashicorp/go-plugin/go.sum
new file mode 100644
index 0000000..21b14e9
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/go.sum
@@ -0,0 +1,31 @@
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd h1:rNuUHR+CvK1IS89MMtcF0EpcVMZtjKfPRp4MEmt/aTs=
+github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
+github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77 h1:7GoSOOW2jpsfkntVKaS2rAr1TJqfcxotyaUcuxoZSzg=
+github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
+github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d h1:g9qWBGx4puODJTMVyoPrpoxPFgVGd+z1DZwjfRu4d0I=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc h1:WiYx1rIFmx8c0mXAFtv5D/mHyKe1+jmuP7PViuwqwuQ=
+golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/grpc v1.14.0 h1:ArxJuB1NWfPY6r9Gp9gqwplT0Ge7nqv9msgu03lHLmo=
+google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.go b/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
index 49fd21c..daf142d 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
@@ -11,6 +11,8 @@ import (
         "sync/atomic"
         "time"
 
+        "github.com/hashicorp/go-plugin/internal/plugin"
+
         "github.com/oklog/run"
         "google.golang.org/grpc"
         "google.golang.org/grpc/credentials"
@@ -19,14 +21,14 @@ import (
 // streamer interface is used in the broker to send/receive connection
 // information.
 type streamer interface {
-        Send(*ConnInfo) error
-        Recv() (*ConnInfo, error)
+        Send(*plugin.ConnInfo) error
+        Recv() (*plugin.ConnInfo, error)
         Close()
 }
 
 // sendErr is used to pass errors back during a send.
 type sendErr struct {
-        i  *ConnInfo
+        i  *plugin.ConnInfo
         ch chan error
 }
 
@@ -38,7 +40,7 @@ type gRPCBrokerServer struct {
         send chan *sendErr
 
         // recv is used to receive connection info from the gRPC stream.
-        recv chan *ConnInfo
+        recv chan *plugin.ConnInfo
 
         // quit closes down the stream.
         quit chan struct{}
@@ -50,7 +52,7 @@ type gRPCBrokerServer struct {
 func newGRPCBrokerServer() *gRPCBrokerServer {
         return &gRPCBrokerServer{
                 send: make(chan *sendErr),
-                recv: make(chan *ConnInfo),
+                recv: make(chan *plugin.ConnInfo),
                 quit: make(chan struct{}),
         }
 }
@@ -58,7 +60,7 @@ func newGRPCBrokerServer() *gRPCBrokerServer {
 // StartStream implements the GRPCBrokerServer interface and will block until
 // the quit channel is closed or the context reports Done. The stream will pass
 // connection information to/from the client.
-func (s *gRPCBrokerServer) StartStream(stream GRPCBroker_StartStreamServer) error {
+func (s *gRPCBrokerServer) StartStream(stream plugin.GRPCBroker_StartStreamServer) error {
         doneCh := stream.Context().Done()
         defer s.Close()
 
@@ -97,7 +99,7 @@ func (s *gRPCBrokerServer) StartStream(stream GRPCBroker_StartStreamServer) erro
 
 // Send is used by the GRPCBroker to pass connection information into the stream
 // to the client.
-func (s *gRPCBrokerServer) Send(i *ConnInfo) error {
+func (s *gRPCBrokerServer) Send(i *plugin.ConnInfo) error {
         ch := make(chan error)
         defer close(ch)
 
@@ -115,7 +117,7 @@ func (s *gRPCBrokerServer) Send(i *ConnInfo) error {
 
 // Recv is used by the GRPCBroker to pass connection information that has been
 // sent from the client from the stream to the broker.
-func (s *gRPCBrokerServer) Recv() (*ConnInfo, error) {
+func (s *gRPCBrokerServer) Recv() (*plugin.ConnInfo, error) {
         select {
         case <-s.quit:
                 return nil, errors.New("broker closed")
@@ -136,13 +138,13 @@ func (s *gRPCBrokerServer) Close() {
 // streamer interfaces.
 type gRPCBrokerClientImpl struct {
         // client is the underlying GRPC client used to make calls to the server.
-        client GRPCBrokerClient
+        client plugin.GRPCBrokerClient
 
         // send is used to send connection info to the gRPC stream.
         send chan *sendErr
 
         // recv is used to receive connection info from the gRPC stream.
-        recv chan *ConnInfo
+        recv chan *plugin.ConnInfo
 
         // quit closes down the stream.
         quit chan struct{}
@@ -153,9 +155,9 @@ type gRPCBrokerClientImpl struct {
 
 func newGRPCBrokerClient(conn *grpc.ClientConn) *gRPCBrokerClientImpl {
         return &gRPCBrokerClientImpl{
-                client: NewGRPCBrokerClient(conn),
+                client: plugin.NewGRPCBrokerClient(conn),
                 send:   make(chan *sendErr),
-                recv:   make(chan *ConnInfo),
+                recv:   make(chan *plugin.ConnInfo),
                 quit:   make(chan struct{}),
         }
 }
@@ -207,7 +209,7 @@ func (s *gRPCBrokerClientImpl) StartStream() error {
 
 // Send is used by the GRPCBroker to pass connection information into the stream
 // to the plugin.
-func (s *gRPCBrokerClientImpl) Send(i *ConnInfo) error {
+func (s *gRPCBrokerClientImpl) Send(i *plugin.ConnInfo) error {
         ch := make(chan error)
         defer close(ch)
 
@@ -225,7 +227,7 @@ func (s *gRPCBrokerClientImpl) Send(i *ConnInfo) error {
 
 // Recv is used by the GRPCBroker to pass connection information that has been
 // sent from the plugin to the broker.
-func (s *gRPCBrokerClientImpl) Recv() (*ConnInfo, error) {
+func (s *gRPCBrokerClientImpl) Recv() (*plugin.ConnInfo, error) {
         select {
         case <-s.quit:
                 return nil, errors.New("broker closed")
@@ -266,7 +268,7 @@ type GRPCBroker struct {
 }
 
 type gRPCBrokerPending struct {
-        ch     chan *ConnInfo
+        ch     chan *plugin.ConnInfo
         doneCh chan struct{}
 }
 
@@ -288,7 +290,7 @@ func (b *GRPCBroker) Accept(id uint32) (net.Listener, error) {
                 return nil, err
         }
 
-        err = b.streamer.Send(&ConnInfo{
+        err = b.streamer.Send(&plugin.ConnInfo{
                 ServiceId: id,
                 Network:   listener.Addr().Network(),
                 Address:   listener.Addr().String(),
@@ -363,7 +365,7 @@ func (b *GRPCBroker) Close() error {
 
 // Dial opens a connection by ID.
 func (b *GRPCBroker) Dial(id uint32) (conn *grpc.ClientConn, err error) {
-        var c *ConnInfo
+        var c *plugin.ConnInfo
 
         // Open the stream
         p := b.getStream(id)
@@ -433,7 +435,7 @@ func (m *GRPCBroker) getStream(id uint32) *gRPCBrokerPending {
         }
 
         m.streams[id] = &gRPCBrokerPending{
-                ch:     make(chan *ConnInfo, 1),
+                ch:     make(chan *plugin.ConnInfo, 1),
                 doneCh: make(chan struct{}),
         }
         return m.streams[id]
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_client.go b/vendor/github.com/hashicorp/go-plugin/grpc_client.go
index 44294d0..294518e 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_client.go
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_client.go
@@ -6,6 +6,7 @@ import (
         "net"
         "time"
 
+        "github.com/hashicorp/go-plugin/internal/plugin"
         "golang.org/x/net/context"
         "google.golang.org/grpc"
         "google.golang.org/grpc/credentials"
@@ -16,12 +17,9 @@ func dialGRPCConn(tls *tls.Config, dialer func(string, time.Duration) (net.Conn,
         // Build dialing options.
         opts := make([]grpc.DialOption, 0, 5)
 
-        // We use a custom dialer so that we can connect over unix domain sockets
+        // We use a custom dialer so that we can connect over unix domain sockets.
         opts = append(opts, grpc.WithDialer(dialer))
 
-        // go-plugin expects to block the connection
-        opts = append(opts, grpc.WithBlock())
-
         // Fail right away
         opts = append(opts, grpc.FailOnNonTempDialError(true))
 
@@ -58,12 +56,15 @@ func newGRPCClient(doneCtx context.Context, c *Client) (*GRPCClient, error) {
         go broker.Run()
         go brokerGRPCClient.StartStream()
 
-        return &GRPCClient{
-                Conn:    conn,
-                Plugins: c.config.Plugins,
-                doneCtx: doneCtx,
-                broker:  broker,
-        }, nil
+        cl := &GRPCClient{
+                Conn:       conn,
+                Plugins:    c.config.Plugins,
+                doneCtx:    doneCtx,
+                broker:     broker,
+                controller: plugin.NewGRPCControllerClient(conn),
+        }
+
+        return cl, nil
 }
 
 // GRPCClient connects to a GRPCServer over gRPC to dispense plugin types.
@@ -73,11 +74,14 @@ type GRPCClient struct {
 
         doneCtx context.Context
         broker  *GRPCBroker
+
+        controller plugin.GRPCControllerClient
 }
 
 // ClientProtocol impl.
 func (c *GRPCClient) Close() error {
         c.broker.Close()
+        c.controller.Shutdown(c.doneCtx, &plugin.Empty{})
         return c.Conn.Close()
 }
 
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_controller.go b/vendor/github.com/hashicorp/go-plugin/grpc_controller.go
new file mode 100644
index 0000000..1a8a8e7
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_controller.go
@@ -0,0 +1,23 @@
+package plugin
+
+import (
+        "context"
+
+        "github.com/hashicorp/go-plugin/internal/plugin"
+)
+
+// GRPCControllerServer handles shutdown calls to terminate the server when the
+// plugin client is closed.
+type grpcControllerServer struct {
+        server *GRPCServer
+}
+
+// Shutdown stops the grpc server. It first will attempt a graceful stop, then a
+// full stop on the server.
+func (s *grpcControllerServer) Shutdown(ctx context.Context, _ *plugin.Empty) (*plugin.Empty, error) {
+        resp := &plugin.Empty{}
+
+        // TODO: figure out why GracefullStop doesn't work.
+        s.server.Stop()
+        return resp, nil
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_server.go b/vendor/github.com/hashicorp/go-plugin/grpc_server.go
index 3a72739..d3dbf1c 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_server.go
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_server.go
@@ -8,6 +8,8 @@ import (
         "io"
         "net"
 
+        hclog "github.com/hashicorp/go-hclog"
+        "github.com/hashicorp/go-plugin/internal/plugin"
         "google.golang.org/grpc"
         "google.golang.org/grpc/credentials"
         "google.golang.org/grpc/health"
@@ -52,6 +54,8 @@ type GRPCServer struct {
         config GRPCServerConfig
         server *grpc.Server
         broker *GRPCBroker
+
+        logger hclog.Logger
 }
 
 // ServerProtocol impl.
@@ -71,10 +75,16 @@ func (s *GRPCServer) Init() error {
 
         // Register the broker service
         brokerServer := newGRPCBrokerServer()
-        RegisterGRPCBrokerServer(s.server, brokerServer)
+        plugin.RegisterGRPCBrokerServer(s.server, brokerServer)
         s.broker = newGRPCBroker(brokerServer, s.TLS)
         go s.broker.Run()
 
+        // Register the controller
+        controllerServer := &grpcControllerServer{
+                server: s,
+        }
+        plugin.RegisterGRPCControllerServer(s.server, controllerServer)
+
         // Register all our plugins onto the gRPC server.
         for k, raw := range s.Plugins {
                 p, ok := raw.(GRPCPlugin)
@@ -83,7 +93,7 @@ func (s *GRPCServer) Init() error {
                 }
 
                 if err := p.GRPCServer(s.broker, s.server); err != nil {
-                        return fmt.Errorf("error registring %q: %s", k, err)
+                        return fmt.Errorf("error registering %q: %s", k, err)
                 }
         }
 
@@ -117,11 +127,11 @@ func (s *GRPCServer) Config() string {
 }
 
 func (s *GRPCServer) Serve(lis net.Listener) {
-        // Start serving in a goroutine
-        go s.server.Serve(lis)
-
-        // Wait until graceful completion
-        <-s.DoneCh
+        defer close(s.DoneCh)
+        err := s.server.Serve(lis)
+        if err != nil {
+                s.logger.Error("grpc server", "error", err)
+        }
 }
 
 // GRPCServerConfig is the extra configuration passed along for consumers
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go b/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go
new file mode 100644
index 0000000..aa2fdc8
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go
@@ -0,0 +1,3 @@
+//go:generate protoc -I ./ ./grpc_broker.proto ./grpc_controller.proto --go_out=plugins=grpc:.
+
+package plugin
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.pb.go b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go
index d490daf..b6850aa 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_broker.pb.go
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go
@@ -1,24 +1,14 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // source: grpc_broker.proto
 
-/*
-Package plugin is a generated protocol buffer package.
-
-It is generated from these files:
-        grpc_broker.proto
-
-It has these top-level messages:
-        ConnInfo
-*/
 package plugin
 
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
-
 import (
+        fmt "fmt"
+        proto "github.com/golang/protobuf/proto"
         context "golang.org/x/net/context"
         grpc "google.golang.org/grpc"
+        math "math"
 )
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -33,15 +23,38 @@ var _ = math.Inf
 const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 
 type ConnInfo struct {
-        ServiceId uint32 `protobuf:"varint,1,opt,name=service_id,json=serviceId" json:"service_id,omitempty"`
-        Network   string `protobuf:"bytes,2,opt,name=network" json:"network,omitempty"`
-        Address   string `protobuf:"bytes,3,opt,name=address" json:"address,omitempty"`
+        ServiceId            uint32   `protobuf:"varint,1,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
+        Network              string   `protobuf:"bytes,2,opt,name=network,proto3" json:"network,omitempty"`
+        Address              string   `protobuf:"bytes,3,opt,name=address,proto3" json:"address,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ConnInfo) Reset()         { *m = ConnInfo{} }
+func (m *ConnInfo) String() string { return proto.CompactTextString(m) }
+func (*ConnInfo) ProtoMessage()    {}
+func (*ConnInfo) Descriptor() ([]byte, []int) {
+        return fileDescriptor_802e9beed3ec3b28, []int{0}
 }
 
-func (m *ConnInfo) Reset()                    { *m = ConnInfo{} }
-func (m *ConnInfo) String() string            { return proto.CompactTextString(m) }
-func (*ConnInfo) ProtoMessage()               {}
-func (*ConnInfo) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+func (m *ConnInfo) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ConnInfo.Unmarshal(m, b)
+}
+func (m *ConnInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ConnInfo.Marshal(b, m, deterministic)
+}
+func (m *ConnInfo) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ConnInfo.Merge(m, src)
+}
+func (m *ConnInfo) XXX_Size() int {
+        return xxx_messageInfo_ConnInfo.Size(m)
+}
+func (m *ConnInfo) XXX_DiscardUnknown() {
+        xxx_messageInfo_ConnInfo.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ConnInfo proto.InternalMessageInfo
 
 func (m *ConnInfo) GetServiceId() uint32 {
         if m != nil {
@@ -68,6 +81,23 @@ func init() {
         proto.RegisterType((*ConnInfo)(nil), "plugin.ConnInfo")
 }
 
+func init() { proto.RegisterFile("grpc_broker.proto", fileDescriptor_802e9beed3ec3b28) }
+
+var fileDescriptor_802e9beed3ec3b28 = []byte{
+        // 175 bytes of a gzipped FileDescriptorProto
+        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4c, 0x2f, 0x2a, 0x48,
+        0x8e, 0x4f, 0x2a, 0xca, 0xcf, 0x4e, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b,
+        0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x8a, 0xe5, 0xe2, 0x70, 0xce, 0xcf, 0xcb, 0xf3, 0xcc, 0x4b,
+        0xcb, 0x17, 0x92, 0xe5, 0xe2, 0x2a, 0x4e, 0x2d, 0x2a, 0xcb, 0x4c, 0x4e, 0x8d, 0xcf, 0x4c, 0x91,
+        0x60, 0x54, 0x60, 0xd4, 0xe0, 0x0d, 0xe2, 0x84, 0x8a, 0x78, 0xa6, 0x08, 0x49, 0x70, 0xb1, 0xe7,
+        0xa5, 0x96, 0x94, 0xe7, 0x17, 0x65, 0x4b, 0x30, 0x29, 0x30, 0x6a, 0x70, 0x06, 0xc1, 0xb8, 0x20,
+        0x99, 0xc4, 0x94, 0x94, 0xa2, 0xd4, 0xe2, 0x62, 0x09, 0x66, 0x88, 0x0c, 0x94, 0x6b, 0xe4, 0xcc,
+        0xc5, 0xe5, 0x1e, 0x14, 0xe0, 0xec, 0x04, 0xb6, 0x5a, 0xc8, 0x94, 0x8b, 0x3b, 0xb8, 0x24, 0xb1,
+        0xa8, 0x24, 0xb8, 0xa4, 0x28, 0x35, 0x31, 0x57, 0x48, 0x40, 0x0f, 0xe2, 0x08, 0x3d, 0x98, 0x0b,
+        0xa4, 0x30, 0x44, 0x34, 0x18, 0x0d, 0x18, 0x9d, 0x38, 0xa2, 0xa0, 0xae, 0x4d, 0x62, 0x03, 0x3b,
+        0xde, 0x18, 0x10, 0x00, 0x00, 0xff, 0xff, 0x10, 0x15, 0x39, 0x47, 0xd1, 0x00, 0x00, 0x00,
+}
+
 // Reference imports to suppress errors if they are not otherwise used.
 var _ context.Context
 var _ grpc.ClientConn
@@ -76,8 +106,9 @@ var _ grpc.ClientConn
 // is compatible with the grpc package it is being compiled against.
 const _ = grpc.SupportPackageIsVersion4
 
-// Client API for GRPCBroker service
-
+// GRPCBrokerClient is the client API for GRPCBroker service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
 type GRPCBrokerClient interface {
         StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error)
 }
@@ -91,7 +122,7 @@ func NewGRPCBrokerClient(cc *grpc.ClientConn) GRPCBrokerClient {
 }
 
 func (c *gRPCBrokerClient) StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error) {
-        stream, err := grpc.NewClientStream(ctx, &_GRPCBroker_serviceDesc.Streams[0], c.cc, "/plugin.GRPCBroker/StartStream", opts...)
+        stream, err := c.cc.NewStream(ctx, &_GRPCBroker_serviceDesc.Streams[0], "/plugin.GRPCBroker/StartStream", opts...)
         if err != nil {
                 return nil, err
         }
@@ -121,8 +152,7 @@ func (x *gRPCBrokerStartStreamClient) Recv() (*ConnInfo, error) {
         return m, nil
 }
 
-// Server API for GRPCBroker service
-
+// GRPCBrokerServer is the server API for GRPCBroker service.
 type GRPCBrokerServer interface {
         StartStream(GRPCBroker_StartStreamServer) error
 }
@@ -171,20 +201,3 @@ var _GRPCBroker_serviceDesc = grpc.ServiceDesc{
         },
         Metadata: "grpc_broker.proto",
 }
-
-func init() { proto.RegisterFile("grpc_broker.proto", fileDescriptor0) }
-
-var fileDescriptor0 = []byte{
-        // 170 bytes of a gzipped FileDescriptorProto
-        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4c, 0x2f, 0x2a, 0x48,
-        0x8e, 0x4f, 0x2a, 0xca, 0xcf, 0x4e, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b,
-        0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x8a, 0xe5, 0xe2, 0x70, 0xce, 0xcf, 0xcb, 0xf3, 0xcc, 0x4b,
-        0xcb, 0x17, 0x92, 0xe5, 0xe2, 0x2a, 0x4e, 0x2d, 0x2a, 0xcb, 0x4c, 0x4e, 0x8d, 0xcf, 0x4c, 0x91,
-        0x60, 0x54, 0x60, 0xd4, 0xe0, 0x0d, 0xe2, 0x84, 0x8a, 0x78, 0xa6, 0x08, 0x49, 0x70, 0xb1, 0xe7,
-        0xa5, 0x96, 0x94, 0xe7, 0x17, 0x65, 0x4b, 0x30, 0x29, 0x30, 0x6a, 0x70, 0x06, 0xc1, 0xb8, 0x20,
-        0x99, 0xc4, 0x94, 0x94, 0xa2, 0xd4, 0xe2, 0x62, 0x09, 0x66, 0x88, 0x0c, 0x94, 0x6b, 0xe4, 0xcc,
-        0xc5, 0xe5, 0x1e, 0x14, 0xe0, 0xec, 0x04, 0xb6, 0x5a, 0xc8, 0x94, 0x8b, 0x3b, 0xb8, 0x24, 0xb1,
-        0xa8, 0x24, 0xb8, 0xa4, 0x28, 0x35, 0x31, 0x57, 0x48, 0x40, 0x0f, 0xe2, 0x08, 0x3d, 0x98, 0x0b,
-        0xa4, 0x30, 0x44, 0x34, 0x18, 0x0d, 0x18, 0x93, 0xd8, 0xc0, 0x4e, 0x36, 0x06, 0x04, 0x00, 0x00,
-        0xff, 0xff, 0x7b, 0x5d, 0xfb, 0xe1, 0xc7, 0x00, 0x00, 0x00,
-}
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.proto b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto
index f578348..3fa79e8 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_broker.proto
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto
@@ -1,5 +1,6 @@
 syntax = "proto3";
 package plugin;
+option go_package = "plugin";
 
 message ConnInfo {
     uint32 service_id = 1;
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go
new file mode 100644
index 0000000..38b4204
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go
@@ -0,0 +1,143 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: grpc_controller.proto
+
+package plugin
+
+import (
+        fmt "fmt"
+        proto "github.com/golang/protobuf/proto"
+        context "golang.org/x/net/context"
+        grpc "google.golang.org/grpc"
+        math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+type Empty struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Empty) Reset()         { *m = Empty{} }
+func (m *Empty) String() string { return proto.CompactTextString(m) }
+func (*Empty) ProtoMessage()    {}
+func (*Empty) Descriptor() ([]byte, []int) {
+        return fileDescriptor_23c2c7e42feab570, []int{0}
+}
+
+func (m *Empty) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Empty.Unmarshal(m, b)
+}
+func (m *Empty) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Empty.Marshal(b, m, deterministic)
+}
+func (m *Empty) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Empty.Merge(m, src)
+}
+func (m *Empty) XXX_Size() int {
+        return xxx_messageInfo_Empty.Size(m)
+}
+func (m *Empty) XXX_DiscardUnknown() {
+        xxx_messageInfo_Empty.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Empty proto.InternalMessageInfo
+
+func init() {
+        proto.RegisterType((*Empty)(nil), "plugin.Empty")
+}
+
+func init() { proto.RegisterFile("grpc_controller.proto", fileDescriptor_23c2c7e42feab570) }
+
+var fileDescriptor_23c2c7e42feab570 = []byte{
+        // 108 bytes of a gzipped FileDescriptorProto
+        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4d, 0x2f, 0x2a, 0x48,
+        0x8e, 0x4f, 0xce, 0xcf, 0x2b, 0x29, 0xca, 0xcf, 0xc9, 0x49, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f,
+        0xc9, 0x17, 0x62, 0x2b, 0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x62, 0xe7, 0x62, 0x75, 0xcd, 0x2d,
+        0x28, 0xa9, 0x34, 0xb2, 0xe2, 0xe2, 0x73, 0x0f, 0x0a, 0x70, 0x76, 0x86, 0x2b, 0x14, 0xd2, 0xe0,
+        0xe2, 0x08, 0xce, 0x28, 0x2d, 0x49, 0xc9, 0x2f, 0xcf, 0x13, 0xe2, 0xd5, 0x83, 0xa8, 0xd7, 0x03,
+        0x2b, 0x96, 0x42, 0xe5, 0x3a, 0x71, 0x44, 0x41, 0x8d, 0x4b, 0x62, 0x03, 0x9b, 0x6e, 0x0c, 0x08,
+        0x00, 0x00, 0xff, 0xff, 0xab, 0x7c, 0x27, 0xe5, 0x76, 0x00, 0x00, 0x00,
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// GRPCControllerClient is the client API for GRPCController service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type GRPCControllerClient interface {
+        Shutdown(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error)
+}
+
+type gRPCControllerClient struct {
+        cc *grpc.ClientConn
+}
+
+func NewGRPCControllerClient(cc *grpc.ClientConn) GRPCControllerClient {
+        return &gRPCControllerClient{cc}
+}
+
+func (c *gRPCControllerClient) Shutdown(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
+        out := new(Empty)
+        err := c.cc.Invoke(ctx, "/plugin.GRPCController/Shutdown", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// GRPCControllerServer is the server API for GRPCController service.
+type GRPCControllerServer interface {
+        Shutdown(context.Context, *Empty) (*Empty, error)
+}
+
+func RegisterGRPCControllerServer(s *grpc.Server, srv GRPCControllerServer) {
+        s.RegisterService(&_GRPCController_serviceDesc, srv)
+}
+
+func _GRPCController_Shutdown_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Empty)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(GRPCControllerServer).Shutdown(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/plugin.GRPCController/Shutdown",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(GRPCControllerServer).Shutdown(ctx, req.(*Empty))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+var _GRPCController_serviceDesc = grpc.ServiceDesc{
+        ServiceName: "plugin.GRPCController",
+        HandlerType: (*GRPCControllerServer)(nil),
+        Methods: []grpc.MethodDesc{
+                {
+                        MethodName: "Shutdown",
+                        Handler:    _GRPCController_Shutdown_Handler,
+                },
+        },
+        Streams:  []grpc.StreamDesc{},
+        Metadata: "grpc_controller.proto",
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto
new file mode 100644
index 0000000..345d0a1
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto
@@ -0,0 +1,11 @@
+syntax = "proto3";
+package plugin;
+option go_package = "plugin";
+
+message Empty {
+}
+
+// The GRPCController is responsible for telling the plugin server to shutdown.
+service GRPCController {
+    rpc Shutdown(Empty) returns (Empty);
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/log_entry.go b/vendor/github.com/hashicorp/go-plugin/log_entry.go
index 2996c14..fb2ef93 100644
--- a/vendor/github.com/hashicorp/go-plugin/log_entry.go
+++ b/vendor/github.com/hashicorp/go-plugin/log_entry.go
@@ -32,11 +32,11 @@ func flattenKVPairs(kvs []*logEntryKV) []interface{} {
 }
 
 // parseJSON handles parsing JSON output
-func parseJSON(input string) (*logEntry, error) {
+func parseJSON(input []byte) (*logEntry, error) {
         var raw map[string]interface{}
         entry := &logEntry{}
 
-        err := json.Unmarshal([]byte(input), &raw)
+        err := json.Unmarshal(input, &raw)
         if err != nil {
                 return nil, err
         }
diff --git a/vendor/github.com/hashicorp/go-plugin/mtls.go b/vendor/github.com/hashicorp/go-plugin/mtls.go
new file mode 100644
index 0000000..8895524
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/mtls.go
@@ -0,0 +1,73 @@
+package plugin
+
+import (
+        "bytes"
+        "crypto/ecdsa"
+        "crypto/elliptic"
+        "crypto/rand"
+        "crypto/x509"
+        "crypto/x509/pkix"
+        "encoding/pem"
+        "math/big"
+        "time"
+)
+
+// generateCert generates a temporary certificate for plugin authentication. The
+// certificate and private key are returns in PEM format.
+func generateCert() (cert []byte, privateKey []byte, err error) {
+        key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+        sn, err := rand.Int(rand.Reader, serialNumberLimit)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        host := "localhost"
+
+        template := &x509.Certificate{
+                Subject: pkix.Name{
+                        CommonName:   host,
+                        Organization: []string{"HashiCorp"},
+                },
+                DNSNames: []string{host},
+                ExtKeyUsage: []x509.ExtKeyUsage{
+                        x509.ExtKeyUsageClientAuth,
+                        x509.ExtKeyUsageServerAuth,
+                },
+                KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageKeyAgreement | x509.KeyUsageCertSign,
+                BasicConstraintsValid: true,
+                SerialNumber:          sn,
+                NotBefore:             time.Now().Add(-30 * time.Second),
+                NotAfter:              time.Now().Add(262980 * time.Hour),
+                IsCA:                  true,
+        }
+
+        der, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        var certOut bytes.Buffer
+        if err := pem.Encode(&certOut, &pem.Block{Type: "CERTIFICATE", Bytes: der}); err != nil {
+                return nil, nil, err
+        }
+
+        keyBytes, err := x509.MarshalECPrivateKey(key)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        var keyOut bytes.Buffer
+        if err := pem.Encode(&keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyBytes}); err != nil {
+                return nil, nil, err
+        }
+
+        cert = certOut.Bytes()
+        privateKey = keyOut.Bytes()
+
+        return cert, privateKey, nil
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/server.go b/vendor/github.com/hashicorp/go-plugin/server.go
index 1e808b9..fc9f05a 100644
--- a/vendor/github.com/hashicorp/go-plugin/server.go
+++ b/vendor/github.com/hashicorp/go-plugin/server.go
@@ -2,6 +2,7 @@ package plugin
 
 import (
         "crypto/tls"
+        "crypto/x509"
         "encoding/base64"
         "errors"
         "fmt"
@@ -11,7 +12,9 @@ import (
         "os"
         "os/signal"
         "runtime"
+        "sort"
         "strconv"
+        "strings"
         "sync/atomic"
 
         "github.com/hashicorp/go-hclog"
@@ -36,6 +39,8 @@ type HandshakeConfig struct {
         // ProtocolVersion is the version that clients must match on to
         // agree they can communicate. This should match the ProtocolVersion
         // set on ClientConfig when using a plugin.
+        // This field is not required if VersionedPlugins are being used in the
+        // Client or Server configurations.
         ProtocolVersion uint
 
         // MagicCookieKey and value are used as a very basic verification
@@ -46,6 +51,10 @@ type HandshakeConfig struct {
         MagicCookieValue string
 }
 
+// PluginSet is a set of plugins provided to be registered in the plugin
+// server.
+type PluginSet map[string]Plugin
+
 // ServeConfig configures what sorts of plugins are served.
 type ServeConfig struct {
         // HandshakeConfig is the configuration that must match clients.
@@ -55,7 +64,13 @@ type ServeConfig struct {
         TLSProvider func() (*tls.Config, error)
 
         // Plugins are the plugins that are served.
-        Plugins map[string]Plugin
+        // The implied version of this PluginSet is the Handshake.ProtocolVersion.
+        Plugins PluginSet
+
+        // VersionedPlugins is a map of PluginSets for specific protocol versions.
+        // These can be used to negotiate a compatible version between client and
+        // server. If this is set, Handshake.ProtocolVersion is not required.
+        VersionedPlugins map[int]PluginSet
 
         // GRPCServer should be non-nil to enable serving the plugins over
         // gRPC. This is a function to create the server when needed with the
@@ -72,14 +87,83 @@ type ServeConfig struct {
         Logger hclog.Logger
 }
 
-// Protocol returns the protocol that this server should speak.
-func (c *ServeConfig) Protocol() Protocol {
-        result := ProtocolNetRPC
-        if c.GRPCServer != nil {
-                result = ProtocolGRPC
+// protocolVersion determines the protocol version and plugin set to be used by
+// the server. In the event that there is no suitable version, the last version
+// in the config is returned leaving the client to report the incompatibility.
+func protocolVersion(opts *ServeConfig) (int, Protocol, PluginSet) {
+        protoVersion := int(opts.ProtocolVersion)
+        pluginSet := opts.Plugins
+        protoType := ProtocolNetRPC
+        // Check if the client sent a list of acceptable versions
+        var clientVersions []int
+        if vs := os.Getenv("PLUGIN_PROTOCOL_VERSIONS"); vs != "" {
+                for _, s := range strings.Split(vs, ",") {
+                        v, err := strconv.Atoi(s)
+                        if err != nil {
+                                fmt.Fprintf(os.Stderr, "server sent invalid plugin version %q", s)
+                                continue
+                        }
+                        clientVersions = append(clientVersions, v)
+                }
+        }
+
+        // We want to iterate in reverse order, to ensure we match the newest
+        // compatible plugin version.
+        sort.Sort(sort.Reverse(sort.IntSlice(clientVersions)))
+
+        // set the old un-versioned fields as if they were versioned plugins
+        if opts.VersionedPlugins == nil {
+                opts.VersionedPlugins = make(map[int]PluginSet)
+        }
+
+        if pluginSet != nil {
+                opts.VersionedPlugins[protoVersion] = pluginSet
         }
 
-        return result
+        // Sort the version to make sure we match the latest first
+        var versions []int
+        for v := range opts.VersionedPlugins {
+                versions = append(versions, v)
+        }
+
+        sort.Sort(sort.Reverse(sort.IntSlice(versions)))
+
+        // See if we have multiple versions of Plugins to choose from
+        for _, version := range versions {
+                // Record each version, since we guarantee that this returns valid
+                // values even if they are not a protocol match.
+                protoVersion = version
+                pluginSet = opts.VersionedPlugins[version]
+
+                // If we have a configured gRPC server we should select a protocol
+                if opts.GRPCServer != nil {
+                        // All plugins in a set must use the same transport, so check the first
+                        // for the protocol type
+                        for _, p := range pluginSet {
+                                switch p.(type) {
+                                case GRPCPlugin:
+                                        protoType = ProtocolGRPC
+                                default:
+                                        protoType = ProtocolNetRPC
+                                }
+                                break
+                        }
+                }
+
+                for _, clientVersion := range clientVersions {
+                        if clientVersion == protoVersion {
+                                return protoVersion, protoType, pluginSet
+                        }
+                }
+        }
+
+        // Return the lowest version as the fallback.
+        // Since we iterated over all the versions in reverse order above, these
+        // values are from the lowest version number plugins (which may be from
+        // a combination of the Handshake.ProtocolVersion and ServeConfig.Plugins
+        // fields). This allows serving the oldest version of our plugins to a
+        // legacy client that did not send a PLUGIN_PROTOCOL_VERSIONS list.
+        return protoVersion, protoType, pluginSet
 }
 
 // Serve serves the plugins given by ServeConfig.
@@ -107,6 +191,10 @@ func Serve(opts *ServeConfig) {
                 os.Exit(1)
         }
 
+        // negotiate the version and plugins
+        // start with default version in the handshake config
+        protoVersion, protoType, pluginSet := protocolVersion(opts)
+
         // Logging goes to the original stderr
         log.SetOutput(os.Stderr)
 
@@ -155,12 +243,47 @@ func Serve(opts *ServeConfig) {
                 }
         }
 
+        var serverCert string
+        clientCert := os.Getenv("PLUGIN_CLIENT_CERT")
+        // If the client is configured using AutoMTLS, the certificate will be here,
+        // and we need to generate our own in response.
+        if tlsConfig == nil && clientCert != "" {
+                logger.Info("configuring server automatic mTLS")
+                clientCertPool := x509.NewCertPool()
+                if !clientCertPool.AppendCertsFromPEM([]byte(clientCert)) {
+                        logger.Error("client cert provided but failed to parse", "cert", clientCert)
+                }
+
+                certPEM, keyPEM, err := generateCert()
+                if err != nil {
+                        logger.Error("failed to generate client certificate", "error", err)
+                        panic(err)
+                }
+
+                cert, err := tls.X509KeyPair(certPEM, keyPEM)
+                if err != nil {
+                        logger.Error("failed to parse client certificate", "error", err)
+                        panic(err)
+                }
+
+                tlsConfig = &tls.Config{
+                        Certificates: []tls.Certificate{cert},
+                        ClientAuth:   tls.RequireAndVerifyClientCert,
+                        ClientCAs:    clientCertPool,
+                        MinVersion:   tls.VersionTLS12,
+                }
+
+                // We send back the raw leaf cert data for the client rather than the
+                // PEM, since the protocol can't handle newlines.
+                serverCert = base64.RawStdEncoding.EncodeToString(cert.Certificate[0])
+        }
+
         // Create the channel to tell us when we're done
         doneCh := make(chan struct{})
 
         // Build the server type
         var server ServerProtocol
-        switch opts.Protocol() {
+        switch protoType {
         case ProtocolNetRPC:
                 // If we have a TLS configuration then we wrap the listener
                 // ourselves and do it at that level.
@@ -170,7 +293,7 @@ func Serve(opts *ServeConfig) {
 
                 // Create the RPC server to dispense
                 server = &RPCServer{
-                        Plugins: opts.Plugins,
+                        Plugins: pluginSet,
                         Stdout:  stdout_r,
                         Stderr:  stderr_r,
                         DoneCh:  doneCh,
@@ -179,16 +302,17 @@ func Serve(opts *ServeConfig) {
         case ProtocolGRPC:
                 // Create the gRPC server
                 server = &GRPCServer{
-                        Plugins: opts.Plugins,
+                        Plugins: pluginSet,
                         Server:  opts.GRPCServer,
                         TLS:     tlsConfig,
                         Stdout:  stdout_r,
                         Stderr:  stderr_r,
                         DoneCh:  doneCh,
+                        logger:  logger,
                 }
 
         default:
-                panic("unknown server protocol: " + opts.Protocol())
+                panic("unknown server protocol: " + protoType)
         }
 
         // Initialize the servers
@@ -197,25 +321,16 @@ func Serve(opts *ServeConfig) {
                 return
         }
 
-        // Build the extra configuration
-        extra := ""
-        if v := server.Config(); v != "" {
-                extra = base64.StdEncoding.EncodeToString([]byte(v))
-        }
-        if extra != "" {
-                extra = "|" + extra
-        }
-
         logger.Debug("plugin address", "network", listener.Addr().Network(), "address", listener.Addr().String())
 
-        // Output the address and service name to stdout so that core can bring it up.
-        fmt.Printf("%d|%d|%s|%s|%s%s\n",
+        // Output the address and service name to stdout so that the client can bring it up.
+        fmt.Printf("%d|%d|%s|%s|%s|%s\n",
                 CoreProtocolVersion,
-                opts.ProtocolVersion,
+                protoVersion,
                 listener.Addr().Network(),
                 listener.Addr().String(),
-                opts.Protocol(),
-                extra)
+                protoType,
+                serverCert)
         os.Stdout.Sync()
 
         // Eat the interrupts
diff --git a/vendor/github.com/hashicorp/go-plugin/testing.go b/vendor/github.com/hashicorp/go-plugin/testing.go
index df29593..2cf2c26 100644
--- a/vendor/github.com/hashicorp/go-plugin/testing.go
+++ b/vendor/github.com/hashicorp/go-plugin/testing.go
@@ -3,13 +3,28 @@ package plugin
 import (
         "bytes"
         "context"
+        "io"
         "net"
         "net/rpc"
 
         "github.com/mitchellh/go-testing-interface"
+        hclog "github.com/hashicorp/go-hclog"
+        "github.com/hashicorp/go-plugin/internal/plugin"
         "google.golang.org/grpc"
 )
 
+// TestOptions allows specifying options that can affect the behavior of the
+// test functions
+type TestOptions struct {
+        //ServerStdout causes the given value to be used in place of a blank buffer
+        //for RPCServer's Stdout
+        ServerStdout io.ReadCloser
+
+        //ServerStderr causes the given value to be used in place of a blank buffer
+        //for RPCServer's Stderr
+        ServerStderr io.ReadCloser
+}
+
 // The testing file contains test helpers that you can use outside of
 // this package for making it easier to test plugins themselves.
 
@@ -61,12 +76,20 @@ func TestRPCConn(t testing.T) (*rpc.Client, *rpc.Server) {
 
 // TestPluginRPCConn returns a plugin RPC client and server that are connected
 // together and configured.
-func TestPluginRPCConn(t testing.T, ps map[string]Plugin) (*RPCClient, *RPCServer) {
+func TestPluginRPCConn(t testing.T, ps map[string]Plugin, opts *TestOptions) (*RPCClient, *RPCServer) {
         // Create two net.Conns we can use to shuttle our control connection
         clientConn, serverConn := TestConn(t)
 
         // Start up the server
         server := &RPCServer{Plugins: ps, Stdout: new(bytes.Buffer), Stderr: new(bytes.Buffer)}
+        if opts != nil {
+                if opts.ServerStdout != nil {
+                        server.Stdout = opts.ServerStdout
+                }
+                if opts.ServerStderr != nil {
+                        server.Stderr = opts.ServerStderr
+                }
+        }
         go server.ServeConn(serverConn)
 
         // Connect the client to the server
@@ -119,9 +142,11 @@ func TestPluginGRPCConn(t testing.T, ps map[string]Plugin) (*GRPCClient, *GRPCSe
         // Start up the server
         server := &GRPCServer{
                 Plugins: ps,
+                DoneCh:  make(chan struct{}),
                 Server:  DefaultGRPCServer,
                 Stdout:  new(bytes.Buffer),
                 Stderr:  new(bytes.Buffer),
+                logger:  hclog.Default(),
         }
         if err := server.Init(); err != nil {
                 t.Fatalf("err: %s", err)
@@ -144,10 +169,11 @@ func TestPluginGRPCConn(t testing.T, ps map[string]Plugin) (*GRPCClient, *GRPCSe
 
         // Create the client
         client := &GRPCClient{
-                Conn:    conn,
-                Plugins: ps,
-                broker:  broker,
-                doneCtx: context.Background(),
+                Conn:       conn,
+                Plugins:    ps,
+                broker:     broker,
+                doneCtx:    context.Background(),
+                controller: plugin.NewGRPCControllerClient(conn),
         }
 
         return client, server
diff --git a/vendor/github.com/hashicorp/go-safetemp/go.mod b/vendor/github.com/hashicorp/go-safetemp/go.mod
new file mode 100644
index 0000000..02bc5f5
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-safetemp/go.mod
@@ -0,0 +1 @@
+module github.com/hashicorp/go-safetemp
diff --git a/vendor/github.com/hashicorp/go-uuid/uuid.go b/vendor/github.com/hashicorp/go-uuid/uuid.go
index ff9364c..911227f 100644
--- a/vendor/github.com/hashicorp/go-uuid/uuid.go
+++ b/vendor/github.com/hashicorp/go-uuid/uuid.go
@@ -15,9 +15,11 @@ func GenerateRandomBytes(size int) ([]byte, error) {
         return buf, nil
 }
 
+const uuidLen = 16
+
 // GenerateUUID is used to generate a random UUID
 func GenerateUUID() (string, error) {
-        buf, err := GenerateRandomBytes(16)
+        buf, err := GenerateRandomBytes(uuidLen)
         if err != nil {
                 return "", err
         }
@@ -25,11 +27,11 @@ func GenerateUUID() (string, error) {
 }
 
 func FormatUUID(buf []byte) (string, error) {
-        if len(buf) != 16 {
-                return "", fmt.Errorf("wrong length byte slice (%d)", len(buf))
+        if buflen := len(buf); buflen != uuidLen {
+                return "", fmt.Errorf("wrong length byte slice (%d)", buflen)
         }
 
-        return fmt.Sprintf("%08x-%04x-%04x-%04x-%12x",
+        return fmt.Sprintf("%x-%x-%x-%x-%x",
                 buf[0:4],
                 buf[4:6],
                 buf[6:8],
@@ -38,16 +40,14 @@ func FormatUUID(buf []byte) (string, error) {
 }
 
 func ParseUUID(uuid string) ([]byte, error) {
-        if len(uuid) != 36 {
+        if len(uuid) != 2 * uuidLen + 4 {
                 return nil, fmt.Errorf("uuid string is wrong length")
         }
 
-        hyph := []byte("-")
-
-        if uuid[8] != hyph[0] ||
-                uuid[13] != hyph[0] ||
-                uuid[18] != hyph[0] ||
-                uuid[23] != hyph[0] {
+        if uuid[8] != '-' ||
+                uuid[13] != '-' ||
+                uuid[18] != '-' ||
+                uuid[23] != '-' {
                 return nil, fmt.Errorf("uuid is improperly formatted")
         }
 
@@ -57,7 +57,7 @@ func ParseUUID(uuid string) ([]byte, error) {
         if err != nil {
                 return nil, err
         }
-        if len(ret) != 16 {
+        if len(ret) != uuidLen {
                 return nil, fmt.Errorf("decoded hex is the wrong length")
         }
 
diff --git a/vendor/github.com/hashicorp/go-version/version.go b/vendor/github.com/hashicorp/go-version/version.go
index 4d1e6e2..186fd7c 100644
--- a/vendor/github.com/hashicorp/go-version/version.go
+++ b/vendor/github.com/hashicorp/go-version/version.go
@@ -10,14 +10,25 @@ import (
 )
 
 // The compiled regular expression used to test the validity of a version.
-var versionRegexp *regexp.Regexp
+var (
+        versionRegexp *regexp.Regexp
+        semverRegexp  *regexp.Regexp
+)
 
 // The raw regular expression string used for testing the validity
 // of a version.
-const VersionRegexpRaw string = `v?([0-9]+(\.[0-9]+)*?)` +
-        `(-([0-9]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)|(-?([A-Za-z\-~]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)))?` +
-        `(\+([0-9A-Za-z\-~]+(\.[0-9A-Za-z\-~]+)*))?` +
-        `?`
+const (
+        VersionRegexpRaw string = `v?([0-9]+(\.[0-9]+)*?)` +
+                `(-([0-9]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)|(-?([A-Za-z\-~]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)))?` +
+                `(\+([0-9A-Za-z\-~]+(\.[0-9A-Za-z\-~]+)*))?` +
+                `?`
+
+        // SemverRegexpRaw requires a separator between version and prerelease
+        SemverRegexpRaw string = `v?([0-9]+(\.[0-9]+)*?)` +
+                `(-([0-9]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)|(-([A-Za-z\-~]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)))?` +
+                `(\+([0-9A-Za-z\-~]+(\.[0-9A-Za-z\-~]+)*))?` +
+                `?`
+)
 
 // Version represents a single version.
 type Version struct {
@@ -30,12 +41,24 @@ type Version struct {
 
 func init() {
         versionRegexp = regexp.MustCompile("^" + VersionRegexpRaw + "$")
+        semverRegexp = regexp.MustCompile("^" + SemverRegexpRaw + "$")
 }
 
 // NewVersion parses the given version and returns a new
 // Version.
 func NewVersion(v string) (*Version, error) {
-        matches := versionRegexp.FindStringSubmatch(v)
+        return newVersion(v, versionRegexp)
+}
+
+// NewSemver parses the given version and returns a new
+// Version that adheres strictly to SemVer specs
+// https://semver.org/
+func NewSemver(v string) (*Version, error) {
+        return newVersion(v, semverRegexp)
+}
+
+func newVersion(v string, pattern *regexp.Regexp) (*Version, error) {
+        matches := pattern.FindStringSubmatch(v)
         if matches == nil {
                 return nil, fmt.Errorf("Malformed version: %s", v)
         }
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/README.md b/vendor/github.com/hashicorp/hcl2/ext/dynblock/README.md
new file mode 100644
index 0000000..2b24fdb
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/README.md
@@ -0,0 +1,184 @@
+# HCL Dynamic Blocks Extension
+
+This HCL extension implements a special block type named "dynamic" that can
+be used to dynamically generate blocks of other types by iterating over
+collection values.
+
+Normally the block structure in an HCL configuration file is rigid, even
+though dynamic expressions can be used within attribute values. This is
+convenient for most applications since it allows the overall structure of
+the document to be decoded easily, but in some applications it is desirable
+to allow dynamic block generation within certain portions of the configuration.
+
+Dynamic block generation is performed using the `dynamic` block type:
+
+```hcl
+toplevel {
+  nested {
+    foo = "static block 1"
+  }
+
+  dynamic "nested" {
+    for_each = ["a", "b", "c"]
+    iterator = nested
+    content {
+      foo = "dynamic block ${nested.value}"
+    }
+  }
+
+  nested {
+    foo = "static block 2"
+  }
+}
+```
+
+The above is interpreted as if it were written as follows:
+
+```hcl
+toplevel {
+  nested {
+    foo = "static block 1"
+  }
+
+  nested {
+    foo = "dynamic block a"
+  }
+
+  nested {
+    foo = "dynamic block b"
+  }
+
+  nested {
+    foo = "dynamic block c"
+  }
+
+  nested {
+    foo = "static block 2"
+  }
+}
+```
+
+Since HCL block syntax is not normally exposed to the possibility of unknown
+values, this extension must make some compromises when asked to iterate over
+an unknown collection. If the length of the collection cannot be statically
+recognized (because it is an unknown value of list, map, or set type) then
+the `dynamic` construct will generate a _single_ dynamic block whose iterator
+key and value are both unknown values of the dynamic pseudo-type, thus causing
+any attribute values derived from iteration to appear as unknown values. There
+is no explicit representation of the fact that the length of the collection may
+eventually be different than one.
+
+## Usage
+
+Pass a body to function `Expand` to obtain a new body that will, on access
+to its content, evaluate and expand any nested `dynamic` blocks.
+Dynamic block processing is also automatically propagated into any nested
+blocks that are returned, allowing users to nest dynamic blocks inside
+one another and to nest dynamic blocks inside other static blocks.
+
+HCL structural decoding does not normally have access to an `EvalContext`, so
+any variables and functions that should be available to the `for_each`
+and `labels` expressions must be passed in when calling `Expand`. Expressions
+within the `content` block are evaluated separately and so can be passed a
+separate `EvalContext` if desired, during normal attribute expression
+evaluation.
+
+## Detecting Variables
+
+Some applications dynamically generate an `EvalContext` by analyzing which
+variables are referenced by an expression before evaluating it.
+
+This unfortunately requires some extra effort when this analysis is required
+for the context passed to `Expand`: the HCL API requires a schema to be
+provided in order to do any analysis of the blocks in a body, but the low-level
+schema model provides a description of only one level of nested blocks at
+a time, and thus a new schema must be provided for each additional level of
+nesting.
+
+To make this arduous process as convenient as possbile, this package provides
+a helper function `WalkForEachVariables`, which returns a `WalkVariablesNode`
+instance that can be used to find variables directly in a given body and also
+determine which nested blocks require recursive calls. Using this mechanism
+requires that the caller be able to look up a schema given a nested block type.
+For _simple_ formats where a specific block type name always has the same schema
+regardless of context, a walk can be implemented as follows:
+
+```go
+func walkVariables(node dynblock.WalkVariablesNode, schema *hcl.BodySchema) []hcl.Traversal {
+        vars, children := node.Visit(schema)
+
+        for _, child := range children {
+                var childSchema *hcl.BodySchema
+                switch child.BlockTypeName {
+                case "a":
+                        childSchema = &hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type:       "b",
+                                                LabelNames: []string{"key"},
+                                        },
+                                },
+                        }
+                case "b":
+                        childSchema = &hcl.BodySchema{
+                                Attributes: []hcl.AttributeSchema{
+                                        {
+                                                Name:     "val",
+                                                Required: true,
+                                        },
+                                },
+                        }
+                default:
+                        // Should never happen, because the above cases should be exhaustive
+                        // for the application's configuration format.
+                        panic(fmt.Errorf("can't find schema for unknown block type %q", child.BlockTypeName))
+                }
+
+                vars = append(vars, testWalkAndAccumVars(child.Node, childSchema)...)
+        }
+}
+```
+
+### Detecting Variables with `hcldec` Specifications
+
+For applications that use the higher-level `hcldec` package to decode nested
+configuration structures into `cty` values, the same specification can be used
+to automatically drive the recursive variable-detection walk described above.
+
+The helper function `ForEachVariablesHCLDec` allows an entire recursive
+configuration structure to be analyzed in a single call given a `hcldec.Spec`
+that describes the nested block structure. This means a `hcldec`-based
+application can support dynamic blocks with only a little additional effort:
+
+```go
+func decodeBody(body hcl.Body, spec hcldec.Spec) (cty.Value, hcl.Diagnostics) {
+        // Determine which variables are needed to expand dynamic blocks
+        neededForDynamic := dynblock.ForEachVariablesHCLDec(body, spec)
+
+        // Build a suitable EvalContext and expand dynamic blocks
+        dynCtx := buildEvalContext(neededForDynamic)
+        dynBody := dynblock.Expand(body, dynCtx)
+
+        // Determine which variables are needed to fully decode the expanded body
+        // This will analyze expressions that came both from static blocks in the
+        // original body and from blocks that were dynamically added by Expand.
+        neededForDecode := hcldec.Variables(dynBody, spec)
+
+        // Build a suitable EvalContext and then fully decode the body as per the
+        // hcldec specification.
+        decCtx := buildEvalContext(neededForDecode)
+        return hcldec.Decode(dynBody, spec, decCtx)
+}
+
+func buildEvalContext(needed []hcl.Traversal) *hcl.EvalContext {
+        // (to be implemented by your application)
+}
+```
+
+# Performance
+
+This extension is going quite harshly against the grain of the HCL API, and
+so it uses lots of wrapping objects and temporary data structures to get its
+work done. HCL in general is not suitable for use in high-performance situations
+or situations sensitive to memory pressure, but that is _especially_ true for
+this extension.
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_body.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_body.go
new file mode 100644
index 0000000..dd30822
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_body.go
@@ -0,0 +1,262 @@
+package dynblock
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// expandBody wraps another hcl.Body and expands any "dynamic" blocks found
+// inside whenever Content or PartialContent is called.
+type expandBody struct {
+        original   hcl.Body
+        forEachCtx *hcl.EvalContext
+        iteration  *iteration // non-nil if we're nested inside another "dynamic" block
+
+        // These are used with PartialContent to produce a "remaining items"
+        // body to return. They are nil on all bodies fresh out of the transformer.
+        //
+        // Note that this is re-implemented here rather than delegating to the
+        // existing support required by the underlying body because we need to
+        // retain access to the entire original body on subsequent decode operations
+        // so we can retain any "dynamic" blocks for types we didn't take consume
+        // on the first pass.
+        hiddenAttrs  map[string]struct{}
+        hiddenBlocks map[string]hcl.BlockHeaderSchema
+}
+
+func (b *expandBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        extSchema := b.extendSchema(schema)
+        rawContent, diags := b.original.Content(extSchema)
+
+        blocks, blockDiags := b.expandBlocks(schema, rawContent.Blocks, false)
+        diags = append(diags, blockDiags...)
+        attrs := b.prepareAttributes(rawContent.Attributes)
+
+        content := &hcl.BodyContent{
+                Attributes:       attrs,
+                Blocks:           blocks,
+                MissingItemRange: b.original.MissingItemRange(),
+        }
+
+        return content, diags
+}
+
+func (b *expandBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        extSchema := b.extendSchema(schema)
+        rawContent, _, diags := b.original.PartialContent(extSchema)
+        // We discard the "remain" argument above because we're going to construct
+        // our own remain that also takes into account remaining "dynamic" blocks.
+
+        blocks, blockDiags := b.expandBlocks(schema, rawContent.Blocks, true)
+        diags = append(diags, blockDiags...)
+        attrs := b.prepareAttributes(rawContent.Attributes)
+
+        content := &hcl.BodyContent{
+                Attributes:       attrs,
+                Blocks:           blocks,
+                MissingItemRange: b.original.MissingItemRange(),
+        }
+
+        remain := &expandBody{
+                original:     b.original,
+                forEachCtx:   b.forEachCtx,
+                iteration:    b.iteration,
+                hiddenAttrs:  make(map[string]struct{}),
+                hiddenBlocks: make(map[string]hcl.BlockHeaderSchema),
+        }
+        for name := range b.hiddenAttrs {
+                remain.hiddenAttrs[name] = struct{}{}
+        }
+        for typeName, blockS := range b.hiddenBlocks {
+                remain.hiddenBlocks[typeName] = blockS
+        }
+        for _, attrS := range schema.Attributes {
+                remain.hiddenAttrs[attrS.Name] = struct{}{}
+        }
+        for _, blockS := range schema.Blocks {
+                remain.hiddenBlocks[blockS.Type] = blockS
+        }
+
+        return content, remain, diags
+}
+
+func (b *expandBody) extendSchema(schema *hcl.BodySchema) *hcl.BodySchema {
+        // We augment the requested schema to also include our special "dynamic"
+        // block type, since then we'll get instances of it interleaved with
+        // all of the literal child blocks we must also include.
+        extSchema := &hcl.BodySchema{
+                Attributes: schema.Attributes,
+                Blocks:     make([]hcl.BlockHeaderSchema, len(schema.Blocks), len(schema.Blocks)+len(b.hiddenBlocks)+1),
+        }
+        copy(extSchema.Blocks, schema.Blocks)
+        extSchema.Blocks = append(extSchema.Blocks, dynamicBlockHeaderSchema)
+
+        // If we have any hiddenBlocks then we also need to register those here
+        // so that a call to "Content" on the underlying body won't fail.
+        // (We'll filter these out again once we process the result of either
+        // Content or PartialContent.)
+        for _, blockS := range b.hiddenBlocks {
+                extSchema.Blocks = append(extSchema.Blocks, blockS)
+        }
+
+        // If we have any hiddenAttrs then we also need to register these, for
+        // the same reason as we deal with hiddenBlocks above.
+        if len(b.hiddenAttrs) != 0 {
+                newAttrs := make([]hcl.AttributeSchema, len(schema.Attributes), len(schema.Attributes)+len(b.hiddenAttrs))
+                copy(newAttrs, extSchema.Attributes)
+                for name := range b.hiddenAttrs {
+                        newAttrs = append(newAttrs, hcl.AttributeSchema{
+                                Name:     name,
+                                Required: false,
+                        })
+                }
+                extSchema.Attributes = newAttrs
+        }
+
+        return extSchema
+}
+
+func (b *expandBody) prepareAttributes(rawAttrs hcl.Attributes) hcl.Attributes {
+        if len(b.hiddenAttrs) == 0 && b.iteration == nil {
+                // Easy path: just pass through the attrs from the original body verbatim
+                return rawAttrs
+        }
+
+        // Otherwise we have some work to do: we must filter out any attributes
+        // that are hidden (since a previous PartialContent call already saw these)
+        // and wrap the expressions of the inner attributes so that they will
+        // have access to our iteration variables.
+        attrs := make(hcl.Attributes, len(rawAttrs))
+        for name, rawAttr := range rawAttrs {
+                if _, hidden := b.hiddenAttrs[name]; hidden {
+                        continue
+                }
+                if b.iteration != nil {
+                        attr := *rawAttr // shallow copy so we can mutate it
+                        attr.Expr = exprWrap{
+                                Expression: attr.Expr,
+                                i:          b.iteration,
+                        }
+                        attrs[name] = &attr
+                } else {
+                        // If we have no active iteration then no wrapping is required.
+                        attrs[name] = rawAttr
+                }
+        }
+        return attrs
+}
+
+func (b *expandBody) expandBlocks(schema *hcl.BodySchema, rawBlocks hcl.Blocks, partial bool) (hcl.Blocks, hcl.Diagnostics) {
+        var blocks hcl.Blocks
+        var diags hcl.Diagnostics
+
+        for _, rawBlock := range rawBlocks {
+                switch rawBlock.Type {
+                case "dynamic":
+                        realBlockType := rawBlock.Labels[0]
+                        if _, hidden := b.hiddenBlocks[realBlockType]; hidden {
+                                continue
+                        }
+
+                        var blockS *hcl.BlockHeaderSchema
+                        for _, candidate := range schema.Blocks {
+                                if candidate.Type == realBlockType {
+                                        blockS = &candidate
+                                        break
+                                }
+                        }
+                        if blockS == nil {
+                                // Not a block type that the caller requested.
+                                if !partial {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Unsupported block type",
+                                                Detail:   fmt.Sprintf("Blocks of type %q are not expected here.", realBlockType),
+                                                Subject:  &rawBlock.LabelRanges[0],
+                                        })
+                                }
+                                continue
+                        }
+
+                        spec, specDiags := b.decodeSpec(blockS, rawBlock)
+                        diags = append(diags, specDiags...)
+                        if specDiags.HasErrors() {
+                                continue
+                        }
+
+                        if spec.forEachVal.IsKnown() {
+                                for it := spec.forEachVal.ElementIterator(); it.Next(); {
+                                        key, value := it.Element()
+                                        i := b.iteration.MakeChild(spec.iteratorName, key, value)
+
+                                        block, blockDiags := spec.newBlock(i, b.forEachCtx)
+                                        diags = append(diags, blockDiags...)
+                                        if block != nil {
+                                                // Attach our new iteration context so that attributes
+                                                // and other nested blocks can refer to our iterator.
+                                                block.Body = b.expandChild(block.Body, i)
+                                                blocks = append(blocks, block)
+                                        }
+                                }
+                        } else {
+                                // If our top-level iteration value isn't known then we're forced
+                                // to compromise since HCL doesn't have any concept of an
+                                // "unknown block". In this case then, we'll produce a single
+                                // dynamic block with the iterator values set to DynamicVal,
+                                // which at least makes the potential for a block visible
+                                // in our result, even though it's not represented in a fully-accurate
+                                // way.
+                                i := b.iteration.MakeChild(spec.iteratorName, cty.DynamicVal, cty.DynamicVal)
+                                block, blockDiags := spec.newBlock(i, b.forEachCtx)
+                                diags = append(diags, blockDiags...)
+                                if block != nil {
+                                        block.Body = b.expandChild(block.Body, i)
+
+                                        // We additionally force all of the leaf attribute values
+                                        // in the result to be unknown so the calling application
+                                        // can, if necessary, use that as a heuristic to detect
+                                        // when a single nested block might be standing in for
+                                        // multiple blocks yet to be expanded. This retains the
+                                        // structure of the generated body but forces all of its
+                                        // leaf attribute values to be unknown.
+                                        block.Body = unknownBody{block.Body}
+
+                                        blocks = append(blocks, block)
+                                }
+                        }
+
+                default:
+                        if _, hidden := b.hiddenBlocks[rawBlock.Type]; !hidden {
+                                // A static block doesn't create a new iteration context, but
+                                // it does need to inherit _our own_ iteration context in
+                                // case it contains expressions that refer to our inherited
+                                // iterators, or nested "dynamic" blocks.
+                                expandedBlock := *rawBlock // shallow copy
+                                expandedBlock.Body = b.expandChild(rawBlock.Body, b.iteration)
+                                blocks = append(blocks, &expandedBlock)
+                        }
+                }
+        }
+
+        return blocks, diags
+}
+
+func (b *expandBody) expandChild(child hcl.Body, i *iteration) hcl.Body {
+        chiCtx := i.EvalContext(b.forEachCtx)
+        ret := Expand(child, chiCtx)
+        ret.(*expandBody).iteration = i
+        return ret
+}
+
+func (b *expandBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        // blocks aren't allowed in JustAttributes mode and this body can
+        // only produce blocks, so we'll just pass straight through to our
+        // underlying body here.
+        return b.original.JustAttributes()
+}
+
+func (b *expandBody) MissingItemRange() hcl.Range {
+        return b.original.MissingItemRange()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_spec.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_spec.go
new file mode 100644
index 0000000..41c0be2
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_spec.go
@@ -0,0 +1,215 @@
+package dynblock
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+type expandSpec struct {
+        blockType      string
+        blockTypeRange hcl.Range
+        defRange       hcl.Range
+        forEachVal     cty.Value
+        iteratorName   string
+        labelExprs     []hcl.Expression
+        contentBody    hcl.Body
+        inherited      map[string]*iteration
+}
+
+func (b *expandBody) decodeSpec(blockS *hcl.BlockHeaderSchema, rawSpec *hcl.Block) (*expandSpec, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        var schema *hcl.BodySchema
+        if len(blockS.LabelNames) != 0 {
+                schema = dynamicBlockBodySchemaLabels
+        } else {
+                schema = dynamicBlockBodySchemaNoLabels
+        }
+
+        specContent, specDiags := rawSpec.Body.Content(schema)
+        diags = append(diags, specDiags...)
+        if specDiags.HasErrors() {
+                return nil, diags
+        }
+
+        //// for_each attribute
+
+        eachAttr := specContent.Attributes["for_each"]
+        eachVal, eachDiags := eachAttr.Expr.Value(b.forEachCtx)
+        diags = append(diags, eachDiags...)
+
+        if !eachVal.CanIterateElements() && eachVal.Type() != cty.DynamicPseudoType {
+                // We skip this error for DynamicPseudoType because that means we either
+                // have a null (which is checked immediately below) or an unknown
+                // (which is handled in the expandBody Content methods).
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid dynamic for_each value",
+                        Detail:      fmt.Sprintf("Cannot use a %s value in for_each. An iterable collection is required.", eachVal.Type().FriendlyName()),
+                        Subject:     eachAttr.Expr.Range().Ptr(),
+                        Expression:  eachAttr.Expr,
+                        EvalContext: b.forEachCtx,
+                })
+                return nil, diags
+        }
+        if eachVal.IsNull() {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid dynamic for_each value",
+                        Detail:      "Cannot use a null value in for_each.",
+                        Subject:     eachAttr.Expr.Range().Ptr(),
+                        Expression:  eachAttr.Expr,
+                        EvalContext: b.forEachCtx,
+                })
+                return nil, diags
+        }
+
+        //// iterator attribute
+
+        iteratorName := blockS.Type
+        if iteratorAttr := specContent.Attributes["iterator"]; iteratorAttr != nil {
+                itTraversal, itDiags := hcl.AbsTraversalForExpr(iteratorAttr.Expr)
+                diags = append(diags, itDiags...)
+                if itDiags.HasErrors() {
+                        return nil, diags
+                }
+
+                if len(itTraversal) != 1 {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid dynamic iterator name",
+                                Detail:   "Dynamic iterator must be a single variable name.",
+                                Subject:  itTraversal.SourceRange().Ptr(),
+                        })
+                        return nil, diags
+                }
+
+                iteratorName = itTraversal.RootName()
+        }
+
+        var labelExprs []hcl.Expression
+        if labelsAttr := specContent.Attributes["labels"]; labelsAttr != nil {
+                var labelDiags hcl.Diagnostics
+                labelExprs, labelDiags = hcl.ExprList(labelsAttr.Expr)
+                diags = append(diags, labelDiags...)
+                if labelDiags.HasErrors() {
+                        return nil, diags
+                }
+
+                if len(labelExprs) > len(blockS.LabelNames) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Extraneous dynamic block label",
+                                Detail:   fmt.Sprintf("Blocks of type %q require %d label(s).", blockS.Type, len(blockS.LabelNames)),
+                                Subject:  labelExprs[len(blockS.LabelNames)].Range().Ptr(),
+                        })
+                        return nil, diags
+                } else if len(labelExprs) < len(blockS.LabelNames) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Insufficient dynamic block labels",
+                                Detail:   fmt.Sprintf("Blocks of type %q require %d label(s).", blockS.Type, len(blockS.LabelNames)),
+                                Subject:  labelsAttr.Expr.Range().Ptr(),
+                        })
+                        return nil, diags
+                }
+        }
+
+        // Since our schema requests only blocks of type "content", we can assume
+        // that all entries in specContent.Blocks are content blocks.
+        if len(specContent.Blocks) == 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Missing dynamic content block",
+                        Detail:   "A dynamic block must have a nested block of type \"content\" to describe the body of each generated block.",
+                        Subject:  &specContent.MissingItemRange,
+                })
+                return nil, diags
+        }
+        if len(specContent.Blocks) > 1 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Extraneous dynamic content block",
+                        Detail:   "Only one nested content block is allowed for each dynamic block.",
+                        Subject:  &specContent.Blocks[1].DefRange,
+                })
+                return nil, diags
+        }
+
+        return &expandSpec{
+                blockType:      blockS.Type,
+                blockTypeRange: rawSpec.LabelRanges[0],
+                defRange:       rawSpec.DefRange,
+                forEachVal:     eachVal,
+                iteratorName:   iteratorName,
+                labelExprs:     labelExprs,
+                contentBody:    specContent.Blocks[0].Body,
+        }, diags
+}
+
+func (s *expandSpec) newBlock(i *iteration, ctx *hcl.EvalContext) (*hcl.Block, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        var labels []string
+        var labelRanges []hcl.Range
+        lCtx := i.EvalContext(ctx)
+        for _, labelExpr := range s.labelExprs {
+                labelVal, labelDiags := labelExpr.Value(lCtx)
+                diags = append(diags, labelDiags...)
+                if labelDiags.HasErrors() {
+                        return nil, diags
+                }
+
+                var convErr error
+                labelVal, convErr = convert.Convert(labelVal, cty.String)
+                if convErr != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid dynamic block label",
+                                Detail:      fmt.Sprintf("Cannot use this value as a dynamic block label: %s.", convErr),
+                                Subject:     labelExpr.Range().Ptr(),
+                                Expression:  labelExpr,
+                                EvalContext: lCtx,
+                        })
+                        return nil, diags
+                }
+                if labelVal.IsNull() {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid dynamic block label",
+                                Detail:      "Cannot use a null value as a dynamic block label.",
+                                Subject:     labelExpr.Range().Ptr(),
+                                Expression:  labelExpr,
+                                EvalContext: lCtx,
+                        })
+                        return nil, diags
+                }
+                if !labelVal.IsKnown() {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid dynamic block label",
+                                Detail:      "This value is not yet known. Dynamic block labels must be immediately-known values.",
+                                Subject:     labelExpr.Range().Ptr(),
+                                Expression:  labelExpr,
+                                EvalContext: lCtx,
+                        })
+                        return nil, diags
+                }
+
+                labels = append(labels, labelVal.AsString())
+                labelRanges = append(labelRanges, labelExpr.Range())
+        }
+
+        block := &hcl.Block{
+                Type:        s.blockType,
+                TypeRange:   s.blockTypeRange,
+                Labels:      labels,
+                LabelRanges: labelRanges,
+                DefRange:    s.defRange,
+                Body:        s.contentBody,
+        }
+
+        return block, diags
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/expr_wrap.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expr_wrap.go
new file mode 100644
index 0000000..6916fc1
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expr_wrap.go
@@ -0,0 +1,42 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type exprWrap struct {
+        hcl.Expression
+        i *iteration
+}
+
+func (e exprWrap) Variables() []hcl.Traversal {
+        raw := e.Expression.Variables()
+        ret := make([]hcl.Traversal, 0, len(raw))
+
+        // Filter out traversals that refer to our iterator name or any
+        // iterator we've inherited; we're going to provide those in
+        // our Value wrapper, so the caller doesn't need to know about them.
+        for _, traversal := range raw {
+                rootName := traversal.RootName()
+                if rootName == e.i.IteratorName {
+                        continue
+                }
+                if _, inherited := e.i.Inherited[rootName]; inherited {
+                        continue
+                }
+                ret = append(ret, traversal)
+        }
+        return ret
+}
+
+func (e exprWrap) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        extCtx := e.i.EvalContext(ctx)
+        return e.Expression.Value(extCtx)
+}
+
+// UnwrapExpression returns the expression being wrapped by this instance.
+// This allows the original expression to be recovered by hcl.UnwrapExpression.
+func (e exprWrap) UnwrapExpression() hcl.Expression {
+        return e.Expression
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/iteration.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/iteration.go
new file mode 100644
index 0000000..7056d33
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/iteration.go
@@ -0,0 +1,66 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type iteration struct {
+        IteratorName string
+        Key          cty.Value
+        Value        cty.Value
+        Inherited    map[string]*iteration
+}
+
+func (s *expandSpec) MakeIteration(key, value cty.Value) *iteration {
+        return &iteration{
+                IteratorName: s.iteratorName,
+                Key:          key,
+                Value:        value,
+                Inherited:    s.inherited,
+        }
+}
+
+func (i *iteration) Object() cty.Value {
+        return cty.ObjectVal(map[string]cty.Value{
+                "key":   i.Key,
+                "value": i.Value,
+        })
+}
+
+func (i *iteration) EvalContext(base *hcl.EvalContext) *hcl.EvalContext {
+        new := base.NewChild()
+
+        if i != nil {
+                new.Variables = map[string]cty.Value{}
+                for name, otherIt := range i.Inherited {
+                        new.Variables[name] = otherIt.Object()
+                }
+                new.Variables[i.IteratorName] = i.Object()
+        }
+
+        return new
+}
+
+func (i *iteration) MakeChild(iteratorName string, key, value cty.Value) *iteration {
+        if i == nil {
+                // Create entirely new root iteration, then
+                return &iteration{
+                        IteratorName: iteratorName,
+                        Key:          key,
+                        Value:        value,
+                }
+        }
+
+        inherited := map[string]*iteration{}
+        for name, otherIt := range i.Inherited {
+                inherited[name] = otherIt
+        }
+        inherited[i.IteratorName] = i
+        return &iteration{
+                IteratorName: iteratorName,
+                Key:          key,
+                Value:        value,
+                Inherited:    inherited,
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/public.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/public.go
new file mode 100644
index 0000000..b7e8ca9
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/public.go
@@ -0,0 +1,44 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Expand "dynamic" blocks in the given body, returning a new body that
+// has those blocks expanded.
+//
+// The given EvalContext is used when evaluating "for_each" and "labels"
+// attributes within dynamic blocks, allowing those expressions access to
+// variables and functions beyond the iterator variable created by the
+// iteration.
+//
+// Expand returns no diagnostics because no blocks are actually expanded
+// until a call to Content or PartialContent on the returned body, which
+// will then expand only the blocks selected by the schema.
+//
+// "dynamic" blocks are also expanded automatically within nested blocks
+// in the given body, including within other dynamic blocks, thus allowing
+// multi-dimensional iteration. However, it is not possible to
+// dynamically-generate the "dynamic" blocks themselves except through nesting.
+//
+//     parent {
+//       dynamic "child" {
+//         for_each = child_objs
+//         content {
+//           dynamic "grandchild" {
+//             for_each = child.value.children
+//             labels   = [grandchild.key]
+//             content {
+//               parent_key = child.key
+//               value      = grandchild.value
+//             }
+//           }
+//         }
+//       }
+//     }
+func Expand(body hcl.Body, ctx *hcl.EvalContext) hcl.Body {
+        return &expandBody{
+                original:   body,
+                forEachCtx: ctx,
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/schema.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/schema.go
new file mode 100644
index 0000000..dc8ed5a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/schema.go
@@ -0,0 +1,50 @@
+package dynblock
+
+import "github.com/hashicorp/hcl2/hcl"
+
+var dynamicBlockHeaderSchema = hcl.BlockHeaderSchema{
+        Type:       "dynamic",
+        LabelNames: []string{"type"},
+}
+
+var dynamicBlockBodySchemaLabels = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name:     "for_each",
+                        Required: true,
+                },
+                {
+                        Name:     "iterator",
+                        Required: false,
+                },
+                {
+                        Name:     "labels",
+                        Required: true,
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type:       "content",
+                        LabelNames: nil,
+                },
+        },
+}
+
+var dynamicBlockBodySchemaNoLabels = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name:     "for_each",
+                        Required: true,
+                },
+                {
+                        Name:     "iterator",
+                        Required: false,
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type:       "content",
+                        LabelNames: nil,
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/unknown_body.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/unknown_body.go
new file mode 100644
index 0000000..932f6a3
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/unknown_body.go
@@ -0,0 +1,84 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// unknownBody is a funny body that just reports everything inside it as
+// unknown. It uses a given other body as a sort of template for what attributes
+// and blocks are inside -- including source location information -- but
+// subsitutes unknown values of unknown type for all attributes.
+//
+// This rather odd process is used to handle expansion of dynamic blocks whose
+// for_each expression is unknown. Since a block cannot itself be unknown,
+// we instead arrange for everything _inside_ the block to be unknown instead,
+// to give the best possible approximation.
+type unknownBody struct {
+        template hcl.Body
+}
+
+var _ hcl.Body = unknownBody{}
+
+func (b unknownBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        content, diags := b.template.Content(schema)
+        content = b.fixupContent(content)
+
+        // We're intentionally preserving the diagnostics reported from the
+        // inner body so that we can still report where the template body doesn't
+        // match the requested schema.
+        return content, diags
+}
+
+func (b unknownBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        content, remain, diags := b.template.PartialContent(schema)
+        content = b.fixupContent(content)
+        remain = unknownBody{remain} // remaining content must also be wrapped
+
+        // We're intentionally preserving the diagnostics reported from the
+        // inner body so that we can still report where the template body doesn't
+        // match the requested schema.
+        return content, remain, diags
+}
+
+func (b unknownBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        attrs, diags := b.template.JustAttributes()
+        attrs = b.fixupAttrs(attrs)
+
+        // We're intentionally preserving the diagnostics reported from the
+        // inner body so that we can still report where the template body doesn't
+        // match the requested schema.
+        return attrs, diags
+}
+
+func (b unknownBody) MissingItemRange() hcl.Range {
+        return b.template.MissingItemRange()
+}
+
+func (b unknownBody) fixupContent(got *hcl.BodyContent) *hcl.BodyContent {
+        ret := &hcl.BodyContent{}
+        ret.Attributes = b.fixupAttrs(got.Attributes)
+        if len(got.Blocks) > 0 {
+                ret.Blocks = make(hcl.Blocks, 0, len(got.Blocks))
+                for _, gotBlock := range got.Blocks {
+                        new := *gotBlock                      // shallow copy
+                        new.Body = unknownBody{gotBlock.Body} // nested content must also be marked unknown
+                        ret.Blocks = append(ret.Blocks, &new)
+                }
+        }
+
+        return ret
+}
+
+func (b unknownBody) fixupAttrs(got hcl.Attributes) hcl.Attributes {
+        if len(got) == 0 {
+                return nil
+        }
+        ret := make(hcl.Attributes, len(got))
+        for name, gotAttr := range got {
+                new := *gotAttr // shallow copy
+                new.Expr = hcl.StaticExpr(cty.DynamicVal, gotAttr.Expr.Range())
+                ret[name] = &new
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables.go
new file mode 100644
index 0000000..ad838f3
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables.go
@@ -0,0 +1,209 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// WalkVariables begins the recursive process of walking all expressions and
+// nested blocks in the given body and its child bodies while taking into
+// account any "dynamic" blocks.
+//
+// This function requires that the caller walk through the nested block
+// structure in the given body level-by-level so that an appropriate schema
+// can be provided at each level to inform further processing. This workflow
+// is thus easiest to use for calling applications that have some higher-level
+// schema representation available with which to drive this multi-step
+// process. If your application uses the hcldec package, you may be able to
+// use VariablesHCLDec instead for a more automatic approach.
+func WalkVariables(body hcl.Body) WalkVariablesNode {
+        return WalkVariablesNode{
+                body:           body,
+                includeContent: true,
+        }
+}
+
+// WalkExpandVariables is like Variables but it includes only the variables
+// required for successful block expansion, ignoring any variables referenced
+// inside block contents. The result is the minimal set of all variables
+// required for a call to Expand, excluding variables that would only be
+// needed to subsequently call Content or PartialContent on the expanded
+// body.
+func WalkExpandVariables(body hcl.Body) WalkVariablesNode {
+        return WalkVariablesNode{
+                body: body,
+        }
+}
+
+type WalkVariablesNode struct {
+        body hcl.Body
+        it   *iteration
+
+        includeContent bool
+}
+
+type WalkVariablesChild struct {
+        BlockTypeName string
+        Node          WalkVariablesNode
+}
+
+// Body returns the HCL Body associated with the child node, in case the caller
+// wants to do some sort of inspection of it in order to decide what schema
+// to pass to Visit.
+//
+// Most implementations should just fetch a fixed schema based on the
+// BlockTypeName field and not access this. Deciding on a schema dynamically
+// based on the body is a strange thing to do and generally necessary only if
+// your caller is already doing other bizarre things with HCL bodies.
+func (c WalkVariablesChild) Body() hcl.Body {
+        return c.Node.body
+}
+
+// Visit returns the variable traversals required for any "dynamic" blocks
+// directly in the body associated with this node, and also returns any child
+// nodes that must be visited in order to continue the walk.
+//
+// Each child node has its associated block type name given in its BlockTypeName
+// field, which the calling application should use to determine the appropriate
+// schema for the content of each child node and pass it to the child node's
+// own Visit method to continue the walk recursively.
+func (n WalkVariablesNode) Visit(schema *hcl.BodySchema) (vars []hcl.Traversal, children []WalkVariablesChild) {
+        extSchema := n.extendSchema(schema)
+        container, _, _ := n.body.PartialContent(extSchema)
+        if container == nil {
+                return vars, children
+        }
+
+        children = make([]WalkVariablesChild, 0, len(container.Blocks))
+
+        if n.includeContent {
+                for _, attr := range container.Attributes {
+                        for _, traversal := range attr.Expr.Variables() {
+                                var ours, inherited bool
+                                if n.it != nil {
+                                        ours = traversal.RootName() == n.it.IteratorName
+                                        _, inherited = n.it.Inherited[traversal.RootName()]
+                                }
+
+                                if !(ours || inherited) {
+                                        vars = append(vars, traversal)
+                                }
+                        }
+                }
+        }
+
+        for _, block := range container.Blocks {
+                switch block.Type {
+
+                case "dynamic":
+                        blockTypeName := block.Labels[0]
+                        inner, _, _ := block.Body.PartialContent(variableDetectionInnerSchema)
+                        if inner == nil {
+                                continue
+                        }
+
+                        iteratorName := blockTypeName
+                        if attr, exists := inner.Attributes["iterator"]; exists {
+                                iterTraversal, _ := hcl.AbsTraversalForExpr(attr.Expr)
+                                if len(iterTraversal) == 0 {
+                                        // Ignore this invalid dynamic block, since it'll produce
+                                        // an error if someone tries to extract content from it
+                                        // later anyway.
+                                        continue
+                                }
+                                iteratorName = iterTraversal.RootName()
+                        }
+                        blockIt := n.it.MakeChild(iteratorName, cty.DynamicVal, cty.DynamicVal)
+
+                        if attr, exists := inner.Attributes["for_each"]; exists {
+                                // Filter out iterator names inherited from parent blocks
+                                for _, traversal := range attr.Expr.Variables() {
+                                        if _, inherited := blockIt.Inherited[traversal.RootName()]; !inherited {
+                                                vars = append(vars, traversal)
+                                        }
+                                }
+                        }
+                        if attr, exists := inner.Attributes["labels"]; exists {
+                                // Filter out both our own iterator name _and_ those inherited
+                                // from parent blocks, since we provide _both_ of these to the
+                                // label expressions.
+                                for _, traversal := range attr.Expr.Variables() {
+                                        ours := traversal.RootName() == iteratorName
+                                        _, inherited := blockIt.Inherited[traversal.RootName()]
+
+                                        if !(ours || inherited) {
+                                                vars = append(vars, traversal)
+                                        }
+                                }
+                        }
+
+                        for _, contentBlock := range inner.Blocks {
+                                // We only request "content" blocks in our schema, so we know
+                                // any blocks we find here will be content blocks. We require
+                                // exactly one content block for actual expansion, but we'll
+                                // be more liberal here so that callers can still collect
+                                // variables from erroneous "dynamic" blocks.
+                                children = append(children, WalkVariablesChild{
+                                        BlockTypeName: blockTypeName,
+                                        Node: WalkVariablesNode{
+                                                body:           contentBlock.Body,
+                                                it:             blockIt,
+                                                includeContent: n.includeContent,
+                                        },
+                                })
+                        }
+
+                default:
+                        children = append(children, WalkVariablesChild{
+                                BlockTypeName: block.Type,
+                                Node: WalkVariablesNode{
+                                        body:           block.Body,
+                                        it:             n.it,
+                                        includeContent: n.includeContent,
+                                },
+                        })
+
+                }
+        }
+
+        return vars, children
+}
+
+func (n WalkVariablesNode) extendSchema(schema *hcl.BodySchema) *hcl.BodySchema {
+        // We augment the requested schema to also include our special "dynamic"
+        // block type, since then we'll get instances of it interleaved with
+        // all of the literal child blocks we must also include.
+        extSchema := &hcl.BodySchema{
+                Attributes: schema.Attributes,
+                Blocks:     make([]hcl.BlockHeaderSchema, len(schema.Blocks), len(schema.Blocks)+1),
+        }
+        copy(extSchema.Blocks, schema.Blocks)
+        extSchema.Blocks = append(extSchema.Blocks, dynamicBlockHeaderSchema)
+
+        return extSchema
+}
+
+// This is a more relaxed schema than what's in schema.go, since we
+// want to maximize the amount of variables we can find even if there
+// are erroneous blocks.
+var variableDetectionInnerSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name:     "for_each",
+                        Required: false,
+                },
+                {
+                        Name:     "labels",
+                        Required: false,
+                },
+                {
+                        Name:     "iterator",
+                        Required: false,
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "content",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables_hcldec.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables_hcldec.go
new file mode 100644
index 0000000..a078d91
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables_hcldec.go
@@ -0,0 +1,43 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+)
+
+// VariablesHCLDec is a wrapper around WalkVariables that uses the given hcldec
+// specification to automatically drive the recursive walk through nested
+// blocks in the given body.
+//
+// This is a drop-in replacement for hcldec.Variables which is able to treat
+// blocks of type "dynamic" in the same special way that dynblock.Expand would,
+// exposing both the variables referenced in the "for_each" and "labels"
+// arguments and variables used in the nested "content" block.
+func VariablesHCLDec(body hcl.Body, spec hcldec.Spec) []hcl.Traversal {
+        rootNode := WalkVariables(body)
+        return walkVariablesWithHCLDec(rootNode, spec)
+}
+
+// ExpandVariablesHCLDec is like VariablesHCLDec but it includes only the
+// minimal set of variables required to call Expand, ignoring variables that
+// are referenced only inside normal block contents. See WalkExpandVariables
+// for more information.
+func ExpandVariablesHCLDec(body hcl.Body, spec hcldec.Spec) []hcl.Traversal {
+        rootNode := WalkExpandVariables(body)
+        return walkVariablesWithHCLDec(rootNode, spec)
+}
+
+func walkVariablesWithHCLDec(node WalkVariablesNode, spec hcldec.Spec) []hcl.Traversal {
+        vars, children := node.Visit(hcldec.ImpliedSchema(spec))
+
+        if len(children) > 0 {
+                childSpecs := hcldec.ChildBlockTypes(spec)
+                for _, child := range children {
+                        if childSpec, exists := childSpecs[child.BlockTypeName]; exists {
+                                vars = append(vars, walkVariablesWithHCLDec(child.Node, childSpec)...)
+                        }
+                }
+        }
+
+        return vars
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/typeexpr/README.md b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/README.md
new file mode 100644
index 0000000..ff2b3f2
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/README.md
@@ -0,0 +1,67 @@
+# HCL Type Expressions Extension
+
+This HCL extension defines a convention for describing HCL types using function
+call and variable reference syntax, allowing configuration formats to include
+type information provided by users.
+
+The type syntax is processed statically from a hcl.Expression, so it cannot
+use any of the usual language operators. This is similar to type expressions
+in statically-typed programming languages.
+
+```hcl
+variable "example" {
+  type = list(string)
+}
+```
+
+The extension is built using the `hcl.ExprAsKeyword` and `hcl.ExprCall`
+functions, and so it relies on the underlying syntax to define how "keyword"
+and "call" are interpreted. The above shows how they are interpreted in
+the HCL native syntax, while the following shows the same information
+expressed in JSON:
+
+```json
+{
+  "variable": {
+    "example": {
+      "type": "list(string)"
+    }
+  }
+}
+```
+
+Notice that since we have additional contextual information that we intend
+to allow only calls and keywords the JSON syntax is able to parse the given
+string directly as an expression, rather than as a template as would be
+the case for normal expression evaluation.
+
+For more information, see [the godoc reference](http://godoc.org/github.com/hashicorp/hcl2/ext/typeexpr).
+
+## Type Expression Syntax
+
+When expressed in the native syntax, the following expressions are permitted
+in a type expression:
+
+* `string` - string
+* `bool` - boolean
+* `number` - number
+* `any` - `cty.DynamicPseudoType` (in function `TypeConstraint` only)
+* `list(<type_expr>)` - list of the type given as an argument
+* `set(<type_expr>)` - set of the type given as an argument
+* `map(<type_expr>)` - map of the type given as an argument
+* `tuple([<type_exprs...>])` - tuple with the element types given in the single list argument
+* `object({<attr_name>=<type_expr>, ...}` - object with the attributes and corresponding types given in the single map argument
+
+For example:
+
+* `list(string)`
+* `object({name=string,age=number})`
+* `map(object({name=string,age=number}))`
+
+Note that the object constructor syntax is not fully-general for all possible
+object types because it requires the attribute names to be valid identifiers.
+In practice it is expected that any time an object type is being fixed for
+type checking it will be one that has identifiers as its attributes; object
+types with weird attributes generally show up only from arbitrary object
+constructors in configuration files, which are usually treated either as maps
+or as the dynamic pseudo-type.
diff --git a/vendor/github.com/hashicorp/hcl2/ext/typeexpr/doc.go b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/doc.go
new file mode 100644
index 0000000..c4b3795
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/doc.go
@@ -0,0 +1,11 @@
+// Package typeexpr extends HCL with a convention for describing HCL types
+// within configuration files.
+//
+// The type syntax is processed statically from a hcl.Expression, so it cannot
+// use any of the usual language operators. This is similar to type expressions
+// in statically-typed programming languages.
+//
+//     variable "example" {
+//       type = list(string)
+//     }
+package typeexpr
diff --git a/vendor/github.com/hashicorp/hcl2/ext/typeexpr/get_type.go b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/get_type.go
new file mode 100644
index 0000000..a84338a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/get_type.go
@@ -0,0 +1,196 @@
+package typeexpr
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+const invalidTypeSummary = "Invalid type specification"
+
+// getType is the internal implementation of both Type and TypeConstraint,
+// using the passed flag to distinguish. When constraint is false, the "any"
+// keyword will produce an error.
+func getType(expr hcl.Expression, constraint bool) (cty.Type, hcl.Diagnostics) {
+        // First we'll try for one of our keywords
+        kw := hcl.ExprAsKeyword(expr)
+        switch kw {
+        case "bool":
+                return cty.Bool, nil
+        case "string":
+                return cty.String, nil
+        case "number":
+                return cty.Number, nil
+        case "any":
+                if constraint {
+                        return cty.DynamicPseudoType, nil
+                }
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("The keyword %q cannot be used in this type specification: an exact type is required.", kw),
+                        Subject:  expr.Range().Ptr(),
+                }}
+        case "list", "map", "set":
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("The %s type constructor requires one argument specifying the element type.", kw),
+                        Subject:  expr.Range().Ptr(),
+                }}
+        case "object":
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   "The object type constructor requires one argument specifying the attribute types and values as a map.",
+                        Subject:  expr.Range().Ptr(),
+                }}
+        case "tuple":
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   "The tuple type constructor requires one argument specifying the element types as a list.",
+                        Subject:  expr.Range().Ptr(),
+                }}
+        case "":
+                // okay! we'll fall through and try processing as a call, then.
+        default:
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("The keyword %q is not a valid type specification.", kw),
+                        Subject:  expr.Range().Ptr(),
+                }}
+        }
+
+        // If we get down here then our expression isn't just a keyword, so we'll
+        // try to process it as a call instead.
+        call, diags := hcl.ExprCall(expr)
+        if diags.HasErrors() {
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   "A type specification is either a primitive type keyword (bool, number, string) or a complex type constructor call, like list(string).",
+                        Subject:  expr.Range().Ptr(),
+                }}
+        }
+
+        switch call.Name {
+        case "bool", "string", "number", "any":
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("Primitive type keyword %q does not expect arguments.", call.Name),
+                        Subject:  &call.ArgsRange,
+                }}
+        }
+
+        if len(call.Arguments) != 1 {
+                contextRange := call.ArgsRange
+                subjectRange := call.ArgsRange
+                if len(call.Arguments) > 1 {
+                        // If we have too many arguments (as opposed to too _few_) then
+                        // we'll highlight the extraneous arguments as the diagnostic
+                        // subject.
+                        subjectRange = hcl.RangeBetween(call.Arguments[1].Range(), call.Arguments[len(call.Arguments)-1].Range())
+                }
+
+                switch call.Name {
+                case "list", "set", "map":
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   fmt.Sprintf("The %s type constructor requires one argument specifying the element type.", call.Name),
+                                Subject:  &subjectRange,
+                                Context:  &contextRange,
+                        }}
+                case "object":
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   "The object type constructor requires one argument specifying the attribute types and values as a map.",
+                                Subject:  &subjectRange,
+                                Context:  &contextRange,
+                        }}
+                case "tuple":
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   "The tuple type constructor requires one argument specifying the element types as a list.",
+                                Subject:  &subjectRange,
+                                Context:  &contextRange,
+                        }}
+                }
+        }
+
+        switch call.Name {
+
+        case "list":
+                ety, diags := getType(call.Arguments[0], constraint)
+                return cty.List(ety), diags
+        case "set":
+                ety, diags := getType(call.Arguments[0], constraint)
+                return cty.Set(ety), diags
+        case "map":
+                ety, diags := getType(call.Arguments[0], constraint)
+                return cty.Map(ety), diags
+        case "object":
+                attrDefs, diags := hcl.ExprMap(call.Arguments[0])
+                if diags.HasErrors() {
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   "Object type constructor requires a map whose keys are attribute names and whose values are the corresponding attribute types.",
+                                Subject:  call.Arguments[0].Range().Ptr(),
+                                Context:  expr.Range().Ptr(),
+                        }}
+                }
+
+                atys := make(map[string]cty.Type)
+                for _, attrDef := range attrDefs {
+                        attrName := hcl.ExprAsKeyword(attrDef.Key)
+                        if attrName == "" {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  invalidTypeSummary,
+                                        Detail:   "Object constructor map keys must be attribute names.",
+                                        Subject:  attrDef.Key.Range().Ptr(),
+                                        Context:  expr.Range().Ptr(),
+                                })
+                                continue
+                        }
+                        aty, attrDiags := getType(attrDef.Value, constraint)
+                        diags = append(diags, attrDiags...)
+                        atys[attrName] = aty
+                }
+                return cty.Object(atys), diags
+        case "tuple":
+                elemDefs, diags := hcl.ExprList(call.Arguments[0])
+                if diags.HasErrors() {
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   "Tuple type constructor requires a list of element types.",
+                                Subject:  call.Arguments[0].Range().Ptr(),
+                                Context:  expr.Range().Ptr(),
+                        }}
+                }
+                etys := make([]cty.Type, len(elemDefs))
+                for i, defExpr := range elemDefs {
+                        ety, elemDiags := getType(defExpr, constraint)
+                        diags = append(diags, elemDiags...)
+                        etys[i] = ety
+                }
+                return cty.Tuple(etys), diags
+        default:
+                // Can't access call.Arguments in this path because we've not validated
+                // that it contains exactly one expression here.
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("Keyword %q is not a valid type constructor.", call.Name),
+                        Subject:  expr.Range().Ptr(),
+                }}
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/typeexpr/public.go b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/public.go
new file mode 100644
index 0000000..e3f5eef
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/public.go
@@ -0,0 +1,129 @@
+package typeexpr
+
+import (
+        "bytes"
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Type attempts to process the given expression as a type expression and, if
+// successful, returns the resulting type. If unsuccessful, error diagnostics
+// are returned.
+func Type(expr hcl.Expression) (cty.Type, hcl.Diagnostics) {
+        return getType(expr, false)
+}
+
+// TypeConstraint attempts to parse the given expression as a type constraint
+// and, if successful, returns the resulting type. If unsuccessful, error
+// diagnostics are returned.
+//
+// A type constraint has the same structure as a type, but it additionally
+// allows the keyword "any" to represent cty.DynamicPseudoType, which is often
+// used as a wildcard in type checking and type conversion operations.
+func TypeConstraint(expr hcl.Expression) (cty.Type, hcl.Diagnostics) {
+        return getType(expr, true)
+}
+
+// TypeString returns a string rendering of the given type as it would be
+// expected to appear in the HCL native syntax.
+//
+// This is primarily intended for showing types to the user in an application
+// that uses typexpr, where the user can be assumed to be familiar with the
+// type expression syntax. In applications that do not use typeexpr these
+// results may be confusing to the user and so type.FriendlyName may be
+// preferable, even though it's less precise.
+//
+// TypeString produces reasonable results only for types like what would be
+// produced by the Type and TypeConstraint functions. In particular, it cannot
+// support capsule types.
+func TypeString(ty cty.Type) string {
+        // Easy cases first
+        switch ty {
+        case cty.String:
+                return "string"
+        case cty.Bool:
+                return "bool"
+        case cty.Number:
+                return "number"
+        case cty.DynamicPseudoType:
+                return "any"
+        }
+
+        if ty.IsCapsuleType() {
+                panic("TypeString does not support capsule types")
+        }
+
+        if ty.IsCollectionType() {
+                ety := ty.ElementType()
+                etyString := TypeString(ety)
+                switch {
+                case ty.IsListType():
+                        return fmt.Sprintf("list(%s)", etyString)
+                case ty.IsSetType():
+                        return fmt.Sprintf("set(%s)", etyString)
+                case ty.IsMapType():
+                        return fmt.Sprintf("map(%s)", etyString)
+                default:
+                        // Should never happen because the above is exhaustive
+                        panic("unsupported collection type")
+                }
+        }
+
+        if ty.IsObjectType() {
+                var buf bytes.Buffer
+                buf.WriteString("object({")
+                atys := ty.AttributeTypes()
+                names := make([]string, 0, len(atys))
+                for name := range atys {
+                        names = append(names, name)
+                }
+                sort.Strings(names)
+                first := true
+                for _, name := range names {
+                        aty := atys[name]
+                        if !first {
+                                buf.WriteByte(',')
+                        }
+                        if !hclsyntax.ValidIdentifier(name) {
+                                // Should never happen for any type produced by this package,
+                                // but we'll do something reasonable here just so we don't
+                                // produce garbage if someone gives us a hand-assembled object
+                                // type that has weird attribute names.
+                                // Using Go-style quoting here isn't perfect, since it doesn't
+                                // exactly match HCL syntax, but it's fine for an edge-case.
+                                buf.WriteString(fmt.Sprintf("%q", name))
+                        } else {
+                                buf.WriteString(name)
+                        }
+                        buf.WriteByte('=')
+                        buf.WriteString(TypeString(aty))
+                        first = false
+                }
+                buf.WriteString("})")
+                return buf.String()
+        }
+
+        if ty.IsTupleType() {
+                var buf bytes.Buffer
+                buf.WriteString("tuple([")
+                etys := ty.TupleElementTypes()
+                first := true
+                for _, ety := range etys {
+                        if !first {
+                                buf.WriteByte(',')
+                        }
+                        buf.WriteString(TypeString(ety))
+                        first = false
+                }
+                buf.WriteString("])")
+                return buf.String()
+        }
+
+        // Should never happen because we covered all cases above.
+        panic(fmt.Errorf("unsupported type %#v", ty))
+}
diff --git a/vendor/github.com/hashicorp/hcl2/gohcl/doc.go b/vendor/github.com/hashicorp/hcl2/gohcl/doc.go
index 8500214..aa3c6ea 100644
--- a/vendor/github.com/hashicorp/hcl2/gohcl/doc.go
+++ b/vendor/github.com/hashicorp/hcl2/gohcl/doc.go
@@ -40,6 +40,10 @@
 // present then any attributes or blocks not matched by another valid tag
 // will cause an error diagnostic.
 //
+// Only a subset of this tagging/typing vocabulary is supported for the
+// "Encode" family of functions. See the EncodeIntoBody docs for full details
+// on the constraints there.
+//
 // Broadly-speaking this package deals with two types of error. The first is
 // errors in the configuration itself, which are returned as diagnostics
 // written with the configuration author as the target audience. The second
diff --git a/vendor/github.com/hashicorp/hcl2/gohcl/encode.go b/vendor/github.com/hashicorp/hcl2/gohcl/encode.go
new file mode 100644
index 0000000..3cbf7e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/gohcl/encode.go
@@ -0,0 +1,191 @@
+package gohcl
+
+import (
+        "fmt"
+        "reflect"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hclwrite"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// EncodeIntoBody replaces the contents of the given hclwrite Body with
+// attributes and blocks derived from the given value, which must be a
+// struct value or a pointer to a struct value with the struct tags defined
+// in this package.
+//
+// This function can work only with fully-decoded data. It will ignore any
+// fields tagged as "remain", any fields that decode attributes into either
+// hcl.Attribute or hcl.Expression values, and any fields that decode blocks
+// into hcl.Attributes values. This function does not have enough information
+// to complete the decoding of these types.
+//
+// Any fields tagged as "label" are ignored by this function. Use EncodeAsBlock
+// to produce a whole hclwrite.Block including block labels.
+//
+// As long as a suitable value is given to encode and the destination body
+// is non-nil, this function will always complete. It will panic in case of
+// any errors in the calling program, such as passing an inappropriate type
+// or a nil body.
+//
+// The layout of the resulting HCL source is derived from the ordering of
+// the struct fields, with blank lines around nested blocks of different types.
+// Fields representing attributes should usually precede those representing
+// blocks so that the attributes can group togather in the result. For more
+// control, use the hclwrite API directly.
+func EncodeIntoBody(val interface{}, dst *hclwrite.Body) {
+        rv := reflect.ValueOf(val)
+        ty := rv.Type()
+        if ty.Kind() == reflect.Ptr {
+                rv = rv.Elem()
+                ty = rv.Type()
+        }
+        if ty.Kind() != reflect.Struct {
+                panic(fmt.Sprintf("value is %s, not struct", ty.Kind()))
+        }
+
+        tags := getFieldTags(ty)
+        populateBody(rv, ty, tags, dst)
+}
+
+// EncodeAsBlock creates a new hclwrite.Block populated with the data from
+// the given value, which must be a struct or pointer to struct with the
+// struct tags defined in this package.
+//
+// If the given struct type has fields tagged with "label" tags then they
+// will be used in order to annotate the created block with labels.
+//
+// This function has the same constraints as EncodeIntoBody and will panic
+// if they are violated.
+func EncodeAsBlock(val interface{}, blockType string) *hclwrite.Block {
+        rv := reflect.ValueOf(val)
+        ty := rv.Type()
+        if ty.Kind() == reflect.Ptr {
+                rv = rv.Elem()
+                ty = rv.Type()
+        }
+        if ty.Kind() != reflect.Struct {
+                panic(fmt.Sprintf("value is %s, not struct", ty.Kind()))
+        }
+
+        tags := getFieldTags(ty)
+        labels := make([]string, len(tags.Labels))
+        for i, lf := range tags.Labels {
+                lv := rv.Field(lf.FieldIndex)
+                // We just stringify whatever we find. It should always be a string
+                // but if not then we'll still do something reasonable.
+                labels[i] = fmt.Sprintf("%s", lv.Interface())
+        }
+
+        block := hclwrite.NewBlock(blockType, labels)
+        populateBody(rv, ty, tags, block.Body())
+        return block
+}
+
+func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwrite.Body) {
+        nameIdxs := make(map[string]int, len(tags.Attributes)+len(tags.Blocks))
+        namesOrder := make([]string, 0, len(tags.Attributes)+len(tags.Blocks))
+        for n, i := range tags.Attributes {
+                nameIdxs[n] = i
+                namesOrder = append(namesOrder, n)
+        }
+        for n, i := range tags.Blocks {
+                nameIdxs[n] = i
+                namesOrder = append(namesOrder, n)
+        }
+        sort.SliceStable(namesOrder, func(i, j int) bool {
+                ni, nj := namesOrder[i], namesOrder[j]
+                return nameIdxs[ni] < nameIdxs[nj]
+        })
+
+        dst.Clear()
+
+        prevWasBlock := false
+        for _, name := range namesOrder {
+                fieldIdx := nameIdxs[name]
+                field := ty.Field(fieldIdx)
+                fieldTy := field.Type
+                fieldVal := rv.Field(fieldIdx)
+
+                if fieldTy.Kind() == reflect.Ptr {
+                        fieldTy = fieldTy.Elem()
+                        fieldVal = fieldVal.Elem()
+                }
+
+                if _, isAttr := tags.Attributes[name]; isAttr {
+
+                        if exprType.AssignableTo(fieldTy) || attrType.AssignableTo(fieldTy) {
+                                continue // ignore undecoded fields
+                        }
+                        if !fieldVal.IsValid() {
+                                continue // ignore (field value is nil pointer)
+                        }
+                        if fieldTy.Kind() == reflect.Ptr && fieldVal.IsNil() {
+                                continue // ignore
+                        }
+                        if prevWasBlock {
+                                dst.AppendNewline()
+                                prevWasBlock = false
+                        }
+
+                        valTy, err := gocty.ImpliedType(fieldVal.Interface())
+                        if err != nil {
+                                panic(fmt.Sprintf("cannot encode %T as HCL expression: %s", fieldVal.Interface(), err))
+                        }
+
+                        val, err := gocty.ToCtyValue(fieldVal.Interface(), valTy)
+                        if err != nil {
+                                // This should never happen, since we should always be able
+                                // to decode into the implied type.
+                                panic(fmt.Sprintf("failed to encode %T as %#v: %s", fieldVal.Interface(), valTy, err))
+                        }
+
+                        dst.SetAttributeValue(name, val)
+
+                } else { // must be a block, then
+                        elemTy := fieldTy
+                        isSeq := false
+                        if elemTy.Kind() == reflect.Slice || elemTy.Kind() == reflect.Array {
+                                isSeq = true
+                                elemTy = elemTy.Elem()
+                        }
+
+                        if bodyType.AssignableTo(elemTy) || attrsType.AssignableTo(elemTy) {
+                                continue // ignore undecoded fields
+                        }
+                        prevWasBlock = false
+
+                        if isSeq {
+                                l := fieldVal.Len()
+                                for i := 0; i < l; i++ {
+                                        elemVal := fieldVal.Index(i)
+                                        if !elemVal.IsValid() {
+                                                continue // ignore (elem value is nil pointer)
+                                        }
+                                        if elemTy.Kind() == reflect.Ptr && elemVal.IsNil() {
+                                                continue // ignore
+                                        }
+                                        block := EncodeAsBlock(elemVal.Interface(), name)
+                                        if !prevWasBlock {
+                                                dst.AppendNewline()
+                                                prevWasBlock = true
+                                        }
+                                        dst.AppendBlock(block)
+                                }
+                        } else {
+                                if !fieldVal.IsValid() {
+                                        continue // ignore (field value is nil pointer)
+                                }
+                                if elemTy.Kind() == reflect.Ptr && fieldVal.IsNil() {
+                                        continue // ignore
+                                }
+                                block := EncodeAsBlock(fieldVal.Interface(), name)
+                                if !prevWasBlock {
+                                        dst.AppendNewline()
+                                        prevWasBlock = true
+                                }
+                                dst.AppendBlock(block)
+                        }
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go
index 6ecf744..c320961 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go
@@ -26,14 +26,43 @@ const (
 type Diagnostic struct {
         Severity DiagnosticSeverity
 
-        // Summary and detail contain the English-language description of the
+        // Summary and Detail contain the English-language description of the
         // problem. Summary is a terse description of the general problem and
         // detail is a more elaborate, often-multi-sentence description of
         // the probem and what might be done to solve it.
         Summary string
         Detail  string
+
+        // Subject and Context are both source ranges relating to the diagnostic.
+        //
+        // Subject is a tight range referring to exactly the construct that
+        // is problematic, while Context is an optional broader range (which should
+        // fully contain Subject) that ought to be shown around Subject when
+        // generating isolated source-code snippets in diagnostic messages.
+        // If Context is nil, the Subject is also the Context.
+        //
+        // Some diagnostics have no source ranges at all. If Context is set then
+        // Subject should always also be set.
         Subject *Range
         Context *Range
+
+        // For diagnostics that occur when evaluating an expression, Expression
+        // may refer to that expression and EvalContext may point to the
+        // EvalContext that was active when evaluating it. This may allow for the
+        // inclusion of additional useful information when rendering a diagnostic
+        // message to the user.
+        //
+        // It is not always possible to select a single EvalContext for a
+        // diagnostic, and so in some cases this field may be nil even when an
+        // expression causes a problem.
+        //
+        // EvalContexts form a tree, so the given EvalContext may refer to a parent
+        // which in turn refers to another parent, etc. For a full picture of all
+        // of the active variables and functions the caller must walk up this
+        // chain, preferring definitions that are "closer" to the expression in
+        // case of colliding names.
+        Expression  Expression
+        EvalContext *EvalContext
 }
 
 // Diagnostics is a list of Diagnostic instances.
@@ -96,6 +125,17 @@ func (d Diagnostics) HasErrors() bool {
         return false
 }
 
+func (d Diagnostics) Errs() []error {
+        var errs []error
+        for _, diag := range d {
+                if diag.Severity == DiagError {
+                        errs = append(errs, diag)
+                }
+        }
+
+        return errs
+}
+
 // A DiagnosticWriter emits diagnostics somehow.
 type DiagnosticWriter interface {
         WriteDiagnostic(*Diagnostic) error
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go
index dfa473a..0b4a262 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go
@@ -2,11 +2,14 @@ package hcl
 
 import (
         "bufio"
+        "bytes"
         "errors"
         "fmt"
         "io"
+        "sort"
 
         wordwrap "github.com/mitchellh/go-wordwrap"
+        "github.com/zclconf/go-cty/cty"
 )
 
 type diagnosticTextWriter struct {
@@ -133,6 +136,62 @@ func (w *diagnosticTextWriter) WriteDiagnostic(diag *Diagnostic) error {
 
                         w.wr.Write([]byte{'\n'})
                 }
+
+                if diag.Expression != nil && diag.EvalContext != nil {
+                        // We will attempt to render the values for any variables
+                        // referenced in the given expression as additional context, for
+                        // situations where the same expression is evaluated multiple
+                        // times in different scopes.
+                        expr := diag.Expression
+                        ctx := diag.EvalContext
+
+                        vars := expr.Variables()
+                        stmts := make([]string, 0, len(vars))
+                        seen := make(map[string]struct{}, len(vars))
+                        for _, traversal := range vars {
+                                val, diags := traversal.TraverseAbs(ctx)
+                                if diags.HasErrors() {
+                                        // Skip anything that generates errors, since we probably
+                                        // already have the same error in our diagnostics set
+                                        // already.
+                                        continue
+                                }
+
+                                traversalStr := w.traversalStr(traversal)
+                                if _, exists := seen[traversalStr]; exists {
+                                        continue // don't show duplicates when the same variable is referenced multiple times
+                                }
+                                switch {
+                                case !val.IsKnown():
+                                        // Can't say anything about this yet, then.
+                                        continue
+                                case val.IsNull():
+                                        stmts = append(stmts, fmt.Sprintf("%s set to null", traversalStr))
+                                default:
+                                        stmts = append(stmts, fmt.Sprintf("%s as %s", traversalStr, w.valueStr(val)))
+                                }
+                                seen[traversalStr] = struct{}{}
+                        }
+
+                        sort.Strings(stmts) // FIXME: Should maybe use a traversal-aware sort that can sort numeric indexes properly?
+                        last := len(stmts) - 1
+
+                        for i, stmt := range stmts {
+                                switch i {
+                                case 0:
+                                        w.wr.Write([]byte{'w', 'i', 't', 'h', ' '})
+                                default:
+                                        w.wr.Write([]byte{' ', ' ', ' ', ' ', ' '})
+                                }
+                                w.wr.Write([]byte(stmt))
+                                switch i {
+                                case last:
+                                        w.wr.Write([]byte{'.', '\n', '\n'})
+                                default:
+                                        w.wr.Write([]byte{',', '\n'})
+                                }
+                        }
+                }
         }
 
         if diag.Detail != "" {
@@ -156,6 +215,90 @@ func (w *diagnosticTextWriter) WriteDiagnostics(diags Diagnostics) error {
         return nil
 }
 
+func (w *diagnosticTextWriter) traversalStr(traversal Traversal) string {
+        // This is a specialized subset of traversal rendering tailored to
+        // producing helpful contextual messages in diagnostics. It is not
+        // comprehensive nor intended to be used for other purposes.
+
+        var buf bytes.Buffer
+        for _, step := range traversal {
+                switch tStep := step.(type) {
+                case TraverseRoot:
+                        buf.WriteString(tStep.Name)
+                case TraverseAttr:
+                        buf.WriteByte('.')
+                        buf.WriteString(tStep.Name)
+                case TraverseIndex:
+                        buf.WriteByte('[')
+                        if keyTy := tStep.Key.Type(); keyTy.IsPrimitiveType() {
+                                buf.WriteString(w.valueStr(tStep.Key))
+                        } else {
+                                // We'll just use a placeholder for more complex values,
+                                // since otherwise our result could grow ridiculously long.
+                                buf.WriteString("...")
+                        }
+                        buf.WriteByte(']')
+                }
+        }
+        return buf.String()
+}
+
+func (w *diagnosticTextWriter) valueStr(val cty.Value) string {
+        // This is a specialized subset of value rendering tailored to producing
+        // helpful but concise messages in diagnostics. It is not comprehensive
+        // nor intended to be used for other purposes.
+
+        ty := val.Type()
+        switch {
+        case val.IsNull():
+                return "null"
+        case !val.IsKnown():
+                // Should never happen here because we should filter before we get
+                // in here, but we'll do something reasonable rather than panic.
+                return "(not yet known)"
+        case ty == cty.Bool:
+                if val.True() {
+                        return "true"
+                }
+                return "false"
+        case ty == cty.Number:
+                bf := val.AsBigFloat()
+                return bf.Text('g', 10)
+        case ty == cty.String:
+                // Go string syntax is not exactly the same as HCL native string syntax,
+                // but we'll accept the minor edge-cases where this is different here
+                // for now, just to get something reasonable here.
+                return fmt.Sprintf("%q", val.AsString())
+        case ty.IsCollectionType() || ty.IsTupleType():
+                l := val.LengthInt()
+                switch l {
+                case 0:
+                        return "empty " + ty.FriendlyName()
+                case 1:
+                        return ty.FriendlyName() + " with 1 element"
+                default:
+                        return fmt.Sprintf("%s with %d elements", ty.FriendlyName(), l)
+                }
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                l := len(atys)
+                switch l {
+                case 0:
+                        return "object with no attributes"
+                case 1:
+                        var name string
+                        for k := range atys {
+                                name = k
+                        }
+                        return fmt.Sprintf("object with 1 attribute %q", name)
+                default:
+                        return fmt.Sprintf("object with %d attributes", l)
+                }
+        default:
+                return ty.FriendlyName()
+        }
+}
+
 func contextString(file *File, offset int) string {
         type contextStringer interface {
                 ContextString(offset int) string
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/diagnostics.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/diagnostics.go
new file mode 100644
index 0000000..94eaf58
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/diagnostics.go
@@ -0,0 +1,23 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// setDiagEvalContext is an internal helper that will impose a particular
+// EvalContext on a set of diagnostics in-place, for any diagnostic that
+// does not already have an EvalContext set.
+//
+// We generally expect diagnostics to be immutable, but this is safe to use
+// on any Diagnostics where none of the contained Diagnostic objects have yet
+// been seen by a caller. Its purpose is to apply additional context to a
+// set of diagnostics produced by a "deeper" component as the stack unwinds
+// during expression evaluation.
+func setDiagEvalContext(diags hcl.Diagnostics, expr hcl.Expression, ctx *hcl.EvalContext) {
+        for _, diag := range diags {
+                if diag.Expression == nil {
+                        diag.Expression = expr
+                        diag.EvalContext = ctx
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go
index cfc7cd9..26819a2 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go
@@ -2,6 +2,7 @@ package hclsyntax
 
 import (
         "fmt"
+        "sync"
 
         "github.com/hashicorp/hcl2/hcl"
         "github.com/zclconf/go-cty/cty"
@@ -104,7 +105,9 @@ func (e *ScopeTraversalExpr) walkChildNodes(w internalWalkFunc) {
 }
 
 func (e *ScopeTraversalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
-        return e.Traversal.TraverseAbs(ctx)
+        val, diags := e.Traversal.TraverseAbs(ctx)
+        setDiagEvalContext(diags, e, ctx)
+        return val, diags
 }
 
 func (e *ScopeTraversalExpr) Range() hcl.Range {
@@ -129,12 +132,13 @@ type RelativeTraversalExpr struct {
 }
 
 func (e *RelativeTraversalExpr) walkChildNodes(w internalWalkFunc) {
-        // Scope traversals have no child nodes
+        w(e.Source)
 }
 
 func (e *RelativeTraversalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         src, diags := e.Source.Value(ctx)
         ret, travDiags := e.Traversal.TraverseRel(src)
+        setDiagEvalContext(travDiags, e, ctx)
         diags = append(diags, travDiags...)
         return ret, diags
 }
@@ -177,8 +181,8 @@ type FunctionCallExpr struct {
 }
 
 func (e *FunctionCallExpr) walkChildNodes(w internalWalkFunc) {
-        for i, arg := range e.Args {
-                e.Args[i] = w(arg).(Expression)
+        for _, arg := range e.Args {
+                w(arg)
         }
 }
 
@@ -206,10 +210,12 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                 if !hasNonNilMap {
                         return cty.DynamicVal, hcl.Diagnostics{
                                 {
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Function calls not allowed",
-                                        Detail:   "Functions may not be called here.",
-                                        Subject:  e.Range().Ptr(),
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Function calls not allowed",
+                                        Detail:      "Functions may not be called here.",
+                                        Subject:     e.Range().Ptr(),
+                                        Expression:  e,
+                                        EvalContext: ctx,
                                 },
                         }
                 }
@@ -225,11 +231,13 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
 
                 return cty.DynamicVal, hcl.Diagnostics{
                         {
-                                Severity: hcl.DiagError,
-                                Summary:  "Call to unknown function",
-                                Detail:   fmt.Sprintf("There is no function named %q.%s", e.Name, suggestion),
-                                Subject:  &e.NameRange,
-                                Context:  e.Range().Ptr(),
+                                Severity:    hcl.DiagError,
+                                Summary:     "Call to unknown function",
+                                Detail:      fmt.Sprintf("There is no function named %q.%s", e.Name, suggestion),
+                                Subject:     &e.NameRange,
+                                Context:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         },
                 }
         }
@@ -254,11 +262,13 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                 case expandVal.Type().IsTupleType() || expandVal.Type().IsListType() || expandVal.Type().IsSetType():
                         if expandVal.IsNull() {
                                 diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Invalid expanding argument value",
-                                        Detail:   "The expanding argument (indicated by ...) must not be null.",
-                                        Context:  expandExpr.Range().Ptr(),
-                                        Subject:  e.Range().Ptr(),
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Invalid expanding argument value",
+                                        Detail:      "The expanding argument (indicated by ...) must not be null.",
+                                        Subject:     expandExpr.Range().Ptr(),
+                                        Context:     e.Range().Ptr(),
+                                        Expression:  expandExpr,
+                                        EvalContext: ctx,
                                 })
                                 return cty.DynamicVal, diags
                         }
@@ -279,11 +289,13 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                         args = newArgs
                 default:
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Invalid expanding argument value",
-                                Detail:   "The expanding argument (indicated by ...) must be of a tuple, list, or set type.",
-                                Context:  expandExpr.Range().Ptr(),
-                                Subject:  e.Range().Ptr(),
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid expanding argument value",
+                                Detail:      "The expanding argument (indicated by ...) must be of a tuple, list, or set type.",
+                                Subject:     expandExpr.Range().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  expandExpr,
+                                EvalContext: ctx,
                         })
                         return cty.DynamicVal, diags
                 }
@@ -303,8 +315,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Function %q expects%s %d argument(s). Missing value for %q.",
                                         e.Name, qual, len(params), missing.Name,
                                 ),
-                                Subject: &e.CloseParenRange,
-                                Context: e.Range().Ptr(),
+                                Subject:     &e.CloseParenRange,
+                                Context:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         },
                 }
         }
@@ -318,8 +332,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Function %q expects only %d argument(s).",
                                         e.Name, len(params),
                                 ),
-                                Subject: args[len(params)].StartRange().Ptr(),
-                                Context: e.Range().Ptr(),
+                                Subject:     args[len(params)].StartRange().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         },
                 }
         }
@@ -349,8 +365,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Invalid value for %q parameter: %s.",
                                         param.Name, err,
                                 ),
-                                Subject: argExpr.StartRange().Ptr(),
-                                Context: e.Range().Ptr(),
+                                Subject:     argExpr.StartRange().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  argExpr,
+                                EvalContext: ctx,
                         })
                 }
 
@@ -386,8 +404,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Invalid value for %q parameter: %s.",
                                         param.Name, err,
                                 ),
-                                Subject: argExpr.StartRange().Ptr(),
-                                Context: e.Range().Ptr(),
+                                Subject:     argExpr.StartRange().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  argExpr,
+                                EvalContext: ctx,
                         })
 
                 default:
@@ -398,8 +418,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Call to function %q failed: %s.",
                                         e.Name, err,
                                 ),
-                                Subject: e.StartRange().Ptr(),
-                                Context: e.Range().Ptr(),
+                                Subject:     e.StartRange().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         })
                 }
 
@@ -441,9 +463,9 @@ type ConditionalExpr struct {
 }
 
 func (e *ConditionalExpr) walkChildNodes(w internalWalkFunc) {
-        e.Condition = w(e.Condition).(Expression)
-        e.TrueResult = w(e.TrueResult).(Expression)
-        e.FalseResult = w(e.FalseResult).(Expression)
+        w(e.Condition)
+        w(e.TrueResult)
+        w(e.FalseResult)
 }
 
 func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -464,10 +486,12 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
                                         // "These expressions are object and object respectively" if the
                                         // object types don't exactly match.
                                         "The true and false result expressions must have consistent types. The given expressions are %s and %s, respectively.",
-                                        trueResult.Type(), falseResult.Type(),
+                                        trueResult.Type().FriendlyName(), falseResult.Type().FriendlyName(),
                                 ),
-                                Subject: hcl.RangeBetween(e.TrueResult.Range(), e.FalseResult.Range()).Ptr(),
-                                Context: &e.SrcRange,
+                                Subject:     hcl.RangeBetween(e.TrueResult.Range(), e.FalseResult.Range()).Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  e,
+                                EvalContext: ctx,
                         },
                 }
         }
@@ -476,11 +500,13 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
         diags = append(diags, condDiags...)
         if condResult.IsNull() {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Null condition",
-                        Detail:   "The condition value is null. Conditions must either be true or false.",
-                        Subject:  e.Condition.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Null condition",
+                        Detail:      "The condition value is null. Conditions must either be true or false.",
+                        Subject:     e.Condition.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.Condition,
+                        EvalContext: ctx,
                 })
                 return cty.UnknownVal(resultType), diags
         }
@@ -490,11 +516,13 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
         condResult, err := convert.Convert(condResult, cty.Bool)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Incorrect condition type",
-                        Detail:   fmt.Sprintf("The condition expression must be of type bool."),
-                        Subject:  e.Condition.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Incorrect condition type",
+                        Detail:      fmt.Sprintf("The condition expression must be of type bool."),
+                        Subject:     e.Condition.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.Condition,
+                        EvalContext: ctx,
                 })
                 return cty.UnknownVal(resultType), diags
         }
@@ -513,8 +541,10 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
                                                 "The true result value has the wrong type: %s.",
                                                 err.Error(),
                                         ),
-                                        Subject: e.TrueResult.Range().Ptr(),
-                                        Context: &e.SrcRange,
+                                        Subject:     e.TrueResult.Range().Ptr(),
+                                        Context:     &e.SrcRange,
+                                        Expression:  e.TrueResult,
+                                        EvalContext: ctx,
                                 })
                                 trueResult = cty.UnknownVal(resultType)
                         }
@@ -534,8 +564,10 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
                                                 "The false result value has the wrong type: %s.",
                                                 err.Error(),
                                         ),
-                                        Subject: e.TrueResult.Range().Ptr(),
-                                        Context: &e.SrcRange,
+                                        Subject:     e.FalseResult.Range().Ptr(),
+                                        Context:     &e.SrcRange,
+                                        Expression:  e.FalseResult,
+                                        EvalContext: ctx,
                                 })
                                 falseResult = cty.UnknownVal(resultType)
                         }
@@ -561,8 +593,8 @@ type IndexExpr struct {
 }
 
 func (e *IndexExpr) walkChildNodes(w internalWalkFunc) {
-        e.Collection = w(e.Collection).(Expression)
-        e.Key = w(e.Key).(Expression)
+        w(e.Collection)
+        w(e.Key)
 }
 
 func (e *IndexExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -572,7 +604,10 @@ func (e *IndexExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         diags = append(diags, collDiags...)
         diags = append(diags, keyDiags...)
 
-        return hcl.Index(coll, key, &e.SrcRange)
+        val, indexDiags := hcl.Index(coll, key, &e.SrcRange)
+        setDiagEvalContext(indexDiags, e, ctx)
+        diags = append(diags, indexDiags...)
+        return val, diags
 }
 
 func (e *IndexExpr) Range() hcl.Range {
@@ -591,8 +626,8 @@ type TupleConsExpr struct {
 }
 
 func (e *TupleConsExpr) walkChildNodes(w internalWalkFunc) {
-        for i, expr := range e.Exprs {
-                e.Exprs[i] = w(expr).(Expression)
+        for _, expr := range e.Exprs {
+                w(expr)
         }
 }
 
@@ -640,9 +675,9 @@ type ObjectConsItem struct {
 }
 
 func (e *ObjectConsExpr) walkChildNodes(w internalWalkFunc) {
-        for i, item := range e.Items {
-                e.Items[i].KeyExpr = w(item.KeyExpr).(Expression)
-                e.Items[i].ValueExpr = w(item.ValueExpr).(Expression)
+        for _, item := range e.Items {
+                w(item.KeyExpr)
+                w(item.ValueExpr)
         }
 }
 
@@ -675,10 +710,12 @@ func (e *ObjectConsExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics
 
                 if key.IsNull() {
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Null value as key",
-                                Detail:   "Can't use a null value as a key.",
-                                Subject:  item.ValueExpr.Range().Ptr(),
+                                Severity:    hcl.DiagError,
+                                Summary:     "Null value as key",
+                                Detail:      "Can't use a null value as a key.",
+                                Subject:     item.ValueExpr.Range().Ptr(),
+                                Expression:  item.KeyExpr,
+                                EvalContext: ctx,
                         })
                         known = false
                         continue
@@ -688,10 +725,12 @@ func (e *ObjectConsExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics
                 key, err = convert.Convert(key, cty.String)
                 if err != nil {
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Incorrect key type",
-                                Detail:   fmt.Sprintf("Can't use this value as a key: %s.", err.Error()),
-                                Subject:  item.ValueExpr.Range().Ptr(),
+                                Severity:    hcl.DiagError,
+                                Summary:     "Incorrect key type",
+                                Detail:      fmt.Sprintf("Can't use this value as a key: %s.", err.Error()),
+                                Subject:     item.KeyExpr.Range().Ptr(),
+                                Expression:  item.KeyExpr,
+                                EvalContext: ctx,
                         })
                         known = false
                         continue
@@ -754,11 +793,31 @@ func (e *ObjectConsKeyExpr) walkChildNodes(w internalWalkFunc) {
         // We only treat our wrapped expression as a real expression if we're
         // not going to interpret it as a literal.
         if e.literalName() == "" {
-                e.Wrapped = w(e.Wrapped).(Expression)
+                w(e.Wrapped)
         }
 }
 
 func (e *ObjectConsKeyExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        // Because we accept a naked identifier as a literal key rather than a
+        // reference, it's confusing to accept a traversal containing periods
+        // here since we can't tell if the user intends to create a key with
+        // periods or actually reference something. To avoid confusing downstream
+        // errors we'll just prohibit a naked multi-step traversal here and
+        // require the user to state their intent more clearly.
+        // (This is handled at evaluation time rather than parse time because
+        // an application using static analysis _can_ accept a naked multi-step
+        // traversal here, if desired.)
+        if travExpr, isTraversal := e.Wrapped.(*ScopeTraversalExpr); isTraversal && len(travExpr.Traversal) > 1 {
+                var diags hcl.Diagnostics
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Ambiguous attribute key",
+                        Detail:   "If this expression is intended to be a reference, wrap it in parentheses. If it's instead intended as a literal name containing periods, wrap it in quotes to create a string literal.",
+                        Subject:  e.Range().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
         if ln := e.literalName(); ln != "" {
                 return cty.StringVal(ln), nil
         }
@@ -818,11 +877,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 
         if collVal.IsNull() {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Iteration over null value",
-                        Detail:   "A null value cannot be used as the collection in a 'for' expression.",
-                        Subject:  e.CollExpr.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Iteration over null value",
+                        Detail:      "A null value cannot be used as the collection in a 'for' expression.",
+                        Subject:     e.CollExpr.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.CollExpr,
+                        EvalContext: ctx,
                 })
                 return cty.DynamicVal, diags
         }
@@ -837,8 +898,10 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 "A value of type %s cannot be used as the collection in a 'for' expression.",
                                 collVal.Type().FriendlyName(),
                         ),
-                        Subject: e.CollExpr.Range().Ptr(),
-                        Context: &e.SrcRange,
+                        Subject:     e.CollExpr.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.CollExpr,
+                        EvalContext: ctx,
                 })
                 return cty.DynamicVal, diags
         }
@@ -846,14 +909,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 return cty.DynamicVal, diags
         }
 
-        childCtx := ctx.NewChild()
-        childCtx.Variables = map[string]cty.Value{}
-
         // Before we start we'll do an early check to see if any CondExpr we've
         // been given is of the wrong type. This isn't 100% reliable (it may
         // be DynamicVal until real values are given) but it should catch some
         // straightforward cases and prevent a barrage of repeated errors.
         if e.CondExpr != nil {
+                childCtx := ctx.NewChild()
+                childCtx.Variables = map[string]cty.Value{}
                 if e.KeyVar != "" {
                         childCtx.Variables[e.KeyVar] = cty.DynamicVal
                 }
@@ -863,22 +925,26 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 diags = append(diags, condDiags...)
                 if result.IsNull() {
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Condition is null",
-                                Detail:   "The value of the 'if' clause must not be null.",
-                                Subject:  e.CondExpr.Range().Ptr(),
-                                Context:  &e.SrcRange,
+                                Severity:    hcl.DiagError,
+                                Summary:     "Condition is null",
+                                Detail:      "The value of the 'if' clause must not be null.",
+                                Subject:     e.CondExpr.Range().Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  e.CondExpr,
+                                EvalContext: ctx,
                         })
                         return cty.DynamicVal, diags
                 }
                 _, err := convert.Convert(result, cty.Bool)
                 if err != nil {
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Invalid 'for' condition",
-                                Detail:   fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
-                                Subject:  e.CondExpr.Range().Ptr(),
-                                Context:  &e.SrcRange,
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid 'for' condition",
+                                Detail:      fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
+                                Subject:     e.CondExpr.Range().Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  e.CondExpr,
+                                EvalContext: ctx,
                         })
                         return cty.DynamicVal, diags
                 }
@@ -902,6 +968,8 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 known := true
                 for it.Next() {
                         k, v := it.Element()
+                        childCtx := ctx.NewChild()
+                        childCtx.Variables = map[string]cty.Value{}
                         if e.KeyVar != "" {
                                 childCtx.Variables[e.KeyVar] = k
                         }
@@ -913,11 +981,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 if includeRaw.IsNull() {
                                         if known {
                                                 diags = append(diags, &hcl.Diagnostic{
-                                                        Severity: hcl.DiagError,
-                                                        Summary:  "Condition is null",
-                                                        Detail:   "The value of the 'if' clause must not be null.",
-                                                        Subject:  e.CondExpr.Range().Ptr(),
-                                                        Context:  &e.SrcRange,
+                                                        Severity:    hcl.DiagError,
+                                                        Summary:     "Invalid 'for' condition",
+                                                        Detail:      "The value of the 'if' clause must not be null.",
+                                                        Subject:     e.CondExpr.Range().Ptr(),
+                                                        Context:     &e.SrcRange,
+                                                        Expression:  e.CondExpr,
+                                                        EvalContext: childCtx,
                                                 })
                                         }
                                         known = false
@@ -927,11 +997,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 if err != nil {
                                         if known {
                                                 diags = append(diags, &hcl.Diagnostic{
-                                                        Severity: hcl.DiagError,
-                                                        Summary:  "Invalid 'for' condition",
-                                                        Detail:   fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
-                                                        Subject:  e.CondExpr.Range().Ptr(),
-                                                        Context:  &e.SrcRange,
+                                                        Severity:    hcl.DiagError,
+                                                        Summary:     "Invalid 'for' condition",
+                                                        Detail:      fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
+                                                        Subject:     e.CondExpr.Range().Ptr(),
+                                                        Context:     &e.SrcRange,
+                                                        Expression:  e.CondExpr,
+                                                        EvalContext: childCtx,
                                                 })
                                         }
                                         known = false
@@ -953,11 +1025,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         if keyRaw.IsNull() {
                                 if known {
                                         diags = append(diags, &hcl.Diagnostic{
-                                                Severity: hcl.DiagError,
-                                                Summary:  "Invalid object key",
-                                                Detail:   "Key expression in 'for' expression must not produce a null value.",
-                                                Subject:  e.KeyExpr.Range().Ptr(),
-                                                Context:  &e.SrcRange,
+                                                Severity:    hcl.DiagError,
+                                                Summary:     "Invalid object key",
+                                                Detail:      "Key expression in 'for' expression must not produce a null value.",
+                                                Subject:     e.KeyExpr.Range().Ptr(),
+                                                Context:     &e.SrcRange,
+                                                Expression:  e.KeyExpr,
+                                                EvalContext: childCtx,
                                         })
                                 }
                                 known = false
@@ -972,11 +1046,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         if err != nil {
                                 if known {
                                         diags = append(diags, &hcl.Diagnostic{
-                                                Severity: hcl.DiagError,
-                                                Summary:  "Invalid object key",
-                                                Detail:   fmt.Sprintf("The key expression produced an invalid result: %s.", err.Error()),
-                                                Subject:  e.KeyExpr.Range().Ptr(),
-                                                Context:  &e.SrcRange,
+                                                Severity:    hcl.DiagError,
+                                                Summary:     "Invalid object key",
+                                                Detail:      fmt.Sprintf("The key expression produced an invalid result: %s.", err.Error()),
+                                                Subject:     e.KeyExpr.Range().Ptr(),
+                                                Context:     &e.SrcRange,
+                                                Expression:  e.KeyExpr,
+                                                EvalContext: childCtx,
                                         })
                                 }
                                 known = false
@@ -996,11 +1072,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                                 Severity: hcl.DiagError,
                                                 Summary:  "Duplicate object key",
                                                 Detail: fmt.Sprintf(
-                                                        "Two different items produced the key %q in this for expression. If duplicates are expected, use the ellipsis (...) after the value expression to enable grouping by key.",
+                                                        "Two different items produced the key %q in this 'for' expression. If duplicates are expected, use the ellipsis (...) after the value expression to enable grouping by key.",
                                                         k,
                                                 ),
-                                                Subject: e.KeyExpr.Range().Ptr(),
-                                                Context: &e.SrcRange,
+                                                Subject:     e.KeyExpr.Range().Ptr(),
+                                                Context:     &e.SrcRange,
+                                                Expression:  e.KeyExpr,
+                                                EvalContext: childCtx,
                                         })
                                 } else {
                                         vals[key.AsString()] = val
@@ -1030,6 +1108,8 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 known := true
                 for it.Next() {
                         k, v := it.Element()
+                        childCtx := ctx.NewChild()
+                        childCtx.Variables = map[string]cty.Value{}
                         if e.KeyVar != "" {
                                 childCtx.Variables[e.KeyVar] = k
                         }
@@ -1041,11 +1121,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 if includeRaw.IsNull() {
                                         if known {
                                                 diags = append(diags, &hcl.Diagnostic{
-                                                        Severity: hcl.DiagError,
-                                                        Summary:  "Condition is null",
-                                                        Detail:   "The value of the 'if' clause must not be null.",
-                                                        Subject:  e.CondExpr.Range().Ptr(),
-                                                        Context:  &e.SrcRange,
+                                                        Severity:    hcl.DiagError,
+                                                        Summary:     "Invalid 'for' condition",
+                                                        Detail:      "The value of the 'if' clause must not be null.",
+                                                        Subject:     e.CondExpr.Range().Ptr(),
+                                                        Context:     &e.SrcRange,
+                                                        Expression:  e.CondExpr,
+                                                        EvalContext: childCtx,
                                                 })
                                         }
                                         known = false
@@ -1063,11 +1145,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 if err != nil {
                                         if known {
                                                 diags = append(diags, &hcl.Diagnostic{
-                                                        Severity: hcl.DiagError,
-                                                        Summary:  "Invalid 'for' condition",
-                                                        Detail:   fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
-                                                        Subject:  e.CondExpr.Range().Ptr(),
-                                                        Context:  &e.SrcRange,
+                                                        Severity:    hcl.DiagError,
+                                                        Summary:     "Invalid 'for' condition",
+                                                        Detail:      fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
+                                                        Subject:     e.CondExpr.Range().Ptr(),
+                                                        Context:     &e.SrcRange,
+                                                        Expression:  e.CondExpr,
+                                                        EvalContext: childCtx,
                                                 })
                                         }
                                         known = false
@@ -1094,7 +1178,7 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 }
 
 func (e *ForExpr) walkChildNodes(w internalWalkFunc) {
-        e.CollExpr = w(e.CollExpr).(Expression)
+        w(e.CollExpr)
 
         scopeNames := map[string]struct{}{}
         if e.KeyVar != "" {
@@ -1107,17 +1191,17 @@ func (e *ForExpr) walkChildNodes(w internalWalkFunc) {
         if e.KeyExpr != nil {
                 w(ChildScope{
                         LocalNames: scopeNames,
-                        Expr:       &e.KeyExpr,
+                        Expr:       e.KeyExpr,
                 })
         }
         w(ChildScope{
                 LocalNames: scopeNames,
-                Expr:       &e.ValExpr,
+                Expr:       e.ValExpr,
         })
         if e.CondExpr != nil {
                 w(ChildScope{
                         LocalNames: scopeNames,
-                        Expr:       &e.CondExpr,
+                        Expr:       e.CondExpr,
                 })
         }
 }
@@ -1151,26 +1235,78 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 return cty.DynamicVal, diags
         }
 
+        sourceTy := sourceVal.Type()
+        if sourceTy == cty.DynamicPseudoType {
+                // If we don't even know the _type_ of our source value yet then
+                // we'll need to defer all processing, since we can't decide our
+                // result type either.
+                return cty.DynamicVal, diags
+        }
+
+        // A "special power" of splat expressions is that they can be applied
+        // both to tuples/lists and to other values, and in the latter case
+        // the value will be treated as an implicit single-item tuple, or as
+        // an empty tuple if the value is null.
+        autoUpgrade := !(sourceTy.IsTupleType() || sourceTy.IsListType() || sourceTy.IsSetType())
+
         if sourceVal.IsNull() {
+                if autoUpgrade {
+                        return cty.EmptyTupleVal, diags
+                }
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Splat of null value",
-                        Detail:   "Splat expressions (with the * symbol) cannot be applied to null values.",
-                        Subject:  e.Source.Range().Ptr(),
-                        Context:  hcl.RangeBetween(e.Source.Range(), e.MarkerRange).Ptr(),
+                        Severity:    hcl.DiagError,
+                        Summary:     "Splat of null value",
+                        Detail:      "Splat expressions (with the * symbol) cannot be applied to null sequences.",
+                        Subject:     e.Source.Range().Ptr(),
+                        Context:     hcl.RangeBetween(e.Source.Range(), e.MarkerRange).Ptr(),
+                        Expression:  e.Source,
+                        EvalContext: ctx,
                 })
                 return cty.DynamicVal, diags
         }
-        if !sourceVal.IsKnown() {
-                return cty.DynamicVal, diags
+
+        if autoUpgrade {
+                sourceVal = cty.TupleVal([]cty.Value{sourceVal})
+                sourceTy = sourceVal.Type()
         }
 
-        // A "special power" of splat expressions is that they can be applied
-        // both to tuples/lists and to other values, and in the latter case
-        // the value will be treated as an implicit single-value list. We'll
-        // deal with that here first.
-        if !(sourceVal.Type().IsTupleType() || sourceVal.Type().IsListType()) {
-                sourceVal = cty.ListVal([]cty.Value{sourceVal})
+        // We'll compute our result type lazily if we need it. In the normal case
+        // it's inferred automatically from the value we construct.
+        resultTy := func() (cty.Type, hcl.Diagnostics) {
+                chiCtx := ctx.NewChild()
+                var diags hcl.Diagnostics
+                switch {
+                case sourceTy.IsListType() || sourceTy.IsSetType():
+                        ety := sourceTy.ElementType()
+                        e.Item.setValue(chiCtx, cty.UnknownVal(ety))
+                        val, itemDiags := e.Each.Value(chiCtx)
+                        diags = append(diags, itemDiags...)
+                        e.Item.clearValue(chiCtx) // clean up our temporary value
+                        return cty.List(val.Type()), diags
+                case sourceTy.IsTupleType():
+                        etys := sourceTy.TupleElementTypes()
+                        resultTys := make([]cty.Type, 0, len(etys))
+                        for _, ety := range etys {
+                                e.Item.setValue(chiCtx, cty.UnknownVal(ety))
+                                val, itemDiags := e.Each.Value(chiCtx)
+                                diags = append(diags, itemDiags...)
+                                e.Item.clearValue(chiCtx) // clean up our temporary value
+                                resultTys = append(resultTys, val.Type())
+                        }
+                        return cty.Tuple(resultTys), diags
+                default:
+                        // Should never happen because of our promotion to list above.
+                        return cty.DynamicPseudoType, diags
+                }
+        }
+
+        if !sourceVal.IsKnown() {
+                // We can't produce a known result in this case, but we'll still
+                // indicate what the result type would be, allowing any downstream type
+                // checking to proceed.
+                ty, tyDiags := resultTy()
+                diags = append(diags, tyDiags...)
+                return cty.UnknownVal(ty), diags
         }
 
         vals := make([]cty.Value, 0, sourceVal.LengthInt())
@@ -1194,15 +1330,28 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         e.Item.clearValue(ctx) // clean up our temporary value
 
         if !isKnown {
-                return cty.DynamicVal, diags
+                // We'll ingore the resultTy diagnostics in this case since they
+                // will just be the same errors we saw while iterating above.
+                ty, _ := resultTy()
+                return cty.UnknownVal(ty), diags
         }
 
-        return cty.TupleVal(vals), diags
+        switch {
+        case sourceTy.IsListType() || sourceTy.IsSetType():
+                if len(vals) == 0 {
+                        ty, tyDiags := resultTy()
+                        diags = append(diags, tyDiags...)
+                        return cty.ListValEmpty(ty.ElementType()), diags
+                }
+                return cty.ListVal(vals), diags
+        default:
+                return cty.TupleVal(vals), diags
+        }
 }
 
 func (e *SplatExpr) walkChildNodes(w internalWalkFunc) {
-        e.Source = w(e.Source).(Expression)
-        e.Each = w(e.Each).(Expression)
+        w(e.Source)
+        w(e.Each)
 }
 
 func (e *SplatExpr) Range() hcl.Range {
@@ -1226,13 +1375,24 @@ func (e *SplatExpr) StartRange() hcl.Range {
 // assigns it a value.
 type AnonSymbolExpr struct {
         SrcRange hcl.Range
-        values   map[*hcl.EvalContext]cty.Value
+
+        // values and its associated lock are used to isolate concurrent
+        // evaluations of a symbol from one another. It is the calling application's
+        // responsibility to ensure that the same splat expression is not evalauted
+        // concurrently within the _same_ EvalContext, but it is fine and safe to
+        // do cuncurrent evaluations with distinct EvalContexts.
+        values     map[*hcl.EvalContext]cty.Value
+        valuesLock sync.RWMutex
 }
 
 func (e *AnonSymbolExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         if ctx == nil {
                 return cty.DynamicVal, nil
         }
+
+        e.valuesLock.RLock()
+        defer e.valuesLock.RUnlock()
+
         val, exists := e.values[ctx]
         if !exists {
                 return cty.DynamicVal, nil
@@ -1243,6 +1403,9 @@ func (e *AnonSymbolExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics
 // setValue sets a temporary local value for the expression when evaluated
 // in the given context, which must be non-nil.
 func (e *AnonSymbolExpr) setValue(ctx *hcl.EvalContext, val cty.Value) {
+        e.valuesLock.Lock()
+        defer e.valuesLock.Unlock()
+
         if e.values == nil {
                 e.values = make(map[*hcl.EvalContext]cty.Value)
         }
@@ -1253,6 +1416,9 @@ func (e *AnonSymbolExpr) setValue(ctx *hcl.EvalContext, val cty.Value) {
 }
 
 func (e *AnonSymbolExpr) clearValue(ctx *hcl.EvalContext) {
+        e.valuesLock.Lock()
+        defer e.valuesLock.Unlock()
+
         if e.values == nil {
                 return
         }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go
index 9a5da04..7f59f1a 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go
@@ -129,8 +129,8 @@ type BinaryOpExpr struct {
 }
 
 func (e *BinaryOpExpr) walkChildNodes(w internalWalkFunc) {
-        e.LHS = w(e.LHS).(Expression)
-        e.RHS = w(e.RHS).(Expression)
+        w(e.LHS)
+        w(e.RHS)
 }
 
 func (e *BinaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -149,21 +149,25 @@ func (e *BinaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
         lhsVal, err := convert.Convert(givenLHSVal, lhsParam.Type)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Invalid operand",
-                        Detail:   fmt.Sprintf("Unsuitable value for left operand: %s.", err),
-                        Subject:  e.LHS.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid operand",
+                        Detail:      fmt.Sprintf("Unsuitable value for left operand: %s.", err),
+                        Subject:     e.LHS.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.LHS,
+                        EvalContext: ctx,
                 })
         }
         rhsVal, err := convert.Convert(givenRHSVal, rhsParam.Type)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Invalid operand",
-                        Detail:   fmt.Sprintf("Unsuitable value for right operand: %s.", err),
-                        Subject:  e.RHS.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid operand",
+                        Detail:      fmt.Sprintf("Unsuitable value for right operand: %s.", err),
+                        Subject:     e.RHS.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.RHS,
+                        EvalContext: ctx,
                 })
         }
 
@@ -178,10 +182,12 @@ func (e *BinaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
                         // FIXME: This diagnostic is useless.
-                        Severity: hcl.DiagError,
-                        Summary:  "Operation failed",
-                        Detail:   fmt.Sprintf("Error during operation: %s.", err),
-                        Subject:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Operation failed",
+                        Detail:      fmt.Sprintf("Error during operation: %s.", err),
+                        Subject:     &e.SrcRange,
+                        Expression:  e,
+                        EvalContext: ctx,
                 })
                 return cty.UnknownVal(e.Op.Type), diags
         }
@@ -206,7 +212,7 @@ type UnaryOpExpr struct {
 }
 
 func (e *UnaryOpExpr) walkChildNodes(w internalWalkFunc) {
-        e.Val = w(e.Val).(Expression)
+        w(e.Val)
 }
 
 func (e *UnaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -219,11 +225,13 @@ func (e *UnaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         val, err := convert.Convert(givenVal, param.Type)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Invalid operand",
-                        Detail:   fmt.Sprintf("Unsuitable value for unary operand: %s.", err),
-                        Subject:  e.Val.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid operand",
+                        Detail:      fmt.Sprintf("Unsuitable value for unary operand: %s.", err),
+                        Subject:     e.Val.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.Val,
+                        EvalContext: ctx,
                 })
         }
 
@@ -238,10 +246,12 @@ func (e *UnaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
                         // FIXME: This diagnostic is useless.
-                        Severity: hcl.DiagError,
-                        Summary:  "Operation failed",
-                        Detail:   fmt.Sprintf("Error during operation: %s.", err),
-                        Subject:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Operation failed",
+                        Detail:      fmt.Sprintf("Error during operation: %s.", err),
+                        Subject:     &e.SrcRange,
+                        Expression:  e,
+                        EvalContext: ctx,
                 })
                 return cty.UnknownVal(e.Op.Type), diags
         }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go
index a1c4727..fa79e3d 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go
@@ -16,8 +16,8 @@ type TemplateExpr struct {
 }
 
 func (e *TemplateExpr) walkChildNodes(w internalWalkFunc) {
-        for i, part := range e.Parts {
-                e.Parts[i] = w(part).(Expression)
+        for _, part := range e.Parts {
+                w(part)
         }
 }
 
@@ -37,8 +37,10 @@ func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
                                 Detail: fmt.Sprintf(
                                         "The expression result is null. Cannot include a null value in a string template.",
                                 ),
-                                Subject: part.Range().Ptr(),
-                                Context: &e.SrcRange,
+                                Subject:     part.Range().Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  part,
+                                EvalContext: ctx,
                         })
                         continue
                 }
@@ -61,8 +63,10 @@ func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
                                         "Cannot include the given value in a string template: %s.",
                                         err.Error(),
                                 ),
-                                Subject: part.Range().Ptr(),
-                                Context: &e.SrcRange,
+                                Subject:     part.Range().Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  part,
+                                EvalContext: ctx,
                         })
                         continue
                 }
@@ -94,7 +98,7 @@ type TemplateJoinExpr struct {
 }
 
 func (e *TemplateJoinExpr) walkChildNodes(w internalWalkFunc) {
-        e.Tuple = w(e.Tuple).(Expression)
+        w(e.Tuple)
 }
 
 func (e *TemplateJoinExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -127,7 +131,9 @@ func (e *TemplateJoinExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                 Detail: fmt.Sprintf(
                                         "An iteration result is null. Cannot include a null value in a string template.",
                                 ),
-                                Subject: e.Range().Ptr(),
+                                Subject:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         })
                         continue
                 }
@@ -143,7 +149,9 @@ func (e *TemplateJoinExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Cannot include one of the interpolation results into the string template: %s.",
                                         err.Error(),
                                 ),
-                                Subject: e.Range().Ptr(),
+                                Subject:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         })
                         continue
                 }
@@ -176,7 +184,7 @@ type TemplateWrapExpr struct {
 }
 
 func (e *TemplateWrapExpr) walkChildNodes(w internalWalkFunc) {
-        e.Wrapped = w(e.Wrapped).(Expression)
+        w(e.Wrapped)
 }
 
 func (e *TemplateWrapExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go
index 4d41b6b..c8c97f3 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go
@@ -3,6 +3,8 @@ package hclsyntax
 import (
         "bytes"
         "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
 )
 
 type navigation struct {
@@ -39,3 +41,19 @@ func (n navigation) ContextString(offset int) string {
         }
         return buf.String()
 }
+
+func (n navigation) ContextDefRange(offset int) hcl.Range {
+        var block *Block
+        for _, candidate := range n.root.Blocks {
+                if candidate.Range().ContainsOffset(offset) {
+                        block = candidate
+                        break
+                }
+        }
+
+        if block == nil {
+                return hcl.Range{}
+        }
+
+        return block.DefRange()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go
index fd426d4..75812e6 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go
@@ -19,4 +19,4 @@ type Node interface {
         Range() hcl.Range
 }
 
-type internalWalkFunc func(Node) Node
+type internalWalkFunc func(Node)
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go
index 002858f..253ad50 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go
@@ -9,7 +9,6 @@ import (
         "github.com/apparentlymart/go-textseg/textseg"
         "github.com/hashicorp/hcl2/hcl"
         "github.com/zclconf/go-cty/cty"
-        "github.com/zclconf/go-cty/cty/convert"
 )
 
 type parser struct {
@@ -55,7 +54,7 @@ Token:
                                                 Severity: hcl.DiagError,
                                                 Summary:  "Attribute redefined",
                                                 Detail: fmt.Sprintf(
-                                                        "The attribute %q was already defined at %s. Each attribute may be defined only once.",
+                                                        "The argument %q was already set at %s. Each argument may be set only once.",
                                                         titem.Name, existing.NameRange.String(),
                                                 ),
                                                 Subject: &titem.NameRange,
@@ -80,15 +79,15 @@ Token:
                                 if bad.Type == TokenOQuote {
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
-                                                Summary:  "Invalid attribute name",
-                                                Detail:   "Attribute names must not be quoted.",
+                                                Summary:  "Invalid argument name",
+                                                Detail:   "Argument names must not be quoted.",
                                                 Subject:  &bad.Range,
                                         })
                                 } else {
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
-                                                Summary:  "Attribute or block definition required",
-                                                Detail:   "An attribute or block definition is required here.",
+                                                Summary:  "Argument or block definition required",
+                                                Detail:   "An argument or block definition is required here.",
                                                 Subject:  &bad.Range,
                                         })
                                 }
@@ -120,8 +119,8 @@ func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) {
                 return nil, hcl.Diagnostics{
                         {
                                 Severity: hcl.DiagError,
-                                Summary:  "Attribute or block definition required",
-                                Detail:   "An attribute or block definition is required here.",
+                                Summary:  "Argument or block definition required",
+                                Detail:   "An argument or block definition is required here.",
                                 Subject:  &ident.Range,
                         },
                 }
@@ -131,7 +130,7 @@ func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) {
 
         switch next.Type {
         case TokenEqual:
-                return p.finishParsingBodyAttribute(ident)
+                return p.finishParsingBodyAttribute(ident, false)
         case TokenOQuote, TokenOBrace, TokenIdent:
                 return p.finishParsingBodyBlock(ident)
         default:
@@ -139,8 +138,8 @@ func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) {
                 return nil, hcl.Diagnostics{
                         {
                                 Severity: hcl.DiagError,
-                                Summary:  "Attribute or block definition required",
-                                Detail:   "An attribute or block definition is required here. To define an attribute, use the equals sign \"=\" to introduce the attribute value.",
+                                Summary:  "Argument or block definition required",
+                                Detail:   "An argument or block definition is required here. To set an argument, use the equals sign \"=\" to introduce the argument value.",
                                 Subject:  &ident.Range,
                         },
                 }
@@ -149,7 +148,72 @@ func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) {
         return nil, nil
 }
 
-func (p *parser) finishParsingBodyAttribute(ident Token) (Node, hcl.Diagnostics) {
+// parseSingleAttrBody is a weird variant of ParseBody that deals with the
+// body of a nested block containing only one attribute value all on a single
+// line, like foo { bar = baz } . It expects to find a single attribute item
+// immediately followed by the end token type with no intervening newlines.
+func (p *parser) parseSingleAttrBody(end TokenType) (*Body, hcl.Diagnostics) {
+        ident := p.Read()
+        if ident.Type != TokenIdent {
+                p.recoverAfterBodyItem()
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Argument or block definition required",
+                                Detail:   "An argument or block definition is required here.",
+                                Subject:  &ident.Range,
+                        },
+                }
+        }
+
+        var attr *Attribute
+        var diags hcl.Diagnostics
+
+        next := p.Peek()
+
+        switch next.Type {
+        case TokenEqual:
+                node, attrDiags := p.finishParsingBodyAttribute(ident, true)
+                diags = append(diags, attrDiags...)
+                attr = node.(*Attribute)
+        case TokenOQuote, TokenOBrace, TokenIdent:
+                p.recoverAfterBodyItem()
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Argument definition required",
+                                Detail:   fmt.Sprintf("A single-line block definition can contain only a single argument. If you meant to define argument %q, use an equals sign to assign it a value. To define a nested block, place it on a line of its own within its parent block.", ident.Bytes),
+                                Subject:  hcl.RangeBetween(ident.Range, next.Range).Ptr(),
+                        },
+                }
+        default:
+                p.recoverAfterBodyItem()
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Argument or block definition required",
+                                Detail:   "An argument or block definition is required here. To set an argument, use the equals sign \"=\" to introduce the argument value.",
+                                Subject:  &ident.Range,
+                        },
+                }
+        }
+
+        return &Body{
+                Attributes: Attributes{
+                        string(ident.Bytes): attr,
+                },
+
+                SrcRange: attr.SrcRange,
+                EndRange: hcl.Range{
+                        Filename: attr.SrcRange.Filename,
+                        Start:    attr.SrcRange.End,
+                        End:      attr.SrcRange.End,
+                },
+        }, diags
+
+}
+
+func (p *parser) finishParsingBodyAttribute(ident Token, singleLine bool) (Node, hcl.Diagnostics) {
         eqTok := p.Read() // eat equals token
         if eqTok.Type != TokenEqual {
                 // should never happen if caller behaves
@@ -166,22 +230,33 @@ func (p *parser) finishParsingBodyAttribute(ident Token) (Node, hcl.Diagnostics)
                 endRange = p.PrevRange()
                 p.recoverAfterBodyItem()
         } else {
-                end := p.Peek()
-                if end.Type != TokenNewline && end.Type != TokenEOF {
-                        if !p.recovery {
-                                diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Missing newline after attribute definition",
-                                        Detail:   "An attribute definition must end with a newline.",
-                                        Subject:  &end.Range,
-                                        Context:  hcl.RangeBetween(ident.Range, end.Range).Ptr(),
-                                })
+                endRange = p.PrevRange()
+                if !singleLine {
+                        end := p.Peek()
+                        if end.Type != TokenNewline && end.Type != TokenEOF {
+                                if !p.recovery {
+                                        summary := "Missing newline after argument"
+                                        detail := "An argument definition must end with a newline."
+
+                                        if end.Type == TokenComma {
+                                                summary = "Unexpected comma after argument"
+                                                detail = "Argument definitions must be separated by newlines, not commas. " + detail
+                                        }
+
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  summary,
+                                                Detail:   detail,
+                                                Subject:  &end.Range,
+                                                Context:  hcl.RangeBetween(ident.Range, end.Range).Ptr(),
+                                        })
+                                }
+                                endRange = p.PrevRange()
+                                p.recoverAfterBodyItem()
+                        } else {
+                                endRange = p.PrevRange()
+                                p.Read() // eat newline
                         }
-                        endRange = p.PrevRange()
-                        p.recoverAfterBodyItem()
-                } else {
-                        endRange = p.PrevRange()
-                        p.Read() // eat newline
                 }
         }
 
@@ -218,19 +293,9 @@ Token:
                         diags = append(diags, labelDiags...)
                         labels = append(labels, label)
                         labelRanges = append(labelRanges, labelRange)
-                        if labelDiags.HasErrors() {
-                                p.recoverAfterBodyItem()
-                                return &Block{
-                                        Type:   blockType,
-                                        Labels: labels,
-                                        Body:   nil,
-
-                                        TypeRange:       ident.Range,
-                                        LabelRanges:     labelRanges,
-                                        OpenBraceRange:  ident.Range, // placeholder
-                                        CloseBraceRange: ident.Range, // placeholder
-                                }, diags
-                        }
+                        // parseQuoteStringLiteral recovers up to the closing quote
+                        // if it encounters problems, so we can continue looking for
+                        // more labels and eventually the block body even.
 
                 case TokenIdent:
                         tok = p.Read() // eat token
@@ -244,7 +309,7 @@ Token:
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Invalid block definition",
-                                        Detail:   "The equals sign \"=\" indicates an attribute definition, and must not be used when defining a block.",
+                                        Detail:   "The equals sign \"=\" indicates an argument definition, and must not be used when defining a block.",
                                         Subject:  &tok.Range,
                                         Context:  hcl.RangeBetween(ident.Range, tok.Range).Ptr(),
                                 })
@@ -273,7 +338,10 @@ Token:
                         return &Block{
                                 Type:   blockType,
                                 Labels: labels,
-                                Body:   nil,
+                                Body: &Body{
+                                        SrcRange: ident.Range,
+                                        EndRange: ident.Range,
+                                },
 
                                 TypeRange:       ident.Range,
                                 LabelRanges:     labelRanges,
@@ -285,7 +353,51 @@ Token:
 
         // Once we fall out here, the peeker is pointed just after our opening
         // brace, so we can begin our nested body parsing.
-        body, bodyDiags := p.ParseBody(TokenCBrace)
+        var body *Body
+        var bodyDiags hcl.Diagnostics
+        switch p.Peek().Type {
+        case TokenNewline, TokenEOF, TokenCBrace:
+                body, bodyDiags = p.ParseBody(TokenCBrace)
+        default:
+                // Special one-line, single-attribute block parsing mode.
+                body, bodyDiags = p.parseSingleAttrBody(TokenCBrace)
+                switch p.Peek().Type {
+                case TokenCBrace:
+                        p.Read() // the happy path - just consume the closing brace
+                case TokenComma:
+                        // User seems to be trying to use the object-constructor
+                        // comma-separated style, which isn't permitted for blocks.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid single-argument block definition",
+                                Detail:   "Single-line block syntax can include only one argument definition. To define multiple arguments, use the multi-line block syntax with one argument definition per line.",
+                                Subject:  p.Peek().Range.Ptr(),
+                        })
+                        p.recover(TokenCBrace)
+                case TokenNewline:
+                        // We don't allow weird mixtures of single and multi-line syntax.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid single-argument block definition",
+                                Detail:   "An argument definition on the same line as its containing block creates a single-line block definition, which must also be closed on the same line. Place the block's closing brace immediately after the argument definition.",
+                                Subject:  p.Peek().Range.Ptr(),
+                        })
+                        p.recover(TokenCBrace)
+                default:
+                        // Some other weird thing is going on. Since we can't guess a likely
+                        // user intent for this one, we'll skip it if we're already in
+                        // recovery mode.
+                        if !p.recovery {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid single-argument block definition",
+                                        Detail:   "A single-line block definition must end with a closing brace immediately after its single argument definition.",
+                                        Subject:  p.Peek().Range.Ptr(),
+                                })
+                        }
+                        p.recover(TokenCBrace)
+                }
+        }
         diags = append(diags, bodyDiags...)
         cBraceRange := p.PrevRange()
 
@@ -305,6 +417,17 @@ Token:
                 p.recoverAfterBodyItem()
         }
 
+        // We must never produce a nil body, since the caller may attempt to
+        // do analysis of a partial result when there's an error, so we'll
+        // insert a placeholder if we otherwise failed to produce a valid
+        // body due to one of the syntax error paths above.
+        if body == nil && diags.HasErrors() {
+                body = &Body{
+                        SrcRange: hcl.RangeBetween(oBrace.Range, cBraceRange),
+                        EndRange: cBraceRange,
+                }
+        }
+
         return &Block{
                 Type:   blockType,
                 Labels: labels,
@@ -459,7 +582,14 @@ func (p *parser) parseBinaryOps(ops []map[TokenType]*Operation) (Expression, hcl
 
 func (p *parser) parseExpressionWithTraversals() (Expression, hcl.Diagnostics) {
         term, diags := p.parseExpressionTerm()
-        ret := term
+        ret, moreDiags := p.parseExpressionTraversals(term)
+        diags = append(diags, moreDiags...)
+        return ret, diags
+}
+
+func (p *parser) parseExpressionTraversals(from Expression) (Expression, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        ret := from
 
 Traversal:
         for {
@@ -657,44 +787,81 @@ Traversal:
                         // the key value is something constant.
 
                         open := p.Read()
-                        // TODO: If we have a TokenStar inside our brackets, parse as
-                        // a Splat expression: foo[*].baz[0].
-                        var close Token
-                        p.PushIncludeNewlines(false) // arbitrary newlines allowed in brackets
-                        keyExpr, keyDiags := p.ParseExpression()
-                        diags = append(diags, keyDiags...)
-                        if p.recovery && keyDiags.HasErrors() {
-                                close = p.recover(TokenCBrack)
-                        } else {
-                                close = p.Read()
+                        switch p.Peek().Type {
+                        case TokenStar:
+                                // This is a full splat expression, like foo[*], which consumes
+                                // the rest of the traversal steps after it using a recursive
+                                // call to this function.
+                                p.Read() // consume star
+                                close := p.Read()
                                 if close.Type != TokenCBrack && !p.recovery {
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
-                                                Summary:  "Missing close bracket on index",
-                                                Detail:   "The index operator must end with a closing bracket (\"]\").",
+                                                Summary:  "Missing close bracket on splat index",
+                                                Detail:   "The star for a full splat operator must be immediately followed by a closing bracket (\"]\").",
                                                 Subject:  &close.Range,
                                         })
                                         close = p.recover(TokenCBrack)
                                 }
-                        }
-                        p.PopIncludeNewlines()
+                                // Splat expressions use a special "anonymous symbol"  as a
+                                // placeholder in an expression to be evaluated once for each
+                                // item in the source expression.
+                                itemExpr := &AnonSymbolExpr{
+                                        SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                                }
+                                // Now we'll recursively call this same function to eat any
+                                // remaining traversal steps against the anonymous symbol.
+                                travExpr, nestedDiags := p.parseExpressionTraversals(itemExpr)
+                                diags = append(diags, nestedDiags...)
 
-                        if lit, isLit := keyExpr.(*LiteralValueExpr); isLit {
-                                litKey, _ := lit.Value(nil)
-                                rng := hcl.RangeBetween(open.Range, close.Range)
-                                step := hcl.TraverseIndex{
-                                        Key:      litKey,
-                                        SrcRange: rng,
+                                ret = &SplatExpr{
+                                        Source: ret,
+                                        Each:   travExpr,
+                                        Item:   itemExpr,
+
+                                        SrcRange:    hcl.RangeBetween(open.Range, travExpr.Range()),
+                                        MarkerRange: hcl.RangeBetween(open.Range, close.Range),
                                 }
-                                ret = makeRelativeTraversal(ret, step, rng)
-                        } else {
-                                rng := hcl.RangeBetween(open.Range, close.Range)
-                                ret = &IndexExpr{
-                                        Collection: ret,
-                                        Key:        keyExpr,
 
-                                        SrcRange:  rng,
-                                        OpenRange: open.Range,
+                        default:
+
+                                var close Token
+                                p.PushIncludeNewlines(false) // arbitrary newlines allowed in brackets
+                                keyExpr, keyDiags := p.ParseExpression()
+                                diags = append(diags, keyDiags...)
+                                if p.recovery && keyDiags.HasErrors() {
+                                        close = p.recover(TokenCBrack)
+                                } else {
+                                        close = p.Read()
+                                        if close.Type != TokenCBrack && !p.recovery {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Missing close bracket on index",
+                                                        Detail:   "The index operator must end with a closing bracket (\"]\").",
+                                                        Subject:  &close.Range,
+                                                })
+                                                close = p.recover(TokenCBrack)
+                                        }
+                                }
+                                p.PopIncludeNewlines()
+
+                                if lit, isLit := keyExpr.(*LiteralValueExpr); isLit {
+                                        litKey, _ := lit.Value(nil)
+                                        rng := hcl.RangeBetween(open.Range, close.Range)
+                                        step := hcl.TraverseIndex{
+                                                Key:      litKey,
+                                                SrcRange: rng,
+                                        }
+                                        ret = makeRelativeTraversal(ret, step, rng)
+                                } else {
+                                        rng := hcl.RangeBetween(open.Range, close.Range)
+                                        ret = &IndexExpr{
+                                                Collection: ret,
+                                                Key:        keyExpr,
+
+                                                SrcRange:  rng,
+                                                OpenRange: open.Range,
+                                        }
                                 }
                         }
 
@@ -813,7 +980,7 @@ func (p *parser) parseExpressionTerm() (Expression, hcl.Diagnostics) {
         case TokenOQuote, TokenOHeredoc:
                 open := p.Read() // eat opening marker
                 closer := p.oppositeBracket(open.Type)
-                exprs, passthru, _, diags := p.parseTemplateInner(closer)
+                exprs, passthru, _, diags := p.parseTemplateInner(closer, tokenOpensFlushHeredoc(open))
 
                 closeRange := p.PrevRange()
 
@@ -891,11 +1058,10 @@ func (p *parser) parseExpressionTerm() (Expression, hcl.Diagnostics) {
 }
 
 func (p *parser) numberLitValue(tok Token) (cty.Value, hcl.Diagnostics) {
-        // We'll lean on the cty converter to do the conversion, to ensure that
-        // the behavior is the same as what would happen if converting a
-        // non-literal string to a number.
-        numStrVal := cty.StringVal(string(tok.Bytes))
-        numVal, err := convert.Convert(numStrVal, cty.Number)
+        // The cty.ParseNumberVal is always the same behavior as converting a
+        // string to a number, ensuring we always interpret decimal numbers in
+        // the same way.
+        numVal, err := cty.ParseNumberVal(string(tok.Bytes))
         if err != nil {
                 ret := cty.UnknownVal(cty.Number)
                 return ret, hcl.Diagnostics{
@@ -1087,13 +1253,19 @@ func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) {
                 panic("parseObjectCons called without peeker pointing to open brace")
         }
 
-        p.PushIncludeNewlines(true)
-        defer p.PopIncludeNewlines()
-
-        if forKeyword.TokenMatches(p.Peek()) {
+        // We must temporarily stop looking at newlines here while we check for
+        // a "for" keyword, since for expressions are _not_ newline-sensitive,
+        // even though object constructors are.
+        p.PushIncludeNewlines(false)
+        isFor := forKeyword.TokenMatches(p.Peek())
+        p.PopIncludeNewlines()
+        if isFor {
                 return p.finishParsingForExpr(open)
         }
 
+        p.PushIncludeNewlines(true)
+        defer p.PopIncludeNewlines()
+
         var close Token
 
         var diags hcl.Diagnostics
@@ -1132,19 +1304,36 @@ func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) {
                 next = p.Peek()
                 if next.Type != TokenEqual && next.Type != TokenColon {
                         if !p.recovery {
-                                if next.Type == TokenNewline || next.Type == TokenComma {
+                                switch next.Type {
+                                case TokenNewline, TokenComma:
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
-                                                Summary:  "Missing item value",
-                                                Detail:   "Expected an item value, introduced by an equals sign (\"=\").",
+                                                Summary:  "Missing attribute value",
+                                                Detail:   "Expected an attribute value, introduced by an equals sign (\"=\").",
                                                 Subject:  &next.Range,
                                                 Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
                                         })
-                                } else {
+                                case TokenIdent:
+                                        // Although this might just be a plain old missing equals
+                                        // sign before a reference, one way to get here is to try
+                                        // to write an attribute name containing a period followed
+                                        // by a digit, which was valid in HCL1, like this:
+                                        //     foo1.2_bar = "baz"
+                                        // We can't know exactly what the user intended here, but
+                                        // we'll augment our message with an extra hint in this case
+                                        // in case it is helpful.
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
                                                 Summary:  "Missing key/value separator",
-                                                Detail:   "Expected an equals sign (\"=\") to mark the beginning of the item value.",
+                                                Detail:   "Expected an equals sign (\"=\") to mark the beginning of the attribute value. If you intended to given an attribute name containing periods or spaces, write the name in quotes to create a string literal.",
+                                                Subject:  &next.Range,
+                                                Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
+                                        })
+                                default:
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Missing key/value separator",
+                                                Detail:   "Expected an equals sign (\"=\") to mark the beginning of the attribute value.",
                                                 Subject:  &next.Range,
                                                 Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
                                         })
@@ -1182,8 +1371,8 @@ func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) {
                         if !p.recovery {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
-                                        Summary:  "Missing item separator",
-                                        Detail:   "Expected a newline or comma to mark the beginning of the next item.",
+                                        Summary:  "Missing attribute separator",
+                                        Detail:   "Expected a newline or comma to mark the beginning of the next attribute.",
                                         Subject:  &next.Range,
                                         Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
                                 })
@@ -1205,6 +1394,8 @@ func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) {
 }
 
 func (p *parser) finishParsingForExpr(open Token) (Expression, hcl.Diagnostics) {
+        p.PushIncludeNewlines(false)
+        defer p.PopIncludeNewlines()
         introducer := p.Read()
         if !forKeyword.TokenMatches(introducer) {
                 // Should never happen if callers are behaving
@@ -1277,7 +1468,7 @@ func (p *parser) finishParsingForExpr(open Token) (Expression, hcl.Diagnostics)
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Invalid 'for' expression",
-                                Detail:   "For expression requires 'in' keyword after names.",
+                                Detail:   "For expression requires the 'in' keyword after its name declarations.",
                                 Subject:  p.Peek().Range.Ptr(),
                                 Context:  hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(),
                         })
@@ -1305,7 +1496,7 @@ func (p *parser) finishParsingForExpr(open Token) (Expression, hcl.Diagnostics)
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Invalid 'for' expression",
-                                Detail:   "For expression requires colon after collection expression.",
+                                Detail:   "For expression requires a colon after the collection expression.",
                                 Subject:  p.Peek().Range.Ptr(),
                                 Context:  hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(),
                         })
@@ -1459,7 +1650,7 @@ Token:
                 case TokenTemplateControl, TokenTemplateInterp:
                         which := "$"
                         if tok.Type == TokenTemplateControl {
-                                which = "!"
+                                which = "%"
                         }
 
                         diags = append(diags, &hcl.Diagnostic{
@@ -1472,7 +1663,16 @@ Token:
                                 Subject: &tok.Range,
                                 Context: hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(),
                         })
-                        p.recover(TokenTemplateSeqEnd)
+
+                        // Now that we're returning an error callers won't attempt to use
+                        // the result for any real operations, but they might try to use
+                        // the partial AST for other analyses, so we'll leave a marker
+                        // to indicate that there was something invalid in the string to
+                        // help avoid misinterpretation of the partial result
+                        ret.WriteString(which)
+                        ret.WriteString("{ ... }")
+
+                        p.recover(TokenTemplateSeqEnd) // we'll try to keep parsing after the sequence ends
 
                 case TokenEOF:
                         diags = append(diags, &hcl.Diagnostic{
@@ -1493,7 +1693,7 @@ Token:
                                 Subject:  &tok.Range,
                                 Context:  hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(),
                         })
-                        p.recover(TokenOQuote)
+                        p.recover(TokenCQuote)
                         break Token
 
                 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go
index 3711067..a141626 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go
@@ -5,16 +5,17 @@ import (
         "strings"
         "unicode"
 
+        "github.com/apparentlymart/go-textseg/textseg"
         "github.com/hashicorp/hcl2/hcl"
         "github.com/zclconf/go-cty/cty"
 )
 
 func (p *parser) ParseTemplate() (Expression, hcl.Diagnostics) {
-        return p.parseTemplate(TokenEOF)
+        return p.parseTemplate(TokenEOF, false)
 }
 
-func (p *parser) parseTemplate(end TokenType) (Expression, hcl.Diagnostics) {
-        exprs, passthru, rng, diags := p.parseTemplateInner(end)
+func (p *parser) parseTemplate(end TokenType, flushHeredoc bool) (Expression, hcl.Diagnostics) {
+        exprs, passthru, rng, diags := p.parseTemplateInner(end, flushHeredoc)
 
         if passthru {
                 if len(exprs) != 1 {
@@ -32,8 +33,11 @@ func (p *parser) parseTemplate(end TokenType) (Expression, hcl.Diagnostics) {
         }, diags
 }
 
-func (p *parser) parseTemplateInner(end TokenType) ([]Expression, bool, hcl.Range, hcl.Diagnostics) {
+func (p *parser) parseTemplateInner(end TokenType, flushHeredoc bool) ([]Expression, bool, hcl.Range, hcl.Diagnostics) {
         parts, diags := p.parseTemplateParts(end)
+        if flushHeredoc {
+                flushHeredocTemplateParts(parts) // Trim off leading spaces on lines per the flush heredoc spec
+        }
         tp := templateParser{
                 Tokens:   parts.Tokens,
                 SrcRange: parts.SrcRange,
@@ -649,6 +653,73 @@ Token:
         return ret, diags
 }
 
+// flushHeredocTemplateParts modifies in-place the line-leading literal strings
+// to apply the flush heredoc processing rule: find the line with the smallest
+// number of whitespace characters as prefix and then trim that number of
+// characters from all of the lines.
+//
+// This rule is applied to static tokens rather than to the rendered result,
+// so interpolating a string with leading whitespace cannot affect the chosen
+// prefix length.
+func flushHeredocTemplateParts(parts *templateParts) {
+        if len(parts.Tokens) == 0 {
+                // Nothing to do
+                return
+        }
+
+        const maxInt = int((^uint(0)) >> 1)
+
+        minSpaces := maxInt
+        newline := true
+        var adjust []*templateLiteralToken
+        for _, ttok := range parts.Tokens {
+                if newline {
+                        newline = false
+                        var spaces int
+                        if lit, ok := ttok.(*templateLiteralToken); ok {
+                                orig := lit.Val
+                                trimmed := strings.TrimLeftFunc(orig, unicode.IsSpace)
+                                // If a token is entirely spaces and ends with a newline
+                                // then it's a "blank line" and thus not considered for
+                                // space-prefix-counting purposes.
+                                if len(trimmed) == 0 && strings.HasSuffix(orig, "\n") {
+                                        spaces = maxInt
+                                } else {
+                                        spaceBytes := len(lit.Val) - len(trimmed)
+                                        spaces, _ = textseg.TokenCount([]byte(orig[:spaceBytes]), textseg.ScanGraphemeClusters)
+                                        adjust = append(adjust, lit)
+                                }
+                        } else if _, ok := ttok.(*templateEndToken); ok {
+                                break // don't process the end token since it never has spaces before it
+                        }
+                        if spaces < minSpaces {
+                                minSpaces = spaces
+                        }
+                }
+                if lit, ok := ttok.(*templateLiteralToken); ok {
+                        if strings.HasSuffix(lit.Val, "\n") {
+                                newline = true // The following token, if any, begins a new line
+                        }
+                }
+        }
+
+        for _, lit := range adjust {
+                // Since we want to count space _characters_ rather than space _bytes_,
+                // we can't just do a straightforward slice operation here and instead
+                // need to hunt for the split point with a scanner.
+                valBytes := []byte(lit.Val)
+                spaceByteCount := 0
+                for i := 0; i < minSpaces; i++ {
+                        adv, _, _ := textseg.ScanGraphemeClusters(valBytes, true)
+                        spaceByteCount += adv
+                        valBytes = valBytes[adv:]
+                }
+                lit.Val = lit.Val[spaceByteCount:]
+                lit.SrcRange.Start.Column += minSpaces
+                lit.SrcRange.Start.Byte += spaceByteCount
+        }
+}
+
 type templateParts struct {
         Tokens   []templateToken
         SrcRange hcl.Range
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go
index de1f524..2895ade 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go
@@ -1,10 +1,10 @@
-// line 1 "scan_string_lit.rl"
+//line scan_string_lit.rl:1
 
 package hclsyntax
 
 // This file is generated from scan_string_lit.rl. DO NOT EDIT.
 
-// line 9 "scan_string_lit.go"
+//line scan_string_lit.go:9
 var _hclstrtok_actions []byte = []byte{
         0, 1, 0, 1, 1, 2, 1, 0,
 }
@@ -114,12 +114,12 @@ const hclstrtok_error int = 0
 const hclstrtok_en_quoted int = 10
 const hclstrtok_en_unquoted int = 4
 
-// line 10 "scan_string_lit.rl"
+//line scan_string_lit.rl:10
 
 func scanStringLit(data []byte, quoted bool) [][]byte {
         var ret [][]byte
 
-        // line 61 "scan_string_lit.rl"
+//line scan_string_lit.rl:61
 
         // Ragel state
         p := 0          // "Pointer" into data
@@ -144,11 +144,11 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
             ret = append(ret, data[ts:te])
         }*/
 
-        // line 154 "scan_string_lit.go"
+//line scan_string_lit.go:154
         {
         }
 
-        // line 158 "scan_string_lit.go"
+//line scan_string_lit.go:158
         {
                 var _klen int
                 var _trans int
@@ -229,7 +229,7 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
                         _acts++
                         switch _hclstrtok_actions[_acts-1] {
                         case 0:
-                                // line 40 "scan_string_lit.rl"
+//line scan_string_lit.rl:40
 
                                 // If te is behind p then we've skipped over some literal
                                 // characters which we must now return.
@@ -239,12 +239,12 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
                                 ts = p
 
                         case 1:
-                                // line 48 "scan_string_lit.rl"
+//line scan_string_lit.rl:48
 
                                 te = p
                                 ret = append(ret, data[ts:te])
 
-                                // line 255 "scan_string_lit.go"
+//line scan_string_lit.go:253
                         }
                 }
 
@@ -267,12 +267,12 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
                                 __acts++
                                 switch _hclstrtok_actions[__acts-1] {
                                 case 1:
-                                        // line 48 "scan_string_lit.rl"
+//line scan_string_lit.rl:48
 
                                         te = p
                                         ret = append(ret, data[ts:te])
 
-                                        // line 281 "scan_string_lit.go"
+//line scan_string_lit.go:278
                                 }
                         }
                 }
@@ -282,7 +282,7 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
                 }
         }
 
-        // line 89 "scan_string_lit.rl"
+//line scan_string_lit.rl:89
 
         if te < p {
                 // Collect any leftover literal characters at the end of the input
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go
index 395e9c1..581e35e 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go
@@ -1,4 +1,4 @@
-// line 1 "scan_tokens.rl"
+//line scan_tokens.rl:1
 
 package hclsyntax
 
@@ -10,570 +10,256 @@ import (
 
 // This file is generated from scan_tokens.rl. DO NOT EDIT.
 
-// line 15 "scan_tokens.go"
+//line scan_tokens.go:15
 var _hcltok_actions []byte = []byte{
-        0, 1, 0, 1, 1, 1, 2, 1, 3,
-        1, 4, 1, 6, 1, 7, 1, 8,
-        1, 9, 1, 10, 1, 11, 1, 12,
-        1, 13, 1, 14, 1, 15, 1, 16,
-        1, 17, 1, 18, 1, 19, 1, 22,
-        1, 23, 1, 24, 1, 25, 1, 26,
-        1, 27, 1, 28, 1, 29, 1, 30,
-        1, 31, 1, 34, 1, 35, 1, 36,
-        1, 37, 1, 38, 1, 39, 1, 40,
-        1, 41, 1, 42, 1, 43, 1, 46,
-        1, 47, 1, 48, 1, 49, 1, 50,
-        1, 51, 1, 52, 1, 58, 1, 59,
-        1, 60, 1, 61, 1, 62, 1, 63,
-        1, 64, 1, 65, 1, 66, 1, 67,
-        1, 68, 1, 69, 1, 70, 1, 71,
-        1, 72, 1, 73, 1, 74, 1, 75,
-        1, 76, 1, 77, 1, 78, 1, 79,
-        1, 80, 1, 81, 1, 82, 1, 83,
-        1, 84, 1, 85, 1, 86, 1, 87,
-        2, 0, 15, 2, 1, 15, 2, 2,
-        24, 2, 2, 28, 2, 3, 24, 2,
-        3, 28, 2, 4, 5, 2, 7, 0,
-        2, 7, 1, 2, 7, 20, 2, 7,
-        21, 2, 7, 32, 2, 7, 33, 2,
-        7, 44, 2, 7, 45, 2, 7, 53,
-        2, 7, 54, 2, 7, 55, 2, 7,
-        56, 2, 7, 57, 3, 7, 2, 20,
-        3, 7, 3, 20,
+        0, 1, 0, 1, 1, 1, 3, 1, 4,
+        1, 7, 1, 8, 1, 9, 1, 10,
+        1, 11, 1, 12, 1, 13, 1, 14,
+        1, 15, 1, 16, 1, 17, 1, 18,
+        1, 19, 1, 20, 1, 23, 1, 24,
+        1, 25, 1, 26, 1, 27, 1, 28,
+        1, 29, 1, 30, 1, 31, 1, 32,
+        1, 35, 1, 36, 1, 37, 1, 38,
+        1, 39, 1, 40, 1, 41, 1, 42,
+        1, 43, 1, 44, 1, 47, 1, 48,
+        1, 49, 1, 50, 1, 51, 1, 52,
+        1, 53, 1, 56, 1, 57, 1, 58,
+        1, 59, 1, 60, 1, 61, 1, 62,
+        1, 63, 1, 64, 1, 65, 1, 66,
+        1, 67, 1, 68, 1, 69, 1, 70,
+        1, 71, 1, 72, 1, 73, 1, 74,
+        1, 75, 1, 76, 1, 77, 1, 78,
+        1, 79, 1, 80, 1, 81, 1, 82,
+        1, 83, 1, 84, 1, 85, 2, 0,
+        14, 2, 0, 25, 2, 0, 29, 2,
+        0, 37, 2, 0, 41, 2, 1, 2,
+        2, 4, 5, 2, 4, 6, 2, 4,
+        21, 2, 4, 22, 2, 4, 33, 2,
+        4, 34, 2, 4, 45, 2, 4, 46,
+        2, 4, 54, 2, 4, 55,
 }
 
 var _hcltok_key_offsets []int16 = []int16{
-        0, 0, 1, 2, 3, 5, 10, 14,
-        16, 58, 99, 145, 146, 150, 156, 156,
-        158, 160, 169, 175, 182, 183, 186, 187,
-        191, 196, 205, 209, 213, 221, 223, 225,
-        227, 230, 262, 264, 266, 270, 274, 277,
-        288, 301, 320, 333, 349, 361, 377, 392,
-        413, 423, 435, 446, 460, 475, 485, 497,
-        506, 518, 520, 524, 545, 554, 564, 570,
-        576, 577, 626, 628, 632, 634, 640, 647,
-        655, 662, 665, 671, 675, 679, 681, 685,
-        689, 693, 699, 707, 715, 721, 723, 727,
-        729, 735, 739, 743, 747, 751, 756, 763,
-        769, 771, 773, 777, 779, 785, 789, 793,
-        803, 808, 822, 837, 839, 847, 849, 854,
-        868, 873, 875, 879, 880, 884, 890, 896,
-        906, 916, 927, 935, 938, 941, 945, 949,
-        951, 954, 954, 957, 959, 989, 991, 993,
-        997, 1002, 1006, 1011, 1013, 1015, 1017, 1026,
-        1030, 1034, 1040, 1042, 1050, 1058, 1070, 1073,
-        1079, 1083, 1085, 1089, 1109, 1111, 1113, 1124,
-        1130, 1132, 1134, 1136, 1140, 1146, 1152, 1154,
-        1159, 1163, 1165, 1173, 1191, 1231, 1241, 1245,
-        1247, 1249, 1250, 1254, 1258, 1262, 1266, 1270,
-        1275, 1279, 1283, 1287, 1289, 1291, 1295, 1305,
-        1309, 1311, 1315, 1319, 1323, 1336, 1338, 1340,
-        1344, 1346, 1350, 1352, 1354, 1384, 1388, 1392,
-        1396, 1399, 1406, 1411, 1422, 1426, 1442, 1456,
-        1460, 1465, 1469, 1473, 1479, 1481, 1487, 1489,
-        1493, 1495, 1501, 1506, 1511, 1521, 1523, 1525,
-        1529, 1533, 1535, 1548, 1550, 1554, 1558, 1566,
-        1568, 1572, 1574, 1575, 1578, 1583, 1585, 1587,
-        1591, 1593, 1597, 1603, 1623, 1629, 1635, 1637,
-        1638, 1648, 1649, 1657, 1664, 1666, 1669, 1671,
-        1673, 1675, 1680, 1684, 1688, 1693, 1703, 1713,
-        1717, 1721, 1735, 1761, 1771, 1773, 1775, 1778,
-        1780, 1783, 1785, 1789, 1791, 1792, 1796, 1798,
-        1801, 1808, 1816, 1818, 1820, 1824, 1826, 1832,
-        1843, 1846, 1848, 1852, 1857, 1887, 1892, 1894,
-        1897, 1902, 1916, 1923, 1937, 1942, 1955, 1959,
-        1972, 1977, 1995, 1996, 2005, 2009, 2021, 2026,
-        2033, 2040, 2047, 2049, 2053, 2075, 2080, 2081,
-        2085, 2087, 2137, 2140, 2151, 2155, 2157, 2163,
-        2169, 2171, 2176, 2178, 2182, 2184, 2185, 2187,
-        2189, 2195, 2197, 2199, 2203, 2209, 2222, 2224,
-        2230, 2234, 2242, 2253, 2261, 2264, 2294, 2300,
-        2303, 2308, 2310, 2314, 2318, 2322, 2324, 2331,
-        2333, 2342, 2349, 2357, 2359, 2379, 2391, 2395,
-        2397, 2415, 2454, 2456, 2460, 2462, 2469, 2473,
-        2501, 2503, 2505, 2507, 2509, 2512, 2514, 2518,
-        2522, 2524, 2527, 2529, 2531, 2534, 2536, 2538,
-        2539, 2541, 2543, 2547, 2551, 2554, 2567, 2569,
-        2575, 2579, 2581, 2585, 2589, 2603, 2606, 2615,
-        2617, 2621, 2627, 2627, 2629, 2631, 2640, 2646,
-        2653, 2654, 2657, 2658, 2662, 2667, 2676, 2680,
-        2684, 2692, 2694, 2696, 2698, 2701, 2733, 2735,
-        2737, 2741, 2745, 2748, 2759, 2772, 2791, 2804,
-        2820, 2832, 2848, 2863, 2884, 2894, 2906, 2917,
-        2931, 2946, 2956, 2968, 2977, 2989, 2991, 2995,
-        3016, 3025, 3035, 3041, 3047, 3048, 3097, 3099,
-        3103, 3105, 3111, 3118, 3126, 3133, 3136, 3142,
-        3146, 3150, 3152, 3156, 3160, 3164, 3170, 3178,
-        3186, 3192, 3194, 3198, 3200, 3206, 3210, 3214,
-        3218, 3222, 3227, 3234, 3240, 3242, 3244, 3248,
-        3250, 3256, 3260, 3264, 3274, 3279, 3293, 3308,
-        3310, 3318, 3320, 3325, 3339, 3344, 3346, 3350,
-        3351, 3355, 3361, 3367, 3377, 3387, 3398, 3406,
-        3409, 3412, 3416, 3420, 3422, 3425, 3425, 3428,
-        3430, 3460, 3462, 3464, 3468, 3473, 3477, 3482,
-        3484, 3486, 3488, 3497, 3501, 3505, 3511, 3513,
-        3521, 3529, 3541, 3544, 3550, 3554, 3556, 3560,
-        3580, 3582, 3584, 3595, 3601, 3603, 3605, 3607,
-        3611, 3617, 3623, 3625, 3630, 3634, 3636, 3644,
-        3662, 3702, 3712, 3716, 3718, 3720, 3721, 3725,
-        3729, 3733, 3737, 3741, 3746, 3750, 3754, 3758,
-        3760, 3762, 3766, 3776, 3780, 3782, 3786, 3790,
-        3794, 3807, 3809, 3811, 3815, 3817, 3821, 3823,
-        3825, 3855, 3859, 3863, 3867, 3870, 3877, 3882,
-        3893, 3897, 3913, 3927, 3931, 3936, 3940, 3944,
-        3950, 3952, 3958, 3960, 3964, 3966, 3972, 3977,
-        3982, 3992, 3994, 3996, 4000, 4004, 4006, 4019,
-        4021, 4025, 4029, 4037, 4039, 4043, 4045, 4046,
-        4049, 4054, 4056, 4058, 4062, 4064, 4068, 4074,
-        4094, 4100, 4106, 4108, 4109, 4119, 4120, 4128,
-        4135, 4137, 4140, 4142, 4144, 4146, 4151, 4155,
-        4159, 4164, 4174, 4184, 4188, 4192, 4206, 4232,
-        4242, 4244, 4246, 4249, 4251, 4254, 4256, 4260,
-        4262, 4263, 4267, 4269, 4271, 4278, 4282, 4289,
-        4296, 4305, 4321, 4333, 4351, 4362, 4374, 4382,
-        4400, 4408, 4438, 4441, 4451, 4461, 4473, 4484,
-        4493, 4506, 4518, 4522, 4528, 4555, 4564, 4567,
-        4572, 4578, 4583, 4604, 4608, 4614, 4614, 4621,
-        4630, 4638, 4641, 4645, 4651, 4657, 4660, 4664,
-        4671, 4677, 4686, 4695, 4699, 4703, 4707, 4711,
-        4718, 4722, 4726, 4736, 4742, 4746, 4752, 4756,
-        4759, 4765, 4771, 4783, 4787, 4791, 4801, 4805,
-        4816, 4818, 4820, 4824, 4836, 4841, 4865, 4869,
-        4875, 4897, 4906, 4910, 4913, 4914, 4922, 4930,
-        4936, 4946, 4953, 4971, 4974, 4977, 4985, 4991,
-        4995, 4999, 5003, 5009, 5017, 5022, 5028, 5032,
-        5040, 5047, 5051, 5058, 5064, 5072, 5080, 5086,
-        5092, 5103, 5107, 5119, 5128, 5145, 5162, 5165,
-        5169, 5171, 5177, 5179, 5183, 5198, 5202, 5206,
-        5210, 5214, 5218, 5220, 5226, 5231, 5235, 5241,
-        5248, 5251, 5269, 5271, 5316, 5322, 5328, 5332,
-        5336, 5342, 5346, 5352, 5358, 5365, 5367, 5373,
-        5379, 5383, 5387, 5395, 5408, 5414, 5421, 5429,
-        5435, 5444, 5450, 5454, 5459, 5463, 5471, 5475,
-        5479, 5509, 5515, 5521, 5527, 5533, 5540, 5546,
-        5553, 5558, 5568, 5572, 5579, 5585, 5589, 5596,
-        5600, 5606, 5609, 5613, 5617, 5621, 5625, 5630,
-        5635, 5639, 5650, 5654, 5658, 5664, 5672, 5676,
-        5693, 5697, 5703, 5713, 5719, 5725, 5728, 5733,
-        5742, 5746, 5750, 5756, 5760, 5766, 5774, 5792,
-        5793, 5803, 5804, 5813, 5821, 5823, 5826, 5828,
-        5830, 5832, 5837, 5850, 5854, 5869, 5898, 5909,
-        5911, 5915, 5919, 5924, 5928, 5930, 5937, 5941,
-        5949, 5953, 5954, 5955, 5957, 5959, 5961, 5963,
-        5965, 5966, 5967, 5968, 5970, 5972, 5974, 5975,
-        5976, 5977, 5978, 5980, 5982, 5984, 5985, 5986,
-        5990, 5996, 5996, 5998, 6000, 6009, 6015, 6022,
-        6023, 6026, 6027, 6031, 6036, 6045, 6049, 6053,
-        6061, 6063, 6065, 6067, 6070, 6102, 6104, 6106,
-        6110, 6114, 6117, 6128, 6141, 6160, 6173, 6189,
-        6201, 6217, 6232, 6253, 6263, 6275, 6286, 6300,
-        6315, 6325, 6337, 6346, 6358, 6360, 6364, 6385,
-        6394, 6404, 6410, 6416, 6417, 6466, 6468, 6472,
-        6474, 6480, 6487, 6495, 6502, 6505, 6511, 6515,
-        6519, 6521, 6525, 6529, 6533, 6539, 6547, 6555,
-        6561, 6563, 6567, 6569, 6575, 6579, 6583, 6587,
-        6591, 6596, 6603, 6609, 6611, 6613, 6617, 6619,
-        6625, 6629, 6633, 6643, 6648, 6662, 6677, 6679,
-        6687, 6689, 6694, 6708, 6713, 6715, 6719, 6720,
-        6724, 6730, 6736, 6746, 6756, 6767, 6775, 6778,
-        6781, 6785, 6789, 6791, 6794, 6794, 6797, 6799,
-        6829, 6831, 6833, 6837, 6842, 6846, 6851, 6853,
-        6855, 6857, 6866, 6870, 6874, 6880, 6882, 6890,
-        6898, 6910, 6913, 6919, 6923, 6925, 6929, 6949,
-        6951, 6953, 6964, 6970, 6972, 6974, 6976, 6980,
-        6986, 6992, 6994, 6999, 7003, 7005, 7013, 7031,
-        7071, 7081, 7085, 7087, 7089, 7090, 7094, 7098,
-        7102, 7106, 7110, 7115, 7119, 7123, 7127, 7129,
-        7131, 7135, 7145, 7149, 7151, 7155, 7159, 7163,
-        7176, 7178, 7180, 7184, 7186, 7190, 7192, 7194,
-        7224, 7228, 7232, 7236, 7239, 7246, 7251, 7262,
-        7266, 7282, 7296, 7300, 7305, 7309, 7313, 7319,
-        7321, 7327, 7329, 7333, 7335, 7341, 7346, 7351,
-        7361, 7363, 7365, 7369, 7373, 7375, 7388, 7390,
-        7394, 7398, 7406, 7408, 7412, 7414, 7415, 7418,
-        7423, 7425, 7427, 7431, 7433, 7437, 7443, 7463,
-        7469, 7475, 7477, 7478, 7488, 7489, 7497, 7504,
-        7506, 7509, 7511, 7513, 7515, 7520, 7524, 7528,
-        7533, 7543, 7553, 7557, 7561, 7575, 7601, 7611,
-        7613, 7615, 7618, 7620, 7623, 7625, 7629, 7631,
-        7632, 7636, 7638, 7640, 7647, 7651, 7658, 7665,
-        7674, 7690, 7702, 7720, 7731, 7743, 7751, 7769,
-        7777, 7807, 7810, 7820, 7830, 7842, 7853, 7862,
-        7875, 7887, 7891, 7897, 7924, 7933, 7936, 7941,
-        7947, 7952, 7973, 7977, 7983, 7983, 7990, 7999,
-        8007, 8010, 8014, 8020, 8026, 8029, 8033, 8040,
-        8046, 8055, 8064, 8068, 8072, 8076, 8080, 8087,
-        8091, 8095, 8105, 8111, 8115, 8121, 8125, 8128,
-        8134, 8140, 8152, 8156, 8160, 8170, 8174, 8185,
-        8187, 8189, 8193, 8205, 8210, 8234, 8238, 8244,
-        8266, 8275, 8279, 8282, 8283, 8291, 8299, 8305,
-        8315, 8322, 8340, 8343, 8346, 8354, 8360, 8364,
-        8368, 8372, 8378, 8386, 8391, 8397, 8401, 8409,
-        8416, 8420, 8427, 8433, 8441, 8449, 8455, 8461,
-        8472, 8476, 8488, 8497, 8514, 8531, 8534, 8538,
-        8540, 8546, 8548, 8552, 8567, 8571, 8575, 8579,
-        8583, 8587, 8589, 8595, 8600, 8604, 8610, 8617,
-        8620, 8638, 8640, 8685, 8691, 8697, 8701, 8705,
-        8711, 8715, 8721, 8727, 8734, 8736, 8742, 8748,
-        8752, 8756, 8764, 8777, 8783, 8790, 8798, 8804,
-        8813, 8819, 8823, 8828, 8832, 8840, 8844, 8848,
-        8878, 8884, 8890, 8896, 8902, 8909, 8915, 8922,
-        8927, 8937, 8941, 8948, 8954, 8958, 8965, 8969,
-        8975, 8978, 8982, 8986, 8990, 8994, 8999, 9004,
-        9008, 9019, 9023, 9027, 9033, 9041, 9045, 9062,
-        9066, 9072, 9082, 9088, 9094, 9097, 9102, 9111,
-        9115, 9119, 9125, 9129, 9135, 9143, 9161, 9162,
-        9172, 9173, 9182, 9190, 9192, 9195, 9197, 9199,
-        9201, 9206, 9219, 9223, 9238, 9267, 9278, 9280,
-        9284, 9288, 9293, 9297, 9299, 9306, 9310, 9318,
-        9322, 9398, 9400, 9401, 9402, 9403, 9404, 9405,
-        9407, 9408, 9413, 9415, 9417, 9418, 9462, 9463,
-        9464, 9466, 9471, 9475, 9475, 9477, 9479, 9490,
-        9500, 9508, 9509, 9511, 9512, 9516, 9520, 9530,
-        9534, 9541, 9552, 9559, 9563, 9569, 9580, 9612,
-        9661, 9676, 9691, 9696, 9698, 9703, 9735, 9743,
-        9745, 9767, 9789, 9791, 9807, 9823, 9839, 9855,
-        9870, 9880, 9897, 9914, 9931, 9947, 9957, 9974,
-        9990, 10006, 10022, 10038, 10054, 10070, 10086, 10087,
-        10088, 10089, 10090, 10092, 10094, 10096, 10110, 10124,
-        10138, 10152, 10153, 10154, 10156, 10158, 10160, 10174,
-        10188, 10189, 10190, 10192, 10194, 10196, 10245, 10289,
-        10291, 10296, 10300, 10300, 10302, 10304, 10315, 10325,
-        10333, 10334, 10336, 10337, 10341, 10345, 10355, 10359,
-        10366, 10377, 10384, 10388, 10394, 10405, 10437, 10486,
-        10501, 10516, 10521, 10523, 10528, 10560, 10568, 10570,
-        10592, 10614,
+        0, 0, 1, 2, 4, 9, 13, 15,
+        57, 98, 144, 145, 149, 155, 155, 157,
+        159, 168, 174, 181, 182, 185, 186, 190,
+        195, 204, 208, 212, 220, 222, 224, 226,
+        229, 261, 263, 265, 269, 273, 276, 287,
+        300, 319, 332, 348, 360, 376, 391, 412,
+        422, 434, 445, 459, 474, 484, 496, 505,
+        517, 519, 523, 544, 553, 563, 569, 575,
+        576, 625, 627, 631, 633, 639, 646, 654,
+        661, 664, 670, 674, 678, 680, 684, 688,
+        692, 698, 706, 714, 720, 722, 726, 728,
+        734, 738, 742, 746, 750, 755, 762, 768,
+        770, 772, 776, 778, 784, 788, 792, 802,
+        807, 821, 836, 838, 846, 848, 853, 867,
+        872, 874, 878, 879, 883, 889, 895, 905,
+        915, 926, 934, 937, 940, 944, 948, 950,
+        953, 953, 956, 958, 988, 990, 992, 996,
+        1001, 1005, 1010, 1012, 1014, 1016, 1025, 1029,
+        1033, 1039, 1041, 1049, 1057, 1069, 1072, 1078,
+        1082, 1084, 1088, 1108, 1110, 1112, 1123, 1129,
+        1131, 1133, 1135, 1139, 1145, 1151, 1153, 1158,
+        1162, 1164, 1172, 1190, 1230, 1240, 1244, 1246,
+        1248, 1249, 1253, 1257, 1261, 1265, 1269, 1274,
+        1278, 1282, 1286, 1288, 1290, 1294, 1304, 1308,
+        1310, 1314, 1318, 1322, 1335, 1337, 1339, 1343,
+        1345, 1349, 1351, 1353, 1383, 1387, 1391, 1395,
+        1398, 1405, 1410, 1421, 1425, 1441, 1455, 1459,
+        1464, 1468, 1472, 1478, 1480, 1486, 1488, 1492,
+        1494, 1500, 1505, 1510, 1520, 1522, 1524, 1528,
+        1532, 1534, 1547, 1549, 1553, 1557, 1565, 1567,
+        1571, 1573, 1574, 1577, 1582, 1584, 1586, 1590,
+        1592, 1596, 1602, 1622, 1628, 1634, 1636, 1637,
+        1647, 1648, 1656, 1663, 1665, 1668, 1670, 1672,
+        1674, 1679, 1683, 1687, 1692, 1702, 1712, 1716,
+        1720, 1734, 1760, 1770, 1772, 1774, 1777, 1779,
+        1782, 1784, 1788, 1790, 1791, 1795, 1797, 1800,
+        1807, 1815, 1817, 1819, 1823, 1825, 1831, 1842,
+        1845, 1847, 1851, 1856, 1886, 1891, 1893, 1896,
+        1901, 1915, 1922, 1936, 1941, 1954, 1958, 1971,
+        1976, 1994, 1995, 2004, 2008, 2020, 2025, 2032,
+        2039, 2046, 2048, 2052, 2074, 2079, 2080, 2084,
+        2086, 2136, 2139, 2150, 2154, 2156, 2162, 2168,
+        2170, 2175, 2177, 2181, 2183, 2184, 2186, 2188,
+        2194, 2196, 2198, 2202, 2208, 2221, 2223, 2229,
+        2233, 2241, 2252, 2260, 2263, 2293, 2299, 2302,
+        2307, 2309, 2313, 2317, 2321, 2323, 2330, 2332,
+        2341, 2348, 2356, 2358, 2378, 2390, 2394, 2396,
+        2414, 2453, 2455, 2459, 2461, 2468, 2472, 2500,
+        2502, 2504, 2506, 2508, 2511, 2513, 2517, 2521,
+        2523, 2526, 2528, 2530, 2533, 2535, 2537, 2538,
+        2540, 2542, 2546, 2550, 2553, 2566, 2568, 2574,
+        2578, 2580, 2584, 2588, 2602, 2605, 2614, 2616,
+        2620, 2626, 2626, 2628, 2630, 2639, 2645, 2652,
+        2653, 2656, 2657, 2661, 2666, 2675, 2679, 2683,
+        2691, 2693, 2695, 2697, 2700, 2732, 2734, 2736,
+        2740, 2744, 2747, 2758, 2771, 2790, 2803, 2819,
+        2831, 2847, 2862, 2883, 2893, 2905, 2916, 2930,
+        2945, 2955, 2967, 2976, 2988, 2990, 2994, 3015,
+        3024, 3034, 3040, 3046, 3047, 3096, 3098, 3102,
+        3104, 3110, 3117, 3125, 3132, 3135, 3141, 3145,
+        3149, 3151, 3155, 3159, 3163, 3169, 3177, 3185,
+        3191, 3193, 3197, 3199, 3205, 3209, 3213, 3217,
+        3221, 3226, 3233, 3239, 3241, 3243, 3247, 3249,
+        3255, 3259, 3263, 3273, 3278, 3292, 3307, 3309,
+        3317, 3319, 3324, 3338, 3343, 3345, 3349, 3350,
+        3354, 3360, 3366, 3376, 3386, 3397, 3405, 3408,
+        3411, 3415, 3419, 3421, 3424, 3424, 3427, 3429,
+        3459, 3461, 3463, 3467, 3472, 3476, 3481, 3483,
+        3485, 3487, 3496, 3500, 3504, 3510, 3512, 3520,
+        3528, 3540, 3543, 3549, 3553, 3555, 3559, 3579,
+        3581, 3583, 3594, 3600, 3602, 3604, 3606, 3610,
+        3616, 3622, 3624, 3629, 3633, 3635, 3643, 3661,
+        3701, 3711, 3715, 3717, 3719, 3720, 3724, 3728,
+        3732, 3736, 3740, 3745, 3749, 3753, 3757, 3759,
+        3761, 3765, 3775, 3779, 3781, 3785, 3789, 3793,
+        3806, 3808, 3810, 3814, 3816, 3820, 3822, 3824,
+        3854, 3858, 3862, 3866, 3869, 3876, 3881, 3892,
+        3896, 3912, 3926, 3930, 3935, 3939, 3943, 3949,
+        3951, 3957, 3959, 3963, 3965, 3971, 3976, 3981,
+        3991, 3993, 3995, 3999, 4003, 4005, 4018, 4020,
+        4024, 4028, 4036, 4038, 4042, 4044, 4045, 4048,
+        4053, 4055, 4057, 4061, 4063, 4067, 4073, 4093,
+        4099, 4105, 4107, 4108, 4118, 4119, 4127, 4134,
+        4136, 4139, 4141, 4143, 4145, 4150, 4154, 4158,
+        4163, 4173, 4183, 4187, 4191, 4205, 4231, 4241,
+        4243, 4245, 4248, 4250, 4253, 4255, 4259, 4261,
+        4262, 4266, 4268, 4270, 4277, 4281, 4288, 4295,
+        4304, 4320, 4332, 4350, 4361, 4373, 4381, 4399,
+        4407, 4437, 4440, 4450, 4460, 4472, 4483, 4492,
+        4505, 4517, 4521, 4527, 4554, 4563, 4566, 4571,
+        4577, 4582, 4603, 4607, 4613, 4613, 4620, 4629,
+        4637, 4640, 4644, 4650, 4656, 4659, 4663, 4670,
+        4676, 4685, 4694, 4698, 4702, 4706, 4710, 4717,
+        4721, 4725, 4735, 4741, 4745, 4751, 4755, 4758,
+        4764, 4770, 4782, 4786, 4790, 4800, 4804, 4815,
+        4817, 4819, 4823, 4835, 4840, 4864, 4868, 4874,
+        4896, 4905, 4909, 4912, 4913, 4921, 4929, 4935,
+        4945, 4952, 4970, 4973, 4976, 4984, 4990, 4994,
+        4998, 5002, 5008, 5016, 5021, 5027, 5031, 5039,
+        5046, 5050, 5057, 5063, 5071, 5079, 5085, 5091,
+        5102, 5106, 5118, 5127, 5144, 5161, 5164, 5168,
+        5170, 5176, 5178, 5182, 5197, 5201, 5205, 5209,
+        5213, 5217, 5219, 5225, 5230, 5234, 5240, 5247,
+        5250, 5268, 5270, 5315, 5321, 5327, 5331, 5335,
+        5341, 5345, 5351, 5357, 5364, 5366, 5372, 5378,
+        5382, 5386, 5394, 5407, 5413, 5420, 5428, 5434,
+        5443, 5449, 5453, 5458, 5462, 5470, 5474, 5478,
+        5508, 5514, 5520, 5526, 5532, 5539, 5545, 5552,
+        5557, 5567, 5571, 5578, 5584, 5588, 5595, 5599,
+        5605, 5608, 5612, 5616, 5620, 5624, 5629, 5634,
+        5638, 5649, 5653, 5657, 5663, 5671, 5675, 5692,
+        5696, 5702, 5712, 5718, 5724, 5727, 5732, 5741,
+        5745, 5749, 5755, 5759, 5765, 5773, 5791, 5792,
+        5802, 5803, 5812, 5820, 5822, 5825, 5827, 5829,
+        5831, 5836, 5849, 5853, 5868, 5897, 5908, 5910,
+        5914, 5918, 5923, 5927, 5929, 5936, 5940, 5948,
+        5952, 5964, 5966, 5968, 5970, 5972, 5974, 5975,
+        5977, 5979, 5981, 5983, 5985, 5986, 5988, 5990,
+        5992, 5994, 5996, 6000, 6006, 6006, 6008, 6010,
+        6019, 6025, 6032, 6033, 6036, 6037, 6041, 6046,
+        6055, 6059, 6063, 6071, 6073, 6075, 6077, 6080,
+        6112, 6114, 6116, 6120, 6124, 6127, 6138, 6151,
+        6170, 6183, 6199, 6211, 6227, 6242, 6263, 6273,
+        6285, 6296, 6310, 6325, 6335, 6347, 6356, 6368,
+        6370, 6374, 6395, 6404, 6414, 6420, 6426, 6427,
+        6476, 6478, 6482, 6484, 6490, 6497, 6505, 6512,
+        6515, 6521, 6525, 6529, 6531, 6535, 6539, 6543,
+        6549, 6557, 6565, 6571, 6573, 6577, 6579, 6585,
+        6589, 6593, 6597, 6601, 6606, 6613, 6619, 6621,
+        6623, 6627, 6629, 6635, 6639, 6643, 6653, 6658,
+        6672, 6687, 6689, 6697, 6699, 6704, 6718, 6723,
+        6725, 6729, 6730, 6734, 6740, 6746, 6756, 6766,
+        6777, 6785, 6788, 6791, 6795, 6799, 6801, 6804,
+        6804, 6807, 6809, 6839, 6841, 6843, 6847, 6852,
+        6856, 6861, 6863, 6865, 6867, 6876, 6880, 6884,
+        6890, 6892, 6900, 6908, 6920, 6923, 6929, 6933,
+        6935, 6939, 6959, 6961, 6963, 6974, 6980, 6982,
+        6984, 6986, 6990, 6996, 7002, 7004, 7009, 7013,
+        7015, 7023, 7041, 7081, 7091, 7095, 7097, 7099,
+        7100, 7104, 7108, 7112, 7116, 7120, 7125, 7129,
+        7133, 7137, 7139, 7141, 7145, 7155, 7159, 7161,
+        7165, 7169, 7173, 7186, 7188, 7190, 7194, 7196,
+        7200, 7202, 7204, 7234, 7238, 7242, 7246, 7249,
+        7256, 7261, 7272, 7276, 7292, 7306, 7310, 7315,
+        7319, 7323, 7329, 7331, 7337, 7339, 7343, 7345,
+        7351, 7356, 7361, 7371, 7373, 7375, 7379, 7383,
+        7385, 7398, 7400, 7404, 7408, 7416, 7418, 7422,
+        7424, 7425, 7428, 7433, 7435, 7437, 7441, 7443,
+        7447, 7453, 7473, 7479, 7485, 7487, 7488, 7498,
+        7499, 7507, 7514, 7516, 7519, 7521, 7523, 7525,
+        7530, 7534, 7538, 7543, 7553, 7563, 7567, 7571,
+        7585, 7611, 7621, 7623, 7625, 7628, 7630, 7633,
+        7635, 7639, 7641, 7642, 7646, 7648, 7650, 7657,
+        7661, 7668, 7675, 7684, 7700, 7712, 7730, 7741,
+        7753, 7761, 7779, 7787, 7817, 7820, 7830, 7840,
+        7852, 7863, 7872, 7885, 7897, 7901, 7907, 7934,
+        7943, 7946, 7951, 7957, 7962, 7983, 7987, 7993,
+        7993, 8000, 8009, 8017, 8020, 8024, 8030, 8036,
+        8039, 8043, 8050, 8056, 8065, 8074, 8078, 8082,
+        8086, 8090, 8097, 8101, 8105, 8115, 8121, 8125,
+        8131, 8135, 8138, 8144, 8150, 8162, 8166, 8170,
+        8180, 8184, 8195, 8197, 8199, 8203, 8215, 8220,
+        8244, 8248, 8254, 8276, 8285, 8289, 8292, 8293,
+        8301, 8309, 8315, 8325, 8332, 8350, 8353, 8356,
+        8364, 8370, 8374, 8378, 8382, 8388, 8396, 8401,
+        8407, 8411, 8419, 8426, 8430, 8437, 8443, 8451,
+        8459, 8465, 8471, 8482, 8486, 8498, 8507, 8524,
+        8541, 8544, 8548, 8550, 8556, 8558, 8562, 8577,
+        8581, 8585, 8589, 8593, 8597, 8599, 8605, 8610,
+        8614, 8620, 8627, 8630, 8648, 8650, 8695, 8701,
+        8707, 8711, 8715, 8721, 8725, 8731, 8737, 8744,
+        8746, 8752, 8758, 8762, 8766, 8774, 8787, 8793,
+        8800, 8808, 8814, 8823, 8829, 8833, 8838, 8842,
+        8850, 8854, 8858, 8888, 8894, 8900, 8906, 8912,
+        8919, 8925, 8932, 8937, 8947, 8951, 8958, 8964,
+        8968, 8975, 8979, 8985, 8988, 8992, 8996, 9000,
+        9004, 9009, 9014, 9018, 9029, 9033, 9037, 9043,
+        9051, 9055, 9072, 9076, 9082, 9092, 9098, 9104,
+        9107, 9112, 9121, 9125, 9129, 9135, 9139, 9145,
+        9153, 9171, 9172, 9182, 9183, 9192, 9200, 9202,
+        9205, 9207, 9209, 9211, 9216, 9229, 9233, 9248,
+        9277, 9288, 9290, 9294, 9298, 9303, 9307, 9309,
+        9316, 9320, 9328, 9332, 9407, 9409, 9410, 9411,
+        9412, 9413, 9414, 9416, 9421, 9423, 9425, 9426,
+        9470, 9471, 9472, 9474, 9479, 9483, 9483, 9485,
+        9487, 9498, 9508, 9516, 9517, 9519, 9520, 9524,
+        9528, 9538, 9542, 9549, 9560, 9567, 9571, 9577,
+        9588, 9620, 9669, 9684, 9699, 9704, 9706, 9711,
+        9743, 9751, 9753, 9775, 9797, 9799, 9815, 9831,
+        9833, 9835, 9835, 9836, 9837, 9838, 9840, 9841,
+        9853, 9855, 9857, 9859, 9873, 9887, 9889, 9892,
+        9895, 9897, 9898, 9899, 9901, 9903, 9905, 9919,
+        9933, 9935, 9938, 9941, 9943, 9944, 9945, 9947,
+        9949, 9951, 10000, 10044, 10046, 10051, 10055, 10055,
+        10057, 10059, 10070, 10080, 10088, 10089, 10091, 10092,
+        10096, 10100, 10110, 10114, 10121, 10132, 10139, 10143,
+        10149, 10160, 10192, 10241, 10256, 10271, 10276, 10278,
+        10283, 10315, 10323, 10325, 10347, 10369,
 }
 
 var _hcltok_trans_keys []byte = []byte{
-        10, 46, 42, 42, 47, 46, 69, 101,
-        48, 57, 43, 45, 48, 57, 48, 57,
-        45, 95, 194, 195, 198, 199, 203, 205,
+        46, 42, 42, 47, 46, 69, 101, 48,
+        57, 43, 45, 48, 57, 48, 57, 45,
+        95, 194, 195, 198, 199, 203, 205, 206,
+        207, 210, 212, 213, 214, 215, 216, 217,
+        219, 220, 221, 222, 223, 224, 225, 226,
+        227, 228, 233, 234, 237, 239, 240, 65,
+        90, 97, 122, 196, 202, 208, 218, 229,
+        236, 95, 194, 195, 198, 199, 203, 205,
         206, 207, 210, 212, 213, 214, 215, 216,
         217, 219, 220, 221, 222, 223, 224, 225,
         226, 227, 228, 233, 234, 237, 239, 240,
         65, 90, 97, 122, 196, 202, 208, 218,
-        229, 236, 95, 194, 195, 198, 199, 203,
-        205, 206, 207, 210, 212, 213, 214, 215,
-        216, 217, 219, 220, 221, 222, 223, 224,
-        225, 226, 227, 228, 233, 234, 237, 239,
-        240, 65, 90, 97, 122, 196, 202, 208,
-        218, 229, 236, 10, 13, 45, 95, 194,
-        195, 198, 199, 203, 204, 205, 206, 207,
-        210, 212, 213, 214, 215, 216, 217, 219,
-        220, 221, 222, 223, 224, 225, 226, 227,
-        228, 233, 234, 237, 239, 240, 243, 48,
-        57, 65, 90, 97, 122, 196, 218, 229,
-        236, 10, 170, 181, 183, 186, 128, 150,
-        152, 182, 184, 255, 192, 255, 0, 127,
-        173, 130, 133, 146, 159, 165, 171, 175,
-        255, 181, 190, 184, 185, 192, 255, 140,
-        134, 138, 142, 161, 163, 255, 182, 130,
-        136, 137, 176, 151, 152, 154, 160, 190,
-        136, 144, 192, 255, 135, 129, 130, 132,
-        133, 144, 170, 176, 178, 144, 154, 160,
-        191, 128, 169, 174, 255, 148, 169, 157,
-        158, 189, 190, 192, 255, 144, 255, 139,
-        140, 178, 255, 186, 128, 181, 160, 161,
-        162, 163, 164, 165, 166, 167, 168, 169,
-        170, 171, 172, 173, 174, 175, 176, 177,
-        178, 179, 180, 181, 182, 183, 184, 185,
-        186, 187, 188, 189, 190, 191, 128, 173,
-        128, 155, 160, 180, 182, 189, 148, 161,
-        163, 255, 176, 164, 165, 132, 169, 177,
-        141, 142, 145, 146, 179, 181, 186, 187,
-        158, 133, 134, 137, 138, 143, 150, 152,
-        155, 164, 165, 178, 255, 188, 129, 131,
-        133, 138, 143, 144, 147, 168, 170, 176,
-        178, 179, 181, 182, 184, 185, 190, 255,
-        157, 131, 134, 137, 138, 142, 144, 146,
-        152, 159, 165, 182, 255, 129, 131, 133,
-        141, 143, 145, 147, 168, 170, 176, 178,
-        179, 181, 185, 188, 255, 134, 138, 142,
-        143, 145, 159, 164, 165, 176, 184, 186,
-        255, 129, 131, 133, 140, 143, 144, 147,
-        168, 170, 176, 178, 179, 181, 185, 188,
-        191, 177, 128, 132, 135, 136, 139, 141,
-        150, 151, 156, 157, 159, 163, 166, 175,
-        156, 130, 131, 133, 138, 142, 144, 146,
-        149, 153, 154, 158, 159, 163, 164, 168,
-        170, 174, 185, 190, 191, 144, 151, 128,
-        130, 134, 136, 138, 141, 166, 175, 128,
-        131, 133, 140, 142, 144, 146, 168, 170,
-        185, 189, 255, 133, 137, 151, 142, 148,
-        155, 159, 164, 165, 176, 255, 128, 131,
-        133, 140, 142, 144, 146, 168, 170, 179,
-        181, 185, 188, 191, 158, 128, 132, 134,
-        136, 138, 141, 149, 150, 160, 163, 166,
-        175, 177, 178, 129, 131, 133, 140, 142,
-        144, 146, 186, 189, 255, 133, 137, 143,
-        147, 152, 158, 164, 165, 176, 185, 192,
-        255, 189, 130, 131, 133, 150, 154, 177,
-        179, 187, 138, 150, 128, 134, 143, 148,
-        152, 159, 166, 175, 178, 179, 129, 186,
-        128, 142, 144, 153, 132, 138, 141, 165,
-        167, 129, 130, 135, 136, 148, 151, 153,
-        159, 161, 163, 170, 171, 173, 185, 187,
-        189, 134, 128, 132, 136, 141, 144, 153,
-        156, 159, 128, 181, 183, 185, 152, 153,
-        160, 169, 190, 191, 128, 135, 137, 172,
-        177, 191, 128, 132, 134, 151, 153, 188,
-        134, 128, 129, 130, 131, 137, 138, 139,
-        140, 141, 142, 143, 144, 153, 154, 155,
-        156, 157, 158, 159, 160, 161, 162, 163,
-        164, 165, 166, 167, 168, 169, 170, 173,
-        175, 176, 177, 178, 179, 181, 182, 183,
-        188, 189, 190, 191, 132, 152, 172, 184,
-        185, 187, 128, 191, 128, 137, 144, 255,
-        158, 159, 134, 187, 136, 140, 142, 143,
-        137, 151, 153, 142, 143, 158, 159, 137,
-        177, 142, 143, 182, 183, 191, 255, 128,
-        130, 133, 136, 150, 152, 255, 145, 150,
-        151, 155, 156, 160, 168, 178, 255, 128,
-        143, 160, 255, 182, 183, 190, 255, 129,
-        255, 173, 174, 192, 255, 129, 154, 160,
-        255, 171, 173, 185, 255, 128, 140, 142,
-        148, 160, 180, 128, 147, 160, 172, 174,
-        176, 178, 179, 148, 150, 152, 155, 158,
-        159, 170, 255, 139, 141, 144, 153, 160,
-        255, 184, 255, 128, 170, 176, 255, 182,
-        255, 128, 158, 160, 171, 176, 187, 134,
-        173, 176, 180, 128, 171, 176, 255, 138,
-        143, 155, 255, 128, 155, 160, 255, 159,
-        189, 190, 192, 255, 167, 128, 137, 144,
-        153, 176, 189, 140, 143, 154, 170, 180,
-        255, 180, 255, 128, 183, 128, 137, 141,
-        189, 128, 136, 144, 146, 148, 182, 184,
-        185, 128, 181, 187, 191, 150, 151, 158,
-        159, 152, 154, 156, 158, 134, 135, 142,
-        143, 190, 255, 190, 128, 180, 182, 188,
-        130, 132, 134, 140, 144, 147, 150, 155,
-        160, 172, 178, 180, 182, 188, 128, 129,
-        130, 131, 132, 133, 134, 176, 177, 178,
-        179, 180, 181, 182, 183, 191, 255, 129,
-        147, 149, 176, 178, 190, 192, 255, 144,
-        156, 161, 144, 156, 165, 176, 130, 135,
-        149, 164, 166, 168, 138, 147, 152, 157,
-        170, 185, 188, 191, 142, 133, 137, 160,
-        255, 137, 255, 128, 174, 176, 255, 159,
-        165, 170, 180, 255, 167, 173, 128, 165,
-        176, 255, 168, 174, 176, 190, 192, 255,
-        128, 150, 160, 166, 168, 174, 176, 182,
-        184, 190, 128, 134, 136, 142, 144, 150,
-        152, 158, 160, 191, 128, 129, 130, 131,
-        132, 133, 134, 135, 144, 145, 255, 133,
-        135, 161, 175, 177, 181, 184, 188, 160,
-        151, 152, 187, 192, 255, 133, 173, 177,
-        255, 143, 159, 187, 255, 176, 191, 182,
-        183, 184, 191, 192, 255, 150, 255, 128,
-        146, 147, 148, 152, 153, 154, 155, 156,
-        158, 159, 160, 161, 162, 163, 164, 165,
-        166, 167, 168, 169, 170, 171, 172, 173,
-        174, 175, 176, 129, 255, 141, 255, 144,
-        189, 141, 143, 172, 255, 191, 128, 175,
-        180, 189, 151, 159, 162, 255, 175, 137,
-        138, 184, 255, 183, 255, 168, 255, 128,
-        179, 188, 134, 143, 154, 159, 184, 186,
-        190, 255, 128, 173, 176, 255, 148, 159,
-        189, 255, 129, 142, 154, 159, 191, 255,
-        128, 182, 128, 141, 144, 153, 160, 182,
-        186, 255, 128, 130, 155, 157, 160, 175,
-        178, 182, 129, 134, 137, 142, 145, 150,
-        160, 166, 168, 174, 176, 255, 155, 166,
-        175, 128, 170, 172, 173, 176, 185, 158,
-        159, 160, 255, 164, 175, 135, 138, 188,
-        255, 164, 169, 171, 172, 173, 174, 175,
-        180, 181, 182, 183, 184, 185, 187, 188,
-        189, 190, 191, 165, 186, 174, 175, 154,
-        255, 190, 128, 134, 147, 151, 157, 168,
-        170, 182, 184, 188, 128, 129, 131, 132,
-        134, 255, 147, 255, 190, 255, 144, 145,
-        136, 175, 188, 255, 128, 143, 160, 175,
-        179, 180, 141, 143, 176, 180, 182, 255,
-        189, 255, 191, 144, 153, 161, 186, 129,
-        154, 166, 255, 191, 255, 130, 135, 138,
-        143, 146, 151, 154, 156, 144, 145, 146,
-        147, 148, 150, 151, 152, 155, 157, 158,
-        160, 170, 171, 172, 175, 161, 169, 128,
-        129, 130, 131, 133, 135, 138, 139, 140,
-        141, 142, 143, 144, 145, 146, 147, 148,
-        149, 152, 156, 157, 160, 161, 162, 163,
-        164, 166, 168, 169, 170, 171, 172, 173,
-        174, 176, 177, 153, 155, 178, 179, 128,
-        139, 141, 166, 168, 186, 188, 189, 191,
-        255, 142, 143, 158, 255, 187, 255, 128,
-        180, 189, 128, 156, 160, 255, 145, 159,
-        161, 255, 128, 159, 176, 255, 139, 143,
-        187, 255, 128, 157, 160, 255, 144, 132,
-        135, 150, 255, 158, 159, 170, 175, 148,
-        151, 188, 255, 128, 167, 176, 255, 164,
-        255, 183, 255, 128, 149, 160, 167, 136,
-        188, 128, 133, 138, 181, 183, 184, 191,
-        255, 150, 159, 183, 255, 128, 158, 160,
-        178, 180, 181, 128, 149, 160, 185, 128,
-        183, 190, 191, 191, 128, 131, 133, 134,
-        140, 147, 149, 151, 153, 179, 184, 186,
-        160, 188, 128, 156, 128, 135, 137, 166,
-        128, 181, 128, 149, 160, 178, 128, 145,
-        128, 178, 129, 130, 131, 132, 133, 135,
-        136, 138, 139, 140, 141, 144, 145, 146,
-        147, 150, 151, 152, 153, 154, 155, 156,
-        162, 163, 171, 176, 177, 178, 128, 134,
-        135, 165, 176, 190, 144, 168, 176, 185,
-        128, 180, 182, 191, 182, 144, 179, 155,
-        133, 137, 141, 143, 157, 255, 190, 128,
-        145, 147, 183, 136, 128, 134, 138, 141,
-        143, 157, 159, 168, 176, 255, 171, 175,
-        186, 255, 128, 131, 133, 140, 143, 144,
-        147, 168, 170, 176, 178, 179, 181, 185,
-        188, 191, 144, 151, 128, 132, 135, 136,
-        139, 141, 157, 163, 166, 172, 176, 180,
-        128, 138, 144, 153, 134, 136, 143, 154,
-        255, 128, 181, 184, 255, 129, 151, 158,
-        255, 129, 131, 133, 143, 154, 255, 128,
-        137, 128, 153, 157, 171, 176, 185, 160,
-        255, 170, 190, 192, 255, 128, 184, 128,
-        136, 138, 182, 184, 191, 128, 144, 153,
-        178, 255, 168, 144, 145, 183, 255, 128,
-        142, 145, 149, 129, 141, 144, 146, 147,
-        148, 175, 255, 132, 255, 128, 144, 129,
-        143, 144, 153, 145, 152, 135, 255, 160,
-        168, 169, 171, 172, 173, 174, 188, 189,
-        190, 191, 161, 167, 185, 255, 128, 158,
-        160, 169, 144, 173, 176, 180, 128, 131,
-        144, 153, 163, 183, 189, 255, 144, 255,
-        133, 143, 191, 255, 143, 159, 160, 128,
-        129, 255, 159, 160, 171, 172, 255, 173,
-        255, 179, 255, 128, 176, 177, 178, 128,
-        129, 171, 175, 189, 255, 128, 136, 144,
-        153, 157, 158, 133, 134, 137, 144, 145,
-        146, 147, 148, 149, 154, 155, 156, 157,
-        158, 159, 168, 169, 170, 150, 153, 165,
-        169, 173, 178, 187, 255, 131, 132, 140,
-        169, 174, 255, 130, 132, 149, 157, 173,
-        186, 188, 160, 161, 163, 164, 167, 168,
-        132, 134, 149, 157, 186, 139, 140, 191,
-        255, 134, 128, 132, 138, 144, 146, 255,
-        166, 167, 129, 155, 187, 149, 181, 143,
-        175, 137, 169, 131, 140, 141, 192, 255,
-        128, 182, 187, 255, 173, 180, 182, 255,
-        132, 155, 159, 161, 175, 128, 160, 163,
-        164, 165, 184, 185, 186, 161, 162, 128,
-        134, 136, 152, 155, 161, 163, 164, 166,
-        170, 133, 143, 151, 255, 139, 143, 154,
-        255, 164, 167, 185, 187, 128, 131, 133,
-        159, 161, 162, 169, 178, 180, 183, 130,
-        135, 137, 139, 148, 151, 153, 155, 157,
-        159, 164, 190, 141, 143, 145, 146, 161,
-        162, 167, 170, 172, 178, 180, 183, 185,
-        188, 128, 137, 139, 155, 161, 163, 165,
-        169, 171, 187, 155, 156, 151, 255, 156,
-        157, 160, 181, 255, 186, 187, 255, 162,
-        255, 160, 168, 161, 167, 158, 255, 160,
-        132, 135, 133, 134, 176, 255, 170, 181,
-        186, 191, 176, 180, 182, 183, 186, 189,
-        134, 140, 136, 138, 142, 161, 163, 255,
-        130, 137, 136, 255, 144, 170, 176, 178,
-        160, 191, 128, 138, 174, 175, 177, 255,
-        148, 150, 164, 167, 173, 176, 185, 189,
-        190, 192, 255, 144, 146, 175, 141, 255,
-        166, 176, 178, 255, 186, 138, 170, 180,
-        181, 160, 161, 162, 164, 165, 166, 167,
-        168, 169, 170, 171, 172, 173, 174, 175,
-        176, 177, 178, 179, 180, 181, 182, 184,
-        186, 187, 188, 189, 190, 183, 185, 154,
-        164, 168, 128, 149, 128, 152, 189, 132,
-        185, 144, 152, 161, 177, 255, 169, 177,
-        129, 132, 141, 142, 145, 146, 179, 181,
-        186, 188, 190, 255, 142, 156, 157, 159,
-        161, 176, 177, 133, 138, 143, 144, 147,
-        168, 170, 176, 178, 179, 181, 182, 184,
-        185, 158, 153, 156, 178, 180, 189, 133,
-        141, 143, 145, 147, 168, 170, 176, 178,
-        179, 181, 185, 144, 185, 160, 161, 189,
-        133, 140, 143, 144, 147, 168, 170, 176,
-        178, 179, 181, 185, 177, 156, 157, 159,
-        161, 131, 156, 133, 138, 142, 144, 146,
-        149, 153, 154, 158, 159, 163, 164, 168,
-        170, 174, 185, 144, 189, 133, 140, 142,
-        144, 146, 168, 170, 185, 152, 154, 160,
-        161, 128, 189, 133, 140, 142, 144, 146,
-        168, 170, 179, 181, 185, 158, 160, 161,
-        177, 178, 189, 133, 140, 142, 144, 146,
-        186, 142, 148, 150, 159, 161, 186, 191,
-        189, 133, 150, 154, 177, 179, 187, 128,
-        134, 129, 176, 178, 179, 132, 138, 141,
-        165, 167, 189, 129, 130, 135, 136, 148,
-        151, 153, 159, 161, 163, 170, 171, 173,
-        176, 178, 179, 134, 128, 132, 156, 159,
-        128, 128, 135, 137, 172, 136, 140, 128,
-        129, 130, 131, 137, 138, 139, 140, 141,
-        142, 143, 144, 153, 154, 155, 156, 157,
-        158, 159, 160, 161, 162, 163, 164, 165,
-        166, 167, 168, 169, 170, 172, 173, 174,
-        175, 176, 177, 178, 179, 180, 181, 182,
-        184, 188, 189, 190, 191, 132, 152, 185,
-        187, 191, 128, 170, 161, 144, 149, 154,
-        157, 165, 166, 174, 176, 181, 255, 130,
-        141, 143, 159, 155, 255, 128, 140, 142,
-        145, 160, 177, 128, 145, 160, 172, 174,
-        176, 151, 156, 170, 128, 168, 176, 255,
-        138, 255, 128, 150, 160, 255, 149, 255,
-        167, 133, 179, 133, 139, 131, 160, 174,
-        175, 186, 255, 166, 255, 128, 163, 141,
-        143, 154, 189, 169, 172, 174, 177, 181,
-        182, 129, 130, 132, 133, 134, 176, 177,
-        178, 179, 180, 181, 182, 183, 177, 191,
-        165, 170, 175, 177, 180, 255, 168, 174,
-        176, 255, 128, 134, 136, 142, 144, 150,
-        152, 158, 128, 129, 130, 131, 132, 133,
-        134, 135, 144, 145, 255, 133, 135, 161,
-        169, 177, 181, 184, 188, 160, 151, 154,
-        128, 146, 147, 148, 152, 153, 154, 155,
-        156, 158, 159, 160, 161, 162, 163, 164,
-        165, 166, 167, 168, 169, 170, 171, 172,
-        173, 174, 175, 176, 129, 255, 141, 143,
-        160, 169, 172, 255, 191, 128, 174, 130,
-        134, 139, 163, 255, 130, 179, 187, 189,
-        178, 183, 138, 165, 176, 255, 135, 159,
-        189, 255, 132, 178, 143, 160, 164, 166,
-        175, 186, 190, 128, 168, 186, 128, 130,
-        132, 139, 160, 182, 190, 255, 176, 178,
-        180, 183, 184, 190, 255, 128, 130, 155,
-        157, 160, 170, 178, 180, 128, 162, 164,
-        169, 171, 172, 173, 174, 175, 180, 181,
-        182, 183, 185, 186, 187, 188, 189, 190,
-        191, 165, 179, 157, 190, 128, 134, 147,
-        151, 159, 168, 170, 182, 184, 188, 176,
-        180, 182, 255, 161, 186, 144, 145, 146,
-        147, 148, 150, 151, 152, 155, 157, 158,
-        160, 170, 171, 172, 175, 161, 169, 128,
-        129, 130, 131, 133, 138, 139, 140, 141,
-        142, 143, 144, 145, 146, 147, 148, 149,
-        152, 156, 157, 160, 161, 162, 163, 164,
-        166, 168, 169, 170, 171, 172, 173, 174,
-        176, 177, 153, 155, 178, 179, 145, 255,
-        139, 143, 182, 255, 158, 175, 128, 144,
-        147, 149, 151, 153, 179, 128, 135, 137,
-        164, 128, 130, 131, 132, 133, 134, 135,
-        136, 138, 139, 140, 141, 144, 145, 146,
-        147, 150, 151, 152, 153, 154, 156, 162,
-        163, 171, 176, 177, 178, 131, 183, 131,
-        175, 144, 168, 131, 166, 182, 144, 178,
-        131, 178, 154, 156, 129, 132, 128, 145,
-        147, 171, 159, 255, 144, 157, 161, 135,
-        138, 128, 175, 135, 132, 133, 128, 174,
-        152, 155, 132, 128, 170, 128, 153, 160,
-        190, 192, 255, 128, 136, 138, 174, 128,
-        178, 255, 160, 168, 169, 171, 172, 173,
-        174, 188, 189, 190, 191, 161, 167, 144,
-        173, 128, 131, 163, 183, 189, 255, 133,
-        143, 145, 255, 147, 159, 128, 176, 177,
-        178, 128, 136, 144, 153, 144, 145, 146,
-        147, 148, 149, 154, 155, 156, 157, 158,
-        159, 150, 153, 131, 140, 255, 160, 163,
-        164, 165, 184, 185, 186, 161, 162, 133,
-        255, 170, 181, 183, 186, 128, 150, 152,
+        229, 236, 10, 13, 45, 95, 194, 195,
+        198, 199, 203, 204, 205, 206, 207, 210,
+        212, 213, 214, 215, 216, 217, 219, 220,
+        221, 222, 223, 224, 225, 226, 227, 228,
+        233, 234, 237, 239, 240, 243, 48, 57,
+        65, 90, 97, 122, 196, 218, 229, 236,
+        10, 170, 181, 183, 186, 128, 150, 152,
         182, 184, 255, 192, 255, 128, 255, 173,
         130, 133, 146, 159, 165, 171, 175, 255,
         181, 190, 184, 185, 192, 255, 140, 134,
@@ -779,649 +465,959 @@ var _hcltok_trans_keys []byte = []byte{
         171, 187, 155, 156, 151, 255, 156, 157,
         160, 181, 255, 186, 187, 255, 162, 255,
         160, 168, 161, 167, 158, 255, 160, 132,
-        135, 133, 134, 176, 255, 128, 191, 154,
-        164, 168, 128, 149, 150, 191, 128, 152,
-        153, 191, 181, 128, 159, 160, 189, 190,
-        191, 189, 128, 131, 132, 185, 186, 191,
-        144, 128, 151, 152, 161, 162, 176, 177,
-        255, 169, 177, 129, 132, 141, 142, 145,
-        146, 179, 181, 186, 188, 190, 191, 192,
-        255, 142, 158, 128, 155, 156, 161, 162,
-        175, 176, 177, 178, 191, 169, 177, 180,
-        183, 128, 132, 133, 138, 139, 142, 143,
-        144, 145, 146, 147, 185, 186, 191, 157,
-        128, 152, 153, 158, 159, 177, 178, 180,
-        181, 191, 142, 146, 169, 177, 180, 189,
-        128, 132, 133, 185, 186, 191, 144, 185,
-        128, 159, 160, 161, 162, 191, 169, 177,
-        180, 189, 128, 132, 133, 140, 141, 142,
-        143, 144, 145, 146, 147, 185, 186, 191,
-        158, 177, 128, 155, 156, 161, 162, 191,
-        131, 145, 155, 157, 128, 132, 133, 138,
-        139, 141, 142, 149, 150, 152, 153, 159,
-        160, 162, 163, 164, 165, 167, 168, 170,
-        171, 173, 174, 185, 186, 191, 144, 128,
-        191, 141, 145, 169, 189, 128, 132, 133,
-        185, 186, 191, 128, 151, 152, 154, 155,
-        159, 160, 161, 162, 191, 128, 141, 145,
-        169, 180, 189, 129, 132, 133, 185, 186,
-        191, 158, 128, 159, 160, 161, 162, 176,
-        177, 178, 179, 191, 141, 145, 189, 128,
-        132, 133, 186, 187, 191, 142, 128, 147,
-        148, 150, 151, 158, 159, 161, 162, 185,
-        186, 191, 178, 188, 128, 132, 133, 150,
-        151, 153, 154, 189, 190, 191, 128, 134,
-        135, 191, 128, 177, 129, 179, 180, 191,
-        128, 131, 137, 141, 152, 160, 164, 166,
-        172, 177, 189, 129, 132, 133, 134, 135,
-        138, 139, 147, 148, 167, 168, 169, 170,
-        179, 180, 191, 133, 128, 134, 135, 155,
-        156, 159, 160, 191, 128, 129, 191, 136,
-        128, 172, 173, 191, 128, 135, 136, 140,
-        141, 191, 191, 128, 170, 171, 190, 161,
-        128, 143, 144, 149, 150, 153, 154, 157,
-        158, 164, 165, 166, 167, 173, 174, 176,
-        177, 180, 181, 255, 130, 141, 143, 159,
-        134, 187, 136, 140, 142, 143, 137, 151,
-        153, 142, 143, 158, 159, 137, 177, 191,
-        142, 143, 182, 183, 192, 255, 129, 151,
-        128, 133, 134, 135, 136, 255, 145, 150,
-        151, 155, 191, 192, 255, 128, 143, 144,
-        159, 160, 255, 182, 183, 190, 191, 192,
-        255, 128, 129, 255, 173, 174, 192, 255,
-        128, 129, 154, 155, 159, 160, 255, 171,
-        173, 185, 191, 192, 255, 141, 128, 145,
-        146, 159, 160, 177, 178, 191, 173, 128,
-        145, 146, 159, 160, 176, 177, 191, 128,
-        179, 180, 191, 151, 156, 128, 191, 128,
-        159, 160, 255, 184, 191, 192, 255, 169,
-        128, 170, 171, 175, 176, 255, 182, 191,
-        192, 255, 128, 158, 159, 191, 128, 143,
-        144, 173, 174, 175, 176, 180, 181, 191,
-        128, 171, 172, 175, 176, 255, 138, 191,
-        192, 255, 128, 150, 151, 159, 160, 255,
-        149, 191, 192, 255, 167, 128, 191, 128,
-        132, 133, 179, 180, 191, 128, 132, 133,
-        139, 140, 191, 128, 130, 131, 160, 161,
-        173, 174, 175, 176, 185, 186, 255, 166,
-        191, 192, 255, 128, 163, 164, 191, 128,
-        140, 141, 143, 144, 153, 154, 189, 190,
-        191, 128, 136, 137, 191, 173, 128, 168,
-        169, 177, 178, 180, 181, 182, 183, 191,
-        0, 127, 192, 255, 150, 151, 158, 159,
-        152, 154, 156, 158, 134, 135, 142, 143,
-        190, 191, 192, 255, 181, 189, 191, 128,
-        190, 133, 181, 128, 129, 130, 140, 141,
-        143, 144, 147, 148, 149, 150, 155, 156,
-        159, 160, 172, 173, 177, 178, 188, 189,
-        191, 177, 191, 128, 190, 128, 143, 144,
-        156, 157, 191, 130, 135, 148, 164, 166,
-        168, 128, 137, 138, 149, 150, 151, 152,
-        157, 158, 169, 170, 185, 186, 187, 188,
-        191, 142, 128, 132, 133, 137, 138, 159,
-        160, 255, 137, 191, 192, 255, 175, 128,
-        255, 159, 165, 170, 175, 177, 180, 191,
-        192, 255, 166, 173, 128, 167, 168, 175,
-        176, 255, 168, 174, 176, 191, 192, 255,
-        167, 175, 183, 191, 128, 150, 151, 159,
-        160, 190, 135, 143, 151, 128, 158, 159,
-        191, 128, 132, 133, 135, 136, 160, 161,
-        169, 170, 176, 177, 181, 182, 183, 184,
-        188, 189, 191, 160, 151, 154, 187, 192,
-        255, 128, 132, 133, 173, 174, 176, 177,
-        255, 143, 159, 187, 191, 192, 255, 128,
-        175, 176, 191, 150, 191, 192, 255, 141,
-        191, 192, 255, 128, 143, 144, 189, 190,
-        191, 141, 143, 160, 169, 172, 191, 192,
-        255, 191, 128, 174, 175, 190, 128, 157,
-        158, 159, 160, 255, 176, 191, 192, 255,
-        128, 150, 151, 159, 160, 161, 162, 255,
-        175, 137, 138, 184, 191, 192, 255, 128,
-        182, 183, 255, 130, 134, 139, 163, 191,
-        192, 255, 128, 129, 130, 179, 180, 191,
-        187, 189, 128, 177, 178, 183, 184, 191,
-        128, 137, 138, 165, 166, 175, 176, 255,
-        135, 159, 189, 191, 192, 255, 128, 131,
-        132, 178, 179, 191, 143, 165, 191, 128,
-        159, 160, 175, 176, 185, 186, 190, 128,
-        168, 169, 191, 131, 186, 128, 139, 140,
-        159, 160, 182, 183, 189, 190, 255, 176,
-        178, 180, 183, 184, 190, 191, 192, 255,
-        129, 128, 130, 131, 154, 155, 157, 158,
-        159, 160, 170, 171, 177, 178, 180, 181,
-        191, 128, 167, 175, 129, 134, 135, 136,
-        137, 142, 143, 144, 145, 150, 151, 159,
-        160, 255, 155, 166, 175, 128, 162, 163,
-        191, 164, 175, 135, 138, 188, 191, 192,
-        255, 174, 175, 154, 191, 192, 255, 157,
-        169, 183, 189, 191, 128, 134, 135, 146,
-        147, 151, 152, 158, 159, 190, 130, 133,
-        128, 255, 178, 191, 192, 255, 128, 146,
-        147, 255, 190, 191, 192, 255, 128, 143,
-        144, 255, 144, 145, 136, 175, 188, 191,
-        192, 255, 181, 128, 175, 176, 255, 189,
-        191, 192, 255, 128, 160, 161, 186, 187,
-        191, 128, 129, 154, 155, 165, 166, 255,
-        191, 192, 255, 128, 129, 130, 135, 136,
-        137, 138, 143, 144, 145, 146, 151, 152,
-        153, 154, 156, 157, 191, 128, 191, 128,
-        129, 130, 131, 133, 138, 139, 140, 141,
-        142, 143, 144, 145, 146, 147, 148, 149,
-        152, 156, 157, 160, 161, 162, 163, 164,
-        166, 168, 169, 170, 171, 172, 173, 174,
-        176, 177, 132, 151, 153, 155, 158, 175,
-        178, 179, 180, 191, 140, 167, 187, 190,
-        128, 255, 142, 143, 158, 191, 192, 255,
-        187, 191, 192, 255, 128, 180, 181, 191,
-        128, 156, 157, 159, 160, 255, 145, 191,
-        192, 255, 128, 159, 160, 175, 176, 255,
-        139, 143, 182, 191, 192, 255, 144, 132,
-        135, 150, 191, 192, 255, 158, 175, 148,
-        151, 188, 191, 192, 255, 128, 167, 168,
-        175, 176, 255, 164, 191, 192, 255, 183,
-        191, 192, 255, 128, 149, 150, 159, 160,
-        167, 168, 191, 136, 182, 188, 128, 133,
-        134, 137, 138, 184, 185, 190, 191, 255,
-        150, 159, 183, 191, 192, 255, 179, 128,
-        159, 160, 181, 182, 191, 128, 149, 150,
-        159, 160, 185, 186, 191, 128, 183, 184,
-        189, 190, 191, 128, 148, 152, 129, 143,
-        144, 179, 180, 191, 128, 159, 160, 188,
-        189, 191, 128, 156, 157, 191, 136, 128,
-        164, 165, 191, 128, 181, 182, 191, 128,
-        149, 150, 159, 160, 178, 179, 191, 128,
-        145, 146, 191, 128, 178, 179, 191, 128,
-        130, 131, 132, 133, 134, 135, 136, 138,
-        139, 140, 141, 144, 145, 146, 147, 150,
-        151, 152, 153, 154, 156, 162, 163, 171,
-        176, 177, 178, 129, 191, 128, 130, 131,
-        183, 184, 191, 128, 130, 131, 175, 176,
-        191, 128, 143, 144, 168, 169, 191, 128,
-        130, 131, 166, 167, 191, 182, 128, 143,
-        144, 178, 179, 191, 128, 130, 131, 178,
-        179, 191, 128, 154, 156, 129, 132, 133,
-        191, 146, 128, 171, 172, 191, 135, 137,
-        142, 158, 128, 168, 169, 175, 176, 255,
-        159, 191, 192, 255, 144, 128, 156, 157,
-        161, 162, 191, 128, 134, 135, 138, 139,
-        191, 128, 175, 176, 191, 134, 128, 131,
-        132, 135, 136, 191, 128, 174, 175, 191,
-        128, 151, 152, 155, 156, 191, 132, 128,
-        191, 128, 170, 171, 191, 128, 153, 154,
-        191, 160, 190, 192, 255, 128, 184, 185,
-        191, 137, 128, 174, 175, 191, 128, 129,
-        177, 178, 255, 144, 191, 192, 255, 128,
-        142, 143, 144, 145, 146, 149, 129, 148,
-        150, 191, 175, 191, 192, 255, 132, 191,
-        192, 255, 128, 144, 129, 143, 145, 191,
-        144, 153, 128, 143, 145, 152, 154, 191,
-        135, 191, 192, 255, 160, 168, 169, 171,
-        172, 173, 174, 188, 189, 190, 191, 128,
-        159, 161, 167, 170, 187, 185, 191, 192,
-        255, 128, 143, 144, 173, 174, 191, 128,
-        131, 132, 162, 163, 183, 184, 188, 189,
-        255, 133, 143, 145, 191, 192, 255, 128,
-        146, 147, 159, 160, 191, 160, 128, 191,
-        128, 129, 191, 192, 255, 159, 160, 171,
-        128, 170, 172, 191, 192, 255, 173, 191,
-        192, 255, 179, 191, 192, 255, 128, 176,
-        177, 178, 129, 191, 128, 129, 130, 191,
-        171, 175, 189, 191, 192, 255, 128, 136,
-        137, 143, 144, 153, 154, 191, 144, 145,
-        146, 147, 148, 149, 154, 155, 156, 157,
-        158, 159, 128, 143, 150, 153, 160, 191,
-        149, 157, 173, 186, 188, 160, 161, 163,
-        164, 167, 168, 132, 134, 149, 157, 186,
-        191, 139, 140, 192, 255, 133, 145, 128,
-        134, 135, 137, 138, 255, 166, 167, 129,
-        155, 187, 149, 181, 143, 175, 137, 169,
-        131, 140, 191, 192, 255, 160, 163, 164,
-        165, 184, 185, 186, 128, 159, 161, 162,
-        166, 191, 133, 191, 192, 255, 132, 160,
-        163, 167, 179, 184, 186, 128, 164, 165,
-        168, 169, 187, 188, 191, 130, 135, 137,
-        139, 144, 147, 151, 153, 155, 157, 159,
-        163, 171, 179, 184, 189, 191, 128, 140,
-        141, 148, 149, 160, 161, 164, 165, 166,
-        167, 190, 138, 164, 170, 128, 155, 156,
-        160, 161, 187, 188, 191, 128, 191, 155,
-        156, 128, 191, 151, 191, 192, 255, 156,
-        157, 160, 128, 191, 181, 191, 192, 255,
-        158, 159, 186, 128, 185, 187, 191, 192,
-        255, 162, 191, 192, 255, 160, 168, 128,
-        159, 161, 167, 169, 191, 158, 191, 192,
-        255, 123, 123, 128, 191, 128, 191, 128,
-        191, 128, 191, 128, 191, 10, 123, 123,
-        128, 191, 128, 191, 128, 191, 123, 123,
-        10, 123, 128, 191, 128, 191, 128, 191,
-        123, 123, 170, 181, 183, 186, 128, 150,
-        152, 182, 184, 255, 192, 255, 128, 255,
-        173, 130, 133, 146, 159, 165, 171, 175,
-        255, 181, 190, 184, 185, 192, 255, 140,
-        134, 138, 142, 161, 163, 255, 182, 130,
-        136, 137, 176, 151, 152, 154, 160, 190,
-        136, 144, 192, 255, 135, 129, 130, 132,
-        133, 144, 170, 176, 178, 144, 154, 160,
-        191, 128, 169, 174, 255, 148, 169, 157,
-        158, 189, 190, 192, 255, 144, 255, 139,
-        140, 178, 255, 186, 128, 181, 160, 161,
-        162, 163, 164, 165, 166, 167, 168, 169,
-        170, 171, 172, 173, 174, 175, 176, 177,
-        178, 179, 180, 181, 182, 183, 184, 185,
-        186, 187, 188, 189, 190, 191, 128, 173,
-        128, 155, 160, 180, 182, 189, 148, 161,
-        163, 255, 176, 164, 165, 132, 169, 177,
-        141, 142, 145, 146, 179, 181, 186, 187,
-        158, 133, 134, 137, 138, 143, 150, 152,
-        155, 164, 165, 178, 255, 188, 129, 131,
-        133, 138, 143, 144, 147, 168, 170, 176,
-        178, 179, 181, 182, 184, 185, 190, 255,
-        157, 131, 134, 137, 138, 142, 144, 146,
-        152, 159, 165, 182, 255, 129, 131, 133,
-        141, 143, 145, 147, 168, 170, 176, 178,
-        179, 181, 185, 188, 255, 134, 138, 142,
-        143, 145, 159, 164, 165, 176, 184, 186,
-        255, 129, 131, 133, 140, 143, 144, 147,
-        168, 170, 176, 178, 179, 181, 185, 188,
-        191, 177, 128, 132, 135, 136, 139, 141,
-        150, 151, 156, 157, 159, 163, 166, 175,
-        156, 130, 131, 133, 138, 142, 144, 146,
-        149, 153, 154, 158, 159, 163, 164, 168,
-        170, 174, 185, 190, 191, 144, 151, 128,
-        130, 134, 136, 138, 141, 166, 175, 128,
-        131, 133, 140, 142, 144, 146, 168, 170,
-        185, 189, 255, 133, 137, 151, 142, 148,
-        155, 159, 164, 165, 176, 255, 128, 131,
-        133, 140, 142, 144, 146, 168, 170, 179,
-        181, 185, 188, 191, 158, 128, 132, 134,
-        136, 138, 141, 149, 150, 160, 163, 166,
-        175, 177, 178, 129, 131, 133, 140, 142,
-        144, 146, 186, 189, 255, 133, 137, 143,
-        147, 152, 158, 164, 165, 176, 185, 192,
-        255, 189, 130, 131, 133, 150, 154, 177,
-        179, 187, 138, 150, 128, 134, 143, 148,
-        152, 159, 166, 175, 178, 179, 129, 186,
-        128, 142, 144, 153, 132, 138, 141, 165,
-        167, 129, 130, 135, 136, 148, 151, 153,
-        159, 161, 163, 170, 171, 173, 185, 187,
-        189, 134, 128, 132, 136, 141, 144, 153,
-        156, 159, 128, 181, 183, 185, 152, 153,
-        160, 169, 190, 191, 128, 135, 137, 172,
-        177, 191, 128, 132, 134, 151, 153, 188,
-        134, 128, 129, 130, 131, 137, 138, 139,
-        140, 141, 142, 143, 144, 153, 154, 155,
-        156, 157, 158, 159, 160, 161, 162, 163,
-        164, 165, 166, 167, 168, 169, 170, 173,
-        175, 176, 177, 178, 179, 181, 182, 183,
-        188, 189, 190, 191, 132, 152, 172, 184,
-        185, 187, 128, 191, 128, 137, 144, 255,
-        158, 159, 134, 187, 136, 140, 142, 143,
-        137, 151, 153, 142, 143, 158, 159, 137,
-        177, 142, 143, 182, 183, 191, 255, 128,
-        130, 133, 136, 150, 152, 255, 145, 150,
-        151, 155, 156, 160, 168, 178, 255, 128,
-        143, 160, 255, 182, 183, 190, 255, 129,
-        255, 173, 174, 192, 255, 129, 154, 160,
-        255, 171, 173, 185, 255, 128, 140, 142,
-        148, 160, 180, 128, 147, 160, 172, 174,
-        176, 178, 179, 148, 150, 152, 155, 158,
-        159, 170, 255, 139, 141, 144, 153, 160,
-        255, 184, 255, 128, 170, 176, 255, 182,
-        255, 128, 158, 160, 171, 176, 187, 134,
-        173, 176, 180, 128, 171, 176, 255, 138,
-        143, 155, 255, 128, 155, 160, 255, 159,
-        189, 190, 192, 255, 167, 128, 137, 144,
-        153, 176, 189, 140, 143, 154, 170, 180,
-        255, 180, 255, 128, 183, 128, 137, 141,
-        189, 128, 136, 144, 146, 148, 182, 184,
-        185, 128, 181, 187, 191, 150, 151, 158,
-        159, 152, 154, 156, 158, 134, 135, 142,
-        143, 190, 255, 190, 128, 180, 182, 188,
-        130, 132, 134, 140, 144, 147, 150, 155,
-        160, 172, 178, 180, 182, 188, 128, 129,
-        130, 131, 132, 133, 134, 176, 177, 178,
-        179, 180, 181, 182, 183, 191, 255, 129,
-        147, 149, 176, 178, 190, 192, 255, 144,
-        156, 161, 144, 156, 165, 176, 130, 135,
-        149, 164, 166, 168, 138, 147, 152, 157,
-        170, 185, 188, 191, 142, 133, 137, 160,
-        255, 137, 255, 128, 174, 176, 255, 159,
-        165, 170, 180, 255, 167, 173, 128, 165,
-        176, 255, 168, 174, 176, 190, 192, 255,
-        128, 150, 160, 166, 168, 174, 176, 182,
-        184, 190, 128, 134, 136, 142, 144, 150,
-        152, 158, 160, 191, 128, 129, 130, 131,
-        132, 133, 134, 135, 144, 145, 255, 133,
-        135, 161, 175, 177, 181, 184, 188, 160,
-        151, 152, 187, 192, 255, 133, 173, 177,
-        255, 143, 159, 187, 255, 176, 191, 182,
-        183, 184, 191, 192, 255, 150, 255, 128,
+        135, 133, 134, 176, 255, 170, 181, 186,
+        191, 176, 180, 182, 183, 186, 189, 134,
+        140, 136, 138, 142, 161, 163, 255, 130,
+        137, 136, 255, 144, 170, 176, 178, 160,
+        191, 128, 138, 174, 175, 177, 255, 148,
+        150, 164, 167, 173, 176, 185, 189, 190,
+        192, 255, 144, 146, 175, 141, 255, 166,
+        176, 178, 255, 186, 138, 170, 180, 181,
+        160, 161, 162, 164, 165, 166, 167, 168,
+        169, 170, 171, 172, 173, 174, 175, 176,
+        177, 178, 179, 180, 181, 182, 184, 186,
+        187, 188, 189, 190, 183, 185, 154, 164,
+        168, 128, 149, 128, 152, 189, 132, 185,
+        144, 152, 161, 177, 255, 169, 177, 129,
+        132, 141, 142, 145, 146, 179, 181, 186,
+        188, 190, 255, 142, 156, 157, 159, 161,
+        176, 177, 133, 138, 143, 144, 147, 168,
+        170, 176, 178, 179, 181, 182, 184, 185,
+        158, 153, 156, 178, 180, 189, 133, 141,
+        143, 145, 147, 168, 170, 176, 178, 179,
+        181, 185, 144, 185, 160, 161, 189, 133,
+        140, 143, 144, 147, 168, 170, 176, 178,
+        179, 181, 185, 177, 156, 157, 159, 161,
+        131, 156, 133, 138, 142, 144, 146, 149,
+        153, 154, 158, 159, 163, 164, 168, 170,
+        174, 185, 144, 189, 133, 140, 142, 144,
+        146, 168, 170, 185, 152, 154, 160, 161,
+        128, 189, 133, 140, 142, 144, 146, 168,
+        170, 179, 181, 185, 158, 160, 161, 177,
+        178, 189, 133, 140, 142, 144, 146, 186,
+        142, 148, 150, 159, 161, 186, 191, 189,
+        133, 150, 154, 177, 179, 187, 128, 134,
+        129, 176, 178, 179, 132, 138, 141, 165,
+        167, 189, 129, 130, 135, 136, 148, 151,
+        153, 159, 161, 163, 170, 171, 173, 176,
+        178, 179, 134, 128, 132, 156, 159, 128,
+        128, 135, 137, 172, 136, 140, 128, 129,
+        130, 131, 137, 138, 139, 140, 141, 142,
+        143, 144, 153, 154, 155, 156, 157, 158,
+        159, 160, 161, 162, 163, 164, 165, 166,
+        167, 168, 169, 170, 172, 173, 174, 175,
+        176, 177, 178, 179, 180, 181, 182, 184,
+        188, 189, 190, 191, 132, 152, 185, 187,
+        191, 128, 170, 161, 144, 149, 154, 157,
+        165, 166, 174, 176, 181, 255, 130, 141,
+        143, 159, 155, 255, 128, 140, 142, 145,
+        160, 177, 128, 145, 160, 172, 174, 176,
+        151, 156, 170, 128, 168, 176, 255, 138,
+        255, 128, 150, 160, 255, 149, 255, 167,
+        133, 179, 133, 139, 131, 160, 174, 175,
+        186, 255, 166, 255, 128, 163, 141, 143,
+        154, 189, 169, 172, 174, 177, 181, 182,
+        129, 130, 132, 133, 134, 176, 177, 178,
+        179, 180, 181, 182, 183, 177, 191, 165,
+        170, 175, 177, 180, 255, 168, 174, 176,
+        255, 128, 134, 136, 142, 144, 150, 152,
+        158, 128, 129, 130, 131, 132, 133, 134,
+        135, 144, 145, 255, 133, 135, 161, 169,
+        177, 181, 184, 188, 160, 151, 154, 128,
         146, 147, 148, 152, 153, 154, 155, 156,
         158, 159, 160, 161, 162, 163, 164, 165,
         166, 167, 168, 169, 170, 171, 172, 173,
-        174, 175, 176, 129, 255, 141, 255, 144,
-        189, 141, 143, 172, 255, 191, 128, 175,
-        180, 189, 151, 159, 162, 255, 175, 137,
-        138, 184, 255, 183, 255, 168, 255, 128,
-        179, 188, 134, 143, 154, 159, 184, 186,
-        190, 255, 128, 173, 176, 255, 148, 159,
-        189, 255, 129, 142, 154, 159, 191, 255,
-        128, 182, 128, 141, 144, 153, 160, 182,
-        186, 255, 128, 130, 155, 157, 160, 175,
-        178, 182, 129, 134, 137, 142, 145, 150,
-        160, 166, 168, 174, 176, 255, 155, 166,
-        175, 128, 170, 172, 173, 176, 185, 158,
-        159, 160, 255, 164, 175, 135, 138, 188,
-        255, 164, 169, 171, 172, 173, 174, 175,
-        180, 181, 182, 183, 184, 185, 187, 188,
-        189, 190, 191, 165, 186, 174, 175, 154,
-        255, 190, 128, 134, 147, 151, 157, 168,
-        170, 182, 184, 188, 128, 129, 131, 132,
-        134, 255, 147, 255, 190, 255, 144, 145,
-        136, 175, 188, 255, 128, 143, 160, 175,
-        179, 180, 141, 143, 176, 180, 182, 255,
-        189, 255, 191, 144, 153, 161, 186, 129,
-        154, 166, 255, 191, 255, 130, 135, 138,
-        143, 146, 151, 154, 156, 144, 145, 146,
-        147, 148, 150, 151, 152, 155, 157, 158,
-        160, 170, 171, 172, 175, 161, 169, 128,
-        129, 130, 131, 133, 135, 138, 139, 140,
-        141, 142, 143, 144, 145, 146, 147, 148,
-        149, 152, 156, 157, 160, 161, 162, 163,
-        164, 166, 168, 169, 170, 171, 172, 173,
-        174, 176, 177, 153, 155, 178, 179, 128,
-        139, 141, 166, 168, 186, 188, 189, 191,
-        255, 142, 143, 158, 255, 187, 255, 128,
-        180, 189, 128, 156, 160, 255, 145, 159,
-        161, 255, 128, 159, 176, 255, 139, 143,
-        187, 255, 128, 157, 160, 255, 144, 132,
-        135, 150, 255, 158, 159, 170, 175, 148,
-        151, 188, 255, 128, 167, 176, 255, 164,
-        255, 183, 255, 128, 149, 160, 167, 136,
-        188, 128, 133, 138, 181, 183, 184, 191,
-        255, 150, 159, 183, 255, 128, 158, 160,
-        178, 180, 181, 128, 149, 160, 185, 128,
-        183, 190, 191, 191, 128, 131, 133, 134,
-        140, 147, 149, 151, 153, 179, 184, 186,
-        160, 188, 128, 156, 128, 135, 137, 166,
-        128, 181, 128, 149, 160, 178, 128, 145,
-        128, 178, 129, 130, 131, 132, 133, 135,
-        136, 138, 139, 140, 141, 144, 145, 146,
-        147, 150, 151, 152, 153, 154, 155, 156,
-        162, 163, 171, 176, 177, 178, 128, 134,
-        135, 165, 176, 190, 144, 168, 176, 185,
-        128, 180, 182, 191, 182, 144, 179, 155,
-        133, 137, 141, 143, 157, 255, 190, 128,
-        145, 147, 183, 136, 128, 134, 138, 141,
-        143, 157, 159, 168, 176, 255, 171, 175,
-        186, 255, 128, 131, 133, 140, 143, 144,
-        147, 168, 170, 176, 178, 179, 181, 185,
-        188, 191, 144, 151, 128, 132, 135, 136,
-        139, 141, 157, 163, 166, 172, 176, 180,
-        128, 138, 144, 153, 134, 136, 143, 154,
-        255, 128, 181, 184, 255, 129, 151, 158,
-        255, 129, 131, 133, 143, 154, 255, 128,
-        137, 128, 153, 157, 171, 176, 185, 160,
-        255, 170, 190, 192, 255, 128, 184, 128,
-        136, 138, 182, 184, 191, 128, 144, 153,
-        178, 255, 168, 144, 145, 183, 255, 128,
-        142, 145, 149, 129, 141, 144, 146, 147,
-        148, 175, 255, 132, 255, 128, 144, 129,
-        143, 144, 153, 145, 152, 135, 255, 160,
-        168, 169, 171, 172, 173, 174, 188, 189,
-        190, 191, 161, 167, 185, 255, 128, 158,
-        160, 169, 144, 173, 176, 180, 128, 131,
-        144, 153, 163, 183, 189, 255, 144, 255,
-        133, 143, 191, 255, 143, 159, 160, 128,
-        129, 255, 159, 160, 171, 172, 255, 173,
-        255, 179, 255, 128, 176, 177, 178, 128,
-        129, 171, 175, 189, 255, 128, 136, 144,
-        153, 157, 158, 133, 134, 137, 144, 145,
-        146, 147, 148, 149, 154, 155, 156, 157,
-        158, 159, 168, 169, 170, 150, 153, 165,
-        169, 173, 178, 187, 255, 131, 132, 140,
-        169, 174, 255, 130, 132, 149, 157, 173,
-        186, 188, 160, 161, 163, 164, 167, 168,
-        132, 134, 149, 157, 186, 139, 140, 191,
-        255, 134, 128, 132, 138, 144, 146, 255,
-        166, 167, 129, 155, 187, 149, 181, 143,
-        175, 137, 169, 131, 140, 141, 192, 255,
-        128, 182, 187, 255, 173, 180, 182, 255,
-        132, 155, 159, 161, 175, 128, 160, 163,
-        164, 165, 184, 185, 186, 161, 162, 128,
-        134, 136, 152, 155, 161, 163, 164, 166,
-        170, 133, 143, 151, 255, 139, 143, 154,
-        255, 164, 167, 185, 187, 128, 131, 133,
-        159, 161, 162, 169, 178, 180, 183, 130,
-        135, 137, 139, 148, 151, 153, 155, 157,
-        159, 164, 190, 141, 143, 145, 146, 161,
-        162, 167, 170, 172, 178, 180, 183, 185,
-        188, 128, 137, 139, 155, 161, 163, 165,
-        169, 171, 187, 155, 156, 151, 255, 156,
-        157, 160, 181, 255, 186, 187, 255, 162,
-        255, 160, 168, 161, 167, 158, 255, 160,
-        132, 135, 133, 134, 176, 255, 128, 191,
-        154, 164, 168, 128, 149, 150, 191, 128,
-        152, 153, 191, 181, 128, 159, 160, 189,
-        190, 191, 189, 128, 131, 132, 185, 186,
-        191, 144, 128, 151, 152, 161, 162, 176,
-        177, 255, 169, 177, 129, 132, 141, 142,
-        145, 146, 179, 181, 186, 188, 190, 191,
-        192, 255, 142, 158, 128, 155, 156, 161,
-        162, 175, 176, 177, 178, 191, 169, 177,
-        180, 183, 128, 132, 133, 138, 139, 142,
-        143, 144, 145, 146, 147, 185, 186, 191,
-        157, 128, 152, 153, 158, 159, 177, 178,
-        180, 181, 191, 142, 146, 169, 177, 180,
-        189, 128, 132, 133, 185, 186, 191, 144,
-        185, 128, 159, 160, 161, 162, 191, 169,
-        177, 180, 189, 128, 132, 133, 140, 141,
-        142, 143, 144, 145, 146, 147, 185, 186,
-        191, 158, 177, 128, 155, 156, 161, 162,
-        191, 131, 145, 155, 157, 128, 132, 133,
-        138, 139, 141, 142, 149, 150, 152, 153,
-        159, 160, 162, 163, 164, 165, 167, 168,
-        170, 171, 173, 174, 185, 186, 191, 144,
-        128, 191, 141, 145, 169, 189, 128, 132,
-        133, 185, 186, 191, 128, 151, 152, 154,
-        155, 159, 160, 161, 162, 191, 128, 141,
-        145, 169, 180, 189, 129, 132, 133, 185,
-        186, 191, 158, 128, 159, 160, 161, 162,
-        176, 177, 178, 179, 191, 141, 145, 189,
-        128, 132, 133, 186, 187, 191, 142, 128,
-        147, 148, 150, 151, 158, 159, 161, 162,
-        185, 186, 191, 178, 188, 128, 132, 133,
-        150, 151, 153, 154, 189, 190, 191, 128,
-        134, 135, 191, 128, 177, 129, 179, 180,
-        191, 128, 131, 137, 141, 152, 160, 164,
-        166, 172, 177, 189, 129, 132, 133, 134,
-        135, 138, 139, 147, 148, 167, 168, 169,
-        170, 179, 180, 191, 133, 128, 134, 135,
-        155, 156, 159, 160, 191, 128, 129, 191,
-        136, 128, 172, 173, 191, 128, 135, 136,
-        140, 141, 191, 191, 128, 170, 171, 190,
-        161, 128, 143, 144, 149, 150, 153, 154,
-        157, 158, 164, 165, 166, 167, 173, 174,
-        176, 177, 180, 181, 255, 130, 141, 143,
-        159, 134, 187, 136, 140, 142, 143, 137,
-        151, 153, 142, 143, 158, 159, 137, 177,
-        191, 142, 143, 182, 183, 192, 255, 129,
-        151, 128, 133, 134, 135, 136, 255, 145,
-        150, 151, 155, 191, 192, 255, 128, 143,
-        144, 159, 160, 255, 182, 183, 190, 191,
-        192, 255, 128, 129, 255, 173, 174, 192,
-        255, 128, 129, 154, 155, 159, 160, 255,
-        171, 173, 185, 191, 192, 255, 141, 128,
-        145, 146, 159, 160, 177, 178, 191, 173,
-        128, 145, 146, 159, 160, 176, 177, 191,
-        128, 179, 180, 191, 151, 156, 128, 191,
-        128, 159, 160, 255, 184, 191, 192, 255,
-        169, 128, 170, 171, 175, 176, 255, 182,
-        191, 192, 255, 128, 158, 159, 191, 128,
-        143, 144, 173, 174, 175, 176, 180, 181,
-        191, 128, 171, 172, 175, 176, 255, 138,
-        191, 192, 255, 128, 150, 151, 159, 160,
-        255, 149, 191, 192, 255, 167, 128, 191,
-        128, 132, 133, 179, 180, 191, 128, 132,
-        133, 139, 140, 191, 128, 130, 131, 160,
-        161, 173, 174, 175, 176, 185, 186, 255,
-        166, 191, 192, 255, 128, 163, 164, 191,
-        128, 140, 141, 143, 144, 153, 154, 189,
-        190, 191, 128, 136, 137, 191, 173, 128,
-        168, 169, 177, 178, 180, 181, 182, 183,
-        191, 0, 127, 192, 255, 150, 151, 158,
-        159, 152, 154, 156, 158, 134, 135, 142,
-        143, 190, 191, 192, 255, 181, 189, 191,
-        128, 190, 133, 181, 128, 129, 130, 140,
-        141, 143, 144, 147, 148, 149, 150, 155,
-        156, 159, 160, 172, 173, 177, 178, 188,
-        189, 191, 177, 191, 128, 190, 128, 143,
-        144, 156, 157, 191, 130, 135, 148, 164,
-        166, 168, 128, 137, 138, 149, 150, 151,
-        152, 157, 158, 169, 170, 185, 186, 187,
-        188, 191, 142, 128, 132, 133, 137, 138,
-        159, 160, 255, 137, 191, 192, 255, 175,
-        128, 255, 159, 165, 170, 175, 177, 180,
-        191, 192, 255, 166, 173, 128, 167, 168,
-        175, 176, 255, 168, 174, 176, 191, 192,
-        255, 167, 175, 183, 191, 128, 150, 151,
-        159, 160, 190, 135, 143, 151, 128, 158,
-        159, 191, 128, 132, 133, 135, 136, 160,
-        161, 169, 170, 176, 177, 181, 182, 183,
-        184, 188, 189, 191, 160, 151, 154, 187,
-        192, 255, 128, 132, 133, 173, 174, 176,
-        177, 255, 143, 159, 187, 191, 192, 255,
-        128, 175, 176, 191, 150, 191, 192, 255,
-        141, 191, 192, 255, 128, 143, 144, 189,
-        190, 191, 141, 143, 160, 169, 172, 191,
-        192, 255, 191, 128, 174, 175, 190, 128,
-        157, 158, 159, 160, 255, 176, 191, 192,
-        255, 128, 150, 151, 159, 160, 161, 162,
-        255, 175, 137, 138, 184, 191, 192, 255,
-        128, 182, 183, 255, 130, 134, 139, 163,
-        191, 192, 255, 128, 129, 130, 179, 180,
-        191, 187, 189, 128, 177, 178, 183, 184,
-        191, 128, 137, 138, 165, 166, 175, 176,
-        255, 135, 159, 189, 191, 192, 255, 128,
-        131, 132, 178, 179, 191, 143, 165, 191,
-        128, 159, 160, 175, 176, 185, 186, 190,
-        128, 168, 169, 191, 131, 186, 128, 139,
-        140, 159, 160, 182, 183, 189, 190, 255,
-        176, 178, 180, 183, 184, 190, 191, 192,
-        255, 129, 128, 130, 131, 154, 155, 157,
-        158, 159, 160, 170, 171, 177, 178, 180,
-        181, 191, 128, 167, 175, 129, 134, 135,
-        136, 137, 142, 143, 144, 145, 150, 151,
-        159, 160, 255, 155, 166, 175, 128, 162,
-        163, 191, 164, 175, 135, 138, 188, 191,
-        192, 255, 174, 175, 154, 191, 192, 255,
-        157, 169, 183, 189, 191, 128, 134, 135,
-        146, 147, 151, 152, 158, 159, 190, 130,
-        133, 128, 255, 178, 191, 192, 255, 128,
-        146, 147, 255, 190, 191, 192, 255, 128,
-        143, 144, 255, 144, 145, 136, 175, 188,
-        191, 192, 255, 181, 128, 175, 176, 255,
-        189, 191, 192, 255, 128, 160, 161, 186,
-        187, 191, 128, 129, 154, 155, 165, 166,
-        255, 191, 192, 255, 128, 129, 130, 135,
-        136, 137, 138, 143, 144, 145, 146, 151,
-        152, 153, 154, 156, 157, 191, 128, 191,
-        128, 129, 130, 131, 133, 138, 139, 140,
-        141, 142, 143, 144, 145, 146, 147, 148,
-        149, 152, 156, 157, 160, 161, 162, 163,
-        164, 166, 168, 169, 170, 171, 172, 173,
-        174, 176, 177, 132, 151, 153, 155, 158,
-        175, 178, 179, 180, 191, 140, 167, 187,
-        190, 128, 255, 142, 143, 158, 191, 192,
-        255, 187, 191, 192, 255, 128, 180, 181,
-        191, 128, 156, 157, 159, 160, 255, 145,
-        191, 192, 255, 128, 159, 160, 175, 176,
-        255, 139, 143, 182, 191, 192, 255, 144,
-        132, 135, 150, 191, 192, 255, 158, 175,
-        148, 151, 188, 191, 192, 255, 128, 167,
-        168, 175, 176, 255, 164, 191, 192, 255,
-        183, 191, 192, 255, 128, 149, 150, 159,
-        160, 167, 168, 191, 136, 182, 188, 128,
-        133, 134, 137, 138, 184, 185, 190, 191,
-        255, 150, 159, 183, 191, 192, 255, 179,
-        128, 159, 160, 181, 182, 191, 128, 149,
-        150, 159, 160, 185, 186, 191, 128, 183,
-        184, 189, 190, 191, 128, 148, 152, 129,
-        143, 144, 179, 180, 191, 128, 159, 160,
-        188, 189, 191, 128, 156, 157, 191, 136,
-        128, 164, 165, 191, 128, 181, 182, 191,
-        128, 149, 150, 159, 160, 178, 179, 191,
-        128, 145, 146, 191, 128, 178, 179, 191,
+        174, 175, 176, 129, 255, 141, 143, 160,
+        169, 172, 255, 191, 128, 174, 130, 134,
+        139, 163, 255, 130, 179, 187, 189, 178,
+        183, 138, 165, 176, 255, 135, 159, 189,
+        255, 132, 178, 143, 160, 164, 166, 175,
+        186, 190, 128, 168, 186, 128, 130, 132,
+        139, 160, 182, 190, 255, 176, 178, 180,
+        183, 184, 190, 255, 128, 130, 155, 157,
+        160, 170, 178, 180, 128, 162, 164, 169,
+        171, 172, 173, 174, 175, 180, 181, 182,
+        183, 185, 186, 187, 188, 189, 190, 191,
+        165, 179, 157, 190, 128, 134, 147, 151,
+        159, 168, 170, 182, 184, 188, 176, 180,
+        182, 255, 161, 186, 144, 145, 146, 147,
+        148, 150, 151, 152, 155, 157, 158, 160,
+        170, 171, 172, 175, 161, 169, 128, 129,
+        130, 131, 133, 138, 139, 140, 141, 142,
+        143, 144, 145, 146, 147, 148, 149, 152,
+        156, 157, 160, 161, 162, 163, 164, 166,
+        168, 169, 170, 171, 172, 173, 174, 176,
+        177, 153, 155, 178, 179, 145, 255, 139,
+        143, 182, 255, 158, 175, 128, 144, 147,
+        149, 151, 153, 179, 128, 135, 137, 164,
         128, 130, 131, 132, 133, 134, 135, 136,
         138, 139, 140, 141, 144, 145, 146, 147,
         150, 151, 152, 153, 154, 156, 162, 163,
-        171, 176, 177, 178, 129, 191, 128, 130,
-        131, 183, 184, 191, 128, 130, 131, 175,
-        176, 191, 128, 143, 144, 168, 169, 191,
-        128, 130, 131, 166, 167, 191, 182, 128,
-        143, 144, 178, 179, 191, 128, 130, 131,
-        178, 179, 191, 128, 154, 156, 129, 132,
-        133, 191, 146, 128, 171, 172, 191, 135,
-        137, 142, 158, 128, 168, 169, 175, 176,
-        255, 159, 191, 192, 255, 144, 128, 156,
-        157, 161, 162, 191, 128, 134, 135, 138,
-        139, 191, 128, 175, 176, 191, 134, 128,
-        131, 132, 135, 136, 191, 128, 174, 175,
-        191, 128, 151, 152, 155, 156, 191, 132,
-        128, 191, 128, 170, 171, 191, 128, 153,
-        154, 191, 160, 190, 192, 255, 128, 184,
-        185, 191, 137, 128, 174, 175, 191, 128,
-        129, 177, 178, 255, 144, 191, 192, 255,
-        128, 142, 143, 144, 145, 146, 149, 129,
-        148, 150, 191, 175, 191, 192, 255, 132,
-        191, 192, 255, 128, 144, 129, 143, 145,
-        191, 144, 153, 128, 143, 145, 152, 154,
-        191, 135, 191, 192, 255, 160, 168, 169,
+        171, 176, 177, 178, 131, 183, 131, 175,
+        144, 168, 131, 166, 182, 144, 178, 131,
+        178, 154, 156, 129, 132, 128, 145, 147,
+        171, 159, 255, 144, 157, 161, 135, 138,
+        128, 175, 135, 132, 133, 128, 174, 152,
+        155, 132, 128, 170, 128, 153, 160, 190,
+        192, 255, 128, 136, 138, 174, 128, 178,
+        255, 160, 168, 169, 171, 172, 173, 174,
+        188, 189, 190, 191, 161, 167, 144, 173,
+        128, 131, 163, 183, 189, 255, 133, 143,
+        145, 255, 147, 159, 128, 176, 177, 178,
+        128, 136, 144, 153, 144, 145, 146, 147,
+        148, 149, 154, 155, 156, 157, 158, 159,
+        150, 153, 131, 140, 255, 160, 163, 164,
+        165, 184, 185, 186, 161, 162, 133, 255,
+        170, 181, 183, 186, 128, 150, 152, 182,
+        184, 255, 192, 255, 128, 255, 173, 130,
+        133, 146, 159, 165, 171, 175, 255, 181,
+        190, 184, 185, 192, 255, 140, 134, 138,
+        142, 161, 163, 255, 182, 130, 136, 137,
+        176, 151, 152, 154, 160, 190, 136, 144,
+        192, 255, 135, 129, 130, 132, 133, 144,
+        170, 176, 178, 144, 154, 160, 191, 128,
+        169, 174, 255, 148, 169, 157, 158, 189,
+        190, 192, 255, 144, 255, 139, 140, 178,
+        255, 186, 128, 181, 160, 161, 162, 163,
+        164, 165, 166, 167, 168, 169, 170, 171,
+        172, 173, 174, 175, 176, 177, 178, 179,
+        180, 181, 182, 183, 184, 185, 186, 187,
+        188, 189, 190, 191, 128, 173, 128, 155,
+        160, 180, 182, 189, 148, 161, 163, 255,
+        176, 164, 165, 132, 169, 177, 141, 142,
+        145, 146, 179, 181, 186, 187, 158, 133,
+        134, 137, 138, 143, 150, 152, 155, 164,
+        165, 178, 255, 188, 129, 131, 133, 138,
+        143, 144, 147, 168, 170, 176, 178, 179,
+        181, 182, 184, 185, 190, 255, 157, 131,
+        134, 137, 138, 142, 144, 146, 152, 159,
+        165, 182, 255, 129, 131, 133, 141, 143,
+        145, 147, 168, 170, 176, 178, 179, 181,
+        185, 188, 255, 134, 138, 142, 143, 145,
+        159, 164, 165, 176, 184, 186, 255, 129,
+        131, 133, 140, 143, 144, 147, 168, 170,
+        176, 178, 179, 181, 185, 188, 191, 177,
+        128, 132, 135, 136, 139, 141, 150, 151,
+        156, 157, 159, 163, 166, 175, 156, 130,
+        131, 133, 138, 142, 144, 146, 149, 153,
+        154, 158, 159, 163, 164, 168, 170, 174,
+        185, 190, 191, 144, 151, 128, 130, 134,
+        136, 138, 141, 166, 175, 128, 131, 133,
+        140, 142, 144, 146, 168, 170, 185, 189,
+        255, 133, 137, 151, 142, 148, 155, 159,
+        164, 165, 176, 255, 128, 131, 133, 140,
+        142, 144, 146, 168, 170, 179, 181, 185,
+        188, 191, 158, 128, 132, 134, 136, 138,
+        141, 149, 150, 160, 163, 166, 175, 177,
+        178, 129, 131, 133, 140, 142, 144, 146,
+        186, 189, 255, 133, 137, 143, 147, 152,
+        158, 164, 165, 176, 185, 192, 255, 189,
+        130, 131, 133, 150, 154, 177, 179, 187,
+        138, 150, 128, 134, 143, 148, 152, 159,
+        166, 175, 178, 179, 129, 186, 128, 142,
+        144, 153, 132, 138, 141, 165, 167, 129,
+        130, 135, 136, 148, 151, 153, 159, 161,
+        163, 170, 171, 173, 185, 187, 189, 134,
+        128, 132, 136, 141, 144, 153, 156, 159,
+        128, 181, 183, 185, 152, 153, 160, 169,
+        190, 191, 128, 135, 137, 172, 177, 191,
+        128, 132, 134, 151, 153, 188, 134, 128,
+        129, 130, 131, 137, 138, 139, 140, 141,
+        142, 143, 144, 153, 154, 155, 156, 157,
+        158, 159, 160, 161, 162, 163, 164, 165,
+        166, 167, 168, 169, 170, 173, 175, 176,
+        177, 178, 179, 181, 182, 183, 188, 189,
+        190, 191, 132, 152, 172, 184, 185, 187,
+        128, 191, 128, 137, 144, 255, 158, 159,
+        134, 187, 136, 140, 142, 143, 137, 151,
+        153, 142, 143, 158, 159, 137, 177, 142,
+        143, 182, 183, 191, 255, 128, 130, 133,
+        136, 150, 152, 255, 145, 150, 151, 155,
+        156, 160, 168, 178, 255, 128, 143, 160,
+        255, 182, 183, 190, 255, 129, 255, 173,
+        174, 192, 255, 129, 154, 160, 255, 171,
+        173, 185, 255, 128, 140, 142, 148, 160,
+        180, 128, 147, 160, 172, 174, 176, 178,
+        179, 148, 150, 152, 155, 158, 159, 170,
+        255, 139, 141, 144, 153, 160, 255, 184,
+        255, 128, 170, 176, 255, 182, 255, 128,
+        158, 160, 171, 176, 187, 134, 173, 176,
+        180, 128, 171, 176, 255, 138, 143, 155,
+        255, 128, 155, 160, 255, 159, 189, 190,
+        192, 255, 167, 128, 137, 144, 153, 176,
+        189, 140, 143, 154, 170, 180, 255, 180,
+        255, 128, 183, 128, 137, 141, 189, 128,
+        136, 144, 146, 148, 182, 184, 185, 128,
+        181, 187, 191, 150, 151, 158, 159, 152,
+        154, 156, 158, 134, 135, 142, 143, 190,
+        255, 190, 128, 180, 182, 188, 130, 132,
+        134, 140, 144, 147, 150, 155, 160, 172,
+        178, 180, 182, 188, 128, 129, 130, 131,
+        132, 133, 134, 176, 177, 178, 179, 180,
+        181, 182, 183, 191, 255, 129, 147, 149,
+        176, 178, 190, 192, 255, 144, 156, 161,
+        144, 156, 165, 176, 130, 135, 149, 164,
+        166, 168, 138, 147, 152, 157, 170, 185,
+        188, 191, 142, 133, 137, 160, 255, 137,
+        255, 128, 174, 176, 255, 159, 165, 170,
+        180, 255, 167, 173, 128, 165, 176, 255,
+        168, 174, 176, 190, 192, 255, 128, 150,
+        160, 166, 168, 174, 176, 182, 184, 190,
+        128, 134, 136, 142, 144, 150, 152, 158,
+        160, 191, 128, 129, 130, 131, 132, 133,
+        134, 135, 144, 145, 255, 133, 135, 161,
+        175, 177, 181, 184, 188, 160, 151, 152,
+        187, 192, 255, 133, 173, 177, 255, 143,
+        159, 187, 255, 176, 191, 182, 183, 184,
+        191, 192, 255, 150, 255, 128, 146, 147,
+        148, 152, 153, 154, 155, 156, 158, 159,
+        160, 161, 162, 163, 164, 165, 166, 167,
+        168, 169, 170, 171, 172, 173, 174, 175,
+        176, 129, 255, 141, 255, 144, 189, 141,
+        143, 172, 255, 191, 128, 175, 180, 189,
+        151, 159, 162, 255, 175, 137, 138, 184,
+        255, 183, 255, 168, 255, 128, 179, 188,
+        134, 143, 154, 159, 184, 186, 190, 255,
+        128, 173, 176, 255, 148, 159, 189, 255,
+        129, 142, 154, 159, 191, 255, 128, 182,
+        128, 141, 144, 153, 160, 182, 186, 255,
+        128, 130, 155, 157, 160, 175, 178, 182,
+        129, 134, 137, 142, 145, 150, 160, 166,
+        168, 174, 176, 255, 155, 166, 175, 128,
+        170, 172, 173, 176, 185, 158, 159, 160,
+        255, 164, 175, 135, 138, 188, 255, 164,
+        169, 171, 172, 173, 174, 175, 180, 181,
+        182, 183, 184, 185, 187, 188, 189, 190,
+        191, 165, 186, 174, 175, 154, 255, 190,
+        128, 134, 147, 151, 157, 168, 170, 182,
+        184, 188, 128, 129, 131, 132, 134, 255,
+        147, 255, 190, 255, 144, 145, 136, 175,
+        188, 255, 128, 143, 160, 175, 179, 180,
+        141, 143, 176, 180, 182, 255, 189, 255,
+        191, 144, 153, 161, 186, 129, 154, 166,
+        255, 191, 255, 130, 135, 138, 143, 146,
+        151, 154, 156, 144, 145, 146, 147, 148,
+        150, 151, 152, 155, 157, 158, 160, 170,
+        171, 172, 175, 161, 169, 128, 129, 130,
+        131, 133, 135, 138, 139, 140, 141, 142,
+        143, 144, 145, 146, 147, 148, 149, 152,
+        156, 157, 160, 161, 162, 163, 164, 166,
+        168, 169, 170, 171, 172, 173, 174, 176,
+        177, 153, 155, 178, 179, 128, 139, 141,
+        166, 168, 186, 188, 189, 191, 255, 142,
+        143, 158, 255, 187, 255, 128, 180, 189,
+        128, 156, 160, 255, 145, 159, 161, 255,
+        128, 159, 176, 255, 139, 143, 187, 255,
+        128, 157, 160, 255, 144, 132, 135, 150,
+        255, 158, 159, 170, 175, 148, 151, 188,
+        255, 128, 167, 176, 255, 164, 255, 183,
+        255, 128, 149, 160, 167, 136, 188, 128,
+        133, 138, 181, 183, 184, 191, 255, 150,
+        159, 183, 255, 128, 158, 160, 178, 180,
+        181, 128, 149, 160, 185, 128, 183, 190,
+        191, 191, 128, 131, 133, 134, 140, 147,
+        149, 151, 153, 179, 184, 186, 160, 188,
+        128, 156, 128, 135, 137, 166, 128, 181,
+        128, 149, 160, 178, 128, 145, 128, 178,
+        129, 130, 131, 132, 133, 135, 136, 138,
+        139, 140, 141, 144, 145, 146, 147, 150,
+        151, 152, 153, 154, 155, 156, 162, 163,
+        171, 176, 177, 178, 128, 134, 135, 165,
+        176, 190, 144, 168, 176, 185, 128, 180,
+        182, 191, 182, 144, 179, 155, 133, 137,
+        141, 143, 157, 255, 190, 128, 145, 147,
+        183, 136, 128, 134, 138, 141, 143, 157,
+        159, 168, 176, 255, 171, 175, 186, 255,
+        128, 131, 133, 140, 143, 144, 147, 168,
+        170, 176, 178, 179, 181, 185, 188, 191,
+        144, 151, 128, 132, 135, 136, 139, 141,
+        157, 163, 166, 172, 176, 180, 128, 138,
+        144, 153, 134, 136, 143, 154, 255, 128,
+        181, 184, 255, 129, 151, 158, 255, 129,
+        131, 133, 143, 154, 255, 128, 137, 128,
+        153, 157, 171, 176, 185, 160, 255, 170,
+        190, 192, 255, 128, 184, 128, 136, 138,
+        182, 184, 191, 128, 144, 153, 178, 255,
+        168, 144, 145, 183, 255, 128, 142, 145,
+        149, 129, 141, 144, 146, 147, 148, 175,
+        255, 132, 255, 128, 144, 129, 143, 144,
+        153, 145, 152, 135, 255, 160, 168, 169,
         171, 172, 173, 174, 188, 189, 190, 191,
-        128, 159, 161, 167, 170, 187, 185, 191,
-        192, 255, 128, 143, 144, 173, 174, 191,
-        128, 131, 132, 162, 163, 183, 184, 188,
-        189, 255, 133, 143, 145, 191, 192, 255,
-        128, 146, 147, 159, 160, 191, 160, 128,
-        191, 128, 129, 191, 192, 255, 159, 160,
-        171, 128, 170, 172, 191, 192, 255, 173,
-        191, 192, 255, 179, 191, 192, 255, 128,
-        176, 177, 178, 129, 191, 128, 129, 130,
-        191, 171, 175, 189, 191, 192, 255, 128,
-        136, 137, 143, 144, 153, 154, 191, 144,
-        145, 146, 147, 148, 149, 154, 155, 156,
-        157, 158, 159, 128, 143, 150, 153, 160,
-        191, 149, 157, 173, 186, 188, 160, 161,
-        163, 164, 167, 168, 132, 134, 149, 157,
-        186, 191, 139, 140, 192, 255, 133, 145,
-        128, 134, 135, 137, 138, 255, 166, 167,
+        161, 167, 185, 255, 128, 158, 160, 169,
+        144, 173, 176, 180, 128, 131, 144, 153,
+        163, 183, 189, 255, 144, 255, 133, 143,
+        191, 255, 143, 159, 160, 128, 129, 255,
+        159, 160, 171, 172, 255, 173, 255, 179,
+        255, 128, 176, 177, 178, 128, 129, 171,
+        175, 189, 255, 128, 136, 144, 153, 157,
+        158, 133, 134, 137, 144, 145, 146, 147,
+        148, 149, 154, 155, 156, 157, 158, 159,
+        168, 169, 170, 150, 153, 165, 169, 173,
+        178, 187, 255, 131, 132, 140, 169, 174,
+        255, 130, 132, 149, 157, 173, 186, 188,
+        160, 161, 163, 164, 167, 168, 132, 134,
+        149, 157, 186, 139, 140, 191, 255, 134,
+        128, 132, 138, 144, 146, 255, 166, 167,
         129, 155, 187, 149, 181, 143, 175, 137,
-        169, 131, 140, 191, 192, 255, 160, 163,
-        164, 165, 184, 185, 186, 128, 159, 161,
-        162, 166, 191, 133, 191, 192, 255, 132,
-        160, 163, 167, 179, 184, 186, 128, 164,
-        165, 168, 169, 187, 188, 191, 130, 135,
-        137, 139, 144, 147, 151, 153, 155, 157,
-        159, 163, 171, 179, 184, 189, 191, 128,
-        140, 141, 148, 149, 160, 161, 164, 165,
-        166, 167, 190, 138, 164, 170, 128, 155,
-        156, 160, 161, 187, 188, 191, 128, 191,
-        155, 156, 128, 191, 151, 191, 192, 255,
-        156, 157, 160, 128, 191, 181, 191, 192,
-        255, 158, 159, 186, 128, 185, 187, 191,
-        192, 255, 162, 191, 192, 255, 160, 168,
-        128, 159, 161, 167, 169, 191, 158, 191,
-        192, 255, 9, 10, 13, 32, 33, 34,
-        35, 37, 38, 46, 47, 60, 61, 62,
-        64, 92, 95, 123, 124, 125, 126, 127,
-        194, 195, 198, 199, 203, 204, 205, 206,
-        207, 210, 212, 213, 214, 215, 216, 217,
-        219, 220, 221, 222, 223, 224, 225, 226,
-        227, 228, 233, 234, 237, 238, 239, 240,
-        0, 39, 40, 45, 48, 57, 58, 63,
-        65, 90, 91, 96, 97, 122, 192, 193,
-        196, 218, 229, 236, 241, 247, 9, 32,
-        10, 61, 10, 38, 46, 42, 47, 42,
+        169, 131, 140, 141, 192, 255, 128, 182,
+        187, 255, 173, 180, 182, 255, 132, 155,
+        159, 161, 175, 128, 160, 163, 164, 165,
+        184, 185, 186, 161, 162, 128, 134, 136,
+        152, 155, 161, 163, 164, 166, 170, 133,
+        143, 151, 255, 139, 143, 154, 255, 164,
+        167, 185, 187, 128, 131, 133, 159, 161,
+        162, 169, 178, 180, 183, 130, 135, 137,
+        139, 148, 151, 153, 155, 157, 159, 164,
+        190, 141, 143, 145, 146, 161, 162, 167,
+        170, 172, 178, 180, 183, 185, 188, 128,
+        137, 139, 155, 161, 163, 165, 169, 171,
+        187, 155, 156, 151, 255, 156, 157, 160,
+        181, 255, 186, 187, 255, 162, 255, 160,
+        168, 161, 167, 158, 255, 160, 132, 135,
+        133, 134, 176, 255, 128, 191, 154, 164,
+        168, 128, 149, 150, 191, 128, 152, 153,
+        191, 181, 128, 159, 160, 189, 190, 191,
+        189, 128, 131, 132, 185, 186, 191, 144,
+        128, 151, 152, 161, 162, 176, 177, 255,
+        169, 177, 129, 132, 141, 142, 145, 146,
+        179, 181, 186, 188, 190, 191, 192, 255,
+        142, 158, 128, 155, 156, 161, 162, 175,
+        176, 177, 178, 191, 169, 177, 180, 183,
+        128, 132, 133, 138, 139, 142, 143, 144,
+        145, 146, 147, 185, 186, 191, 157, 128,
+        152, 153, 158, 159, 177, 178, 180, 181,
+        191, 142, 146, 169, 177, 180, 189, 128,
+        132, 133, 185, 186, 191, 144, 185, 128,
+        159, 160, 161, 162, 191, 169, 177, 180,
+        189, 128, 132, 133, 140, 141, 142, 143,
+        144, 145, 146, 147, 185, 186, 191, 158,
+        177, 128, 155, 156, 161, 162, 191, 131,
+        145, 155, 157, 128, 132, 133, 138, 139,
+        141, 142, 149, 150, 152, 153, 159, 160,
+        162, 163, 164, 165, 167, 168, 170, 171,
+        173, 174, 185, 186, 191, 144, 128, 191,
+        141, 145, 169, 189, 128, 132, 133, 185,
+        186, 191, 128, 151, 152, 154, 155, 159,
+        160, 161, 162, 191, 128, 141, 145, 169,
+        180, 189, 129, 132, 133, 185, 186, 191,
+        158, 128, 159, 160, 161, 162, 176, 177,
+        178, 179, 191, 141, 145, 189, 128, 132,
+        133, 186, 187, 191, 142, 128, 147, 148,
+        150, 151, 158, 159, 161, 162, 185, 186,
+        191, 178, 188, 128, 132, 133, 150, 151,
+        153, 154, 189, 190, 191, 128, 134, 135,
+        191, 128, 177, 129, 179, 180, 191, 128,
+        131, 137, 141, 152, 160, 164, 166, 172,
+        177, 189, 129, 132, 133, 134, 135, 138,
+        139, 147, 148, 167, 168, 169, 170, 179,
+        180, 191, 133, 128, 134, 135, 155, 156,
+        159, 160, 191, 128, 129, 191, 136, 128,
+        172, 173, 191, 128, 135, 136, 140, 141,
+        191, 191, 128, 170, 171, 190, 161, 128,
+        143, 144, 149, 150, 153, 154, 157, 158,
+        164, 165, 166, 167, 173, 174, 176, 177,
+        180, 181, 255, 130, 141, 143, 159, 134,
+        187, 136, 140, 142, 143, 137, 151, 153,
+        142, 143, 158, 159, 137, 177, 191, 142,
+        143, 182, 183, 192, 255, 129, 151, 128,
+        133, 134, 135, 136, 255, 145, 150, 151,
+        155, 191, 192, 255, 128, 143, 144, 159,
+        160, 255, 182, 183, 190, 191, 192, 255,
+        128, 129, 255, 173, 174, 192, 255, 128,
+        129, 154, 155, 159, 160, 255, 171, 173,
+        185, 191, 192, 255, 141, 128, 145, 146,
+        159, 160, 177, 178, 191, 173, 128, 145,
+        146, 159, 160, 176, 177, 191, 128, 179,
+        180, 191, 151, 156, 128, 191, 128, 159,
+        160, 255, 184, 191, 192, 255, 169, 128,
+        170, 171, 175, 176, 255, 182, 191, 192,
+        255, 128, 158, 159, 191, 128, 143, 144,
+        173, 174, 175, 176, 180, 181, 191, 128,
+        171, 172, 175, 176, 255, 138, 191, 192,
+        255, 128, 150, 151, 159, 160, 255, 149,
+        191, 192, 255, 167, 128, 191, 128, 132,
+        133, 179, 180, 191, 128, 132, 133, 139,
+        140, 191, 128, 130, 131, 160, 161, 173,
+        174, 175, 176, 185, 186, 255, 166, 191,
+        192, 255, 128, 163, 164, 191, 128, 140,
+        141, 143, 144, 153, 154, 189, 190, 191,
+        128, 136, 137, 191, 173, 128, 168, 169,
+        177, 178, 180, 181, 182, 183, 191, 0,
+        127, 192, 255, 150, 151, 158, 159, 152,
+        154, 156, 158, 134, 135, 142, 143, 190,
+        191, 192, 255, 181, 189, 191, 128, 190,
+        133, 181, 128, 129, 130, 140, 141, 143,
+        144, 147, 148, 149, 150, 155, 156, 159,
+        160, 172, 173, 177, 178, 188, 189, 191,
+        177, 191, 128, 190, 128, 143, 144, 156,
+        157, 191, 130, 135, 148, 164, 166, 168,
+        128, 137, 138, 149, 150, 151, 152, 157,
+        158, 169, 170, 185, 186, 187, 188, 191,
+        142, 128, 132, 133, 137, 138, 159, 160,
+        255, 137, 191, 192, 255, 175, 128, 255,
+        159, 165, 170, 175, 177, 180, 191, 192,
+        255, 166, 173, 128, 167, 168, 175, 176,
+        255, 168, 174, 176, 191, 192, 255, 167,
+        175, 183, 191, 128, 150, 151, 159, 160,
+        190, 135, 143, 151, 128, 158, 159, 191,
+        128, 132, 133, 135, 136, 160, 161, 169,
+        170, 176, 177, 181, 182, 183, 184, 188,
+        189, 191, 160, 151, 154, 187, 192, 255,
+        128, 132, 133, 173, 174, 176, 177, 255,
+        143, 159, 187, 191, 192, 255, 128, 175,
+        176, 191, 150, 191, 192, 255, 141, 191,
+        192, 255, 128, 143, 144, 189, 190, 191,
+        141, 143, 160, 169, 172, 191, 192, 255,
+        191, 128, 174, 175, 190, 128, 157, 158,
+        159, 160, 255, 176, 191, 192, 255, 128,
+        150, 151, 159, 160, 161, 162, 255, 175,
+        137, 138, 184, 191, 192, 255, 128, 182,
+        183, 255, 130, 134, 139, 163, 191, 192,
+        255, 128, 129, 130, 179, 180, 191, 187,
+        189, 128, 177, 178, 183, 184, 191, 128,
+        137, 138, 165, 166, 175, 176, 255, 135,
+        159, 189, 191, 192, 255, 128, 131, 132,
+        178, 179, 191, 143, 165, 191, 128, 159,
+        160, 175, 176, 185, 186, 190, 128, 168,
+        169, 191, 131, 186, 128, 139, 140, 159,
+        160, 182, 183, 189, 190, 255, 176, 178,
+        180, 183, 184, 190, 191, 192, 255, 129,
+        128, 130, 131, 154, 155, 157, 158, 159,
+        160, 170, 171, 177, 178, 180, 181, 191,
+        128, 167, 175, 129, 134, 135, 136, 137,
+        142, 143, 144, 145, 150, 151, 159, 160,
+        255, 155, 166, 175, 128, 162, 163, 191,
+        164, 175, 135, 138, 188, 191, 192, 255,
+        174, 175, 154, 191, 192, 255, 157, 169,
+        183, 189, 191, 128, 134, 135, 146, 147,
+        151, 152, 158, 159, 190, 130, 133, 128,
+        255, 178, 191, 192, 255, 128, 146, 147,
+        255, 190, 191, 192, 255, 128, 143, 144,
+        255, 144, 145, 136, 175, 188, 191, 192,
+        255, 181, 128, 175, 176, 255, 189, 191,
+        192, 255, 128, 160, 161, 186, 187, 191,
+        128, 129, 154, 155, 165, 166, 255, 191,
+        192, 255, 128, 129, 130, 135, 136, 137,
+        138, 143, 144, 145, 146, 151, 152, 153,
+        154, 156, 157, 191, 128, 191, 128, 129,
+        130, 131, 133, 138, 139, 140, 141, 142,
+        143, 144, 145, 146, 147, 148, 149, 152,
+        156, 157, 160, 161, 162, 163, 164, 166,
+        168, 169, 170, 171, 172, 173, 174, 176,
+        177, 132, 151, 153, 155, 158, 175, 178,
+        179, 180, 191, 140, 167, 187, 190, 128,
+        255, 142, 143, 158, 191, 192, 255, 187,
+        191, 192, 255, 128, 180, 181, 191, 128,
+        156, 157, 159, 160, 255, 145, 191, 192,
+        255, 128, 159, 160, 175, 176, 255, 139,
+        143, 182, 191, 192, 255, 144, 132, 135,
+        150, 191, 192, 255, 158, 175, 148, 151,
+        188, 191, 192, 255, 128, 167, 168, 175,
+        176, 255, 164, 191, 192, 255, 183, 191,
+        192, 255, 128, 149, 150, 159, 160, 167,
+        168, 191, 136, 182, 188, 128, 133, 134,
+        137, 138, 184, 185, 190, 191, 255, 150,
+        159, 183, 191, 192, 255, 179, 128, 159,
+        160, 181, 182, 191, 128, 149, 150, 159,
+        160, 185, 186, 191, 128, 183, 184, 189,
+        190, 191, 128, 148, 152, 129, 143, 144,
+        179, 180, 191, 128, 159, 160, 188, 189,
+        191, 128, 156, 157, 191, 136, 128, 164,
+        165, 191, 128, 181, 182, 191, 128, 149,
+        150, 159, 160, 178, 179, 191, 128, 145,
+        146, 191, 128, 178, 179, 191, 128, 130,
+        131, 132, 133, 134, 135, 136, 138, 139,
+        140, 141, 144, 145, 146, 147, 150, 151,
+        152, 153, 154, 156, 162, 163, 171, 176,
+        177, 178, 129, 191, 128, 130, 131, 183,
+        184, 191, 128, 130, 131, 175, 176, 191,
+        128, 143, 144, 168, 169, 191, 128, 130,
+        131, 166, 167, 191, 182, 128, 143, 144,
+        178, 179, 191, 128, 130, 131, 178, 179,
+        191, 128, 154, 156, 129, 132, 133, 191,
+        146, 128, 171, 172, 191, 135, 137, 142,
+        158, 128, 168, 169, 175, 176, 255, 159,
+        191, 192, 255, 144, 128, 156, 157, 161,
+        162, 191, 128, 134, 135, 138, 139, 191,
+        128, 175, 176, 191, 134, 128, 131, 132,
+        135, 136, 191, 128, 174, 175, 191, 128,
+        151, 152, 155, 156, 191, 132, 128, 191,
+        128, 170, 171, 191, 128, 153, 154, 191,
+        160, 190, 192, 255, 128, 184, 185, 191,
+        137, 128, 174, 175, 191, 128, 129, 177,
+        178, 255, 144, 191, 192, 255, 128, 142,
+        143, 144, 145, 146, 149, 129, 148, 150,
+        191, 175, 191, 192, 255, 132, 191, 192,
+        255, 128, 144, 129, 143, 145, 191, 144,
+        153, 128, 143, 145, 152, 154, 191, 135,
+        191, 192, 255, 160, 168, 169, 171, 172,
+        173, 174, 188, 189, 190, 191, 128, 159,
+        161, 167, 170, 187, 185, 191, 192, 255,
+        128, 143, 144, 173, 174, 191, 128, 131,
+        132, 162, 163, 183, 184, 188, 189, 255,
+        133, 143, 145, 191, 192, 255, 128, 146,
+        147, 159, 160, 191, 160, 128, 191, 128,
+        129, 191, 192, 255, 159, 160, 171, 128,
+        170, 172, 191, 192, 255, 173, 191, 192,
+        255, 179, 191, 192, 255, 128, 176, 177,
+        178, 129, 191, 128, 129, 130, 191, 171,
+        175, 189, 191, 192, 255, 128, 136, 137,
+        143, 144, 153, 154, 191, 144, 145, 146,
+        147, 148, 149, 154, 155, 156, 157, 158,
+        159, 128, 143, 150, 153, 160, 191, 149,
+        157, 173, 186, 188, 160, 161, 163, 164,
+        167, 168, 132, 134, 149, 157, 186, 191,
+        139, 140, 192, 255, 133, 145, 128, 134,
+        135, 137, 138, 255, 166, 167, 129, 155,
+        187, 149, 181, 143, 175, 137, 169, 131,
+        140, 191, 192, 255, 160, 163, 164, 165,
+        184, 185, 186, 128, 159, 161, 162, 166,
+        191, 133, 191, 192, 255, 132, 160, 163,
+        167, 179, 184, 186, 128, 164, 165, 168,
+        169, 187, 188, 191, 130, 135, 137, 139,
+        144, 147, 151, 153, 155, 157, 159, 163,
+        171, 179, 184, 189, 191, 128, 140, 141,
+        148, 149, 160, 161, 164, 165, 166, 167,
+        190, 138, 164, 170, 128, 155, 156, 160,
+        161, 187, 188, 191, 128, 191, 155, 156,
+        128, 191, 151, 191, 192, 255, 156, 157,
+        160, 128, 191, 181, 191, 192, 255, 158,
+        159, 186, 128, 185, 187, 191, 192, 255,
+        162, 191, 192, 255, 160, 168, 128, 159,
+        161, 167, 169, 191, 158, 191, 192, 255,
+        10, 13, 128, 191, 192, 223, 224, 239,
+        240, 247, 248, 255, 128, 191, 128, 191,
+        128, 191, 128, 191, 128, 191, 10, 128,
+        191, 128, 191, 128, 191, 36, 123, 37,
+        123, 10, 128, 191, 128, 191, 128, 191,
+        36, 123, 37, 123, 170, 181, 183, 186,
+        128, 150, 152, 182, 184, 255, 192, 255,
+        128, 255, 173, 130, 133, 146, 159, 165,
+        171, 175, 255, 181, 190, 184, 185, 192,
+        255, 140, 134, 138, 142, 161, 163, 255,
+        182, 130, 136, 137, 176, 151, 152, 154,
+        160, 190, 136, 144, 192, 255, 135, 129,
+        130, 132, 133, 144, 170, 176, 178, 144,
+        154, 160, 191, 128, 169, 174, 255, 148,
+        169, 157, 158, 189, 190, 192, 255, 144,
+        255, 139, 140, 178, 255, 186, 128, 181,
+        160, 161, 162, 163, 164, 165, 166, 167,
+        168, 169, 170, 171, 172, 173, 174, 175,
+        176, 177, 178, 179, 180, 181, 182, 183,
+        184, 185, 186, 187, 188, 189, 190, 191,
+        128, 173, 128, 155, 160, 180, 182, 189,
+        148, 161, 163, 255, 176, 164, 165, 132,
+        169, 177, 141, 142, 145, 146, 179, 181,
+        186, 187, 158, 133, 134, 137, 138, 143,
+        150, 152, 155, 164, 165, 178, 255, 188,
+        129, 131, 133, 138, 143, 144, 147, 168,
+        170, 176, 178, 179, 181, 182, 184, 185,
+        190, 255, 157, 131, 134, 137, 138, 142,
+        144, 146, 152, 159, 165, 182, 255, 129,
+        131, 133, 141, 143, 145, 147, 168, 170,
+        176, 178, 179, 181, 185, 188, 255, 134,
+        138, 142, 143, 145, 159, 164, 165, 176,
+        184, 186, 255, 129, 131, 133, 140, 143,
+        144, 147, 168, 170, 176, 178, 179, 181,
+        185, 188, 191, 177, 128, 132, 135, 136,
+        139, 141, 150, 151, 156, 157, 159, 163,
+        166, 175, 156, 130, 131, 133, 138, 142,
+        144, 146, 149, 153, 154, 158, 159, 163,
+        164, 168, 170, 174, 185, 190, 191, 144,
+        151, 128, 130, 134, 136, 138, 141, 166,
+        175, 128, 131, 133, 140, 142, 144, 146,
+        168, 170, 185, 189, 255, 133, 137, 151,
+        142, 148, 155, 159, 164, 165, 176, 255,
+        128, 131, 133, 140, 142, 144, 146, 168,
+        170, 179, 181, 185, 188, 191, 158, 128,
+        132, 134, 136, 138, 141, 149, 150, 160,
+        163, 166, 175, 177, 178, 129, 131, 133,
+        140, 142, 144, 146, 186, 189, 255, 133,
+        137, 143, 147, 152, 158, 164, 165, 176,
+        185, 192, 255, 189, 130, 131, 133, 150,
+        154, 177, 179, 187, 138, 150, 128, 134,
+        143, 148, 152, 159, 166, 175, 178, 179,
+        129, 186, 128, 142, 144, 153, 132, 138,
+        141, 165, 167, 129, 130, 135, 136, 148,
+        151, 153, 159, 161, 163, 170, 171, 173,
+        185, 187, 189, 134, 128, 132, 136, 141,
+        144, 153, 156, 159, 128, 181, 183, 185,
+        152, 153, 160, 169, 190, 191, 128, 135,
+        137, 172, 177, 191, 128, 132, 134, 151,
+        153, 188, 134, 128, 129, 130, 131, 137,
+        138, 139, 140, 141, 142, 143, 144, 153,
+        154, 155, 156, 157, 158, 159, 160, 161,
+        162, 163, 164, 165, 166, 167, 168, 169,
+        170, 173, 175, 176, 177, 178, 179, 181,
+        182, 183, 188, 189, 190, 191, 132, 152,
+        172, 184, 185, 187, 128, 191, 128, 137,
+        144, 255, 158, 159, 134, 187, 136, 140,
+        142, 143, 137, 151, 153, 142, 143, 158,
+        159, 137, 177, 142, 143, 182, 183, 191,
+        255, 128, 130, 133, 136, 150, 152, 255,
+        145, 150, 151, 155, 156, 160, 168, 178,
+        255, 128, 143, 160, 255, 182, 183, 190,
+        255, 129, 255, 173, 174, 192, 255, 129,
+        154, 160, 255, 171, 173, 185, 255, 128,
+        140, 142, 148, 160, 180, 128, 147, 160,
+        172, 174, 176, 178, 179, 148, 150, 152,
+        155, 158, 159, 170, 255, 139, 141, 144,
+        153, 160, 255, 184, 255, 128, 170, 176,
+        255, 182, 255, 128, 158, 160, 171, 176,
+        187, 134, 173, 176, 180, 128, 171, 176,
+        255, 138, 143, 155, 255, 128, 155, 160,
+        255, 159, 189, 190, 192, 255, 167, 128,
+        137, 144, 153, 176, 189, 140, 143, 154,
+        170, 180, 255, 180, 255, 128, 183, 128,
+        137, 141, 189, 128, 136, 144, 146, 148,
+        182, 184, 185, 128, 181, 187, 191, 150,
+        151, 158, 159, 152, 154, 156, 158, 134,
+        135, 142, 143, 190, 255, 190, 128, 180,
+        182, 188, 130, 132, 134, 140, 144, 147,
+        150, 155, 160, 172, 178, 180, 182, 188,
+        128, 129, 130, 131, 132, 133, 134, 176,
+        177, 178, 179, 180, 181, 182, 183, 191,
+        255, 129, 147, 149, 176, 178, 190, 192,
+        255, 144, 156, 161, 144, 156, 165, 176,
+        130, 135, 149, 164, 166, 168, 138, 147,
+        152, 157, 170, 185, 188, 191, 142, 133,
+        137, 160, 255, 137, 255, 128, 174, 176,
+        255, 159, 165, 170, 180, 255, 167, 173,
+        128, 165, 176, 255, 168, 174, 176, 190,
+        192, 255, 128, 150, 160, 166, 168, 174,
+        176, 182, 184, 190, 128, 134, 136, 142,
+        144, 150, 152, 158, 160, 191, 128, 129,
+        130, 131, 132, 133, 134, 135, 144, 145,
+        255, 133, 135, 161, 175, 177, 181, 184,
+        188, 160, 151, 152, 187, 192, 255, 133,
+        173, 177, 255, 143, 159, 187, 255, 176,
+        191, 182, 183, 184, 191, 192, 255, 150,
+        255, 128, 146, 147, 148, 152, 153, 154,
+        155, 156, 158, 159, 160, 161, 162, 163,
+        164, 165, 166, 167, 168, 169, 170, 171,
+        172, 173, 174, 175, 176, 129, 255, 141,
+        255, 144, 189, 141, 143, 172, 255, 191,
+        128, 175, 180, 189, 151, 159, 162, 255,
+        175, 137, 138, 184, 255, 183, 255, 168,
+        255, 128, 179, 188, 134, 143, 154, 159,
+        184, 186, 190, 255, 128, 173, 176, 255,
+        148, 159, 189, 255, 129, 142, 154, 159,
+        191, 255, 128, 182, 128, 141, 144, 153,
+        160, 182, 186, 255, 128, 130, 155, 157,
+        160, 175, 178, 182, 129, 134, 137, 142,
+        145, 150, 160, 166, 168, 174, 176, 255,
+        155, 166, 175, 128, 170, 172, 173, 176,
+        185, 158, 159, 160, 255, 164, 175, 135,
+        138, 188, 255, 164, 169, 171, 172, 173,
+        174, 175, 180, 181, 182, 183, 184, 185,
+        187, 188, 189, 190, 191, 165, 186, 174,
+        175, 154, 255, 190, 128, 134, 147, 151,
+        157, 168, 170, 182, 184, 188, 128, 129,
+        131, 132, 134, 255, 147, 255, 190, 255,
+        144, 145, 136, 175, 188, 255, 128, 143,
+        160, 175, 179, 180, 141, 143, 176, 180,
+        182, 255, 189, 255, 191, 144, 153, 161,
+        186, 129, 154, 166, 255, 191, 255, 130,
+        135, 138, 143, 146, 151, 154, 156, 144,
+        145, 146, 147, 148, 150, 151, 152, 155,
+        157, 158, 160, 170, 171, 172, 175, 161,
+        169, 128, 129, 130, 131, 133, 135, 138,
+        139, 140, 141, 142, 143, 144, 145, 146,
+        147, 148, 149, 152, 156, 157, 160, 161,
+        162, 163, 164, 166, 168, 169, 170, 171,
+        172, 173, 174, 176, 177, 153, 155, 178,
+        179, 128, 139, 141, 166, 168, 186, 188,
+        189, 191, 255, 142, 143, 158, 255, 187,
+        255, 128, 180, 189, 128, 156, 160, 255,
+        145, 159, 161, 255, 128, 159, 176, 255,
+        139, 143, 187, 255, 128, 157, 160, 255,
+        144, 132, 135, 150, 255, 158, 159, 170,
+        175, 148, 151, 188, 255, 128, 167, 176,
+        255, 164, 255, 183, 255, 128, 149, 160,
+        167, 136, 188, 128, 133, 138, 181, 183,
+        184, 191, 255, 150, 159, 183, 255, 128,
+        158, 160, 178, 180, 181, 128, 149, 160,
+        185, 128, 183, 190, 191, 191, 128, 131,
+        133, 134, 140, 147, 149, 151, 153, 179,
+        184, 186, 160, 188, 128, 156, 128, 135,
+        137, 166, 128, 181, 128, 149, 160, 178,
+        128, 145, 128, 178, 129, 130, 131, 132,
+        133, 135, 136, 138, 139, 140, 141, 144,
+        145, 146, 147, 150, 151, 152, 153, 154,
+        155, 156, 162, 163, 171, 176, 177, 178,
+        128, 134, 135, 165, 176, 190, 144, 168,
+        176, 185, 128, 180, 182, 191, 182, 144,
+        179, 155, 133, 137, 141, 143, 157, 255,
+        190, 128, 145, 147, 183, 136, 128, 134,
+        138, 141, 143, 157, 159, 168, 176, 255,
+        171, 175, 186, 255, 128, 131, 133, 140,
+        143, 144, 147, 168, 170, 176, 178, 179,
+        181, 185, 188, 191, 144, 151, 128, 132,
+        135, 136, 139, 141, 157, 163, 166, 172,
+        176, 180, 128, 138, 144, 153, 134, 136,
+        143, 154, 255, 128, 181, 184, 255, 129,
+        151, 158, 255, 129, 131, 133, 143, 154,
+        255, 128, 137, 128, 153, 157, 171, 176,
+        185, 160, 255, 170, 190, 192, 255, 128,
+        184, 128, 136, 138, 182, 184, 191, 128,
+        144, 153, 178, 255, 168, 144, 145, 183,
+        255, 128, 142, 145, 149, 129, 141, 144,
+        146, 147, 148, 175, 255, 132, 255, 128,
+        144, 129, 143, 144, 153, 145, 152, 135,
+        255, 160, 168, 169, 171, 172, 173, 174,
+        188, 189, 190, 191, 161, 167, 185, 255,
+        128, 158, 160, 169, 144, 173, 176, 180,
+        128, 131, 144, 153, 163, 183, 189, 255,
+        144, 255, 133, 143, 191, 255, 143, 159,
+        160, 128, 129, 255, 159, 160, 171, 172,
+        255, 173, 255, 179, 255, 128, 176, 177,
+        178, 128, 129, 171, 175, 189, 255, 128,
+        136, 144, 153, 157, 158, 133, 134, 137,
+        144, 145, 146, 147, 148, 149, 154, 155,
+        156, 157, 158, 159, 168, 169, 170, 150,
+        153, 165, 169, 173, 178, 187, 255, 131,
+        132, 140, 169, 174, 255, 130, 132, 149,
+        157, 173, 186, 188, 160, 161, 163, 164,
+        167, 168, 132, 134, 149, 157, 186, 139,
+        140, 191, 255, 134, 128, 132, 138, 144,
+        146, 255, 166, 167, 129, 155, 187, 149,
+        181, 143, 175, 137, 169, 131, 140, 141,
+        192, 255, 128, 182, 187, 255, 173, 180,
+        182, 255, 132, 155, 159, 161, 175, 128,
+        160, 163, 164, 165, 184, 185, 186, 161,
+        162, 128, 134, 136, 152, 155, 161, 163,
+        164, 166, 170, 133, 143, 151, 255, 139,
+        143, 154, 255, 164, 167, 185, 187, 128,
+        131, 133, 159, 161, 162, 169, 178, 180,
+        183, 130, 135, 137, 139, 148, 151, 153,
+        155, 157, 159, 164, 190, 141, 143, 145,
+        146, 161, 162, 167, 170, 172, 178, 180,
+        183, 185, 188, 128, 137, 139, 155, 161,
+        163, 165, 169, 171, 187, 155, 156, 151,
+        255, 156, 157, 160, 181, 255, 186, 187,
+        255, 162, 255, 160, 168, 161, 167, 158,
+        255, 160, 132, 135, 133, 134, 176, 255,
+        128, 191, 154, 164, 168, 128, 149, 150,
+        191, 128, 152, 153, 191, 181, 128, 159,
+        160, 189, 190, 191, 189, 128, 131, 132,
+        185, 186, 191, 144, 128, 151, 152, 161,
+        162, 176, 177, 255, 169, 177, 129, 132,
+        141, 142, 145, 146, 179, 181, 186, 188,
+        190, 191, 192, 255, 142, 158, 128, 155,
+        156, 161, 162, 175, 176, 177, 178, 191,
+        169, 177, 180, 183, 128, 132, 133, 138,
+        139, 142, 143, 144, 145, 146, 147, 185,
+        186, 191, 157, 128, 152, 153, 158, 159,
+        177, 178, 180, 181, 191, 142, 146, 169,
+        177, 180, 189, 128, 132, 133, 185, 186,
+        191, 144, 185, 128, 159, 160, 161, 162,
+        191, 169, 177, 180, 189, 128, 132, 133,
+        140, 141, 142, 143, 144, 145, 146, 147,
+        185, 186, 191, 158, 177, 128, 155, 156,
+        161, 162, 191, 131, 145, 155, 157, 128,
+        132, 133, 138, 139, 141, 142, 149, 150,
+        152, 153, 159, 160, 162, 163, 164, 165,
+        167, 168, 170, 171, 173, 174, 185, 186,
+        191, 144, 128, 191, 141, 145, 169, 189,
+        128, 132, 133, 185, 186, 191, 128, 151,
+        152, 154, 155, 159, 160, 161, 162, 191,
+        128, 141, 145, 169, 180, 189, 129, 132,
+        133, 185, 186, 191, 158, 128, 159, 160,
+        161, 162, 176, 177, 178, 179, 191, 141,
+        145, 189, 128, 132, 133, 186, 187, 191,
+        142, 128, 147, 148, 150, 151, 158, 159,
+        161, 162, 185, 186, 191, 178, 188, 128,
+        132, 133, 150, 151, 153, 154, 189, 190,
+        191, 128, 134, 135, 191, 128, 177, 129,
+        179, 180, 191, 128, 131, 137, 141, 152,
+        160, 164, 166, 172, 177, 189, 129, 132,
+        133, 134, 135, 138, 139, 147, 148, 167,
+        168, 169, 170, 179, 180, 191, 133, 128,
+        134, 135, 155, 156, 159, 160, 191, 128,
+        129, 191, 136, 128, 172, 173, 191, 128,
+        135, 136, 140, 141, 191, 191, 128, 170,
+        171, 190, 161, 128, 143, 144, 149, 150,
+        153, 154, 157, 158, 164, 165, 166, 167,
+        173, 174, 176, 177, 180, 181, 255, 130,
+        141, 143, 159, 134, 187, 136, 140, 142,
+        143, 137, 151, 153, 142, 143, 158, 159,
+        137, 177, 191, 142, 143, 182, 183, 192,
+        255, 129, 151, 128, 133, 134, 135, 136,
+        255, 145, 150, 151, 155, 191, 192, 255,
+        128, 143, 144, 159, 160, 255, 182, 183,
+        190, 191, 192, 255, 128, 129, 255, 173,
+        174, 192, 255, 128, 129, 154, 155, 159,
+        160, 255, 171, 173, 185, 191, 192, 255,
+        141, 128, 145, 146, 159, 160, 177, 178,
+        191, 173, 128, 145, 146, 159, 160, 176,
+        177, 191, 128, 179, 180, 191, 151, 156,
+        128, 191, 128, 159, 160, 255, 184, 191,
+        192, 255, 169, 128, 170, 171, 175, 176,
+        255, 182, 191, 192, 255, 128, 158, 159,
+        191, 128, 143, 144, 173, 174, 175, 176,
+        180, 181, 191, 128, 171, 172, 175, 176,
+        255, 138, 191, 192, 255, 128, 150, 151,
+        159, 160, 255, 149, 191, 192, 255, 167,
+        128, 191, 128, 132, 133, 179, 180, 191,
+        128, 132, 133, 139, 140, 191, 128, 130,
+        131, 160, 161, 173, 174, 175, 176, 185,
+        186, 255, 166, 191, 192, 255, 128, 163,
+        164, 191, 128, 140, 141, 143, 144, 153,
+        154, 189, 190, 191, 128, 136, 137, 191,
+        173, 128, 168, 169, 177, 178, 180, 181,
+        182, 183, 191, 0, 127, 192, 255, 150,
+        151, 158, 159, 152, 154, 156, 158, 134,
+        135, 142, 143, 190, 191, 192, 255, 181,
+        189, 191, 128, 190, 133, 181, 128, 129,
+        130, 140, 141, 143, 144, 147, 148, 149,
+        150, 155, 156, 159, 160, 172, 173, 177,
+        178, 188, 189, 191, 177, 191, 128, 190,
+        128, 143, 144, 156, 157, 191, 130, 135,
+        148, 164, 166, 168, 128, 137, 138, 149,
+        150, 151, 152, 157, 158, 169, 170, 185,
+        186, 187, 188, 191, 142, 128, 132, 133,
+        137, 138, 159, 160, 255, 137, 191, 192,
+        255, 175, 128, 255, 159, 165, 170, 175,
+        177, 180, 191, 192, 255, 166, 173, 128,
+        167, 168, 175, 176, 255, 168, 174, 176,
+        191, 192, 255, 167, 175, 183, 191, 128,
+        150, 151, 159, 160, 190, 135, 143, 151,
+        128, 158, 159, 191, 128, 132, 133, 135,
+        136, 160, 161, 169, 170, 176, 177, 181,
+        182, 183, 184, 188, 189, 191, 160, 151,
+        154, 187, 192, 255, 128, 132, 133, 173,
+        174, 176, 177, 255, 143, 159, 187, 191,
+        192, 255, 128, 175, 176, 191, 150, 191,
+        192, 255, 141, 191, 192, 255, 128, 143,
+        144, 189, 190, 191, 141, 143, 160, 169,
+        172, 191, 192, 255, 191, 128, 174, 175,
+        190, 128, 157, 158, 159, 160, 255, 176,
+        191, 192, 255, 128, 150, 151, 159, 160,
+        161, 162, 255, 175, 137, 138, 184, 191,
+        192, 255, 128, 182, 183, 255, 130, 134,
+        139, 163, 191, 192, 255, 128, 129, 130,
+        179, 180, 191, 187, 189, 128, 177, 178,
+        183, 184, 191, 128, 137, 138, 165, 166,
+        175, 176, 255, 135, 159, 189, 191, 192,
+        255, 128, 131, 132, 178, 179, 191, 143,
+        165, 191, 128, 159, 160, 175, 176, 185,
+        186, 190, 128, 168, 169, 191, 131, 186,
+        128, 139, 140, 159, 160, 182, 183, 189,
+        190, 255, 176, 178, 180, 183, 184, 190,
+        191, 192, 255, 129, 128, 130, 131, 154,
+        155, 157, 158, 159, 160, 170, 171, 177,
+        178, 180, 181, 191, 128, 167, 175, 129,
+        134, 135, 136, 137, 142, 143, 144, 145,
+        150, 151, 159, 160, 255, 155, 166, 175,
+        128, 162, 163, 191, 164, 175, 135, 138,
+        188, 191, 192, 255, 174, 175, 154, 191,
+        192, 255, 157, 169, 183, 189, 191, 128,
+        134, 135, 146, 147, 151, 152, 158, 159,
+        190, 130, 133, 128, 255, 178, 191, 192,
+        255, 128, 146, 147, 255, 190, 191, 192,
+        255, 128, 143, 144, 255, 144, 145, 136,
+        175, 188, 191, 192, 255, 181, 128, 175,
+        176, 255, 189, 191, 192, 255, 128, 160,
+        161, 186, 187, 191, 128, 129, 154, 155,
+        165, 166, 255, 191, 192, 255, 128, 129,
+        130, 135, 136, 137, 138, 143, 144, 145,
+        146, 151, 152, 153, 154, 156, 157, 191,
+        128, 191, 128, 129, 130, 131, 133, 138,
+        139, 140, 141, 142, 143, 144, 145, 146,
+        147, 148, 149, 152, 156, 157, 160, 161,
+        162, 163, 164, 166, 168, 169, 170, 171,
+        172, 173, 174, 176, 177, 132, 151, 153,
+        155, 158, 175, 178, 179, 180, 191, 140,
+        167, 187, 190, 128, 255, 142, 143, 158,
+        191, 192, 255, 187, 191, 192, 255, 128,
+        180, 181, 191, 128, 156, 157, 159, 160,
+        255, 145, 191, 192, 255, 128, 159, 160,
+        175, 176, 255, 139, 143, 182, 191, 192,
+        255, 144, 132, 135, 150, 191, 192, 255,
+        158, 175, 148, 151, 188, 191, 192, 255,
+        128, 167, 168, 175, 176, 255, 164, 191,
+        192, 255, 183, 191, 192, 255, 128, 149,
+        150, 159, 160, 167, 168, 191, 136, 182,
+        188, 128, 133, 134, 137, 138, 184, 185,
+        190, 191, 255, 150, 159, 183, 191, 192,
+        255, 179, 128, 159, 160, 181, 182, 191,
+        128, 149, 150, 159, 160, 185, 186, 191,
+        128, 183, 184, 189, 190, 191, 128, 148,
+        152, 129, 143, 144, 179, 180, 191, 128,
+        159, 160, 188, 189, 191, 128, 156, 157,
+        191, 136, 128, 164, 165, 191, 128, 181,
+        182, 191, 128, 149, 150, 159, 160, 178,
+        179, 191, 128, 145, 146, 191, 128, 178,
+        179, 191, 128, 130, 131, 132, 133, 134,
+        135, 136, 138, 139, 140, 141, 144, 145,
+        146, 147, 150, 151, 152, 153, 154, 156,
+        162, 163, 171, 176, 177, 178, 129, 191,
+        128, 130, 131, 183, 184, 191, 128, 130,
+        131, 175, 176, 191, 128, 143, 144, 168,
+        169, 191, 128, 130, 131, 166, 167, 191,
+        182, 128, 143, 144, 178, 179, 191, 128,
+        130, 131, 178, 179, 191, 128, 154, 156,
+        129, 132, 133, 191, 146, 128, 171, 172,
+        191, 135, 137, 142, 158, 128, 168, 169,
+        175, 176, 255, 159, 191, 192, 255, 144,
+        128, 156, 157, 161, 162, 191, 128, 134,
+        135, 138, 139, 191, 128, 175, 176, 191,
+        134, 128, 131, 132, 135, 136, 191, 128,
+        174, 175, 191, 128, 151, 152, 155, 156,
+        191, 132, 128, 191, 128, 170, 171, 191,
+        128, 153, 154, 191, 160, 190, 192, 255,
+        128, 184, 185, 191, 137, 128, 174, 175,
+        191, 128, 129, 177, 178, 255, 144, 191,
+        192, 255, 128, 142, 143, 144, 145, 146,
+        149, 129, 148, 150, 191, 175, 191, 192,
+        255, 132, 191, 192, 255, 128, 144, 129,
+        143, 145, 191, 144, 153, 128, 143, 145,
+        152, 154, 191, 135, 191, 192, 255, 160,
+        168, 169, 171, 172, 173, 174, 188, 189,
+        190, 191, 128, 159, 161, 167, 170, 187,
+        185, 191, 192, 255, 128, 143, 144, 173,
+        174, 191, 128, 131, 132, 162, 163, 183,
+        184, 188, 189, 255, 133, 143, 145, 191,
+        192, 255, 128, 146, 147, 159, 160, 191,
+        160, 128, 191, 128, 129, 191, 192, 255,
+        159, 160, 171, 128, 170, 172, 191, 192,
+        255, 173, 191, 192, 255, 179, 191, 192,
+        255, 128, 176, 177, 178, 129, 191, 128,
+        129, 130, 191, 171, 175, 189, 191, 192,
+        255, 128, 136, 137, 143, 144, 153, 154,
+        191, 144, 145, 146, 147, 148, 149, 154,
+        155, 156, 157, 158, 159, 128, 143, 150,
+        153, 160, 191, 149, 157, 173, 186, 188,
+        160, 161, 163, 164, 167, 168, 132, 134,
+        149, 157, 186, 191, 139, 140, 192, 255,
+        133, 145, 128, 134, 135, 137, 138, 255,
+        166, 167, 129, 155, 187, 149, 181, 143,
+        175, 137, 169, 131, 140, 191, 192, 255,
+        160, 163, 164, 165, 184, 185, 186, 128,
+        159, 161, 162, 166, 191, 133, 191, 192,
+        255, 132, 160, 163, 167, 179, 184, 186,
+        128, 164, 165, 168, 169, 187, 188, 191,
+        130, 135, 137, 139, 144, 147, 151, 153,
+        155, 157, 159, 163, 171, 179, 184, 189,
+        191, 128, 140, 141, 148, 149, 160, 161,
+        164, 165, 166, 167, 190, 138, 164, 170,
+        128, 155, 156, 160, 161, 187, 188, 191,
+        128, 191, 155, 156, 128, 191, 151, 191,
+        192, 255, 156, 157, 160, 128, 191, 181,
+        191, 192, 255, 158, 159, 186, 128, 185,
+        187, 191, 192, 255, 162, 191, 192, 255,
+        160, 168, 128, 159, 161, 167, 169, 191,
+        158, 191, 192, 255, 9, 10, 13, 32,
+        33, 34, 35, 38, 46, 47, 60, 61,
+        62, 64, 92, 95, 123, 124, 125, 126,
+        127, 194, 195, 198, 199, 203, 204, 205,
+        206, 207, 210, 212, 213, 214, 215, 216,
+        217, 219, 220, 221, 222, 223, 224, 225,
+        226, 227, 228, 233, 234, 237, 238, 239,
+        240, 0, 36, 37, 45, 48, 57, 58,
+        63, 65, 90, 91, 96, 97, 122, 192,
+        193, 196, 218, 229, 236, 241, 247, 9,
+        32, 10, 61, 10, 38, 46, 42, 47,
         46, 69, 101, 48, 57, 60, 61, 61,
         62, 61, 45, 95, 194, 195, 198, 199,
         203, 204, 205, 206, 207, 210, 212, 213,
@@ -1472,229 +1468,131 @@ var _hcltok_trans_keys []byte = []byte{
         159, 161, 169, 173, 191, 128, 191, 10,
         13, 34, 36, 37, 92, 128, 191, 192,
         223, 224, 239, 240, 247, 248, 255, 10,
-        13, 34, 36, 37, 92, 128, 191, 192,
+        13, 34, 92, 36, 37, 128, 191, 192,
         223, 224, 239, 240, 247, 248, 255, 10,
-        13, 34, 36, 37, 92, 128, 191, 192,
+        13, 36, 123, 123, 126, 126, 37, 123,
+        126, 10, 13, 128, 191, 192, 223, 224,
+        239, 240, 247, 248, 255, 128, 191, 128,
+        191, 128, 191, 10, 13, 36, 37, 128,
+        191, 192, 223, 224, 239, 240, 247, 248,
+        255, 10, 13, 36, 37, 128, 191, 192,
         223, 224, 239, 240, 247, 248, 255, 10,
-        13, 34, 36, 37, 92, 128, 191, 192,
+        13, 10, 13, 123, 10, 13, 126, 10,
+        13, 126, 126, 128, 191, 128, 191, 128,
+        191, 10, 13, 36, 37, 128, 191, 192,
         223, 224, 239, 240, 247, 248, 255, 10,
-        13, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 36, 37,
-        92, 123, 192, 223, 224, 239, 240, 247,
-        10, 13, 34, 36, 37, 92, 123, 128,
-        191, 192, 223, 224, 239, 240, 247, 248,
-        255, 10, 13, 34, 36, 37, 92, 123,
-        128, 191, 192, 223, 224, 239, 240, 247,
-        248, 255, 10, 13, 34, 36, 37, 92,
-        123, 128, 191, 192, 223, 224, 239, 240,
-        247, 248, 255, 10, 13, 34, 36, 37,
-        92, 128, 191, 192, 223, 224, 239, 240,
-        247, 248, 255, 36, 37, 92, 123, 192,
-        223, 224, 239, 240, 247, 10, 13, 34,
-        36, 37, 92, 123, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 123, 126,
-        123, 126, 128, 191, 128, 191, 128, 191,
-        10, 13, 36, 37, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        36, 37, 128, 191, 192, 223, 224, 239,
-        240, 247, 248, 255, 10, 13, 36, 37,
-        128, 191, 192, 223, 224, 239, 240, 247,
-        248, 255, 10, 13, 36, 37, 128, 191,
-        192, 223, 224, 239, 240, 247, 248, 255,
-        126, 126, 128, 191, 128, 191, 128, 191,
-        10, 13, 36, 37, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        36, 37, 128, 191, 192, 223, 224, 239,
-        240, 247, 248, 255, 126, 126, 128, 191,
-        128, 191, 128, 191, 95, 194, 195, 198,
-        199, 203, 204, 205, 206, 207, 210, 212,
-        213, 214, 215, 216, 217, 219, 220, 221,
-        222, 223, 224, 225, 226, 227, 228, 233,
-        234, 237, 238, 239, 240, 65, 90, 97,
-        122, 128, 191, 192, 193, 196, 218, 229,
-        236, 241, 247, 248, 255, 45, 95, 194,
-        195, 198, 199, 203, 204, 205, 206, 207,
-        210, 212, 213, 214, 215, 216, 217, 219,
-        220, 221, 222, 223, 224, 225, 226, 227,
-        228, 233, 234, 237, 239, 240, 243, 48,
-        57, 65, 90, 97, 122, 196, 218, 229,
-        236, 128, 191, 170, 181, 186, 128, 191,
-        151, 183, 128, 255, 192, 255, 0, 127,
-        173, 130, 133, 146, 159, 165, 171, 175,
-        191, 192, 255, 181, 190, 128, 175, 176,
-        183, 184, 185, 186, 191, 134, 139, 141,
-        162, 128, 135, 136, 255, 182, 130, 137,
-        176, 151, 152, 154, 160, 136, 191, 192,
-        255, 128, 143, 144, 170, 171, 175, 176,
-        178, 179, 191, 128, 159, 160, 191, 176,
-        128, 138, 139, 173, 174, 255, 148, 150,
-        164, 167, 173, 176, 185, 189, 190, 192,
-        255, 144, 128, 145, 146, 175, 176, 191,
-        128, 140, 141, 255, 166, 176, 178, 191,
-        192, 255, 186, 128, 137, 138, 170, 171,
-        179, 180, 181, 182, 191, 160, 161, 162,
-        164, 165, 166, 167, 168, 169, 170, 171,
-        172, 173, 174, 175, 176, 177, 178, 179,
-        180, 181, 182, 183, 184, 185, 186, 187,
-        188, 189, 190, 128, 191, 128, 129, 130,
-        131, 137, 138, 139, 140, 141, 142, 143,
-        144, 153, 154, 155, 156, 157, 158, 159,
-        160, 161, 162, 163, 164, 165, 166, 167,
-        168, 169, 170, 171, 172, 173, 174, 175,
-        176, 177, 178, 179, 180, 182, 183, 184,
-        188, 189, 190, 191, 132, 187, 129, 130,
-        132, 133, 134, 176, 177, 178, 179, 180,
-        181, 182, 183, 128, 191, 128, 129, 130,
-        131, 132, 133, 134, 135, 144, 136, 143,
-        145, 191, 192, 255, 182, 183, 184, 128,
-        191, 128, 191, 191, 128, 190, 192, 255,
-        128, 146, 147, 148, 152, 153, 154, 155,
-        156, 158, 159, 160, 161, 162, 163, 164,
+        13, 36, 37, 128, 191, 192, 223, 224,
+        239, 240, 247, 248, 255, 10, 13, 10,
+        13, 123, 10, 13, 126, 10, 13, 126,
+        126, 128, 191, 128, 191, 128, 191, 95,
+        194, 195, 198, 199, 203, 204, 205, 206,
+        207, 210, 212, 213, 214, 215, 216, 217,
+        219, 220, 221, 222, 223, 224, 225, 226,
+        227, 228, 233, 234, 237, 238, 239, 240,
+        65, 90, 97, 122, 128, 191, 192, 193,
+        196, 218, 229, 236, 241, 247, 248, 255,
+        45, 95, 194, 195, 198, 199, 203, 204,
+        205, 206, 207, 210, 212, 213, 214, 215,
+        216, 217, 219, 220, 221, 222, 223, 224,
+        225, 226, 227, 228, 233, 234, 237, 239,
+        240, 243, 48, 57, 65, 90, 97, 122,
+        196, 218, 229, 236, 128, 191, 170, 181,
+        186, 128, 191, 151, 183, 128, 255, 192,
+        255, 0, 127, 173, 130, 133, 146, 159,
+        165, 171, 175, 191, 192, 255, 181, 190,
+        128, 175, 176, 183, 184, 185, 186, 191,
+        134, 139, 141, 162, 128, 135, 136, 255,
+        182, 130, 137, 176, 151, 152, 154, 160,
+        136, 191, 192, 255, 128, 143, 144, 170,
+        171, 175, 176, 178, 179, 191, 128, 159,
+        160, 191, 176, 128, 138, 139, 173, 174,
+        255, 148, 150, 164, 167, 173, 176, 185,
+        189, 190, 192, 255, 144, 128, 145, 146,
+        175, 176, 191, 128, 140, 141, 255, 166,
+        176, 178, 191, 192, 255, 186, 128, 137,
+        138, 170, 171, 179, 180, 181, 182, 191,
+        160, 161, 162, 164, 165, 166, 167, 168,
+        169, 170, 171, 172, 173, 174, 175, 176,
+        177, 178, 179, 180, 181, 182, 183, 184,
+        185, 186, 187, 188, 189, 190, 128, 191,
+        128, 129, 130, 131, 137, 138, 139, 140,
+        141, 142, 143, 144, 153, 154, 155, 156,
+        157, 158, 159, 160, 161, 162, 163, 164,
         165, 166, 167, 168, 169, 170, 171, 172,
-        173, 174, 175, 176, 129, 191, 192, 255,
-        158, 159, 128, 157, 160, 191, 192, 255,
-        128, 191, 164, 169, 171, 172, 173, 174,
-        175, 180, 181, 182, 183, 184, 185, 187,
-        188, 189, 190, 191, 128, 163, 165, 186,
-        144, 145, 146, 147, 148, 150, 151, 152,
-        155, 157, 158, 160, 170, 171, 172, 175,
-        128, 159, 161, 169, 173, 191, 128, 191,
+        173, 174, 175, 176, 177, 178, 179, 180,
+        182, 183, 184, 188, 189, 190, 191, 132,
+        187, 129, 130, 132, 133, 134, 176, 177,
+        178, 179, 180, 181, 182, 183, 128, 191,
+        128, 129, 130, 131, 132, 133, 134, 135,
+        144, 136, 143, 145, 191, 192, 255, 182,
+        183, 184, 128, 191, 128, 191, 191, 128,
+        190, 192, 255, 128, 146, 147, 148, 152,
+        153, 154, 155, 156, 158, 159, 160, 161,
+        162, 163, 164, 165, 166, 167, 168, 169,
+        170, 171, 172, 173, 174, 175, 176, 129,
+        191, 192, 255, 158, 159, 128, 157, 160,
+        191, 192, 255, 128, 191, 164, 169, 171,
+        172, 173, 174, 175, 180, 181, 182, 183,
+        184, 185, 187, 188, 189, 190, 191, 128,
+        163, 165, 186, 144, 145, 146, 147, 148,
+        150, 151, 152, 155, 157, 158, 160, 170,
+        171, 172, 175, 128, 159, 161, 169, 173,
+        191, 128, 191,
 }
 
 var _hcltok_single_lengths []byte = []byte{
-        0, 1, 1, 1, 2, 3, 2, 0,
-        32, 31, 36, 1, 4, 0, 0, 0,
-        0, 1, 2, 1, 1, 1, 1, 0,
-        1, 1, 0, 0, 2, 0, 0, 0,
-        1, 32, 0, 0, 0, 0, 1, 3,
-        1, 1, 1, 0, 2, 0, 1, 1,
-        2, 0, 3, 0, 1, 0, 2, 1,
-        2, 0, 0, 5, 1, 4, 0, 0,
-        1, 43, 0, 0, 0, 2, 3, 2,
-        1, 1, 0, 0, 0, 0, 0, 0,
+        0, 1, 1, 2, 3, 2, 0, 32,
+        31, 36, 1, 4, 0, 0, 0, 0,
+        1, 2, 1, 1, 1, 1, 0, 1,
+        1, 0, 0, 2, 0, 0, 0, 1,
+        32, 0, 0, 0, 0, 1, 3, 1,
+        1, 1, 0, 2, 0, 1, 1, 2,
+        0, 3, 0, 1, 0, 2, 1, 2,
+        0, 0, 5, 1, 4, 0, 0, 1,
+        43, 0, 0, 0, 2, 3, 2, 1,
+        1, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 1, 1, 0,
-        0, 0, 0, 0, 0, 0, 0, 4,
-        1, 0, 15, 0, 0, 0, 1, 6,
-        1, 0, 0, 1, 0, 2, 0, 0,
-        0, 9, 0, 1, 1, 0, 0, 0,
-        3, 0, 1, 0, 28, 0, 0, 0,
-        1, 0, 1, 0, 0, 0, 1, 0,
+        0, 0, 0, 0, 1, 1, 0, 0,
+        0, 0, 0, 0, 0, 0, 4, 1,
+        0, 15, 0, 0, 0, 1, 6, 1,
+        0, 0, 1, 0, 2, 0, 0, 0,
+        9, 0, 1, 1, 0, 0, 0, 3,
+        0, 1, 0, 28, 0, 0, 0, 1,
+        0, 1, 0, 0, 0, 1, 0, 0,
+        0, 0, 0, 0, 0, 1, 0, 2,
+        0, 0, 18, 0, 0, 1, 0, 0,
         0, 0, 0, 0, 0, 0, 1, 0,
-        2, 0, 0, 18, 0, 0, 1, 0,
-        0, 0, 0, 0, 0, 0, 0, 1,
-        0, 0, 0, 16, 36, 0, 0, 0,
-        0, 1, 0, 0, 0, 0, 0, 1,
-        0, 0, 0, 0, 0, 0, 2, 0,
-        0, 0, 0, 0, 1, 0, 0, 0,
-        0, 0, 0, 0, 28, 0, 0, 0,
-        1, 1, 1, 1, 0, 0, 2, 0,
-        1, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 1, 1, 4, 0, 0, 2,
-        2, 0, 11, 0, 0, 0, 0, 0,
-        0, 0, 1, 1, 3, 0, 0, 4,
-        0, 0, 0, 18, 0, 0, 0, 1,
-        4, 1, 4, 1, 0, 3, 2, 2,
-        2, 1, 0, 0, 1, 8, 0, 0,
-        0, 4, 12, 0, 2, 0, 3, 0,
-        1, 0, 2, 0, 1, 2, 0, 3,
-        1, 2, 0, 0, 0, 0, 0, 1,
-        1, 0, 0, 1, 28, 3, 0, 1,
-        1, 2, 1, 0, 1, 1, 2, 1,
-        1, 2, 1, 1, 0, 2, 1, 1,
-        1, 1, 0, 0, 6, 1, 1, 0,
-        0, 46, 1, 1, 0, 0, 0, 0,
-        2, 1, 0, 0, 0, 1, 0, 0,
-        0, 0, 0, 0, 0, 13, 2, 0,
-        0, 0, 9, 0, 1, 28, 0, 1,
-        3, 0, 2, 0, 0, 0, 1, 0,
-        1, 1, 2, 0, 18, 2, 0, 0,
-        16, 35, 0, 0, 0, 1, 0, 28,
-        0, 0, 0, 0, 1, 0, 2, 0,
-        0, 1, 0, 0, 1, 0, 0, 1,
-        0, 0, 0, 0, 1, 11, 0, 0,
-        0, 0, 4, 0, 12, 1, 7, 0,
-        4, 0, 0, 0, 0, 1, 2, 1,
-        1, 1, 1, 0, 1, 1, 0, 0,
-        2, 0, 0, 0, 1, 32, 0, 0,
-        0, 0, 1, 3, 1, 1, 1, 0,
-        2, 0, 1, 1, 2, 0, 3, 0,
-        1, 0, 2, 1, 2, 0, 0, 5,
-        1, 4, 0, 0, 1, 43, 0, 0,
-        0, 2, 3, 2, 1, 1, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        0, 1, 1, 0, 0, 0, 0, 0,
-        0, 0, 0, 4, 1, 0, 15, 0,
-        0, 0, 1, 6, 1, 0, 0, 1,
-        0, 2, 0, 0, 0, 9, 0, 1,
-        1, 0, 0, 0, 3, 0, 1, 0,
-        28, 0, 0, 0, 1, 0, 1, 0,
-        0, 0, 1, 0, 0, 0, 0, 0,
-        0, 0, 1, 0, 2, 0, 0, 18,
-        0, 0, 1, 0, 0, 0, 0, 0,
-        0, 0, 0, 1, 0, 0, 0, 16,
-        36, 0, 0, 0, 0, 1, 0, 0,
+        0, 0, 16, 36, 0, 0, 0, 0,
+        1, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 0, 0, 0, 2, 0, 0,
         0, 0, 0, 1, 0, 0, 0, 0,
-        0, 0, 2, 0, 0, 0, 0, 0,
-        1, 0, 0, 0, 0, 0, 0, 0,
-        28, 0, 0, 0, 1, 1, 1, 1,
-        0, 0, 2, 0, 1, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 1, 1,
-        4, 0, 0, 2, 2, 0, 11, 0,
-        0, 0, 0, 0, 0, 0, 1, 1,
-        3, 0, 0, 4, 0, 0, 0, 18,
-        0, 0, 0, 1, 4, 1, 4, 1,
-        0, 3, 2, 2, 2, 1, 0, 0,
-        1, 8, 0, 0, 0, 4, 12, 0,
-        2, 0, 3, 0, 1, 0, 2, 0,
-        1, 2, 0, 0, 3, 0, 1, 1,
-        1, 2, 2, 4, 1, 6, 2, 4,
-        2, 4, 1, 4, 0, 6, 1, 3,
-        1, 2, 0, 2, 11, 1, 1, 1,
-        0, 1, 1, 0, 2, 0, 3, 3,
-        2, 1, 0, 0, 0, 1, 0, 1,
-        0, 1, 1, 0, 2, 0, 0, 1,
-        0, 0, 0, 0, 0, 0, 0, 1,
-        0, 0, 0, 0, 0, 0, 0, 1,
-        0, 0, 0, 4, 3, 2, 2, 0,
-        6, 1, 0, 1, 1, 0, 2, 0,
-        4, 3, 0, 1, 1, 0, 0, 0,
-        0, 0, 0, 0, 1, 0, 0, 0,
-        1, 0, 3, 0, 2, 0, 0, 0,
-        3, 0, 2, 1, 1, 3, 1, 0,
-        0, 0, 0, 0, 5, 2, 0, 0,
-        0, 0, 0, 0, 1, 0, 0, 1,
-        1, 0, 0, 35, 4, 0, 0, 0,
-        0, 0, 0, 0, 1, 0, 0, 0,
-        0, 0, 0, 3, 0, 1, 0, 0,
-        3, 0, 0, 1, 0, 0, 0, 0,
-        28, 0, 0, 0, 0, 1, 0, 3,
-        1, 4, 0, 1, 0, 0, 1, 0,
-        0, 1, 0, 0, 0, 0, 1, 1,
-        0, 7, 0, 0, 2, 2, 0, 11,
-        0, 0, 0, 0, 0, 1, 1, 3,
-        0, 0, 4, 0, 0, 0, 12, 1,
-        4, 1, 5, 2, 0, 3, 2, 2,
-        2, 1, 7, 0, 7, 17, 3, 0,
-        2, 0, 3, 0, 0, 1, 0, 2,
-        0, 1, 1, 0, 0, 0, 0, 0,
-        1, 1, 1, 0, 0, 0, 1, 1,
-        1, 1, 0, 0, 0, 1, 1, 4,
+        0, 0, 0, 28, 0, 0, 0, 1,
+        1, 1, 1, 0, 0, 2, 0, 1,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 1, 1, 4, 0, 0, 2, 2,
+        0, 11, 0, 0, 0, 0, 0, 0,
+        0, 1, 1, 3, 0, 0, 4, 0,
+        0, 0, 18, 0, 0, 0, 1, 4,
+        1, 4, 1, 0, 3, 2, 2, 2,
+        1, 0, 0, 1, 8, 0, 0, 0,
+        4, 12, 0, 2, 0, 3, 0, 1,
+        0, 2, 0, 1, 2, 0, 3, 1,
+        2, 0, 0, 0, 0, 0, 1, 1,
+        0, 0, 1, 28, 3, 0, 1, 1,
+        2, 1, 0, 1, 1, 2, 1, 1,
+        2, 1, 1, 0, 2, 1, 1, 1,
+        1, 0, 0, 6, 1, 1, 0, 0,
+        46, 1, 1, 0, 0, 0, 0, 2,
+        1, 0, 0, 0, 1, 0, 0, 0,
+        0, 0, 0, 0, 13, 2, 0, 0,
+        0, 9, 0, 1, 28, 0, 1, 3,
+        0, 2, 0, 0, 0, 1, 0, 1,
+        1, 2, 0, 18, 2, 0, 0, 16,
+        35, 0, 0, 0, 1, 0, 28, 0,
+        0, 0, 0, 1, 0, 2, 0, 0,
+        1, 0, 0, 1, 0, 0, 1, 0,
+        0, 0, 0, 1, 11, 0, 0, 0,
+        0, 4, 0, 12, 1, 7, 0, 4,
         0, 0, 0, 0, 1, 2, 1, 1,
         1, 1, 0, 1, 1, 0, 0, 2,
         0, 0, 0, 1, 32, 0, 0, 0,
@@ -1759,145 +1657,143 @@ var _hcltok_single_lengths []byte = []byte{
         1, 5, 2, 0, 3, 2, 2, 2,
         1, 7, 0, 7, 17, 3, 0, 2,
         0, 3, 0, 0, 1, 0, 2, 0,
-        54, 2, 1, 1, 1, 1, 1, 2,
-        1, 3, 2, 2, 1, 34, 1, 1,
-        0, 3, 2, 0, 0, 0, 1, 2,
-        4, 1, 0, 1, 0, 0, 0, 0,
-        1, 1, 1, 0, 0, 1, 30, 47,
-        13, 9, 3, 0, 1, 28, 2, 0,
-        18, 16, 0, 6, 6, 6, 6, 5,
-        4, 7, 7, 7, 6, 4, 7, 6,
-        6, 6, 6, 6, 6, 6, 1, 1,
-        1, 1, 0, 0, 0, 4, 4, 4,
-        4, 1, 1, 0, 0, 0, 4, 2,
-        1, 1, 0, 0, 0, 33, 34, 0,
-        3, 2, 0, 0, 0, 1, 2, 4,
-        1, 0, 1, 0, 0, 0, 0, 1,
-        1, 1, 0, 0, 1, 30, 47, 13,
-        9, 3, 0, 1, 28, 2, 0, 18,
-        16, 0,
+        2, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 2, 2, 1, 0, 0, 0,
+        2, 2, 4, 0, 0, 0, 0, 1,
+        2, 1, 1, 1, 1, 0, 1, 1,
+        0, 0, 2, 0, 0, 0, 1, 32,
+        0, 0, 0, 0, 1, 3, 1, 1,
+        1, 0, 2, 0, 1, 1, 2, 0,
+        3, 0, 1, 0, 2, 1, 2, 0,
+        0, 5, 1, 4, 0, 0, 1, 43,
+        0, 0, 0, 2, 3, 2, 1, 1,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 1, 1, 0, 0, 0,
+        0, 0, 0, 0, 0, 4, 1, 0,
+        15, 0, 0, 0, 1, 6, 1, 0,
+        0, 1, 0, 2, 0, 0, 0, 9,
+        0, 1, 1, 0, 0, 0, 3, 0,
+        1, 0, 28, 0, 0, 0, 1, 0,
+        1, 0, 0, 0, 1, 0, 0, 0,
+        0, 0, 0, 0, 1, 0, 2, 0,
+        0, 18, 0, 0, 1, 0, 0, 0,
+        0, 0, 0, 0, 0, 1, 0, 0,
+        0, 16, 36, 0, 0, 0, 0, 1,
+        0, 0, 0, 0, 0, 1, 0, 0,
+        0, 0, 0, 0, 2, 0, 0, 0,
+        0, 0, 1, 0, 0, 0, 0, 0,
+        0, 0, 28, 0, 0, 0, 1, 1,
+        1, 1, 0, 0, 2, 0, 1, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        1, 1, 4, 0, 0, 2, 2, 0,
+        11, 0, 0, 0, 0, 0, 0, 0,
+        1, 1, 3, 0, 0, 4, 0, 0,
+        0, 18, 0, 0, 0, 1, 4, 1,
+        4, 1, 0, 3, 2, 2, 2, 1,
+        0, 0, 1, 8, 0, 0, 0, 4,
+        12, 0, 2, 0, 3, 0, 1, 0,
+        2, 0, 1, 2, 0, 0, 3, 0,
+        1, 1, 1, 2, 2, 4, 1, 6,
+        2, 4, 2, 4, 1, 4, 0, 6,
+        1, 3, 1, 2, 0, 2, 11, 1,
+        1, 1, 0, 1, 1, 0, 2, 0,
+        3, 3, 2, 1, 0, 0, 0, 1,
+        0, 1, 0, 1, 1, 0, 2, 0,
+        0, 1, 0, 0, 0, 0, 0, 0,
+        0, 1, 0, 0, 0, 0, 0, 0,
+        0, 1, 0, 0, 0, 4, 3, 2,
+        2, 0, 6, 1, 0, 1, 1, 0,
+        2, 0, 4, 3, 0, 1, 1, 0,
+        0, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 1, 0, 3, 0, 2, 0,
+        0, 0, 3, 0, 2, 1, 1, 3,
+        1, 0, 0, 0, 0, 0, 5, 2,
+        0, 0, 0, 0, 0, 0, 1, 0,
+        0, 1, 1, 0, 0, 35, 4, 0,
+        0, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 0, 0, 0, 3, 0, 1,
+        0, 0, 3, 0, 0, 1, 0, 0,
+        0, 0, 28, 0, 0, 0, 0, 1,
+        0, 3, 1, 4, 0, 1, 0, 0,
+        1, 0, 0, 1, 0, 0, 0, 0,
+        1, 1, 0, 7, 0, 0, 2, 2,
+        0, 11, 0, 0, 0, 0, 0, 1,
+        1, 3, 0, 0, 4, 0, 0, 0,
+        12, 1, 4, 1, 5, 2, 0, 3,
+        2, 2, 2, 1, 7, 0, 7, 17,
+        3, 0, 2, 0, 3, 0, 0, 1,
+        0, 2, 0, 53, 2, 1, 1, 1,
+        1, 1, 2, 3, 2, 2, 1, 34,
+        1, 1, 0, 3, 2, 0, 0, 0,
+        1, 2, 4, 1, 0, 1, 0, 0,
+        0, 0, 1, 1, 1, 0, 0, 1,
+        30, 47, 13, 9, 3, 0, 1, 28,
+        2, 0, 18, 16, 0, 6, 4, 2,
+        2, 0, 1, 1, 1, 2, 1, 2,
+        0, 0, 0, 4, 2, 2, 3, 3,
+        2, 1, 1, 0, 0, 0, 4, 2,
+        2, 3, 3, 2, 1, 1, 0, 0,
+        0, 33, 34, 0, 3, 2, 0, 0,
+        0, 1, 2, 4, 1, 0, 1, 0,
+        0, 0, 0, 1, 1, 1, 0, 0,
+        1, 30, 47, 13, 9, 3, 0, 1,
+        28, 2, 0, 18, 16, 0,
 }
 
 var _hcltok_range_lengths []byte = []byte{
-        0, 0, 0, 0, 0, 1, 1, 1,
-        5, 5, 5, 0, 0, 3, 0, 1,
-        1, 4, 2, 3, 0, 1, 0, 2,
-        2, 4, 2, 2, 3, 1, 1, 1,
-        1, 0, 1, 1, 2, 2, 1, 4,
-        6, 9, 6, 8, 5, 8, 7, 10,
-        4, 6, 4, 7, 7, 5, 5, 4,
-        5, 1, 2, 8, 4, 3, 3, 3,
-        0, 3, 1, 2, 1, 2, 2, 3,
-        3, 1, 3, 2, 2, 1, 2, 2,
-        2, 3, 4, 4, 3, 1, 2, 1,
-        3, 2, 2, 2, 2, 2, 3, 3,
-        1, 1, 2, 1, 3, 2, 2, 3,
-        2, 7, 0, 1, 4, 1, 2, 4,
-        2, 1, 2, 0, 2, 2, 3, 5,
-        5, 1, 4, 1, 1, 2, 2, 1,
-        0, 0, 1, 1, 1, 1, 1, 2,
-        2, 2, 2, 1, 1, 1, 4, 2,
-        2, 3, 1, 4, 4, 6, 1, 3,
-        1, 1, 2, 1, 1, 1, 5, 3,
-        1, 1, 1, 2, 3, 3, 1, 2,
-        2, 1, 4, 1, 2, 5, 2, 1,
-        1, 0, 2, 2, 2, 2, 2, 2,
-        2, 2, 2, 1, 1, 2, 4, 2,
-        1, 2, 2, 2, 6, 1, 1, 2,
-        1, 2, 1, 1, 1, 2, 2, 2,
-        1, 3, 2, 5, 2, 8, 6, 2,
-        2, 2, 2, 3, 1, 3, 1, 2,
-        1, 3, 2, 2, 3, 1, 1, 1,
-        1, 1, 1, 1, 2, 2, 4, 1,
-        2, 1, 0, 1, 1, 1, 1, 0,
-        1, 2, 3, 1, 3, 3, 1, 0,
-        3, 0, 2, 3, 1, 0, 0, 0,
-        0, 2, 2, 2, 2, 1, 5, 2,
-        2, 5, 7, 5, 0, 1, 0, 1,
-        1, 1, 1, 1, 0, 1, 1, 0,
-        3, 3, 1, 1, 2, 1, 3, 5,
-        1, 1, 2, 2, 1, 1, 1, 1,
-        2, 6, 3, 7, 2, 6, 1, 6,
-        2, 8, 0, 4, 2, 5, 2, 3,
-        3, 3, 1, 2, 8, 2, 0, 2,
-        1, 2, 1, 5, 2, 1, 3, 3,
-        0, 2, 1, 2, 1, 0, 1, 1,
-        3, 1, 1, 2, 3, 0, 0, 3,
-        2, 4, 1, 4, 1, 1, 3, 1,
-        1, 1, 1, 2, 2, 1, 3, 1,
-        4, 3, 3, 1, 1, 5, 2, 1,
-        1, 2, 1, 2, 1, 3, 2, 0,
-        1, 1, 1, 1, 1, 1, 1, 2,
-        1, 1, 1, 1, 1, 1, 1, 0,
-        1, 1, 2, 2, 1, 1, 1, 3,
-        2, 1, 0, 2, 1, 1, 1, 1,
-        0, 3, 0, 1, 1, 4, 2, 3,
-        0, 1, 0, 2, 2, 4, 2, 2,
-        3, 1, 1, 1, 1, 0, 1, 1,
-        2, 2, 1, 4, 6, 9, 6, 8,
-        5, 8, 7, 10, 4, 6, 4, 7,
-        7, 5, 5, 4, 5, 1, 2, 8,
-        4, 3, 3, 3, 0, 3, 1, 2,
-        1, 2, 2, 3, 3, 1, 3, 2,
-        2, 1, 2, 2, 2, 3, 4, 4,
-        3, 1, 2, 1, 3, 2, 2, 2,
-        2, 2, 3, 3, 1, 1, 2, 1,
-        3, 2, 2, 3, 2, 7, 0, 1,
-        4, 1, 2, 4, 2, 1, 2, 0,
-        2, 2, 3, 5, 5, 1, 4, 1,
-        1, 2, 2, 1, 0, 0, 1, 1,
-        1, 1, 1, 2, 2, 2, 2, 1,
-        1, 1, 4, 2, 2, 3, 1, 4,
-        4, 6, 1, 3, 1, 1, 2, 1,
-        1, 1, 5, 3, 1, 1, 1, 2,
-        3, 3, 1, 2, 2, 1, 4, 1,
-        2, 5, 2, 1, 1, 0, 2, 2,
-        2, 2, 2, 2, 2, 2, 2, 1,
-        1, 2, 4, 2, 1, 2, 2, 2,
-        6, 1, 1, 2, 1, 2, 1, 1,
-        1, 2, 2, 2, 1, 3, 2, 5,
-        2, 8, 6, 2, 2, 2, 2, 3,
-        1, 3, 1, 2, 1, 3, 2, 2,
-        3, 1, 1, 1, 1, 1, 1, 1,
-        2, 2, 4, 1, 2, 1, 0, 1,
-        1, 1, 1, 0, 1, 2, 3, 1,
-        3, 3, 1, 0, 3, 0, 2, 3,
-        1, 0, 0, 0, 0, 2, 2, 2,
-        2, 1, 5, 2, 2, 5, 7, 5,
-        0, 1, 0, 1, 1, 1, 1, 1,
-        0, 1, 1, 1, 2, 2, 3, 3,
-        4, 7, 5, 7, 5, 3, 3, 7,
-        3, 13, 1, 3, 5, 3, 5, 3,
-        6, 5, 2, 2, 8, 4, 1, 2,
-        3, 2, 10, 2, 2, 0, 2, 3,
-        3, 1, 2, 3, 3, 1, 2, 3,
-        3, 4, 4, 2, 1, 2, 2, 3,
-        2, 2, 5, 3, 2, 3, 2, 1,
-        3, 3, 6, 2, 2, 5, 2, 5,
-        1, 1, 2, 4, 1, 11, 1, 3,
-        8, 4, 2, 1, 0, 4, 3, 3,
-        3, 2, 9, 1, 1, 4, 3, 2,
-        2, 2, 3, 4, 2, 3, 2, 4,
-        3, 2, 2, 3, 3, 4, 3, 3,
-        4, 2, 5, 4, 8, 7, 1, 2,
-        1, 3, 1, 2, 5, 1, 2, 2,
-        2, 2, 1, 3, 2, 2, 3, 3,
-        1, 9, 1, 5, 1, 3, 2, 2,
-        3, 2, 3, 3, 3, 1, 3, 3,
-        2, 2, 4, 5, 3, 3, 4, 3,
-        3, 3, 2, 2, 2, 4, 2, 2,
-        1, 3, 3, 3, 3, 3, 3, 2,
-        2, 3, 2, 3, 3, 2, 3, 2,
-        3, 1, 2, 2, 2, 2, 2, 2,
-        2, 2, 2, 2, 2, 3, 2, 3,
-        2, 3, 5, 3, 3, 1, 2, 3,
-        2, 2, 1, 2, 3, 4, 3, 0,
-        3, 0, 2, 3, 1, 0, 0, 0,
-        0, 2, 3, 2, 4, 6, 4, 1,
-        1, 2, 1, 2, 1, 3, 2, 3,
-        2, 0, 0, 1, 1, 1, 1, 1,
-        0, 0, 0, 1, 1, 1, 0, 0,
-        0, 0, 1, 1, 1, 0, 0, 0,
+        0, 0, 0, 0, 1, 1, 1, 5,
+        5, 5, 0, 0, 3, 0, 1, 1,
+        4, 2, 3, 0, 1, 0, 2, 2,
+        4, 2, 2, 3, 1, 1, 1, 1,
+        0, 1, 1, 2, 2, 1, 4, 6,
+        9, 6, 8, 5, 8, 7, 10, 4,
+        6, 4, 7, 7, 5, 5, 4, 5,
+        1, 2, 8, 4, 3, 3, 3, 0,
+        3, 1, 2, 1, 2, 2, 3, 3,
+        1, 3, 2, 2, 1, 2, 2, 2,
+        3, 4, 4, 3, 1, 2, 1, 3,
+        2, 2, 2, 2, 2, 3, 3, 1,
+        1, 2, 1, 3, 2, 2, 3, 2,
+        7, 0, 1, 4, 1, 2, 4, 2,
+        1, 2, 0, 2, 2, 3, 5, 5,
+        1, 4, 1, 1, 2, 2, 1, 0,
+        0, 1, 1, 1, 1, 1, 2, 2,
+        2, 2, 1, 1, 1, 4, 2, 2,
+        3, 1, 4, 4, 6, 1, 3, 1,
+        1, 2, 1, 1, 1, 5, 3, 1,
+        1, 1, 2, 3, 3, 1, 2, 2,
+        1, 4, 1, 2, 5, 2, 1, 1,
+        0, 2, 2, 2, 2, 2, 2, 2,
+        2, 2, 1, 1, 2, 4, 2, 1,
+        2, 2, 2, 6, 1, 1, 2, 1,
+        2, 1, 1, 1, 2, 2, 2, 1,
+        3, 2, 5, 2, 8, 6, 2, 2,
+        2, 2, 3, 1, 3, 1, 2, 1,
+        3, 2, 2, 3, 1, 1, 1, 1,
+        1, 1, 1, 2, 2, 4, 1, 2,
+        1, 0, 1, 1, 1, 1, 0, 1,
+        2, 3, 1, 3, 3, 1, 0, 3,
+        0, 2, 3, 1, 0, 0, 0, 0,
+        2, 2, 2, 2, 1, 5, 2, 2,
+        5, 7, 5, 0, 1, 0, 1, 1,
+        1, 1, 1, 0, 1, 1, 0, 3,
+        3, 1, 1, 2, 1, 3, 5, 1,
+        1, 2, 2, 1, 1, 1, 1, 2,
+        6, 3, 7, 2, 6, 1, 6, 2,
+        8, 0, 4, 2, 5, 2, 3, 3,
+        3, 1, 2, 8, 2, 0, 2, 1,
+        2, 1, 5, 2, 1, 3, 3, 0,
+        2, 1, 2, 1, 0, 1, 1, 3,
+        1, 1, 2, 3, 0, 0, 3, 2,
+        4, 1, 4, 1, 1, 3, 1, 1,
+        1, 1, 2, 2, 1, 3, 1, 4,
+        3, 3, 1, 1, 5, 2, 1, 1,
+        2, 1, 2, 1, 3, 2, 0, 1,
+        1, 1, 1, 1, 1, 1, 2, 1,
+        1, 1, 1, 1, 1, 1, 0, 1,
+        1, 2, 2, 1, 1, 1, 3, 2,
+        1, 0, 2, 1, 1, 1, 1, 0,
         3, 0, 1, 1, 4, 2, 3, 0,
         1, 0, 2, 2, 4, 2, 2, 3,
         1, 1, 1, 1, 0, 1, 1, 2,
@@ -1962,826 +1858,889 @@ var _hcltok_range_lengths []byte = []byte{
         0, 2, 3, 1, 0, 0, 0, 0,
         2, 3, 2, 4, 6, 4, 1, 1,
         2, 1, 2, 1, 3, 2, 3, 2,
-        11, 0, 0, 0, 0, 0, 0, 0,
-        0, 1, 0, 0, 0, 5, 0, 0,
-        1, 1, 1, 0, 1, 1, 5, 4,
-        2, 0, 1, 0, 2, 2, 5, 2,
-        3, 5, 3, 2, 3, 5, 1, 1,
-        1, 3, 1, 1, 2, 2, 3, 1,
-        2, 3, 1, 5, 5, 5, 5, 5,
-        3, 5, 5, 5, 5, 3, 5, 5,
-        5, 5, 5, 5, 5, 5, 0, 0,
-        0, 0, 1, 1, 1, 5, 5, 5,
-        5, 0, 0, 1, 1, 1, 5, 6,
-        0, 0, 1, 1, 1, 8, 5, 1,
-        1, 1, 0, 1, 1, 5, 4, 2,
-        0, 1, 0, 2, 2, 5, 2, 3,
-        5, 3, 2, 3, 5, 1, 1, 1,
-        3, 1, 1, 2, 2, 3, 1, 2,
-        3, 1,
+        5, 1, 1, 1, 1, 1, 0, 1,
+        1, 1, 0, 0, 0, 1, 1, 1,
+        0, 0, 0, 3, 0, 1, 1, 4,
+        2, 3, 0, 1, 0, 2, 2, 4,
+        2, 2, 3, 1, 1, 1, 1, 0,
+        1, 1, 2, 2, 1, 4, 6, 9,
+        6, 8, 5, 8, 7, 10, 4, 6,
+        4, 7, 7, 5, 5, 4, 5, 1,
+        2, 8, 4, 3, 3, 3, 0, 3,
+        1, 2, 1, 2, 2, 3, 3, 1,
+        3, 2, 2, 1, 2, 2, 2, 3,
+        4, 4, 3, 1, 2, 1, 3, 2,
+        2, 2, 2, 2, 3, 3, 1, 1,
+        2, 1, 3, 2, 2, 3, 2, 7,
+        0, 1, 4, 1, 2, 4, 2, 1,
+        2, 0, 2, 2, 3, 5, 5, 1,
+        4, 1, 1, 2, 2, 1, 0, 0,
+        1, 1, 1, 1, 1, 2, 2, 2,
+        2, 1, 1, 1, 4, 2, 2, 3,
+        1, 4, 4, 6, 1, 3, 1, 1,
+        2, 1, 1, 1, 5, 3, 1, 1,
+        1, 2, 3, 3, 1, 2, 2, 1,
+        4, 1, 2, 5, 2, 1, 1, 0,
+        2, 2, 2, 2, 2, 2, 2, 2,
+        2, 1, 1, 2, 4, 2, 1, 2,
+        2, 2, 6, 1, 1, 2, 1, 2,
+        1, 1, 1, 2, 2, 2, 1, 3,
+        2, 5, 2, 8, 6, 2, 2, 2,
+        2, 3, 1, 3, 1, 2, 1, 3,
+        2, 2, 3, 1, 1, 1, 1, 1,
+        1, 1, 2, 2, 4, 1, 2, 1,
+        0, 1, 1, 1, 1, 0, 1, 2,
+        3, 1, 3, 3, 1, 0, 3, 0,
+        2, 3, 1, 0, 0, 0, 0, 2,
+        2, 2, 2, 1, 5, 2, 2, 5,
+        7, 5, 0, 1, 0, 1, 1, 1,
+        1, 1, 0, 1, 1, 1, 2, 2,
+        3, 3, 4, 7, 5, 7, 5, 3,
+        3, 7, 3, 13, 1, 3, 5, 3,
+        5, 3, 6, 5, 2, 2, 8, 4,
+        1, 2, 3, 2, 10, 2, 2, 0,
+        2, 3, 3, 1, 2, 3, 3, 1,
+        2, 3, 3, 4, 4, 2, 1, 2,
+        2, 3, 2, 2, 5, 3, 2, 3,
+        2, 1, 3, 3, 6, 2, 2, 5,
+        2, 5, 1, 1, 2, 4, 1, 11,
+        1, 3, 8, 4, 2, 1, 0, 4,
+        3, 3, 3, 2, 9, 1, 1, 4,
+        3, 2, 2, 2, 3, 4, 2, 3,
+        2, 4, 3, 2, 2, 3, 3, 4,
+        3, 3, 4, 2, 5, 4, 8, 7,
+        1, 2, 1, 3, 1, 2, 5, 1,
+        2, 2, 2, 2, 1, 3, 2, 2,
+        3, 3, 1, 9, 1, 5, 1, 3,
+        2, 2, 3, 2, 3, 3, 3, 1,
+        3, 3, 2, 2, 4, 5, 3, 3,
+        4, 3, 3, 3, 2, 2, 2, 4,
+        2, 2, 1, 3, 3, 3, 3, 3,
+        3, 2, 2, 3, 2, 3, 3, 2,
+        3, 2, 3, 1, 2, 2, 2, 2,
+        2, 2, 2, 2, 2, 2, 2, 3,
+        2, 3, 2, 3, 5, 3, 3, 1,
+        2, 3, 2, 2, 1, 2, 3, 4,
+        3, 0, 3, 0, 2, 3, 1, 0,
+        0, 0, 0, 2, 3, 2, 4, 6,
+        4, 1, 1, 2, 1, 2, 1, 3,
+        2, 3, 2, 11, 0, 0, 0, 0,
+        0, 0, 0, 1, 0, 0, 0, 5,
+        0, 0, 1, 1, 1, 0, 1, 1,
+        5, 4, 2, 0, 1, 0, 2, 2,
+        5, 2, 3, 5, 3, 2, 3, 5,
+        1, 1, 1, 3, 1, 1, 2, 2,
+        3, 1, 2, 3, 1, 5, 6, 0,
+        0, 0, 0, 0, 0, 0, 0, 5,
+        1, 1, 1, 5, 6, 0, 0, 0,
+        0, 0, 0, 1, 1, 1, 5, 6,
+        0, 0, 0, 0, 0, 0, 1, 1,
+        1, 8, 5, 1, 1, 1, 0, 1,
+        1, 5, 4, 2, 0, 1, 0, 2,
+        2, 5, 2, 3, 5, 3, 2, 3,
+        5, 1, 1, 1, 3, 1, 1, 2,
+        2, 3, 1, 2, 3, 1,
 }
 
 var _hcltok_index_offsets []int16 = []int16{
-        0, 0, 2, 4, 6, 9, 14, 18,
-        20, 58, 95, 137, 139, 144, 148, 149,
-        151, 153, 159, 164, 169, 171, 174, 176,
-        179, 183, 189, 192, 195, 201, 203, 205,
-        207, 210, 243, 245, 247, 250, 253, 256,
-        264, 272, 283, 291, 300, 308, 317, 326,
-        338, 345, 352, 360, 368, 377, 383, 391,
-        397, 405, 407, 410, 424, 430, 438, 442,
-        446, 448, 495, 497, 500, 502, 507, 513,
-        519, 524, 527, 531, 534, 537, 539, 542,
-        545, 548, 552, 557, 562, 566, 568, 571,
-        573, 577, 580, 583, 586, 589, 593, 598,
-        602, 604, 606, 609, 611, 615, 618, 621,
-        629, 633, 641, 657, 659, 664, 666, 670,
-        681, 685, 687, 690, 692, 695, 700, 704,
-        710, 716, 727, 732, 735, 738, 741, 744,
-        746, 750, 751, 754, 756, 786, 788, 790,
-        793, 797, 800, 804, 806, 808, 810, 816,
-        819, 822, 826, 828, 833, 838, 845, 848,
-        852, 856, 858, 861, 881, 883, 885, 892,
-        896, 898, 900, 902, 905, 909, 913, 915,
-        919, 922, 924, 929, 947, 986, 992, 995,
-        997, 999, 1001, 1004, 1007, 1010, 1013, 1016,
-        1020, 1023, 1026, 1029, 1031, 1033, 1036, 1043,
-        1046, 1048, 1051, 1054, 1057, 1065, 1067, 1069,
-        1072, 1074, 1077, 1079, 1081, 1111, 1114, 1117,
-        1120, 1123, 1128, 1132, 1139, 1142, 1151, 1160,
-        1163, 1167, 1170, 1173, 1177, 1179, 1183, 1185,
-        1188, 1190, 1194, 1198, 1202, 1210, 1212, 1214,
-        1218, 1222, 1224, 1237, 1239, 1242, 1245, 1250,
-        1252, 1255, 1257, 1259, 1262, 1267, 1269, 1271,
-        1276, 1278, 1281, 1285, 1305, 1309, 1313, 1315,
-        1317, 1325, 1327, 1334, 1339, 1341, 1345, 1348,
-        1351, 1354, 1358, 1361, 1364, 1368, 1378, 1384,
-        1387, 1390, 1400, 1420, 1426, 1429, 1431, 1435,
-        1437, 1440, 1442, 1446, 1448, 1450, 1454, 1456,
-        1460, 1465, 1471, 1473, 1475, 1478, 1480, 1484,
-        1491, 1494, 1496, 1499, 1503, 1533, 1538, 1540,
-        1543, 1547, 1556, 1561, 1569, 1573, 1581, 1585,
-        1593, 1597, 1608, 1610, 1616, 1619, 1627, 1631,
-        1636, 1641, 1646, 1648, 1651, 1666, 1670, 1672,
-        1675, 1677, 1726, 1729, 1736, 1739, 1741, 1745,
-        1749, 1752, 1756, 1758, 1761, 1763, 1765, 1767,
-        1769, 1773, 1775, 1777, 1780, 1784, 1798, 1801,
-        1805, 1808, 1813, 1824, 1829, 1832, 1862, 1866,
-        1869, 1874, 1876, 1880, 1883, 1886, 1888, 1893,
-        1895, 1901, 1906, 1912, 1914, 1934, 1942, 1945,
-        1947, 1965, 2003, 2005, 2008, 2010, 2015, 2018,
-        2047, 2049, 2051, 2053, 2055, 2058, 2060, 2064,
-        2067, 2069, 2072, 2074, 2076, 2079, 2081, 2083,
-        2085, 2087, 2089, 2092, 2095, 2098, 2111, 2113,
-        2117, 2120, 2122, 2127, 2130, 2144, 2147, 2156,
-        2158, 2163, 2167, 2168, 2170, 2172, 2178, 2183,
-        2188, 2190, 2193, 2195, 2198, 2202, 2208, 2211,
-        2214, 2220, 2222, 2224, 2226, 2229, 2262, 2264,
-        2266, 2269, 2272, 2275, 2283, 2291, 2302, 2310,
-        2319, 2327, 2336, 2345, 2357, 2364, 2371, 2379,
-        2387, 2396, 2402, 2410, 2416, 2424, 2426, 2429,
-        2443, 2449, 2457, 2461, 2465, 2467, 2514, 2516,
-        2519, 2521, 2526, 2532, 2538, 2543, 2546, 2550,
-        2553, 2556, 2558, 2561, 2564, 2567, 2571, 2576,
-        2581, 2585, 2587, 2590, 2592, 2596, 2599, 2602,
-        2605, 2608, 2612, 2617, 2621, 2623, 2625, 2628,
-        2630, 2634, 2637, 2640, 2648, 2652, 2660, 2676,
-        2678, 2683, 2685, 2689, 2700, 2704, 2706, 2709,
-        2711, 2714, 2719, 2723, 2729, 2735, 2746, 2751,
-        2754, 2757, 2760, 2763, 2765, 2769, 2770, 2773,
-        2775, 2805, 2807, 2809, 2812, 2816, 2819, 2823,
-        2825, 2827, 2829, 2835, 2838, 2841, 2845, 2847,
-        2852, 2857, 2864, 2867, 2871, 2875, 2877, 2880,
-        2900, 2902, 2904, 2911, 2915, 2917, 2919, 2921,
-        2924, 2928, 2932, 2934, 2938, 2941, 2943, 2948,
-        2966, 3005, 3011, 3014, 3016, 3018, 3020, 3023,
-        3026, 3029, 3032, 3035, 3039, 3042, 3045, 3048,
-        3050, 3052, 3055, 3062, 3065, 3067, 3070, 3073,
-        3076, 3084, 3086, 3088, 3091, 3093, 3096, 3098,
-        3100, 3130, 3133, 3136, 3139, 3142, 3147, 3151,
-        3158, 3161, 3170, 3179, 3182, 3186, 3189, 3192,
-        3196, 3198, 3202, 3204, 3207, 3209, 3213, 3217,
-        3221, 3229, 3231, 3233, 3237, 3241, 3243, 3256,
-        3258, 3261, 3264, 3269, 3271, 3274, 3276, 3278,
-        3281, 3286, 3288, 3290, 3295, 3297, 3300, 3304,
-        3324, 3328, 3332, 3334, 3336, 3344, 3346, 3353,
-        3358, 3360, 3364, 3367, 3370, 3373, 3377, 3380,
-        3383, 3387, 3397, 3403, 3406, 3409, 3419, 3439,
-        3445, 3448, 3450, 3454, 3456, 3459, 3461, 3465,
-        3467, 3469, 3473, 3475, 3477, 3483, 3486, 3491,
-        3496, 3502, 3512, 3520, 3532, 3539, 3549, 3555,
-        3567, 3573, 3591, 3594, 3602, 3608, 3618, 3625,
-        3632, 3640, 3648, 3651, 3656, 3676, 3682, 3685,
-        3689, 3693, 3697, 3709, 3712, 3717, 3718, 3724,
-        3731, 3737, 3740, 3743, 3747, 3751, 3754, 3757,
-        3762, 3766, 3772, 3778, 3781, 3785, 3788, 3791,
-        3796, 3799, 3802, 3808, 3812, 3815, 3819, 3822,
-        3825, 3829, 3833, 3840, 3843, 3846, 3852, 3855,
-        3862, 3864, 3866, 3869, 3878, 3883, 3897, 3901,
-        3905, 3920, 3926, 3929, 3932, 3934, 3939, 3945,
-        3949, 3957, 3963, 3973, 3976, 3979, 3984, 3988,
-        3991, 3994, 3997, 4001, 4006, 4010, 4014, 4017,
-        4022, 4027, 4030, 4036, 4040, 4046, 4051, 4055,
-        4059, 4067, 4070, 4078, 4084, 4094, 4105, 4108,
-        4111, 4113, 4117, 4119, 4122, 4133, 4137, 4140,
-        4143, 4146, 4149, 4151, 4155, 4159, 4162, 4166,
-        4171, 4174, 4184, 4186, 4227, 4233, 4237, 4240,
-        4243, 4247, 4250, 4254, 4258, 4263, 4265, 4269,
-        4273, 4276, 4279, 4284, 4293, 4297, 4302, 4307,
-        4311, 4318, 4322, 4325, 4329, 4332, 4337, 4340,
-        4343, 4373, 4377, 4381, 4385, 4389, 4394, 4398,
-        4404, 4408, 4416, 4419, 4424, 4428, 4431, 4436,
-        4439, 4443, 4446, 4449, 4452, 4455, 4458, 4462,
-        4466, 4469, 4479, 4482, 4485, 4490, 4496, 4499,
-        4514, 4517, 4521, 4527, 4531, 4535, 4538, 4542,
-        4549, 4552, 4555, 4561, 4564, 4568, 4573, 4589,
-        4591, 4599, 4601, 4609, 4615, 4617, 4621, 4624,
-        4627, 4630, 4634, 4645, 4648, 4660, 4684, 4692,
-        4694, 4698, 4701, 4706, 4709, 4711, 4716, 4719,
-        4725, 4728, 4730, 4732, 4734, 4736, 4738, 4740,
-        4742, 4744, 4746, 4748, 4750, 4752, 4754, 4756,
-        4758, 4760, 4762, 4764, 4766, 4768, 4770, 4772,
-        4777, 4781, 4782, 4784, 4786, 4792, 4797, 4802,
-        4804, 4807, 4809, 4812, 4816, 4822, 4825, 4828,
-        4834, 4836, 4838, 4840, 4843, 4876, 4878, 4880,
-        4883, 4886, 4889, 4897, 4905, 4916, 4924, 4933,
-        4941, 4950, 4959, 4971, 4978, 4985, 4993, 5001,
-        5010, 5016, 5024, 5030, 5038, 5040, 5043, 5057,
-        5063, 5071, 5075, 5079, 5081, 5128, 5130, 5133,
-        5135, 5140, 5146, 5152, 5157, 5160, 5164, 5167,
-        5170, 5172, 5175, 5178, 5181, 5185, 5190, 5195,
-        5199, 5201, 5204, 5206, 5210, 5213, 5216, 5219,
-        5222, 5226, 5231, 5235, 5237, 5239, 5242, 5244,
-        5248, 5251, 5254, 5262, 5266, 5274, 5290, 5292,
-        5297, 5299, 5303, 5314, 5318, 5320, 5323, 5325,
-        5328, 5333, 5337, 5343, 5349, 5360, 5365, 5368,
-        5371, 5374, 5377, 5379, 5383, 5384, 5387, 5389,
-        5419, 5421, 5423, 5426, 5430, 5433, 5437, 5439,
-        5441, 5443, 5449, 5452, 5455, 5459, 5461, 5466,
-        5471, 5478, 5481, 5485, 5489, 5491, 5494, 5514,
-        5516, 5518, 5525, 5529, 5531, 5533, 5535, 5538,
-        5542, 5546, 5548, 5552, 5555, 5557, 5562, 5580,
-        5619, 5625, 5628, 5630, 5632, 5634, 5637, 5640,
-        5643, 5646, 5649, 5653, 5656, 5659, 5662, 5664,
-        5666, 5669, 5676, 5679, 5681, 5684, 5687, 5690,
-        5698, 5700, 5702, 5705, 5707, 5710, 5712, 5714,
-        5744, 5747, 5750, 5753, 5756, 5761, 5765, 5772,
-        5775, 5784, 5793, 5796, 5800, 5803, 5806, 5810,
-        5812, 5816, 5818, 5821, 5823, 5827, 5831, 5835,
-        5843, 5845, 5847, 5851, 5855, 5857, 5870, 5872,
-        5875, 5878, 5883, 5885, 5888, 5890, 5892, 5895,
-        5900, 5902, 5904, 5909, 5911, 5914, 5918, 5938,
-        5942, 5946, 5948, 5950, 5958, 5960, 5967, 5972,
-        5974, 5978, 5981, 5984, 5987, 5991, 5994, 5997,
-        6001, 6011, 6017, 6020, 6023, 6033, 6053, 6059,
-        6062, 6064, 6068, 6070, 6073, 6075, 6079, 6081,
-        6083, 6087, 6089, 6091, 6097, 6100, 6105, 6110,
-        6116, 6126, 6134, 6146, 6153, 6163, 6169, 6181,
-        6187, 6205, 6208, 6216, 6222, 6232, 6239, 6246,
-        6254, 6262, 6265, 6270, 6290, 6296, 6299, 6303,
-        6307, 6311, 6323, 6326, 6331, 6332, 6338, 6345,
-        6351, 6354, 6357, 6361, 6365, 6368, 6371, 6376,
-        6380, 6386, 6392, 6395, 6399, 6402, 6405, 6410,
-        6413, 6416, 6422, 6426, 6429, 6433, 6436, 6439,
-        6443, 6447, 6454, 6457, 6460, 6466, 6469, 6476,
-        6478, 6480, 6483, 6492, 6497, 6511, 6515, 6519,
-        6534, 6540, 6543, 6546, 6548, 6553, 6559, 6563,
-        6571, 6577, 6587, 6590, 6593, 6598, 6602, 6605,
-        6608, 6611, 6615, 6620, 6624, 6628, 6631, 6636,
-        6641, 6644, 6650, 6654, 6660, 6665, 6669, 6673,
-        6681, 6684, 6692, 6698, 6708, 6719, 6722, 6725,
-        6727, 6731, 6733, 6736, 6747, 6751, 6754, 6757,
-        6760, 6763, 6765, 6769, 6773, 6776, 6780, 6785,
-        6788, 6798, 6800, 6841, 6847, 6851, 6854, 6857,
-        6861, 6864, 6868, 6872, 6877, 6879, 6883, 6887,
-        6890, 6893, 6898, 6907, 6911, 6916, 6921, 6925,
-        6932, 6936, 6939, 6943, 6946, 6951, 6954, 6957,
-        6987, 6991, 6995, 6999, 7003, 7008, 7012, 7018,
-        7022, 7030, 7033, 7038, 7042, 7045, 7050, 7053,
-        7057, 7060, 7063, 7066, 7069, 7072, 7076, 7080,
-        7083, 7093, 7096, 7099, 7104, 7110, 7113, 7128,
-        7131, 7135, 7141, 7145, 7149, 7152, 7156, 7163,
-        7166, 7169, 7175, 7178, 7182, 7187, 7203, 7205,
-        7213, 7215, 7223, 7229, 7231, 7235, 7238, 7241,
-        7244, 7248, 7259, 7262, 7274, 7298, 7306, 7308,
-        7312, 7315, 7320, 7323, 7325, 7330, 7333, 7339,
-        7342, 7408, 7411, 7413, 7415, 7417, 7419, 7421,
-        7424, 7426, 7431, 7434, 7437, 7439, 7479, 7481,
-        7483, 7485, 7490, 7494, 7495, 7497, 7499, 7506,
-        7513, 7520, 7522, 7524, 7526, 7529, 7532, 7538,
-        7541, 7546, 7553, 7558, 7561, 7565, 7572, 7604,
-        7653, 7668, 7681, 7686, 7688, 7692, 7723, 7729,
-        7731, 7752, 7772, 7774, 7786, 7798, 7810, 7822,
-        7833, 7841, 7854, 7867, 7880, 7892, 7900, 7913,
-        7925, 7937, 7949, 7961, 7973, 7985, 7997, 7999,
-        8001, 8003, 8005, 8007, 8009, 8011, 8021, 8031,
-        8041, 8051, 8053, 8055, 8057, 8059, 8061, 8071,
-        8080, 8082, 8084, 8086, 8088, 8090, 8132, 8172,
-        8174, 8179, 8183, 8184, 8186, 8188, 8195, 8202,
-        8209, 8211, 8213, 8215, 8218, 8221, 8227, 8230,
-        8235, 8242, 8247, 8250, 8254, 8261, 8293, 8342,
-        8357, 8370, 8375, 8377, 8381, 8412, 8418, 8420,
-        8441, 8461,
+        0, 0, 2, 4, 7, 12, 16, 18,
+        56, 93, 135, 137, 142, 146, 147, 149,
+        151, 157, 162, 167, 169, 172, 174, 177,
+        181, 187, 190, 193, 199, 201, 203, 205,
+        208, 241, 243, 245, 248, 251, 254, 262,
+        270, 281, 289, 298, 306, 315, 324, 336,
+        343, 350, 358, 366, 375, 381, 389, 395,
+        403, 405, 408, 422, 428, 436, 440, 444,
+        446, 493, 495, 498, 500, 505, 511, 517,
+        522, 525, 529, 532, 535, 537, 540, 543,
+        546, 550, 555, 560, 564, 566, 569, 571,
+        575, 578, 581, 584, 587, 591, 596, 600,
+        602, 604, 607, 609, 613, 616, 619, 627,
+        631, 639, 655, 657, 662, 664, 668, 679,
+        683, 685, 688, 690, 693, 698, 702, 708,
+        714, 725, 730, 733, 736, 739, 742, 744,
+        748, 749, 752, 754, 784, 786, 788, 791,
+        795, 798, 802, 804, 806, 808, 814, 817,
+        820, 824, 826, 831, 836, 843, 846, 850,
+        854, 856, 859, 879, 881, 883, 890, 894,
+        896, 898, 900, 903, 907, 911, 913, 917,
+        920, 922, 927, 945, 984, 990, 993, 995,
+        997, 999, 1002, 1005, 1008, 1011, 1014, 1018,
+        1021, 1024, 1027, 1029, 1031, 1034, 1041, 1044,
+        1046, 1049, 1052, 1055, 1063, 1065, 1067, 1070,
+        1072, 1075, 1077, 1079, 1109, 1112, 1115, 1118,
+        1121, 1126, 1130, 1137, 1140, 1149, 1158, 1161,
+        1165, 1168, 1171, 1175, 1177, 1181, 1183, 1186,
+        1188, 1192, 1196, 1200, 1208, 1210, 1212, 1216,
+        1220, 1222, 1235, 1237, 1240, 1243, 1248, 1250,
+        1253, 1255, 1257, 1260, 1265, 1267, 1269, 1274,
+        1276, 1279, 1283, 1303, 1307, 1311, 1313, 1315,
+        1323, 1325, 1332, 1337, 1339, 1343, 1346, 1349,
+        1352, 1356, 1359, 1362, 1366, 1376, 1382, 1385,
+        1388, 1398, 1418, 1424, 1427, 1429, 1433, 1435,
+        1438, 1440, 1444, 1446, 1448, 1452, 1454, 1458,
+        1463, 1469, 1471, 1473, 1476, 1478, 1482, 1489,
+        1492, 1494, 1497, 1501, 1531, 1536, 1538, 1541,
+        1545, 1554, 1559, 1567, 1571, 1579, 1583, 1591,
+        1595, 1606, 1608, 1614, 1617, 1625, 1629, 1634,
+        1639, 1644, 1646, 1649, 1664, 1668, 1670, 1673,
+        1675, 1724, 1727, 1734, 1737, 1739, 1743, 1747,
+        1750, 1754, 1756, 1759, 1761, 1763, 1765, 1767,
+        1771, 1773, 1775, 1778, 1782, 1796, 1799, 1803,
+        1806, 1811, 1822, 1827, 1830, 1860, 1864, 1867,
+        1872, 1874, 1878, 1881, 1884, 1886, 1891, 1893,
+        1899, 1904, 1910, 1912, 1932, 1940, 1943, 1945,
+        1963, 2001, 2003, 2006, 2008, 2013, 2016, 2045,
+        2047, 2049, 2051, 2053, 2056, 2058, 2062, 2065,
+        2067, 2070, 2072, 2074, 2077, 2079, 2081, 2083,
+        2085, 2087, 2090, 2093, 2096, 2109, 2111, 2115,
+        2118, 2120, 2125, 2128, 2142, 2145, 2154, 2156,
+        2161, 2165, 2166, 2168, 2170, 2176, 2181, 2186,
+        2188, 2191, 2193, 2196, 2200, 2206, 2209, 2212,
+        2218, 2220, 2222, 2224, 2227, 2260, 2262, 2264,
+        2267, 2270, 2273, 2281, 2289, 2300, 2308, 2317,
+        2325, 2334, 2343, 2355, 2362, 2369, 2377, 2385,
+        2394, 2400, 2408, 2414, 2422, 2424, 2427, 2441,
+        2447, 2455, 2459, 2463, 2465, 2512, 2514, 2517,
+        2519, 2524, 2530, 2536, 2541, 2544, 2548, 2551,
+        2554, 2556, 2559, 2562, 2565, 2569, 2574, 2579,
+        2583, 2585, 2588, 2590, 2594, 2597, 2600, 2603,
+        2606, 2610, 2615, 2619, 2621, 2623, 2626, 2628,
+        2632, 2635, 2638, 2646, 2650, 2658, 2674, 2676,
+        2681, 2683, 2687, 2698, 2702, 2704, 2707, 2709,
+        2712, 2717, 2721, 2727, 2733, 2744, 2749, 2752,
+        2755, 2758, 2761, 2763, 2767, 2768, 2771, 2773,
+        2803, 2805, 2807, 2810, 2814, 2817, 2821, 2823,
+        2825, 2827, 2833, 2836, 2839, 2843, 2845, 2850,
+        2855, 2862, 2865, 2869, 2873, 2875, 2878, 2898,
+        2900, 2902, 2909, 2913, 2915, 2917, 2919, 2922,
+        2926, 2930, 2932, 2936, 2939, 2941, 2946, 2964,
+        3003, 3009, 3012, 3014, 3016, 3018, 3021, 3024,
+        3027, 3030, 3033, 3037, 3040, 3043, 3046, 3048,
+        3050, 3053, 3060, 3063, 3065, 3068, 3071, 3074,
+        3082, 3084, 3086, 3089, 3091, 3094, 3096, 3098,
+        3128, 3131, 3134, 3137, 3140, 3145, 3149, 3156,
+        3159, 3168, 3177, 3180, 3184, 3187, 3190, 3194,
+        3196, 3200, 3202, 3205, 3207, 3211, 3215, 3219,
+        3227, 3229, 3231, 3235, 3239, 3241, 3254, 3256,
+        3259, 3262, 3267, 3269, 3272, 3274, 3276, 3279,
+        3284, 3286, 3288, 3293, 3295, 3298, 3302, 3322,
+        3326, 3330, 3332, 3334, 3342, 3344, 3351, 3356,
+        3358, 3362, 3365, 3368, 3371, 3375, 3378, 3381,
+        3385, 3395, 3401, 3404, 3407, 3417, 3437, 3443,
+        3446, 3448, 3452, 3454, 3457, 3459, 3463, 3465,
+        3467, 3471, 3473, 3475, 3481, 3484, 3489, 3494,
+        3500, 3510, 3518, 3530, 3537, 3547, 3553, 3565,
+        3571, 3589, 3592, 3600, 3606, 3616, 3623, 3630,
+        3638, 3646, 3649, 3654, 3674, 3680, 3683, 3687,
+        3691, 3695, 3707, 3710, 3715, 3716, 3722, 3729,
+        3735, 3738, 3741, 3745, 3749, 3752, 3755, 3760,
+        3764, 3770, 3776, 3779, 3783, 3786, 3789, 3794,
+        3797, 3800, 3806, 3810, 3813, 3817, 3820, 3823,
+        3827, 3831, 3838, 3841, 3844, 3850, 3853, 3860,
+        3862, 3864, 3867, 3876, 3881, 3895, 3899, 3903,
+        3918, 3924, 3927, 3930, 3932, 3937, 3943, 3947,
+        3955, 3961, 3971, 3974, 3977, 3982, 3986, 3989,
+        3992, 3995, 3999, 4004, 4008, 4012, 4015, 4020,
+        4025, 4028, 4034, 4038, 4044, 4049, 4053, 4057,
+        4065, 4068, 4076, 4082, 4092, 4103, 4106, 4109,
+        4111, 4115, 4117, 4120, 4131, 4135, 4138, 4141,
+        4144, 4147, 4149, 4153, 4157, 4160, 4164, 4169,
+        4172, 4182, 4184, 4225, 4231, 4235, 4238, 4241,
+        4245, 4248, 4252, 4256, 4261, 4263, 4267, 4271,
+        4274, 4277, 4282, 4291, 4295, 4300, 4305, 4309,
+        4316, 4320, 4323, 4327, 4330, 4335, 4338, 4341,
+        4371, 4375, 4379, 4383, 4387, 4392, 4396, 4402,
+        4406, 4414, 4417, 4422, 4426, 4429, 4434, 4437,
+        4441, 4444, 4447, 4450, 4453, 4456, 4460, 4464,
+        4467, 4477, 4480, 4483, 4488, 4494, 4497, 4512,
+        4515, 4519, 4525, 4529, 4533, 4536, 4540, 4547,
+        4550, 4553, 4559, 4562, 4566, 4571, 4587, 4589,
+        4597, 4599, 4607, 4613, 4615, 4619, 4622, 4625,
+        4628, 4632, 4643, 4646, 4658, 4682, 4690, 4692,
+        4696, 4699, 4704, 4707, 4709, 4714, 4717, 4723,
+        4726, 4734, 4736, 4738, 4740, 4742, 4744, 4746,
+        4748, 4750, 4752, 4755, 4758, 4760, 4762, 4764,
+        4766, 4769, 4772, 4777, 4781, 4782, 4784, 4786,
+        4792, 4797, 4802, 4804, 4807, 4809, 4812, 4816,
+        4822, 4825, 4828, 4834, 4836, 4838, 4840, 4843,
+        4876, 4878, 4880, 4883, 4886, 4889, 4897, 4905,
+        4916, 4924, 4933, 4941, 4950, 4959, 4971, 4978,
+        4985, 4993, 5001, 5010, 5016, 5024, 5030, 5038,
+        5040, 5043, 5057, 5063, 5071, 5075, 5079, 5081,
+        5128, 5130, 5133, 5135, 5140, 5146, 5152, 5157,
+        5160, 5164, 5167, 5170, 5172, 5175, 5178, 5181,
+        5185, 5190, 5195, 5199, 5201, 5204, 5206, 5210,
+        5213, 5216, 5219, 5222, 5226, 5231, 5235, 5237,
+        5239, 5242, 5244, 5248, 5251, 5254, 5262, 5266,
+        5274, 5290, 5292, 5297, 5299, 5303, 5314, 5318,
+        5320, 5323, 5325, 5328, 5333, 5337, 5343, 5349,
+        5360, 5365, 5368, 5371, 5374, 5377, 5379, 5383,
+        5384, 5387, 5389, 5419, 5421, 5423, 5426, 5430,
+        5433, 5437, 5439, 5441, 5443, 5449, 5452, 5455,
+        5459, 5461, 5466, 5471, 5478, 5481, 5485, 5489,
+        5491, 5494, 5514, 5516, 5518, 5525, 5529, 5531,
+        5533, 5535, 5538, 5542, 5546, 5548, 5552, 5555,
+        5557, 5562, 5580, 5619, 5625, 5628, 5630, 5632,
+        5634, 5637, 5640, 5643, 5646, 5649, 5653, 5656,
+        5659, 5662, 5664, 5666, 5669, 5676, 5679, 5681,
+        5684, 5687, 5690, 5698, 5700, 5702, 5705, 5707,
+        5710, 5712, 5714, 5744, 5747, 5750, 5753, 5756,
+        5761, 5765, 5772, 5775, 5784, 5793, 5796, 5800,
+        5803, 5806, 5810, 5812, 5816, 5818, 5821, 5823,
+        5827, 5831, 5835, 5843, 5845, 5847, 5851, 5855,
+        5857, 5870, 5872, 5875, 5878, 5883, 5885, 5888,
+        5890, 5892, 5895, 5900, 5902, 5904, 5909, 5911,
+        5914, 5918, 5938, 5942, 5946, 5948, 5950, 5958,
+        5960, 5967, 5972, 5974, 5978, 5981, 5984, 5987,
+        5991, 5994, 5997, 6001, 6011, 6017, 6020, 6023,
+        6033, 6053, 6059, 6062, 6064, 6068, 6070, 6073,
+        6075, 6079, 6081, 6083, 6087, 6089, 6091, 6097,
+        6100, 6105, 6110, 6116, 6126, 6134, 6146, 6153,
+        6163, 6169, 6181, 6187, 6205, 6208, 6216, 6222,
+        6232, 6239, 6246, 6254, 6262, 6265, 6270, 6290,
+        6296, 6299, 6303, 6307, 6311, 6323, 6326, 6331,
+        6332, 6338, 6345, 6351, 6354, 6357, 6361, 6365,
+        6368, 6371, 6376, 6380, 6386, 6392, 6395, 6399,
+        6402, 6405, 6410, 6413, 6416, 6422, 6426, 6429,
+        6433, 6436, 6439, 6443, 6447, 6454, 6457, 6460,
+        6466, 6469, 6476, 6478, 6480, 6483, 6492, 6497,
+        6511, 6515, 6519, 6534, 6540, 6543, 6546, 6548,
+        6553, 6559, 6563, 6571, 6577, 6587, 6590, 6593,
+        6598, 6602, 6605, 6608, 6611, 6615, 6620, 6624,
+        6628, 6631, 6636, 6641, 6644, 6650, 6654, 6660,
+        6665, 6669, 6673, 6681, 6684, 6692, 6698, 6708,
+        6719, 6722, 6725, 6727, 6731, 6733, 6736, 6747,
+        6751, 6754, 6757, 6760, 6763, 6765, 6769, 6773,
+        6776, 6780, 6785, 6788, 6798, 6800, 6841, 6847,
+        6851, 6854, 6857, 6861, 6864, 6868, 6872, 6877,
+        6879, 6883, 6887, 6890, 6893, 6898, 6907, 6911,
+        6916, 6921, 6925, 6932, 6936, 6939, 6943, 6946,
+        6951, 6954, 6957, 6987, 6991, 6995, 6999, 7003,
+        7008, 7012, 7018, 7022, 7030, 7033, 7038, 7042,
+        7045, 7050, 7053, 7057, 7060, 7063, 7066, 7069,
+        7072, 7076, 7080, 7083, 7093, 7096, 7099, 7104,
+        7110, 7113, 7128, 7131, 7135, 7141, 7145, 7149,
+        7152, 7156, 7163, 7166, 7169, 7175, 7178, 7182,
+        7187, 7203, 7205, 7213, 7215, 7223, 7229, 7231,
+        7235, 7238, 7241, 7244, 7248, 7259, 7262, 7274,
+        7298, 7306, 7308, 7312, 7315, 7320, 7323, 7325,
+        7330, 7333, 7339, 7342, 7407, 7410, 7412, 7414,
+        7416, 7418, 7420, 7423, 7428, 7431, 7434, 7436,
+        7476, 7478, 7480, 7482, 7487, 7491, 7492, 7494,
+        7496, 7503, 7510, 7517, 7519, 7521, 7523, 7526,
+        7529, 7535, 7538, 7543, 7550, 7555, 7558, 7562,
+        7569, 7601, 7650, 7665, 7678, 7683, 7685, 7689,
+        7720, 7726, 7728, 7749, 7769, 7771, 7783, 7794,
+        7797, 7800, 7801, 7803, 7805, 7807, 7810, 7812,
+        7820, 7822, 7824, 7826, 7836, 7845, 7848, 7852,
+        7856, 7859, 7861, 7863, 7865, 7867, 7869, 7879,
+        7888, 7891, 7895, 7899, 7902, 7904, 7906, 7908,
+        7910, 7912, 7954, 7994, 7996, 8001, 8005, 8006,
+        8008, 8010, 8017, 8024, 8031, 8033, 8035, 8037,
+        8040, 8043, 8049, 8052, 8057, 8064, 8069, 8072,
+        8076, 8083, 8115, 8164, 8179, 8192, 8197, 8199,
+        8203, 8234, 8240, 8242, 8263, 8283,
 }
 
 var _hcltok_indicies []int16 = []int16{
-        2, 1, 4, 3, 6, 5, 6, 7,
-        5, 9, 11, 11, 10, 8, 12, 12,
-        10, 8, 10, 8, 13, 14, 15, 16,
-        18, 19, 20, 21, 22, 23, 24, 25,
-        26, 27, 28, 29, 30, 31, 32, 33,
-        34, 35, 36, 37, 38, 39, 40, 42,
-        43, 44, 45, 46, 14, 14, 17, 17,
-        41, 3, 14, 15, 16, 18, 19, 20,
-        21, 22, 23, 24, 25, 26, 27, 28,
-        29, 30, 31, 32, 33, 34, 35, 36,
-        37, 38, 39, 40, 42, 43, 44, 45,
-        46, 14, 14, 17, 17, 41, 3, 47,
-        48, 14, 14, 49, 16, 18, 19, 20,
-        19, 50, 51, 23, 52, 25, 26, 53,
-        54, 55, 56, 57, 58, 59, 60, 61,
-        62, 63, 64, 65, 40, 42, 66, 44,
-        67, 68, 69, 14, 14, 14, 17, 41,
-        3, 47, 3, 14, 14, 14, 14, 3,
-        14, 14, 14, 3, 14, 3, 14, 3,
-        14, 3, 3, 3, 3, 3, 14, 3,
-        3, 3, 3, 14, 14, 14, 14, 14,
-        3, 3, 14, 3, 3, 14, 3, 14,
-        3, 3, 14, 3, 3, 3, 14, 14,
-        14, 14, 14, 14, 3, 14, 14, 3,
-        14, 14, 3, 3, 3, 3, 3, 3,
-        14, 14, 3, 3, 14, 3, 14, 14,
-        14, 3, 70, 71, 72, 73, 17, 74,
-        75, 76, 77, 78, 79, 80, 81, 82,
-        83, 84, 85, 86, 87, 88, 89, 90,
-        91, 92, 93, 94, 95, 96, 97, 98,
-        99, 100, 3, 14, 3, 14, 3, 14,
-        14, 3, 14, 14, 3, 3, 3, 14,
-        3, 3, 3, 3, 3, 3, 3, 14,
-        3, 3, 3, 3, 3, 3, 3, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 14, 3, 3, 3, 3, 3, 3,
-        3, 3, 14, 14, 14, 14, 14, 14,
-        14, 14, 14, 3, 3, 3, 3, 3,
-        3, 3, 3, 14, 14, 14, 14, 14,
-        14, 14, 14, 14, 3, 14, 14, 14,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 3, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 3,
-        3, 3, 3, 3, 3, 3, 3, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 3, 3,
-        3, 3, 3, 3, 3, 3, 14, 14,
-        14, 14, 14, 14, 3, 14, 14, 14,
-        14, 14, 14, 14, 3, 14, 3, 14,
-        14, 3, 14, 14, 14, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        14, 3, 14, 14, 14, 3, 14, 3,
-        101, 102, 103, 104, 105, 106, 107, 108,
-        109, 110, 111, 112, 113, 114, 115, 116,
-        117, 19, 118, 119, 120, 121, 122, 123,
-        124, 125, 126, 127, 128, 129, 130, 131,
-        132, 133, 134, 135, 17, 18, 136, 137,
-        138, 139, 140, 17, 19, 17, 3, 14,
-        3, 14, 14, 3, 3, 14, 3, 3,
-        3, 3, 14, 3, 3, 3, 3, 3,
-        14, 3, 3, 3, 3, 3, 14, 14,
-        14, 14, 14, 3, 3, 3, 14, 3,
-        3, 3, 14, 14, 14, 3, 3, 3,
-        14, 14, 3, 3, 3, 14, 14, 14,
-        3, 3, 3, 14, 14, 14, 14, 3,
-        14, 14, 14, 14, 3, 3, 3, 3,
-        3, 14, 14, 14, 14, 3, 3, 14,
-        14, 14, 3, 3, 14, 14, 14, 14,
-        3, 14, 14, 3, 14, 14, 3, 3,
-        3, 14, 14, 14, 3, 3, 3, 3,
-        14, 14, 14, 14, 14, 3, 3, 3,
-        3, 14, 3, 14, 14, 3, 14, 14,
-        3, 14, 3, 14, 14, 14, 3, 14,
-        14, 3, 3, 3, 14, 3, 3, 3,
-        3, 3, 3, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 14,
-        3, 141, 142, 143, 144, 145, 146, 147,
-        148, 149, 17, 150, 151, 152, 153, 154,
-        3, 14, 3, 3, 3, 3, 3, 14,
-        14, 3, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 3, 3, 14, 14,
-        14, 3, 3, 14, 3, 3, 14, 14,
-        14, 14, 14, 3, 3, 3, 3, 14,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 3, 155, 112, 156, 157,
-        158, 17, 159, 160, 19, 17, 3, 14,
-        14, 14, 14, 3, 3, 3, 14, 3,
-        3, 14, 14, 14, 3, 3, 3, 14,
-        14, 3, 122, 3, 19, 17, 17, 161,
-        3, 17, 3, 14, 19, 162, 163, 19,
-        164, 165, 19, 60, 166, 167, 168, 169,
-        170, 19, 171, 172, 173, 19, 174, 175,
-        176, 18, 177, 178, 179, 18, 180, 19,
-        17, 3, 3, 14, 14, 3, 3, 3,
-        14, 14, 14, 14, 3, 14, 14, 3,
-        3, 3, 3, 14, 14, 3, 3, 14,
-        14, 3, 3, 3, 3, 3, 3, 14,
-        14, 14, 3, 3, 3, 14, 3, 3,
-        3, 14, 14, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 14, 3, 3, 3, 14,
-        14, 14, 14, 3, 181, 182, 3, 17,
-        3, 14, 3, 3, 14, 19, 183, 184,
-        185, 186, 60, 187, 188, 58, 189, 190,
-        191, 192, 193, 194, 195, 196, 197, 17,
-        3, 3, 14, 3, 14, 14, 14, 14,
-        14, 14, 14, 3, 14, 14, 14, 3,
-        14, 3, 3, 14, 3, 14, 3, 3,
-        14, 14, 14, 14, 3, 14, 14, 14,
-        3, 3, 14, 14, 14, 14, 3, 14,
-        14, 3, 3, 14, 14, 14, 14, 14,
-        3, 198, 199, 200, 201, 202, 203, 204,
-        205, 206, 207, 208, 204, 209, 210, 211,
-        212, 41, 3, 213, 214, 19, 215, 216,
-        217, 218, 219, 220, 221, 222, 223, 19,
-        17, 224, 225, 226, 227, 19, 228, 229,
-        230, 231, 232, 233, 234, 235, 236, 237,
-        238, 239, 240, 241, 242, 19, 147, 17,
-        243, 3, 14, 14, 14, 14, 14, 3,
-        3, 3, 14, 3, 14, 14, 3, 14,
-        3, 14, 14, 3, 3, 3, 14, 14,
-        14, 3, 3, 3, 14, 14, 14, 3,
-        3, 3, 3, 14, 3, 3, 14, 3,
-        3, 14, 14, 14, 3, 3, 14, 3,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        14, 14, 3, 3, 3, 14, 14, 3,
-        14, 14, 3, 14, 14, 3, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 3, 14, 3, 14, 14, 3,
-        14, 3, 14, 14, 3, 14, 3, 14,
-        3, 244, 215, 245, 246, 247, 248, 249,
-        250, 251, 252, 253, 101, 254, 19, 255,
-        256, 257, 19, 258, 132, 259, 260, 261,
-        262, 263, 264, 265, 266, 19, 3, 3,
-        3, 14, 14, 14, 3, 14, 14, 3,
-        14, 14, 3, 3, 3, 3, 3, 14,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        14, 14, 3, 3, 3, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 3, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 14, 3, 3, 3, 3, 14, 14,
-        14, 3, 3, 3, 14, 3, 3, 3,
-        14, 14, 3, 14, 14, 14, 3, 14,
-        3, 3, 3, 14, 14, 3, 14, 14,
-        14, 3, 14, 14, 14, 3, 3, 3,
-        3, 14, 19, 184, 267, 268, 17, 19,
-        17, 3, 3, 14, 3, 14, 19, 267,
-        17, 3, 19, 269, 17, 3, 3, 14,
-        19, 270, 271, 272, 175, 273, 274, 19,
-        275, 276, 277, 17, 3, 3, 14, 14,
-        14, 3, 14, 14, 3, 14, 14, 14,
-        14, 3, 3, 14, 3, 3, 14, 14,
-        3, 14, 3, 19, 17, 3, 278, 19,
-        279, 3, 17, 3, 14, 3, 14, 280,
-        19, 281, 282, 3, 14, 3, 3, 3,
-        14, 14, 14, 14, 3, 283, 284, 285,
-        19, 286, 287, 288, 289, 290, 291, 292,
-        293, 294, 295, 296, 297, 298, 299, 17,
-        3, 14, 14, 14, 3, 3, 3, 3,
-        14, 14, 3, 3, 14, 3, 3, 3,
-        3, 3, 3, 3, 14, 3, 14, 3,
-        3, 3, 3, 3, 3, 14, 14, 14,
-        14, 14, 3, 3, 14, 3, 3, 3,
-        14, 3, 3, 14, 3, 3, 14, 3,
-        3, 14, 3, 3, 3, 14, 14, 14,
-        3, 3, 3, 14, 14, 14, 14, 3,
-        300, 19, 301, 19, 302, 303, 304, 305,
-        17, 3, 14, 14, 14, 14, 14, 3,
-        3, 3, 14, 3, 3, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        14, 3, 306, 19, 17, 3, 14, 307,
-        19, 103, 17, 3, 14, 308, 3, 17,
-        3, 14, 19, 309, 17, 3, 3, 14,
-        310, 3, 19, 311, 17, 3, 3, 14,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 3, 3,
-        14, 3, 14, 14, 14, 3, 14, 3,
-        14, 14, 14, 3, 3, 3, 3, 3,
-        3, 3, 14, 14, 14, 3, 14, 3,
-        3, 3, 14, 14, 14, 14, 3, 312,
-        313, 72, 314, 315, 316, 317, 318, 319,
-        320, 321, 322, 323, 324, 325, 326, 327,
-        328, 329, 330, 331, 332, 334, 335, 336,
-        337, 338, 339, 333, 3, 14, 14, 14,
-        14, 3, 14, 3, 14, 14, 3, 14,
-        14, 14, 3, 3, 3, 3, 3, 3,
-        3, 3, 3, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 3, 14, 14, 14,
-        14, 14, 14, 14, 3, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 3, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 3, 14, 14, 14, 14, 14, 3,
-        14, 14, 3, 14, 14, 14, 14, 14,
-        14, 14, 3, 14, 14, 14, 3, 14,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 3, 14, 3,
-        14, 14, 3, 14, 14, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 3, 14, 14, 14, 3, 14, 3,
-        14, 14, 3, 14, 3, 340, 341, 342,
-        104, 105, 106, 107, 108, 343, 110, 111,
-        112, 113, 114, 115, 344, 345, 170, 346,
-        261, 120, 347, 122, 232, 272, 125, 348,
-        349, 350, 351, 352, 353, 354, 355, 356,
-        357, 134, 358, 19, 17, 18, 19, 137,
-        138, 139, 140, 17, 17, 3, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 3,
-        3, 3, 14, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 3, 14, 14, 3,
-        14, 14, 14, 3, 3, 14, 14, 14,
-        3, 3, 14, 14, 3, 14, 3, 14,
-        3, 14, 14, 14, 3, 3, 14, 14,
-        3, 14, 14, 3, 14, 14, 14, 3,
-        359, 143, 145, 146, 147, 148, 149, 17,
-        360, 151, 361, 153, 362, 3, 14, 14,
-        3, 3, 3, 3, 14, 3, 3, 14,
-        14, 14, 14, 14, 3, 363, 112, 364,
-        157, 158, 17, 159, 160, 19, 17, 3,
-        14, 14, 14, 14, 3, 3, 3, 14,
-        19, 162, 163, 19, 365, 366, 222, 311,
-        166, 167, 168, 367, 170, 368, 369, 370,
-        371, 372, 373, 374, 375, 376, 377, 178,
-        179, 18, 378, 19, 17, 3, 3, 3,
-        3, 14, 14, 14, 3, 3, 3, 3,
-        3, 14, 14, 3, 14, 14, 14, 3,
-        14, 14, 3, 3, 3, 14, 14, 3,
-        14, 14, 14, 14, 3, 14, 3, 14,
-        14, 14, 14, 14, 3, 3, 3, 3,
-        3, 14, 14, 14, 14, 14, 14, 3,
-        14, 3, 19, 183, 184, 379, 186, 60,
-        187, 188, 58, 189, 190, 380, 17, 193,
-        381, 195, 196, 197, 17, 3, 14, 14,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        3, 14, 3, 382, 383, 200, 201, 202,
-        384, 204, 205, 385, 386, 387, 204, 209,
-        210, 211, 212, 41, 3, 213, 214, 19,
-        215, 216, 218, 388, 220, 389, 222, 223,
-        19, 17, 390, 225, 226, 227, 19, 228,
-        229, 230, 231, 232, 233, 234, 235, 391,
-        237, 238, 392, 240, 241, 242, 19, 147,
-        17, 243, 3, 3, 14, 3, 3, 14,
-        3, 14, 14, 14, 14, 14, 3, 14,
-        14, 3, 393, 394, 395, 396, 397, 398,
-        399, 400, 250, 401, 322, 402, 216, 403,
-        404, 405, 406, 407, 404, 408, 409, 410,
-        261, 411, 263, 412, 413, 274, 3, 14,
-        3, 14, 3, 14, 3, 14, 3, 14,
-        14, 3, 14, 3, 14, 14, 14, 3,
-        14, 14, 3, 3, 14, 14, 14, 3,
-        14, 3, 14, 3, 14, 14, 3, 14,
-        3, 14, 3, 14, 3, 14, 3, 14,
-        3, 3, 3, 14, 14, 14, 3, 14,
-        14, 3, 19, 270, 232, 414, 404, 415,
-        274, 19, 416, 417, 277, 17, 3, 14,
-        3, 14, 14, 14, 3, 3, 3, 14,
-        14, 3, 280, 19, 281, 418, 3, 14,
-        14, 3, 19, 286, 287, 288, 289, 290,
-        291, 292, 293, 294, 295, 419, 17, 3,
-        3, 3, 14, 19, 420, 19, 268, 303,
-        304, 305, 17, 3, 3, 14, 422, 422,
-        422, 422, 421, 422, 422, 422, 421, 422,
-        421, 422, 422, 421, 421, 421, 421, 421,
-        421, 422, 421, 421, 421, 421, 422, 422,
-        422, 422, 422, 421, 421, 422, 421, 421,
-        422, 421, 422, 421, 421, 422, 421, 421,
-        421, 422, 422, 422, 422, 422, 422, 421,
-        422, 422, 421, 422, 422, 421, 421, 421,
-        421, 421, 421, 422, 422, 421, 421, 422,
-        421, 422, 422, 422, 421, 423, 424, 425,
+        1, 0, 3, 2, 3, 4, 2, 6,
+        8, 8, 7, 5, 9, 9, 7, 5,
+        7, 5, 10, 11, 12, 13, 15, 16,
+        17, 18, 19, 20, 21, 22, 23, 24,
+        25, 26, 27, 28, 29, 30, 31, 32,
+        33, 34, 35, 36, 37, 39, 40, 41,
+        42, 43, 11, 11, 14, 14, 38, 0,
+        11, 12, 13, 15, 16, 17, 18, 19,
+        20, 21, 22, 23, 24, 25, 26, 27,
+        28, 29, 30, 31, 32, 33, 34, 35,
+        36, 37, 39, 40, 41, 42, 43, 11,
+        11, 14, 14, 38, 0, 44, 45, 11,
+        11, 46, 13, 15, 16, 17, 16, 47,
+        48, 20, 49, 22, 23, 50, 51, 52,
+        53, 54, 55, 56, 57, 58, 59, 60,
+        61, 62, 37, 39, 63, 41, 64, 65,
+        66, 11, 11, 11, 14, 38, 0, 44,
+        0, 11, 11, 11, 11, 0, 11, 11,
+        11, 0, 11, 0, 11, 11, 0, 0,
+        0, 0, 0, 0, 11, 0, 0, 0,
+        0, 11, 11, 11, 11, 11, 0, 0,
+        11, 0, 0, 11, 0, 11, 0, 0,
+        11, 0, 0, 0, 11, 11, 11, 11,
+        11, 11, 0, 11, 11, 0, 11, 11,
+        0, 0, 0, 0, 0, 0, 11, 11,
+        0, 0, 11, 0, 11, 11, 11, 0,
+        67, 68, 69, 70, 14, 71, 72, 73,
+        74, 75, 76, 77, 78, 79, 80, 81,
+        82, 83, 84, 85, 86, 87, 88, 89,
+        90, 91, 92, 93, 94, 95, 96, 97,
+        0, 11, 0, 11, 0, 11, 11, 0,
+        11, 11, 0, 0, 0, 11, 0, 0,
+        0, 0, 0, 0, 0, 11, 0, 0,
+        0, 0, 0, 0, 0, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        11, 0, 0, 0, 0, 0, 0, 0,
+        0, 11, 11, 11, 11, 11, 11, 11,
+        11, 11, 0, 11, 11, 11, 11, 11,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 0,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 0, 0, 0,
+        0, 0, 0, 0, 0, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 0, 0, 0, 0,
+        0, 0, 0, 0, 11, 11, 11, 11,
+        11, 11, 0, 11, 11, 11, 11, 11,
+        11, 11, 0, 11, 0, 11, 11, 0,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 11, 11, 0, 11, 11, 11, 0,
+        11, 11, 11, 0, 11, 0, 98, 99,
+        100, 101, 102, 103, 104, 105, 106, 107,
+        108, 109, 110, 111, 112, 113, 114, 16,
+        115, 116, 117, 118, 119, 120, 121, 122,
+        123, 124, 125, 126, 127, 128, 129, 130,
+        131, 132, 14, 15, 133, 134, 135, 136,
+        137, 14, 16, 14, 0, 11, 0, 11,
+        11, 0, 0, 11, 0, 0, 0, 0,
+        11, 0, 0, 0, 0, 0, 11, 0,
+        0, 0, 0, 0, 11, 11, 11, 11,
+        11, 0, 0, 0, 11, 0, 0, 0,
+        11, 11, 11, 0, 0, 0, 11, 11,
+        0, 0, 0, 11, 11, 11, 0, 0,
+        0, 11, 11, 11, 11, 0, 11, 11,
+        11, 11, 0, 0, 0, 0, 0, 11,
+        11, 11, 11, 0, 0, 11, 11, 11,
+        0, 0, 11, 11, 11, 11, 0, 11,
+        11, 0, 11, 11, 0, 0, 0, 11,
+        11, 11, 0, 0, 0, 0, 11, 11,
+        11, 11, 11, 0, 0, 0, 0, 11,
+        0, 11, 11, 0, 11, 11, 0, 11,
+        0, 11, 11, 11, 0, 11, 11, 0,
+        0, 0, 11, 0, 0, 0, 0, 0,
+        0, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 11, 0, 138,
+        139, 140, 141, 142, 143, 144, 145, 146,
+        14, 147, 148, 149, 150, 151, 0, 11,
+        0, 0, 0, 0, 0, 11, 11, 0,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 0, 0, 11, 11, 11, 0,
+        0, 11, 0, 0, 11, 11, 11, 11,
+        11, 0, 0, 0, 0, 11, 11, 11,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 0, 152, 109, 153, 154, 155, 14,
+        156, 157, 16, 14, 0, 11, 11, 11,
+        11, 0, 0, 0, 11, 0, 0, 11,
+        11, 11, 0, 0, 0, 11, 11, 0,
+        119, 0, 16, 14, 14, 158, 0, 14,
+        0, 11, 16, 159, 160, 16, 161, 162,
+        16, 57, 163, 164, 165, 166, 167, 16,
+        168, 169, 170, 16, 171, 172, 173, 15,
+        174, 175, 176, 15, 177, 16, 14, 0,
+        0, 11, 11, 0, 0, 0, 11, 11,
+        11, 11, 0, 11, 11, 0, 0, 0,
+        0, 11, 11, 0, 0, 11, 11, 0,
+        0, 0, 0, 0, 0, 11, 11, 11,
+        0, 0, 0, 11, 0, 0, 0, 11,
+        11, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 11, 0, 0, 0, 11, 11, 11,
+        11, 0, 178, 179, 0, 14, 0, 11,
+        0, 0, 11, 16, 180, 181, 182, 183,
+        57, 184, 185, 55, 186, 187, 188, 189,
+        190, 191, 192, 193, 194, 14, 0, 0,
+        11, 0, 11, 11, 11, 11, 11, 11,
+        11, 0, 11, 11, 11, 0, 11, 0,
+        0, 11, 0, 11, 0, 0, 11, 11,
+        11, 11, 0, 11, 11, 11, 0, 0,
+        11, 11, 11, 11, 0, 11, 11, 0,
+        0, 11, 11, 11, 11, 11, 0, 195,
+        196, 197, 198, 199, 200, 201, 202, 203,
+        204, 205, 201, 206, 207, 208, 209, 38,
+        0, 210, 211, 16, 212, 213, 214, 215,
+        216, 217, 218, 219, 220, 16, 14, 221,
+        222, 223, 224, 16, 225, 226, 227, 228,
+        229, 230, 231, 232, 233, 234, 235, 236,
+        237, 238, 239, 16, 144, 14, 240, 0,
+        11, 11, 11, 11, 11, 0, 0, 0,
+        11, 0, 11, 11, 0, 11, 0, 11,
+        11, 0, 0, 0, 11, 11, 11, 0,
+        0, 0, 11, 11, 11, 0, 0, 0,
+        0, 11, 0, 0, 11, 0, 0, 11,
+        11, 11, 0, 0, 11, 0, 11, 11,
+        11, 0, 11, 11, 11, 11, 11, 11,
+        0, 0, 0, 11, 11, 0, 11, 11,
+        0, 11, 11, 0, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        0, 11, 0, 11, 11, 0, 11, 0,
+        11, 11, 0, 11, 0, 11, 0, 241,
+        212, 242, 243, 244, 245, 246, 247, 248,
+        249, 250, 98, 251, 16, 252, 253, 254,
+        16, 255, 129, 256, 257, 258, 259, 260,
+        261, 262, 263, 16, 0, 0, 0, 11,
+        11, 11, 0, 11, 11, 0, 11, 11,
+        0, 0, 0, 0, 0, 11, 11, 11,
+        11, 0, 11, 11, 11, 11, 11, 11,
+        0, 0, 0, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 0, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        0, 0, 0, 0, 11, 11, 11, 0,
+        0, 0, 11, 0, 0, 0, 11, 11,
+        0, 11, 11, 11, 0, 11, 0, 0,
+        0, 11, 11, 0, 11, 11, 11, 0,
+        11, 11, 11, 0, 0, 0, 0, 11,
+        16, 181, 264, 265, 14, 16, 14, 0,
+        0, 11, 0, 11, 16, 264, 14, 0,
+        16, 266, 14, 0, 0, 11, 16, 267,
+        268, 269, 172, 270, 271, 16, 272, 273,
+        274, 14, 0, 0, 11, 11, 11, 0,
+        11, 11, 0, 11, 11, 11, 11, 0,
+        0, 11, 0, 0, 11, 11, 0, 11,
+        0, 16, 14, 0, 275, 16, 276, 0,
+        14, 0, 11, 0, 11, 277, 16, 278,
+        279, 0, 11, 0, 0, 0, 11, 11,
+        11, 11, 0, 280, 281, 282, 16, 283,
+        284, 285, 286, 287, 288, 289, 290, 291,
+        292, 293, 294, 295, 296, 14, 0, 11,
+        11, 11, 0, 0, 0, 0, 11, 11,
+        0, 0, 11, 0, 0, 0, 0, 0,
+        0, 0, 11, 0, 11, 0, 0, 0,
+        0, 0, 0, 11, 11, 11, 11, 11,
+        0, 0, 11, 0, 0, 0, 11, 0,
+        0, 11, 0, 0, 11, 0, 0, 11,
+        0, 0, 0, 11, 11, 11, 0, 0,
+        0, 11, 11, 11, 11, 0, 297, 16,
+        298, 16, 299, 300, 301, 302, 14, 0,
+        11, 11, 11, 11, 11, 0, 0, 0,
+        11, 0, 0, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        11, 0, 11, 11, 11, 11, 11, 0,
+        303, 16, 14, 0, 11, 304, 16, 100,
+        14, 0, 11, 305, 0, 14, 0, 11,
+        16, 306, 14, 0, 0, 11, 307, 0,
+        16, 308, 14, 0, 0, 11, 11, 11,
+        11, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 0, 0, 11, 0,
+        11, 11, 11, 0, 11, 0, 11, 11,
+        11, 0, 0, 0, 0, 0, 0, 0,
+        11, 11, 11, 0, 11, 0, 0, 0,
+        11, 11, 11, 11, 0, 309, 310, 69,
+        311, 312, 313, 314, 315, 316, 317, 318,
+        319, 320, 321, 322, 323, 324, 325, 326,
+        327, 328, 329, 331, 332, 333, 334, 335,
+        336, 330, 0, 11, 11, 11, 11, 0,
+        11, 0, 11, 11, 0, 11, 11, 11,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 0, 11, 11, 11, 11, 11,
+        11, 11, 0, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 0, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 0,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        0, 11, 11, 11, 11, 11, 11, 11,
+        0, 11, 11, 11, 0, 11, 11, 11,
+        11, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 0, 11, 0, 11, 11,
+        0, 11, 11, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 0,
+        11, 11, 11, 0, 11, 0, 11, 11,
+        0, 11, 0, 337, 338, 339, 101, 102,
+        103, 104, 105, 340, 107, 108, 109, 110,
+        111, 112, 341, 342, 167, 343, 258, 117,
+        344, 119, 229, 269, 122, 345, 346, 347,
+        348, 349, 350, 351, 352, 353, 354, 131,
+        355, 16, 14, 15, 16, 134, 135, 136,
+        137, 14, 14, 0, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 0, 0, 0,
+        11, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 0, 11, 11, 0, 11, 11,
+        11, 0, 0, 11, 11, 11, 0, 0,
+        11, 11, 0, 11, 0, 11, 0, 11,
+        11, 11, 0, 0, 11, 11, 0, 11,
+        11, 0, 11, 11, 11, 0, 356, 140,
+        142, 143, 144, 145, 146, 14, 357, 148,
+        358, 150, 359, 0, 11, 11, 0, 0,
+        0, 0, 11, 0, 0, 11, 11, 11,
+        11, 11, 0, 360, 109, 361, 154, 155,
+        14, 156, 157, 16, 14, 0, 11, 11,
+        11, 11, 0, 0, 0, 11, 16, 159,
+        160, 16, 362, 363, 219, 308, 163, 164,
+        165, 364, 167, 365, 366, 367, 368, 369,
+        370, 371, 372, 373, 374, 175, 176, 15,
+        375, 16, 14, 0, 0, 0, 0, 11,
+        11, 11, 0, 0, 0, 0, 0, 11,
+        11, 0, 11, 11, 11, 0, 11, 11,
+        0, 0, 0, 11, 11, 0, 11, 11,
+        11, 11, 0, 11, 0, 11, 11, 11,
+        11, 11, 0, 0, 0, 0, 0, 11,
+        11, 11, 11, 11, 11, 0, 11, 0,
+        16, 180, 181, 376, 183, 57, 184, 185,
+        55, 186, 187, 377, 14, 190, 378, 192,
+        193, 194, 14, 0, 11, 11, 11, 11,
+        11, 11, 11, 0, 11, 11, 0, 11,
+        0, 379, 380, 197, 198, 199, 381, 201,
+        202, 382, 383, 384, 201, 206, 207, 208,
+        209, 38, 0, 210, 211, 16, 212, 213,
+        215, 385, 217, 386, 219, 220, 16, 14,
+        387, 222, 223, 224, 16, 225, 226, 227,
+        228, 229, 230, 231, 232, 388, 234, 235,
+        389, 237, 238, 239, 16, 144, 14, 240,
+        0, 0, 11, 0, 0, 11, 0, 11,
+        11, 11, 11, 11, 0, 11, 11, 0,
+        390, 391, 392, 393, 394, 395, 396, 397,
+        247, 398, 319, 399, 213, 400, 401, 402,
+        403, 404, 401, 405, 406, 407, 258, 408,
+        260, 409, 410, 271, 0, 11, 0, 11,
+        0, 11, 0, 11, 0, 11, 11, 0,
+        11, 0, 11, 11, 11, 0, 11, 11,
+        0, 0, 11, 11, 11, 0, 11, 0,
+        11, 0, 11, 11, 0, 11, 0, 11,
+        0, 11, 0, 11, 0, 11, 0, 0,
+        0, 11, 11, 11, 0, 11, 11, 0,
+        16, 267, 229, 411, 401, 412, 271, 16,
+        413, 414, 274, 14, 0, 11, 0, 11,
+        11, 11, 0, 0, 0, 11, 11, 0,
+        277, 16, 278, 415, 0, 11, 11, 0,
+        16, 283, 284, 285, 286, 287, 288, 289,
+        290, 291, 292, 416, 14, 0, 0, 0,
+        11, 16, 417, 16, 265, 300, 301, 302,
+        14, 0, 0, 11, 419, 419, 419, 419,
+        418, 419, 419, 419, 418, 419, 418, 419,
+        419, 418, 418, 418, 418, 418, 418, 419,
+        418, 418, 418, 418, 419, 419, 419, 419,
+        419, 418, 418, 419, 418, 418, 419, 418,
+        419, 418, 418, 419, 418, 418, 418, 419,
+        419, 419, 419, 419, 419, 418, 419, 419,
+        418, 419, 419, 418, 418, 418, 418, 418,
+        418, 419, 419, 418, 418, 419, 418, 419,
+        419, 419, 418, 421, 422, 423, 424, 425,
         426, 427, 428, 429, 430, 431, 432, 433,
         434, 435, 436, 437, 438, 439, 440, 441,
         442, 443, 444, 445, 446, 447, 448, 449,
-        450, 451, 452, 453, 454, 421, 422, 421,
-        422, 421, 422, 422, 421, 422, 422, 421,
-        421, 421, 422, 421, 421, 421, 421, 421,
-        421, 421, 422, 421, 421, 421, 421, 421,
-        421, 421, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 421, 421, 421,
-        421, 421, 421, 421, 421, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 421, 421,
-        421, 421, 421, 421, 421, 421, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 421,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 421, 422, 422, 422,
-        422, 422, 422, 421, 422, 422, 422, 422,
-        422, 422, 421, 421, 421, 421, 421, 421,
-        421, 421, 422, 422, 422, 422, 422, 422,
-        422, 422, 421, 422, 422, 422, 422, 422,
-        422, 422, 422, 421, 422, 422, 422, 422,
-        422, 421, 421, 421, 421, 421, 421, 421,
-        421, 422, 422, 422, 422, 422, 422, 421,
-        422, 422, 422, 422, 422, 422, 422, 421,
-        422, 421, 422, 422, 421, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 421, 422, 422, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 422, 422,
-        421, 422, 422, 422, 421, 422, 422, 422,
-        421, 422, 421, 455, 456, 457, 458, 459,
+        450, 451, 452, 418, 419, 418, 419, 418,
+        419, 419, 418, 419, 419, 418, 418, 418,
+        419, 418, 418, 418, 418, 418, 418, 418,
+        419, 418, 418, 418, 418, 418, 418, 418,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 418, 418, 418, 418, 418,
+        418, 418, 418, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 418, 418, 418, 418,
+        418, 418, 418, 418, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 418, 419, 419,
+        419, 419, 419, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 418, 419, 419, 419, 419, 419,
+        419, 418, 419, 419, 419, 419, 419, 419,
+        418, 418, 418, 418, 418, 418, 418, 418,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        418, 419, 419, 419, 419, 419, 419, 419,
+        419, 418, 419, 419, 419, 419, 419, 418,
+        418, 418, 418, 418, 418, 418, 418, 419,
+        419, 419, 419, 419, 419, 418, 419, 419,
+        419, 419, 419, 419, 419, 418, 419, 418,
+        419, 419, 418, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        418, 419, 419, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 419, 419, 418, 419,
+        419, 419, 418, 419, 419, 419, 418, 419,
+        418, 453, 454, 455, 456, 457, 458, 459,
         460, 461, 462, 463, 464, 465, 466, 467,
         468, 469, 470, 471, 472, 473, 474, 475,
         476, 477, 478, 479, 480, 481, 482, 483,
-        484, 485, 486, 487, 488, 489, 490, 427,
-        491, 492, 493, 494, 495, 496, 427, 472,
-        427, 421, 422, 421, 422, 422, 421, 421,
-        422, 421, 421, 421, 421, 422, 421, 421,
-        421, 421, 421, 422, 421, 421, 421, 421,
-        421, 422, 422, 422, 422, 422, 421, 421,
-        421, 422, 421, 421, 421, 422, 422, 422,
-        421, 421, 421, 422, 422, 421, 421, 421,
-        422, 422, 422, 421, 421, 421, 422, 422,
-        422, 422, 421, 422, 422, 422, 422, 421,
-        421, 421, 421, 421, 422, 422, 422, 422,
-        421, 421, 422, 422, 422, 421, 421, 422,
-        422, 422, 422, 421, 422, 422, 421, 422,
-        422, 421, 421, 421, 422, 422, 422, 421,
-        421, 421, 421, 422, 422, 422, 422, 422,
-        421, 421, 421, 421, 422, 421, 422, 422,
-        421, 422, 422, 421, 422, 421, 422, 422,
-        422, 421, 422, 422, 421, 421, 421, 422,
-        421, 421, 421, 421, 421, 421, 421, 422,
-        422, 422, 422, 421, 422, 422, 422, 422,
-        422, 422, 422, 421, 497, 498, 499, 500,
-        501, 502, 503, 504, 505, 427, 506, 507,
-        508, 509, 510, 421, 422, 421, 421, 421,
-        421, 421, 422, 422, 421, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 421, 422, 422, 422, 421,
-        421, 422, 422, 422, 421, 421, 422, 421,
-        421, 422, 422, 422, 422, 422, 421, 421,
-        421, 421, 422, 422, 422, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 421, 511,
-        466, 512, 513, 514, 427, 515, 516, 472,
-        427, 421, 422, 422, 422, 422, 421, 421,
-        421, 422, 421, 421, 422, 422, 422, 421,
-        421, 421, 422, 422, 421, 477, 421, 472,
-        427, 427, 517, 421, 427, 421, 422, 472,
-        518, 519, 472, 520, 521, 472, 522, 523,
-        524, 525, 526, 527, 472, 528, 529, 530,
-        472, 531, 532, 533, 491, 534, 535, 536,
-        491, 537, 472, 427, 421, 421, 422, 422,
-        421, 421, 421, 422, 422, 422, 422, 421,
-        422, 422, 421, 421, 421, 421, 422, 422,
-        421, 421, 422, 422, 421, 421, 421, 421,
-        421, 421, 422, 422, 422, 421, 421, 421,
-        422, 421, 421, 421, 422, 422, 421, 422,
-        422, 422, 422, 421, 422, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 422, 421,
-        421, 421, 422, 422, 422, 422, 421, 538,
-        539, 421, 427, 421, 422, 421, 421, 422,
-        472, 540, 541, 542, 543, 522, 544, 545,
+        484, 485, 486, 487, 488, 425, 489, 490,
+        491, 492, 493, 494, 425, 470, 425, 418,
+        419, 418, 419, 419, 418, 418, 419, 418,
+        418, 418, 418, 419, 418, 418, 418, 418,
+        418, 419, 418, 418, 418, 418, 418, 419,
+        419, 419, 419, 419, 418, 418, 418, 419,
+        418, 418, 418, 419, 419, 419, 418, 418,
+        418, 419, 419, 418, 418, 418, 419, 419,
+        419, 418, 418, 418, 419, 419, 419, 419,
+        418, 419, 419, 419, 419, 418, 418, 418,
+        418, 418, 419, 419, 419, 419, 418, 418,
+        419, 419, 419, 418, 418, 419, 419, 419,
+        419, 418, 419, 419, 418, 419, 419, 418,
+        418, 418, 419, 419, 419, 418, 418, 418,
+        418, 419, 419, 419, 419, 419, 418, 418,
+        418, 418, 419, 418, 419, 419, 418, 419,
+        419, 418, 419, 418, 419, 419, 419, 418,
+        419, 419, 418, 418, 418, 419, 418, 418,
+        418, 418, 418, 418, 418, 419, 419, 419,
+        419, 418, 419, 419, 419, 419, 419, 419,
+        419, 418, 495, 496, 497, 498, 499, 500,
+        501, 502, 503, 425, 504, 505, 506, 507,
+        508, 418, 419, 418, 418, 418, 418, 418,
+        419, 419, 418, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 418, 419, 419, 419, 418, 418, 419,
+        419, 419, 418, 418, 419, 418, 418, 419,
+        419, 419, 419, 419, 418, 418, 418, 418,
+        419, 419, 419, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 418, 509, 464, 510,
+        511, 512, 425, 513, 514, 470, 425, 418,
+        419, 419, 419, 419, 418, 418, 418, 419,
+        418, 418, 419, 419, 419, 418, 418, 418,
+        419, 419, 418, 475, 418, 470, 425, 425,
+        515, 418, 425, 418, 419, 470, 516, 517,
+        470, 518, 519, 470, 520, 521, 522, 523,
+        524, 525, 470, 526, 527, 528, 470, 529,
+        530, 531, 489, 532, 533, 534, 489, 535,
+        470, 425, 418, 418, 419, 419, 418, 418,
+        418, 419, 419, 419, 419, 418, 419, 419,
+        418, 418, 418, 418, 419, 419, 418, 418,
+        419, 419, 418, 418, 418, 418, 418, 418,
+        419, 419, 419, 418, 418, 418, 419, 418,
+        418, 418, 419, 419, 418, 419, 419, 419,
+        419, 418, 419, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 419, 418, 418, 418,
+        419, 419, 419, 419, 418, 536, 537, 418,
+        425, 418, 419, 418, 418, 419, 470, 538,
+        539, 540, 541, 520, 542, 543, 544, 545,
         546, 547, 548, 549, 550, 551, 552, 553,
-        554, 555, 427, 421, 421, 422, 421, 422,
-        422, 422, 422, 422, 422, 422, 421, 422,
-        422, 422, 421, 422, 421, 421, 422, 421,
-        422, 421, 421, 422, 422, 422, 422, 421,
-        422, 422, 422, 421, 421, 422, 422, 422,
-        422, 421, 422, 422, 421, 421, 422, 422,
-        422, 422, 422, 421, 556, 557, 558, 559,
-        560, 561, 562, 563, 564, 565, 566, 562,
-        568, 569, 570, 571, 567, 421, 572, 573,
-        472, 574, 575, 576, 577, 578, 579, 580,
-        581, 582, 472, 427, 583, 584, 585, 586,
-        472, 587, 588, 589, 590, 591, 592, 593,
-        594, 595, 596, 597, 598, 599, 600, 601,
-        472, 503, 427, 602, 421, 422, 422, 422,
-        422, 422, 421, 421, 421, 422, 421, 422,
-        422, 421, 422, 421, 422, 422, 421, 421,
-        421, 422, 422, 422, 421, 421, 421, 422,
-        422, 422, 421, 421, 421, 421, 422, 421,
-        421, 422, 421, 421, 422, 422, 422, 421,
-        421, 422, 421, 422, 422, 422, 421, 422,
-        422, 422, 422, 422, 422, 421, 421, 421,
-        422, 422, 421, 422, 422, 421, 422, 422,
-        421, 422, 422, 421, 422, 422, 422, 422,
-        422, 422, 422, 421, 422, 421, 422, 421,
-        422, 422, 421, 422, 421, 422, 422, 421,
-        422, 421, 422, 421, 603, 574, 604, 605,
-        606, 607, 608, 609, 610, 611, 612, 455,
-        613, 472, 614, 615, 616, 472, 617, 487,
-        618, 619, 620, 621, 622, 623, 624, 625,
-        472, 421, 421, 421, 422, 422, 422, 421,
-        422, 422, 421, 422, 422, 421, 421, 421,
-        421, 421, 422, 422, 422, 422, 421, 422,
-        422, 422, 422, 422, 422, 421, 421, 421,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 421, 422, 422, 422, 422, 422, 422,
-        422, 422, 421, 422, 422, 421, 421, 421,
-        421, 422, 422, 422, 421, 421, 421, 422,
-        421, 421, 421, 422, 422, 421, 422, 422,
-        422, 421, 422, 421, 421, 421, 422, 422,
-        421, 422, 422, 422, 421, 422, 422, 422,
-        421, 421, 421, 421, 422, 472, 541, 626,
-        627, 427, 472, 427, 421, 421, 422, 421,
-        422, 472, 626, 427, 421, 472, 628, 427,
-        421, 421, 422, 472, 629, 630, 631, 532,
-        632, 633, 472, 634, 635, 636, 427, 421,
-        421, 422, 422, 422, 421, 422, 422, 421,
-        422, 422, 422, 422, 421, 421, 422, 421,
-        421, 422, 422, 421, 422, 421, 472, 427,
-        421, 637, 472, 638, 421, 427, 421, 422,
-        421, 422, 639, 472, 640, 641, 421, 422,
-        421, 421, 421, 422, 422, 422, 422, 421,
-        642, 643, 644, 472, 645, 646, 647, 648,
+        425, 418, 418, 419, 418, 419, 419, 419,
+        419, 419, 419, 419, 418, 419, 419, 419,
+        418, 419, 418, 418, 419, 418, 419, 418,
+        418, 419, 419, 419, 419, 418, 419, 419,
+        419, 418, 418, 419, 419, 419, 419, 418,
+        419, 419, 418, 418, 419, 419, 419, 419,
+        419, 418, 554, 555, 556, 557, 558, 559,
+        560, 561, 562, 563, 564, 560, 566, 567,
+        568, 569, 565, 418, 570, 571, 470, 572,
+        573, 574, 575, 576, 577, 578, 579, 580,
+        470, 425, 581, 582, 583, 584, 470, 585,
+        586, 587, 588, 589, 590, 591, 592, 593,
+        594, 595, 596, 597, 598, 599, 470, 501,
+        425, 600, 418, 419, 419, 419, 419, 419,
+        418, 418, 418, 419, 418, 419, 419, 418,
+        419, 418, 419, 419, 418, 418, 418, 419,
+        419, 419, 418, 418, 418, 419, 419, 419,
+        418, 418, 418, 418, 419, 418, 418, 419,
+        418, 418, 419, 419, 419, 418, 418, 419,
+        418, 419, 419, 419, 418, 419, 419, 419,
+        419, 419, 419, 418, 418, 418, 419, 419,
+        418, 419, 419, 418, 419, 419, 418, 419,
+        419, 418, 419, 419, 419, 419, 419, 419,
+        419, 418, 419, 418, 419, 418, 419, 419,
+        418, 419, 418, 419, 419, 418, 419, 418,
+        419, 418, 601, 572, 602, 603, 604, 605,
+        606, 607, 608, 609, 610, 453, 611, 470,
+        612, 613, 614, 470, 615, 485, 616, 617,
+        618, 619, 620, 621, 622, 623, 470, 418,
+        418, 418, 419, 419, 419, 418, 419, 419,
+        418, 419, 419, 418, 418, 418, 418, 418,
+        419, 419, 419, 419, 418, 419, 419, 419,
+        419, 419, 419, 418, 418, 418, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 418,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        418, 419, 419, 418, 418, 418, 418, 419,
+        419, 419, 418, 418, 418, 419, 418, 418,
+        418, 419, 419, 418, 419, 419, 419, 418,
+        419, 418, 418, 418, 419, 419, 418, 419,
+        419, 419, 418, 419, 419, 419, 418, 418,
+        418, 418, 419, 470, 539, 624, 625, 425,
+        470, 425, 418, 418, 419, 418, 419, 470,
+        624, 425, 418, 470, 626, 425, 418, 418,
+        419, 470, 627, 628, 629, 530, 630, 631,
+        470, 632, 633, 634, 425, 418, 418, 419,
+        419, 419, 418, 419, 419, 418, 419, 419,
+        419, 419, 418, 418, 419, 418, 418, 419,
+        419, 418, 419, 418, 470, 425, 418, 635,
+        470, 636, 418, 425, 418, 419, 418, 419,
+        637, 470, 638, 639, 418, 419, 418, 418,
+        418, 419, 419, 419, 419, 418, 640, 641,
+        642, 470, 643, 644, 645, 646, 647, 648,
         649, 650, 651, 652, 653, 654, 655, 656,
-        657, 658, 427, 421, 422, 422, 422, 421,
-        421, 421, 421, 422, 422, 421, 421, 422,
-        421, 421, 421, 421, 421, 421, 421, 422,
-        421, 422, 421, 421, 421, 421, 421, 421,
-        422, 422, 422, 422, 422, 421, 421, 422,
-        421, 421, 421, 422, 421, 421, 422, 421,
-        421, 422, 421, 421, 422, 421, 421, 421,
-        422, 422, 422, 421, 421, 421, 422, 422,
-        422, 422, 421, 659, 472, 660, 472, 661,
-        662, 663, 664, 427, 421, 422, 422, 422,
-        422, 422, 421, 421, 421, 422, 421, 421,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 421, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 421, 422,
-        422, 422, 422, 422, 421, 665, 472, 427,
-        421, 422, 666, 472, 457, 427, 421, 422,
-        667, 421, 427, 421, 422, 472, 668, 427,
-        421, 421, 422, 669, 421, 472, 670, 427,
-        421, 421, 422, 672, 671, 422, 422, 422,
-        422, 672, 671, 422, 672, 671, 672, 672,
-        422, 672, 671, 422, 672, 422, 672, 671,
-        422, 672, 422, 672, 422, 671, 672, 672,
-        672, 672, 672, 672, 672, 672, 671, 422,
-        422, 672, 672, 422, 672, 422, 672, 671,
-        672, 672, 672, 672, 672, 422, 672, 422,
-        672, 422, 672, 671, 672, 672, 422, 672,
-        422, 672, 671, 672, 672, 672, 672, 672,
-        422, 672, 422, 672, 671, 422, 422, 672,
-        422, 672, 671, 672, 672, 672, 422, 672,
-        422, 672, 422, 672, 422, 672, 671, 672,
-        422, 672, 422, 672, 671, 422, 672, 672,
-        672, 672, 422, 672, 422, 672, 422, 672,
-        422, 672, 422, 672, 422, 672, 671, 422,
-        672, 671, 672, 672, 672, 422, 672, 422,
-        672, 671, 672, 422, 672, 422, 672, 671,
-        422, 672, 672, 672, 672, 422, 672, 422,
-        672, 671, 422, 672, 422, 672, 422, 672,
-        671, 672, 672, 422, 672, 422, 672, 671,
-        422, 672, 422, 672, 422, 672, 422, 671,
-        672, 672, 672, 422, 672, 422, 672, 671,
-        422, 672, 671, 672, 672, 422, 672, 671,
-        672, 672, 672, 422, 672, 672, 672, 672,
-        672, 672, 422, 422, 672, 422, 672, 422,
-        672, 422, 672, 671, 672, 422, 672, 422,
-        672, 671, 422, 672, 671, 672, 422, 672,
-        671, 672, 422, 672, 671, 422, 422, 672,
-        671, 422, 672, 422, 672, 422, 672, 422,
-        672, 422, 672, 422, 671, 672, 672, 422,
-        672, 672, 672, 672, 422, 422, 672, 672,
-        672, 672, 672, 422, 672, 672, 672, 672,
-        672, 671, 422, 672, 672, 422, 672, 422,
-        671, 672, 672, 422, 672, 671, 422, 422,
-        672, 422, 671, 672, 672, 671, 422, 672,
-        422, 671, 672, 671, 422, 672, 422, 672,
-        422, 671, 672, 672, 671, 422, 672, 422,
-        672, 422, 672, 671, 672, 422, 672, 422,
-        672, 671, 422, 672, 671, 422, 422, 672,
-        671, 672, 422, 671, 672, 671, 422, 672,
-        422, 672, 422, 671, 672, 671, 422, 422,
-        672, 671, 672, 422, 672, 422, 672, 671,
-        422, 672, 422, 671, 672, 671, 422, 422,
-        672, 422, 671, 672, 671, 422, 422, 672,
-        671, 672, 422, 672, 671, 672, 422, 672,
-        671, 672, 422, 672, 422, 672, 422, 671,
-        672, 671, 422, 422, 672, 671, 672, 422,
-        672, 422, 672, 671, 422, 672, 671, 672,
-        672, 422, 672, 422, 672, 671, 671, 422,
-        671, 422, 672, 672, 422, 672, 672, 672,
-        672, 672, 672, 672, 671, 422, 672, 672,
-        672, 422, 671, 672, 672, 672, 422, 672,
-        422, 672, 422, 672, 422, 672, 422, 672,
-        671, 422, 422, 672, 671, 672, 422, 672,
-        671, 422, 422, 672, 422, 422, 422, 672,
-        422, 672, 422, 672, 422, 672, 422, 671,
-        422, 672, 422, 672, 422, 671, 672, 671,
-        422, 672, 422, 671, 672, 422, 672, 672,
-        672, 671, 422, 672, 422, 422, 672, 422,
-        671, 672, 672, 671, 422, 672, 672, 672,
-        672, 422, 672, 422, 671, 672, 672, 672,
-        422, 672, 671, 672, 422, 672, 422, 672,
-        422, 672, 422, 672, 671, 672, 672, 422,
-        672, 671, 422, 672, 422, 672, 422, 671,
-        672, 672, 671, 422, 672, 422, 671, 672,
-        671, 422, 672, 671, 422, 672, 422, 672,
-        671, 672, 672, 672, 671, 422, 422, 422,
-        672, 671, 422, 672, 422, 671, 672, 671,
-        422, 672, 422, 672, 422, 671, 672, 672,
-        672, 671, 422, 672, 422, 671, 672, 672,
-        672, 672, 671, 422, 672, 422, 672, 671,
-        422, 422, 672, 422, 672, 671, 672, 422,
-        672, 422, 671, 672, 672, 671, 422, 672,
-        422, 672, 671, 422, 672, 672, 672, 422,
-        672, 422, 671, 422, 672, 671, 672, 422,
-        422, 672, 422, 672, 422, 671, 672, 672,
-        672, 672, 671, 422, 672, 422, 672, 422,
-        672, 422, 672, 422, 672, 671, 672, 672,
-        672, 422, 672, 422, 672, 422, 672, 422,
-        671, 672, 672, 422, 422, 672, 671, 672,
-        422, 672, 672, 671, 422, 672, 422, 672,
-        671, 422, 422, 672, 672, 672, 672, 422,
-        672, 422, 672, 422, 671, 672, 672, 422,
-        671, 672, 671, 422, 672, 422, 671, 672,
-        671, 422, 672, 422, 671, 672, 422, 672,
-        672, 671, 422, 672, 672, 422, 671, 672,
-        671, 422, 672, 422, 672, 671, 672, 422,
-        672, 422, 671, 672, 671, 422, 672, 422,
-        672, 422, 672, 422, 672, 422, 672, 671,
-        673, 671, 674, 675, 676, 677, 678, 679,
-        680, 681, 682, 683, 684, 676, 685, 686,
-        687, 688, 689, 676, 690, 691, 692, 693,
+        425, 418, 419, 419, 419, 418, 418, 418,
+        418, 419, 419, 418, 418, 419, 418, 418,
+        418, 418, 418, 418, 418, 419, 418, 419,
+        418, 418, 418, 418, 418, 418, 419, 419,
+        419, 419, 419, 418, 418, 419, 418, 418,
+        418, 419, 418, 418, 419, 418, 418, 419,
+        418, 418, 419, 418, 418, 418, 419, 419,
+        419, 418, 418, 418, 419, 419, 419, 419,
+        418, 657, 470, 658, 470, 659, 660, 661,
+        662, 425, 418, 419, 419, 419, 419, 419,
+        418, 418, 418, 419, 418, 418, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        418, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 418, 419, 419, 419,
+        419, 419, 418, 663, 470, 425, 418, 419,
+        664, 470, 455, 425, 418, 419, 665, 418,
+        425, 418, 419, 470, 666, 425, 418, 418,
+        419, 667, 418, 470, 668, 425, 418, 418,
+        419, 670, 669, 419, 419, 419, 419, 670,
+        669, 419, 670, 669, 670, 670, 419, 670,
+        669, 419, 670, 419, 670, 669, 419, 670,
+        419, 670, 419, 669, 670, 670, 670, 670,
+        670, 670, 670, 670, 669, 419, 419, 670,
+        670, 419, 670, 419, 670, 669, 670, 670,
+        670, 670, 670, 419, 670, 419, 670, 419,
+        670, 669, 670, 670, 419, 670, 419, 670,
+        669, 670, 670, 670, 670, 670, 419, 670,
+        419, 670, 669, 419, 419, 670, 419, 670,
+        669, 670, 670, 670, 419, 670, 419, 670,
+        419, 670, 419, 670, 669, 670, 419, 670,
+        419, 670, 669, 419, 670, 670, 670, 670,
+        419, 670, 419, 670, 419, 670, 419, 670,
+        419, 670, 419, 670, 669, 419, 670, 669,
+        670, 670, 670, 419, 670, 419, 670, 669,
+        670, 419, 670, 419, 670, 669, 419, 670,
+        670, 670, 670, 419, 670, 419, 670, 669,
+        419, 670, 419, 670, 419, 670, 669, 670,
+        670, 419, 670, 419, 670, 669, 419, 670,
+        419, 670, 419, 670, 419, 669, 670, 670,
+        670, 419, 670, 419, 670, 669, 419, 670,
+        669, 670, 670, 419, 670, 669, 670, 670,
+        670, 419, 670, 670, 670, 670, 670, 670,
+        419, 419, 670, 419, 670, 419, 670, 419,
+        670, 669, 670, 419, 670, 419, 670, 669,
+        419, 670, 669, 670, 419, 670, 669, 670,
+        419, 670, 669, 419, 419, 670, 669, 419,
+        670, 419, 670, 419, 670, 419, 670, 419,
+        670, 419, 669, 670, 670, 419, 670, 670,
+        670, 670, 419, 419, 670, 670, 670, 670,
+        670, 419, 670, 670, 670, 670, 670, 669,
+        419, 670, 670, 419, 670, 419, 669, 670,
+        670, 419, 670, 669, 419, 419, 670, 419,
+        669, 670, 670, 669, 419, 670, 419, 669,
+        670, 669, 419, 670, 419, 670, 419, 669,
+        670, 670, 669, 419, 670, 419, 670, 419,
+        670, 669, 670, 419, 670, 419, 670, 669,
+        419, 670, 669, 419, 419, 670, 669, 670,
+        419, 669, 670, 669, 419, 670, 419, 670,
+        419, 669, 670, 669, 419, 419, 670, 669,
+        670, 419, 670, 419, 670, 669, 419, 670,
+        419, 669, 670, 669, 419, 419, 670, 419,
+        669, 670, 669, 419, 419, 670, 669, 670,
+        419, 670, 669, 670, 419, 670, 669, 670,
+        419, 670, 419, 670, 419, 669, 670, 669,
+        419, 419, 670, 669, 670, 419, 670, 419,
+        670, 669, 419, 670, 669, 670, 670, 419,
+        670, 419, 670, 669, 669, 419, 669, 419,
+        670, 670, 419, 670, 670, 670, 670, 670,
+        670, 670, 669, 419, 670, 670, 670, 419,
+        669, 670, 670, 670, 419, 670, 419, 670,
+        419, 670, 419, 670, 419, 670, 669, 419,
+        419, 670, 669, 670, 419, 670, 669, 419,
+        419, 670, 419, 419, 419, 670, 419, 670,
+        419, 670, 419, 670, 419, 669, 419, 670,
+        419, 670, 419, 669, 670, 669, 419, 670,
+        419, 669, 670, 419, 670, 670, 670, 669,
+        419, 670, 419, 419, 670, 419, 669, 670,
+        670, 669, 419, 670, 670, 670, 670, 419,
+        670, 419, 669, 670, 670, 670, 419, 670,
+        669, 670, 419, 670, 419, 670, 419, 670,
+        419, 670, 669, 670, 670, 419, 670, 669,
+        419, 670, 419, 670, 419, 669, 670, 670,
+        669, 419, 670, 419, 669, 670, 669, 419,
+        670, 669, 419, 670, 419, 670, 669, 670,
+        670, 670, 669, 419, 419, 419, 670, 669,
+        419, 670, 419, 669, 670, 669, 419, 670,
+        419, 670, 419, 669, 670, 670, 670, 669,
+        419, 670, 419, 669, 670, 670, 670, 670,
+        669, 419, 670, 419, 670, 669, 419, 419,
+        670, 419, 670, 669, 670, 419, 670, 419,
+        669, 670, 670, 669, 419, 670, 419, 670,
+        669, 419, 670, 670, 670, 419, 670, 419,
+        669, 419, 670, 669, 670, 419, 419, 670,
+        419, 670, 419, 669, 670, 670, 670, 670,
+        669, 419, 670, 419, 670, 419, 670, 419,
+        670, 419, 670, 669, 670, 670, 670, 419,
+        670, 419, 670, 419, 670, 419, 669, 670,
+        670, 419, 419, 670, 669, 670, 419, 670,
+        670, 669, 419, 670, 419, 670, 669, 419,
+        419, 670, 670, 670, 670, 419, 670, 419,
+        670, 419, 669, 670, 670, 419, 669, 670,
+        669, 419, 670, 419, 669, 670, 669, 419,
+        670, 419, 669, 670, 419, 670, 670, 669,
+        419, 670, 670, 419, 669, 670, 669, 419,
+        670, 419, 670, 669, 670, 419, 670, 419,
+        669, 670, 669, 419, 670, 419, 670, 419,
+        670, 419, 670, 419, 670, 669, 671, 669,
+        672, 673, 674, 675, 676, 677, 678, 679,
+        680, 681, 682, 674, 683, 684, 685, 686,
+        687, 674, 688, 689, 690, 691, 692, 693,
         694, 695, 696, 697, 698, 699, 700, 701,
-        702, 703, 704, 676, 705, 673, 685, 673,
-        706, 673, 671, 672, 672, 672, 672, 422,
-        671, 672, 672, 671, 422, 672, 671, 422,
-        422, 672, 671, 422, 672, 422, 671, 672,
-        671, 422, 422, 672, 422, 671, 672, 672,
-        671, 422, 672, 672, 672, 671, 422, 672,
-        422, 672, 672, 671, 422, 422, 672, 422,
-        671, 672, 671, 422, 672, 671, 422, 422,
-        672, 422, 672, 671, 422, 672, 422, 422,
-        672, 422, 672, 422, 671, 672, 672, 671,
-        422, 672, 672, 422, 672, 671, 422, 672,
-        422, 672, 671, 422, 672, 422, 671, 422,
-        672, 672, 672, 422, 672, 671, 672, 422,
-        672, 671, 422, 672, 671, 672, 422, 672,
-        671, 422, 672, 671, 422, 672, 422, 672,
-        671, 422, 672, 671, 422, 672, 671, 707,
+        702, 674, 703, 671, 683, 671, 704, 671,
+        669, 670, 670, 670, 670, 419, 669, 670,
+        670, 669, 419, 670, 669, 419, 419, 670,
+        669, 419, 670, 419, 669, 670, 669, 419,
+        419, 670, 419, 669, 670, 670, 669, 419,
+        670, 670, 670, 669, 419, 670, 419, 670,
+        670, 669, 419, 419, 670, 419, 669, 670,
+        669, 419, 670, 669, 419, 419, 670, 419,
+        670, 669, 419, 670, 419, 419, 670, 419,
+        670, 419, 669, 670, 670, 669, 419, 670,
+        670, 419, 670, 669, 419, 670, 419, 670,
+        669, 419, 670, 419, 669, 419, 670, 670,
+        670, 419, 670, 669, 670, 419, 670, 669,
+        419, 670, 669, 670, 419, 670, 669, 419,
+        670, 669, 419, 670, 419, 670, 669, 419,
+        670, 669, 419, 670, 669, 705, 706, 707,
         708, 709, 710, 711, 712, 713, 714, 715,
-        716, 717, 718, 678, 719, 720, 721, 722,
-        723, 720, 724, 725, 726, 727, 728, 729,
-        730, 731, 732, 673, 671, 672, 422, 672,
-        671, 672, 422, 672, 671, 672, 422, 672,
-        671, 672, 422, 672, 671, 422, 672, 422,
-        672, 671, 672, 422, 672, 671, 672, 422,
-        422, 422, 672, 671, 672, 422, 672, 671,
-        672, 672, 672, 672, 422, 672, 422, 671,
-        672, 671, 422, 422, 672, 422, 672, 671,
-        672, 422, 672, 671, 422, 672, 671, 672,
-        672, 422, 672, 671, 422, 672, 671, 672,
-        422, 672, 671, 422, 672, 671, 422, 672,
-        671, 422, 672, 671, 672, 671, 422, 422,
-        672, 671, 672, 422, 672, 671, 422, 672,
-        422, 671, 672, 671, 422, 676, 733, 673,
-        676, 734, 676, 735, 685, 673, 671, 672,
-        671, 422, 672, 671, 422, 676, 734, 685,
-        673, 671, 676, 736, 673, 685, 673, 671,
-        672, 671, 422, 676, 737, 694, 738, 720,
-        739, 732, 676, 740, 741, 742, 673, 685,
-        673, 671, 672, 671, 422, 672, 422, 672,
-        671, 422, 672, 422, 672, 422, 671, 672,
-        672, 671, 422, 672, 422, 672, 671, 422,
-        672, 671, 676, 685, 427, 671, 743, 676,
-        744, 685, 673, 671, 427, 672, 671, 422,
-        672, 671, 422, 745, 676, 746, 747, 673,
-        671, 422, 672, 671, 672, 672, 671, 422,
-        422, 672, 422, 672, 671, 676, 748, 749,
-        750, 751, 752, 753, 754, 755, 756, 757,
-        758, 673, 685, 673, 671, 672, 422, 672,
-        672, 672, 672, 672, 672, 672, 422, 672,
-        422, 672, 672, 672, 672, 672, 672, 671,
-        422, 672, 672, 422, 672, 422, 671, 672,
-        422, 672, 672, 672, 422, 672, 672, 422,
-        672, 672, 422, 672, 672, 422, 672, 672,
-        671, 422, 676, 759, 676, 735, 760, 761,
-        762, 673, 685, 673, 671, 672, 671, 422,
-        672, 672, 672, 422, 672, 672, 672, 422,
-        672, 422, 672, 671, 422, 422, 422, 422,
-        672, 672, 422, 422, 422, 422, 422, 672,
-        672, 672, 672, 672, 672, 672, 422, 672,
-        422, 672, 422, 671, 672, 672, 672, 422,
-        672, 422, 672, 671, 685, 427, 763, 676,
-        685, 427, 672, 671, 422, 764, 676, 765,
-        685, 427, 672, 671, 422, 672, 422, 766,
-        685, 673, 671, 427, 672, 671, 422, 676,
-        767, 673, 685, 673, 671, 672, 671, 422,
-        768, 769, 768, 770, 771, 768, 772, 768,
-        773, 768, 771, 774, 775, 774, 777, 776,
-        778, 779, 778, 780, 781, 776, 782, 776,
-        783, 778, 784, 779, 785, 780, 787, 786,
-        788, 789, 789, 786, 790, 786, 791, 788,
-        792, 789, 793, 789, 795, 795, 795, 795,
+        716, 676, 717, 718, 719, 720, 721, 718,
+        722, 723, 724, 725, 726, 727, 728, 729,
+        730, 671, 669, 670, 419, 670, 669, 670,
+        419, 670, 669, 670, 419, 670, 669, 670,
+        419, 670, 669, 419, 670, 419, 670, 669,
+        670, 419, 670, 669, 670, 419, 419, 419,
+        670, 669, 670, 419, 670, 669, 670, 670,
+        670, 670, 419, 670, 419, 669, 670, 669,
+        419, 419, 670, 419, 670, 669, 670, 419,
+        670, 669, 419, 670, 669, 670, 670, 419,
+        670, 669, 419, 670, 669, 670, 419, 670,
+        669, 419, 670, 669, 419, 670, 669, 419,
+        670, 669, 670, 669, 419, 419, 670, 669,
+        670, 419, 670, 669, 419, 670, 419, 669,
+        670, 669, 419, 674, 731, 671, 674, 732,
+        674, 733, 683, 671, 669, 670, 669, 419,
+        670, 669, 419, 674, 732, 683, 671, 669,
+        674, 734, 671, 683, 671, 669, 670, 669,
+        419, 674, 735, 692, 736, 718, 737, 730,
+        674, 738, 739, 740, 671, 683, 671, 669,
+        670, 669, 419, 670, 419, 670, 669, 419,
+        670, 419, 670, 419, 669, 670, 670, 669,
+        419, 670, 419, 670, 669, 419, 670, 669,
+        674, 683, 425, 669, 741, 674, 742, 683,
+        671, 669, 425, 670, 669, 419, 670, 669,
+        419, 743, 674, 744, 745, 671, 669, 419,
+        670, 669, 670, 670, 669, 419, 419, 670,
+        419, 670, 669, 674, 746, 747, 748, 749,
+        750, 751, 752, 753, 754, 755, 756, 671,
+        683, 671, 669, 670, 419, 670, 670, 670,
+        670, 670, 670, 670, 419, 670, 419, 670,
+        670, 670, 670, 670, 670, 669, 419, 670,
+        670, 419, 670, 419, 669, 670, 419, 670,
+        670, 670, 419, 670, 670, 419, 670, 670,
+        419, 670, 670, 419, 670, 670, 669, 419,
+        674, 757, 674, 733, 758, 759, 760, 671,
+        683, 671, 669, 670, 669, 419, 670, 670,
+        670, 419, 670, 670, 670, 419, 670, 419,
+        670, 669, 419, 419, 419, 419, 670, 670,
+        419, 419, 419, 419, 419, 670, 670, 670,
+        670, 670, 670, 670, 419, 670, 419, 670,
+        419, 669, 670, 670, 670, 419, 670, 419,
+        670, 669, 683, 425, 761, 674, 683, 425,
+        670, 669, 419, 762, 674, 763, 683, 425,
+        670, 669, 419, 670, 419, 764, 683, 671,
+        669, 425, 670, 669, 419, 674, 765, 671,
+        683, 671, 669, 670, 669, 419, 766, 766,
+        766, 768, 769, 770, 766, 767, 767, 771,
+        768, 771, 769, 771, 767, 772, 773, 772,
+        775, 774, 776, 774, 777, 774, 779, 778,
+        781, 782, 780, 781, 783, 780, 785, 784,
+        786, 784, 787, 784, 789, 788, 791, 792,
+        790, 791, 793, 790, 795, 795, 795, 795,
         794, 795, 795, 795, 794, 795, 794, 795,
         795, 794, 794, 794, 794, 794, 794, 795,
         794, 794, 794, 794, 795, 795, 795, 795,
@@ -3103,375 +3062,343 @@ var _hcltok_indicies []int16 = []int16{
         1046, 1045, 795, 1046, 795, 1140, 1059, 1047,
         1045, 801, 1046, 1045, 795, 1050, 1141, 1047,
         1059, 1047, 1045, 1046, 1045, 795, 1142, 1143,
-        1144, 1142, 1145, 1146, 1147, 1148, 1149, 1150,
-        1151, 1152, 1153, 1154, 672, 672, 422, 1155,
-        1156, 1157, 1158, 672, 1161, 1162, 1164, 1165,
-        1166, 1160, 1167, 1168, 1169, 1170, 1171, 1172,
-        1173, 1174, 1175, 1176, 1177, 1178, 1179, 1180,
-        1181, 1182, 1183, 1184, 1185, 1186, 1188, 1189,
-        1190, 1191, 1192, 1193, 672, 1148, 10, 1148,
-        422, 1148, 422, 1160, 1163, 1187, 1194, 1159,
-        1142, 1142, 1195, 1143, 1196, 1198, 1197, 2,
-        1, 1199, 1197, 1200, 1197, 5, 1, 1197,
-        6, 5, 9, 11, 11, 10, 1202, 1203,
-        1204, 1197, 1205, 1206, 1197, 1207, 1197, 422,
-        422, 1209, 1210, 491, 472, 1211, 472, 1212,
-        1213, 1214, 1215, 1216, 1217, 1218, 1219, 1220,
-        1221, 1222, 546, 1223, 522, 1224, 1225, 1226,
-        1227, 1228, 1229, 1230, 1231, 1232, 1233, 1234,
-        1235, 422, 422, 422, 427, 567, 1208, 1236,
-        1197, 1237, 1197, 672, 1238, 422, 422, 422,
-        672, 1238, 672, 672, 422, 1238, 422, 1238,
-        422, 1238, 422, 672, 672, 672, 672, 672,
-        1238, 422, 672, 672, 672, 422, 672, 422,
-        1238, 422, 672, 672, 672, 672, 422, 1238,
-        672, 422, 672, 422, 672, 422, 672, 672,
-        422, 672, 1238, 422, 672, 422, 672, 422,
-        672, 1238, 672, 422, 1238, 672, 422, 672,
-        422, 1238, 672, 672, 672, 672, 672, 1238,
-        422, 422, 672, 422, 672, 1238, 672, 422,
-        1238, 672, 672, 1238, 422, 422, 672, 422,
-        672, 422, 672, 1238, 1239, 1240, 1241, 1242,
-        1243, 1244, 1245, 1246, 1247, 1248, 1249, 717,
-        1250, 1251, 1252, 1253, 1254, 1255, 1256, 1257,
-        1258, 1259, 1260, 1261, 1260, 1262, 1263, 1264,
-        1265, 1266, 673, 1238, 1267, 1268, 1269, 1270,
-        1271, 1272, 1273, 1274, 1275, 1276, 1277, 1278,
-        1279, 1280, 1281, 1282, 1283, 1284, 1285, 727,
-        1286, 1287, 1288, 694, 1289, 1290, 1291, 1292,
-        1293, 1294, 673, 1295, 1296, 1297, 1298, 1299,
-        1300, 1301, 1302, 676, 1303, 673, 676, 1304,
-        1305, 1306, 1307, 685, 1238, 1308, 1309, 1310,
-        1311, 705, 1312, 1313, 685, 1314, 1315, 1316,
-        1317, 1318, 673, 1238, 1319, 1278, 1320, 1321,
-        1322, 685, 1323, 1324, 676, 673, 685, 427,
-        1238, 1288, 673, 676, 685, 427, 685, 427,
-        1325, 685, 1238, 427, 676, 1326, 1327, 676,
-        1328, 1329, 683, 1330, 1331, 1332, 1333, 1334,
-        1284, 1335, 1336, 1337, 1338, 1339, 1340, 1341,
-        1342, 1343, 1344, 1345, 1346, 1303, 1347, 676,
-        685, 427, 1238, 1348, 1349, 685, 673, 1238,
-        427, 673, 1238, 676, 1350, 733, 1351, 1352,
-        1353, 1354, 1355, 1356, 1357, 1358, 673, 1359,
-        1360, 1361, 1362, 1363, 1364, 673, 685, 1238,
-        1366, 1367, 1368, 1369, 1370, 1371, 1372, 1373,
-        1374, 1375, 1376, 1372, 1378, 1379, 1380, 1381,
-        1365, 1377, 1365, 1238, 1365, 1238, 1382, 1382,
-        1383, 1384, 1385, 1386, 1387, 1388, 1389, 1390,
-        1387, 771, 1391, 1391, 1391, 1392, 1393, 1386,
-        1391, 772, 773, 1394, 1391, 771, 1395, 1395,
-        1395, 1397, 1398, 1399, 1395, 1400, 1401, 1402,
-        1395, 1396, 1403, 1403, 1403, 1405, 1406, 1407,
-        1403, 1408, 1409, 1410, 1403, 1404, 1391, 1391,
-        1411, 1412, 1386, 1391, 772, 773, 1394, 1391,
-        771, 1413, 1414, 1415, 771, 1416, 1417, 1418,
-        769, 769, 769, 769, 1420, 1421, 1422, 1396,
-        769, 1423, 1424, 1425, 769, 1419, 770, 770,
-        770, 1427, 1428, 1429, 1396, 770, 1430, 1431,
-        1432, 770, 1426, 769, 769, 769, 1434, 1435,
-        1436, 1404, 769, 1437, 1438, 1439, 769, 1433,
-        1395, 1395, 771, 1440, 1441, 1399, 1395, 1400,
-        1401, 1402, 1395, 1396, 1442, 1443, 1444, 771,
-        1445, 1446, 1447, 770, 770, 770, 770, 1449,
-        1450, 1451, 1404, 770, 1452, 1453, 1454, 770,
-        1448, 1403, 1403, 771, 1455, 1456, 1407, 1403,
-        1408, 1409, 1410, 1403, 1404, 1403, 1403, 1403,
-        1405, 1406, 1407, 771, 1408, 1409, 1410, 1403,
-        1404, 1403, 1403, 1403, 1405, 1406, 1407, 772,
-        1408, 1409, 1410, 1403, 1404, 1403, 1403, 1403,
-        1405, 1406, 1407, 773, 1408, 1409, 1410, 1403,
-        1404, 1395, 1395, 1395, 1397, 1398, 1399, 771,
-        1400, 1401, 1402, 1395, 1396, 1395, 1395, 1395,
-        1397, 1398, 1399, 772, 1400, 1401, 1402, 1395,
-        1396, 1395, 1395, 1395, 1397, 1398, 1399, 773,
-        1400, 1401, 1402, 1395, 1396, 1458, 769, 1460,
-        1459, 1461, 770, 1463, 1462, 771, 1464, 775,
-        1464, 1465, 1464, 777, 1466, 1467, 1468, 1469,
-        1470, 1471, 1472, 1469, 781, 777, 1466, 1474,
-        1475, 1473, 782, 783, 1476, 1473, 781, 1479,
-        1480, 1481, 1482, 1477, 1483, 1484, 1485, 1477,
-        1478, 1488, 1489, 1490, 1491, 1486, 1492, 1493,
-        1494, 1486, 1487, 1496, 1495, 1498, 1497, 781,
-        1499, 782, 1499, 783, 1499, 787, 1500, 1501,
-        1502, 1503, 1504, 1505, 1506, 1503, 789, 787,
-        1500, 1508, 1507, 790, 791, 1509, 1507, 789,
-        1511, 1510, 1513, 1512, 789, 1514, 790, 1514,
-        791, 1514, 795, 1517, 1518, 1520, 1521, 1522,
-        1516, 1523, 1524, 1525, 1526, 1527, 1528, 1529,
-        1530, 1531, 1532, 1533, 1534, 1535, 1536, 1537,
-        1538, 1539, 1540, 1541, 1542, 1544, 1545, 1546,
-        1547, 1548, 1549, 795, 795, 1515, 1516, 1519,
-        1543, 1550, 1515, 1046, 795, 795, 1552, 1553,
-        865, 846, 1554, 846, 1555, 1556, 1557, 1558,
-        1559, 1560, 1561, 1562, 1563, 1564, 1565, 920,
-        1566, 896, 1567, 1568, 1569, 1570, 1571, 1572,
-        1573, 1574, 1575, 1576, 1577, 1578, 795, 795,
-        795, 801, 941, 1551, 1046, 1579, 795, 795,
-        795, 1046, 1579, 1046, 1046, 795, 1579, 795,
-        1579, 795, 1579, 795, 1046, 1046, 1046, 1046,
-        1046, 1579, 795, 1046, 1046, 1046, 795, 1046,
-        795, 1579, 795, 1046, 1046, 1046, 1046, 795,
-        1579, 1046, 795, 1046, 795, 1046, 795, 1046,
-        1046, 795, 1046, 1579, 795, 1046, 795, 1046,
-        795, 1046, 1579, 1046, 795, 1579, 1046, 795,
-        1046, 795, 1579, 1046, 1046, 1046, 1046, 1046,
-        1579, 795, 795, 1046, 795, 1046, 1579, 1046,
-        795, 1579, 1046, 1046, 1579, 795, 795, 1046,
-        795, 1046, 795, 1046, 1579, 1580, 1581, 1582,
-        1583, 1584, 1585, 1586, 1587, 1588, 1589, 1590,
-        1091, 1591, 1592, 1593, 1594, 1595, 1596, 1597,
-        1598, 1599, 1600, 1601, 1602, 1601, 1603, 1604,
-        1605, 1606, 1607, 1047, 1579, 1608, 1609, 1610,
-        1611, 1612, 1613, 1614, 1615, 1616, 1617, 1618,
-        1619, 1620, 1621, 1622, 1623, 1624, 1625, 1626,
-        1101, 1627, 1628, 1629, 1068, 1630, 1631, 1632,
-        1633, 1634, 1635, 1047, 1636, 1637, 1638, 1639,
-        1640, 1641, 1642, 1643, 1050, 1644, 1047, 1050,
-        1645, 1646, 1647, 1648, 1059, 1579, 1649, 1650,
-        1651, 1652, 1079, 1653, 1654, 1059, 1655, 1656,
-        1657, 1658, 1659, 1047, 1579, 1660, 1619, 1661,
-        1662, 1663, 1059, 1664, 1665, 1050, 1047, 1059,
-        801, 1579, 1629, 1047, 1050, 1059, 801, 1059,
-        801, 1666, 1059, 1579, 801, 1050, 1667, 1668,
-        1050, 1669, 1670, 1057, 1671, 1672, 1673, 1674,
-        1675, 1625, 1676, 1677, 1678, 1679, 1680, 1681,
-        1682, 1683, 1684, 1685, 1686, 1687, 1644, 1688,
-        1050, 1059, 801, 1579, 1689, 1690, 1059, 1047,
-        1579, 801, 1047, 1579, 1050, 1691, 1107, 1692,
-        1693, 1694, 1695, 1696, 1697, 1698, 1699, 1047,
-        1700, 1701, 1702, 1703, 1704, 1705, 1047, 1059,
-        1579, 1707, 1708, 1709, 1710, 1711, 1712, 1713,
-        1714, 1715, 1716, 1717, 1713, 1719, 1720, 1721,
-        1722, 1706, 1718, 1706, 1579, 1706, 1579,
+        1144, 1142, 1145, 1146, 1147, 1149, 1150, 1151,
+        1152, 1153, 1154, 670, 670, 419, 1155, 1156,
+        1157, 1158, 670, 1161, 1162, 1164, 1165, 1166,
+        1160, 1167, 1168, 1169, 1170, 1171, 1172, 1173,
+        1174, 1175, 1176, 1177, 1178, 1179, 1180, 1181,
+        1182, 1183, 1184, 1185, 1186, 1188, 1189, 1190,
+        1191, 1192, 1193, 670, 1148, 7, 1148, 419,
+        1148, 419, 1160, 1163, 1187, 1194, 1159, 1142,
+        1142, 1195, 1143, 1196, 1198, 1197, 4, 1147,
+        1200, 1197, 1201, 1197, 2, 1147, 1197, 6,
+        8, 8, 7, 1202, 1203, 1204, 1197, 1205,
+        1206, 1197, 1207, 1197, 419, 419, 1209, 1210,
+        489, 470, 1211, 470, 1212, 1213, 1214, 1215,
+        1216, 1217, 1218, 1219, 1220, 1221, 1222, 544,
+        1223, 520, 1224, 1225, 1226, 1227, 1228, 1229,
+        1230, 1231, 1232, 1233, 1234, 1235, 419, 419,
+        419, 425, 565, 1208, 1236, 1197, 1237, 1197,
+        670, 1238, 419, 419, 419, 670, 1238, 670,
+        670, 419, 1238, 419, 1238, 419, 1238, 419,
+        670, 670, 670, 670, 670, 1238, 419, 670,
+        670, 670, 419, 670, 419, 1238, 419, 670,
+        670, 670, 670, 419, 1238, 670, 419, 670,
+        419, 670, 419, 670, 670, 419, 670, 1238,
+        419, 670, 419, 670, 419, 670, 1238, 670,
+        419, 1238, 670, 419, 670, 419, 1238, 670,
+        670, 670, 670, 670, 1238, 419, 419, 670,
+        419, 670, 1238, 670, 419, 1238, 670, 670,
+        1238, 419, 419, 670, 419, 670, 419, 670,
+        1238, 1239, 1240, 1241, 1242, 1243, 1244, 1245,
+        1246, 1247, 1248, 1249, 715, 1250, 1251, 1252,
+        1253, 1254, 1255, 1256, 1257, 1258, 1259, 1260,
+        1261, 1260, 1262, 1263, 1264, 1265, 1266, 671,
+        1238, 1267, 1268, 1269, 1270, 1271, 1272, 1273,
+        1274, 1275, 1276, 1277, 1278, 1279, 1280, 1281,
+        1282, 1283, 1284, 1285, 725, 1286, 1287, 1288,
+        692, 1289, 1290, 1291, 1292, 1293, 1294, 671,
+        1295, 1296, 1297, 1298, 1299, 1300, 1301, 1302,
+        674, 1303, 671, 674, 1304, 1305, 1306, 1307,
+        683, 1238, 1308, 1309, 1310, 1311, 703, 1312,
+        1313, 683, 1314, 1315, 1316, 1317, 1318, 671,
+        1238, 1319, 1278, 1320, 1321, 1322, 683, 1323,
+        1324, 674, 671, 683, 425, 1238, 1288, 671,
+        674, 683, 425, 683, 425, 1325, 683, 1238,
+        425, 674, 1326, 1327, 674, 1328, 1329, 681,
+        1330, 1331, 1332, 1333, 1334, 1284, 1335, 1336,
+        1337, 1338, 1339, 1340, 1341, 1342, 1343, 1344,
+        1345, 1346, 1303, 1347, 674, 683, 425, 1238,
+        1348, 1349, 683, 671, 1238, 425, 671, 1238,
+        674, 1350, 731, 1351, 1352, 1353, 1354, 1355,
+        1356, 1357, 1358, 671, 1359, 1360, 1361, 1362,
+        1363, 1364, 671, 683, 1238, 1366, 1367, 1368,
+        1369, 1370, 1371, 1372, 1373, 1374, 1375, 1376,
+        1372, 1378, 1379, 1380, 1381, 1365, 1377, 1365,
+        1238, 1365, 1238, 1382, 1382, 1383, 1384, 1385,
+        1386, 1387, 1388, 1389, 1390, 1387, 767, 1391,
+        1391, 1391, 1392, 1391, 1391, 768, 769, 770,
+        1391, 767, 1382, 1382, 1393, 1396, 1397, 1395,
+        1398, 1399, 1398, 1400, 1391, 1402, 1401, 1396,
+        1403, 1395, 1405, 1404, 1394, 1394, 1394, 768,
+        769, 770, 1394, 767, 767, 1406, 773, 1406,
+        1407, 1406, 775, 1408, 1409, 1410, 1411, 1412,
+        1413, 1414, 1411, 776, 775, 1408, 1415, 1415,
+        777, 779, 1416, 1415, 776, 1418, 1419, 1417,
+        1418, 1419, 1420, 1417, 775, 1408, 1421, 1415,
+        775, 1408, 1415, 1423, 1422, 1425, 1424, 776,
+        1426, 777, 1426, 779, 1426, 785, 1427, 1428,
+        1429, 1430, 1431, 1432, 1433, 1430, 786, 785,
+        1427, 1434, 1434, 787, 789, 1435, 1434, 786,
+        1437, 1438, 1436, 1437, 1438, 1439, 1436, 785,
+        1427, 1440, 1434, 785, 1427, 1434, 1442, 1441,
+        1444, 1443, 786, 1445, 787, 1445, 789, 1445,
+        795, 1448, 1449, 1451, 1452, 1453, 1447, 1454,
+        1455, 1456, 1457, 1458, 1459, 1460, 1461, 1462,
+        1463, 1464, 1465, 1466, 1467, 1468, 1469, 1470,
+        1471, 1472, 1473, 1475, 1476, 1477, 1478, 1479,
+        1480, 795, 795, 1446, 1447, 1450, 1474, 1481,
+        1446, 1046, 795, 795, 1483, 1484, 865, 846,
+        1485, 846, 1486, 1487, 1488, 1489, 1490, 1491,
+        1492, 1493, 1494, 1495, 1496, 920, 1497, 896,
+        1498, 1499, 1500, 1501, 1502, 1503, 1504, 1505,
+        1506, 1507, 1508, 1509, 795, 795, 795, 801,
+        941, 1482, 1046, 1510, 795, 795, 795, 1046,
+        1510, 1046, 1046, 795, 1510, 795, 1510, 795,
+        1510, 795, 1046, 1046, 1046, 1046, 1046, 1510,
+        795, 1046, 1046, 1046, 795, 1046, 795, 1510,
+        795, 1046, 1046, 1046, 1046, 795, 1510, 1046,
+        795, 1046, 795, 1046, 795, 1046, 1046, 795,
+        1046, 1510, 795, 1046, 795, 1046, 795, 1046,
+        1510, 1046, 795, 1510, 1046, 795, 1046, 795,
+        1510, 1046, 1046, 1046, 1046, 1046, 1510, 795,
+        795, 1046, 795, 1046, 1510, 1046, 795, 1510,
+        1046, 1046, 1510, 795, 795, 1046, 795, 1046,
+        795, 1046, 1510, 1511, 1512, 1513, 1514, 1515,
+        1516, 1517, 1518, 1519, 1520, 1521, 1091, 1522,
+        1523, 1524, 1525, 1526, 1527, 1528, 1529, 1530,
+        1531, 1532, 1533, 1532, 1534, 1535, 1536, 1537,
+        1538, 1047, 1510, 1539, 1540, 1541, 1542, 1543,
+        1544, 1545, 1546, 1547, 1548, 1549, 1550, 1551,
+        1552, 1553, 1554, 1555, 1556, 1557, 1101, 1558,
+        1559, 1560, 1068, 1561, 1562, 1563, 1564, 1565,
+        1566, 1047, 1567, 1568, 1569, 1570, 1571, 1572,
+        1573, 1574, 1050, 1575, 1047, 1050, 1576, 1577,
+        1578, 1579, 1059, 1510, 1580, 1581, 1582, 1583,
+        1079, 1584, 1585, 1059, 1586, 1587, 1588, 1589,
+        1590, 1047, 1510, 1591, 1550, 1592, 1593, 1594,
+        1059, 1595, 1596, 1050, 1047, 1059, 801, 1510,
+        1560, 1047, 1050, 1059, 801, 1059, 801, 1597,
+        1059, 1510, 801, 1050, 1598, 1599, 1050, 1600,
+        1601, 1057, 1602, 1603, 1604, 1605, 1606, 1556,
+        1607, 1608, 1609, 1610, 1611, 1612, 1613, 1614,
+        1615, 1616, 1617, 1618, 1575, 1619, 1050, 1059,
+        801, 1510, 1620, 1621, 1059, 1047, 1510, 801,
+        1047, 1510, 1050, 1622, 1107, 1623, 1624, 1625,
+        1626, 1627, 1628, 1629, 1630, 1047, 1631, 1632,
+        1633, 1634, 1635, 1636, 1047, 1059, 1510, 1638,
+        1639, 1640, 1641, 1642, 1643, 1644, 1645, 1646,
+        1647, 1648, 1644, 1650, 1651, 1652, 1653, 1637,
+        1649, 1637, 1510, 1637, 1510,
 }
 
 var _hcltok_trans_targs []int16 = []int16{
-        1464, 1, 1464, 1464, 1464, 3, 4, 1472,
-        1464, 5, 1473, 6, 7, 9, 10, 287,
-        13, 14, 15, 16, 17, 288, 289, 20,
-        290, 22, 23, 291, 292, 293, 294, 295,
-        296, 297, 298, 299, 300, 329, 349, 354,
-        128, 129, 130, 357, 152, 372, 376, 1464,
-        11, 12, 18, 19, 21, 24, 25, 26,
-        27, 28, 29, 30, 31, 32, 33, 65,
-        106, 121, 132, 155, 171, 284, 34, 35,
-        36, 37, 38, 39, 40, 41, 42, 43,
-        44, 45, 46, 47, 48, 49, 50, 51,
-        52, 53, 54, 55, 56, 57, 58, 59,
-        60, 61, 62, 63, 64, 66, 67, 68,
-        69, 70, 71, 72, 73, 74, 75, 76,
-        77, 78, 79, 80, 81, 82, 83, 84,
-        85, 86, 87, 88, 89, 90, 91, 92,
-        93, 94, 95, 96, 97, 98, 99, 100,
-        101, 102, 103, 104, 105, 107, 108, 109,
-        110, 111, 112, 113, 114, 115, 116, 117,
-        118, 119, 120, 122, 123, 124, 125, 126,
-        127, 131, 133, 134, 135, 136, 137, 138,
-        139, 140, 141, 142, 143, 144, 145, 146,
-        147, 148, 149, 150, 151, 153, 154, 156,
-        157, 158, 159, 160, 161, 162, 163, 164,
-        165, 166, 167, 168, 169, 170, 172, 204,
-        228, 231, 232, 234, 243, 244, 247, 251,
-        269, 276, 278, 280, 282, 173, 174, 175,
-        176, 177, 178, 179, 180, 181, 182, 183,
-        184, 185, 186, 187, 188, 189, 190, 191,
-        192, 193, 194, 195, 196, 197, 198, 199,
-        200, 201, 202, 203, 205, 206, 207, 208,
-        209, 210, 211, 212, 213, 214, 215, 216,
-        217, 218, 219, 220, 221, 222, 223, 224,
-        225, 226, 227, 229, 230, 233, 235, 236,
-        237, 238, 239, 240, 241, 242, 245, 246,
-        248, 249, 250, 252, 253, 254, 255, 256,
-        257, 258, 259, 260, 261, 262, 263, 264,
-        265, 266, 267, 268, 270, 271, 272, 273,
-        274, 275, 277, 279, 281, 283, 285, 286,
-        301, 302, 303, 304, 305, 306, 307, 308,
-        309, 310, 311, 312, 313, 314, 315, 316,
-        317, 318, 319, 320, 321, 322, 323, 324,
-        325, 326, 327, 328, 330, 331, 332, 333,
-        334, 335, 336, 337, 338, 339, 340, 341,
-        342, 343, 344, 345, 346, 347, 348, 350,
-        351, 352, 353, 355, 356, 358, 359, 360,
-        361, 362, 363, 364, 365, 366, 367, 368,
-        369, 370, 371, 373, 374, 375, 377, 383,
-        405, 410, 412, 414, 378, 379, 380, 381,
-        382, 384, 385, 386, 387, 388, 389, 390,
-        391, 392, 393, 394, 395, 396, 397, 398,
-        399, 400, 401, 402, 403, 404, 406, 407,
-        408, 409, 411, 413, 415, 1464, 1477, 438,
-        439, 440, 441, 418, 442, 443, 444, 445,
-        446, 447, 448, 449, 450, 451, 452, 453,
-        454, 455, 456, 457, 458, 459, 460, 461,
-        462, 463, 464, 465, 466, 467, 468, 470,
-        471, 472, 473, 474, 475, 476, 477, 478,
-        479, 480, 481, 482, 483, 484, 485, 486,
-        420, 487, 488, 489, 490, 491, 492, 493,
-        494, 495, 496, 497, 498, 499, 500, 501,
-        502, 503, 504, 419, 505, 506, 507, 508,
-        509, 511, 512, 513, 514, 515, 516, 517,
-        518, 519, 520, 521, 522, 523, 524, 526,
-        527, 528, 529, 530, 531, 535, 537, 538,
-        539, 540, 435, 541, 542, 543, 544, 545,
-        546, 547, 548, 549, 550, 551, 552, 553,
-        554, 555, 557, 558, 560, 561, 562, 563,
-        564, 565, 433, 566, 567, 568, 569, 570,
-        571, 572, 573, 574, 576, 608, 632, 635,
-        636, 638, 647, 648, 651, 655, 673, 533,
-        680, 682, 684, 686, 577, 578, 579, 580,
-        581, 582, 583, 584, 585, 586, 587, 588,
-        589, 590, 591, 592, 593, 594, 595, 596,
-        597, 598, 599, 600, 601, 602, 603, 604,
-        605, 606, 607, 609, 610, 611, 612, 613,
-        614, 615, 616, 617, 618, 619, 620, 621,
-        622, 623, 624, 625, 626, 627, 628, 629,
-        630, 631, 633, 634, 637, 639, 640, 641,
-        642, 643, 644, 645, 646, 649, 650, 652,
-        653, 654, 656, 657, 658, 659, 660, 661,
-        662, 663, 664, 665, 666, 667, 668, 669,
-        670, 671, 672, 674, 675, 676, 677, 678,
-        679, 681, 683, 685, 687, 689, 690, 1464,
-        1464, 691, 828, 829, 760, 830, 831, 832,
-        833, 834, 835, 789, 836, 725, 837, 838,
-        839, 840, 841, 842, 843, 844, 745, 845,
-        846, 847, 848, 849, 850, 851, 852, 853,
-        854, 770, 855, 857, 858, 859, 860, 861,
-        862, 863, 864, 865, 866, 703, 867, 868,
-        869, 870, 871, 872, 873, 874, 875, 741,
-        876, 877, 878, 879, 880, 811, 882, 883,
-        886, 888, 889, 890, 891, 892, 893, 896,
-        897, 899, 900, 901, 903, 904, 905, 906,
-        907, 908, 909, 910, 911, 912, 913, 915,
-        916, 917, 918, 921, 923, 924, 926, 928,
-        1515, 1517, 1518, 1516, 931, 932, 1515, 934,
-        1541, 1541, 1541, 1543, 1544, 1542, 939, 940,
-        1545, 1546, 1550, 1550, 1550, 1551, 946, 947,
-        1552, 1553, 1557, 1558, 1557, 973, 974, 975,
-        976, 953, 977, 978, 979, 980, 981, 982,
-        983, 984, 985, 986, 987, 988, 989, 990,
-        991, 992, 993, 994, 995, 996, 997, 998,
-        999, 1000, 1001, 1002, 1003, 1005, 1006, 1007,
-        1008, 1009, 1010, 1011, 1012, 1013, 1014, 1015,
-        1016, 1017, 1018, 1019, 1020, 1021, 955, 1022,
-        1023, 1024, 1025, 1026, 1027, 1028, 1029, 1030,
-        1031, 1032, 1033, 1034, 1035, 1036, 1037, 1038,
-        1039, 954, 1040, 1041, 1042, 1043, 1044, 1046,
-        1047, 1048, 1049, 1050, 1051, 1052, 1053, 1054,
-        1055, 1056, 1057, 1058, 1059, 1061, 1062, 1063,
-        1064, 1065, 1066, 1070, 1072, 1073, 1074, 1075,
-        970, 1076, 1077, 1078, 1079, 1080, 1081, 1082,
-        1083, 1084, 1085, 1086, 1087, 1088, 1089, 1090,
-        1092, 1093, 1095, 1096, 1097, 1098, 1099, 1100,
-        968, 1101, 1102, 1103, 1104, 1105, 1106, 1107,
-        1108, 1109, 1111, 1143, 1167, 1170, 1171, 1173,
-        1182, 1183, 1186, 1190, 1208, 1068, 1215, 1217,
-        1219, 1221, 1112, 1113, 1114, 1115, 1116, 1117,
-        1118, 1119, 1120, 1121, 1122, 1123, 1124, 1125,
-        1126, 1127, 1128, 1129, 1130, 1131, 1132, 1133,
-        1134, 1135, 1136, 1137, 1138, 1139, 1140, 1141,
-        1142, 1144, 1145, 1146, 1147, 1148, 1149, 1150,
-        1151, 1152, 1153, 1154, 1155, 1156, 1157, 1158,
-        1159, 1160, 1161, 1162, 1163, 1164, 1165, 1166,
-        1168, 1169, 1172, 1174, 1175, 1176, 1177, 1178,
-        1179, 1180, 1181, 1184, 1185, 1187, 1188, 1189,
-        1191, 1192, 1193, 1194, 1195, 1196, 1197, 1198,
-        1199, 1200, 1201, 1202, 1203, 1204, 1205, 1206,
-        1207, 1209, 1210, 1211, 1212, 1213, 1214, 1216,
-        1218, 1220, 1222, 1224, 1225, 1557, 1557, 1226,
-        1363, 1364, 1295, 1365, 1366, 1367, 1368, 1369,
-        1370, 1324, 1371, 1260, 1372, 1373, 1374, 1375,
-        1376, 1377, 1378, 1379, 1280, 1380, 1381, 1382,
-        1383, 1384, 1385, 1386, 1387, 1388, 1389, 1305,
-        1390, 1392, 1393, 1394, 1395, 1396, 1397, 1398,
-        1399, 1400, 1401, 1238, 1402, 1403, 1404, 1405,
-        1406, 1407, 1408, 1409, 1410, 1276, 1411, 1412,
-        1413, 1414, 1415, 1346, 1417, 1418, 1421, 1423,
-        1424, 1425, 1426, 1427, 1428, 1431, 1432, 1434,
-        1435, 1436, 1438, 1439, 1440, 1441, 1442, 1443,
-        1444, 1445, 1446, 1447, 1448, 1450, 1451, 1452,
-        1453, 1456, 1458, 1459, 1461, 1463, 1465, 1464,
-        1466, 1467, 1464, 1468, 1464, 1469, 1470, 1471,
-        1474, 1475, 1476, 1464, 1478, 1464, 1479, 1464,
-        1480, 1481, 1482, 1483, 1484, 1485, 1486, 1487,
-        1488, 1489, 1490, 1491, 1492, 1493, 1494, 1495,
-        1496, 1497, 1498, 1499, 1500, 1501, 1502, 1503,
-        1504, 1505, 1506, 1507, 1508, 1509, 1510, 1511,
-        1512, 1513, 1514, 1464, 1464, 1464, 1464, 1464,
-        2, 1464, 1464, 8, 1464, 1464, 1464, 1464,
-        1464, 416, 417, 421, 422, 423, 424, 425,
-        426, 427, 428, 429, 430, 431, 432, 434,
-        436, 437, 469, 510, 525, 532, 534, 536,
-        556, 559, 575, 688, 1464, 1464, 1464, 692,
-        693, 694, 695, 696, 697, 698, 699, 700,
-        701, 702, 704, 705, 706, 707, 708, 709,
-        710, 711, 712, 713, 714, 715, 716, 717,
-        718, 719, 720, 721, 722, 723, 724, 726,
-        727, 728, 729, 730, 731, 732, 733, 734,
-        735, 736, 737, 738, 739, 740, 742, 743,
-        744, 746, 747, 748, 749, 750, 751, 752,
-        753, 754, 755, 756, 757, 758, 759, 761,
-        762, 763, 764, 765, 766, 767, 768, 769,
-        771, 772, 773, 774, 775, 776, 777, 778,
-        779, 780, 781, 782, 783, 784, 785, 786,
-        787, 788, 790, 791, 792, 793, 794, 795,
-        796, 797, 798, 799, 800, 801, 802, 803,
-        804, 805, 806, 807, 808, 809, 810, 812,
-        813, 814, 815, 816, 817, 818, 819, 820,
-        821, 822, 823, 824, 825, 826, 827, 856,
-        881, 884, 885, 887, 894, 895, 898, 902,
-        914, 919, 920, 922, 925, 927, 1515, 1515,
-        1534, 1536, 1519, 1515, 1538, 1539, 1540, 1515,
-        929, 930, 933, 1515, 1516, 929, 930, 1519,
-        931, 932, 933, 1515, 1516, 929, 930, 1519,
-        931, 932, 933, 1520, 1525, 1521, 1522, 1524,
-        1531, 1532, 1533, 1517, 1521, 1522, 1524, 1531,
-        1532, 1533, 1518, 1523, 1526, 1527, 1528, 1529,
-        1530, 1517, 1521, 1522, 1524, 1531, 1532, 1533,
-        1520, 1525, 1523, 1526, 1527, 1528, 1529, 1530,
-        1518, 1523, 1526, 1527, 1528, 1529, 1530, 1520,
-        1525, 1515, 1535, 1515, 1515, 1537, 1515, 1515,
-        1515, 935, 936, 942, 943, 1541, 1547, 1548,
-        1549, 1541, 937, 938, 941, 1541, 1542, 1541,
-        936, 937, 938, 939, 940, 941, 1541, 1542,
-        1541, 936, 937, 938, 939, 940, 941, 1541,
-        1541, 1541, 1541, 1541, 944, 949, 950, 1550,
-        1554, 1555, 1556, 1550, 945, 948, 1550, 1550,
-        1550, 1550, 1550, 1557, 1559, 1560, 1561, 1562,
-        1563, 1564, 1565, 1566, 1567, 1568, 1569, 1570,
-        1571, 1572, 1573, 1574, 1575, 1576, 1577, 1578,
-        1579, 1580, 1581, 1582, 1583, 1584, 1585, 1586,
-        1587, 1588, 1589, 1590, 1591, 1592, 1593, 1557,
-        951, 952, 956, 957, 958, 959, 960, 961,
-        962, 963, 964, 965, 966, 967, 969, 971,
-        972, 1004, 1045, 1060, 1067, 1069, 1071, 1091,
-        1094, 1110, 1223, 1557, 1227, 1228, 1229, 1230,
-        1231, 1232, 1233, 1234, 1235, 1236, 1237, 1239,
+        1459, 1459, 2, 3, 1459, 1459, 4, 1467,
+        5, 6, 8, 9, 286, 12, 13, 14,
+        15, 16, 287, 288, 19, 289, 21, 22,
+        290, 291, 292, 293, 294, 295, 296, 297,
+        298, 299, 328, 348, 353, 127, 128, 129,
+        356, 151, 371, 375, 1459, 10, 11, 17,
+        18, 20, 23, 24, 25, 26, 27, 28,
+        29, 30, 31, 32, 64, 105, 120, 131,
+        154, 170, 283, 33, 34, 35, 36, 37,
+        38, 39, 40, 41, 42, 43, 44, 45,
+        46, 47, 48, 49, 50, 51, 52, 53,
+        54, 55, 56, 57, 58, 59, 60, 61,
+        62, 63, 65, 66, 67, 68, 69, 70,
+        71, 72, 73, 74, 75, 76, 77, 78,
+        79, 80, 81, 82, 83, 84, 85, 86,
+        87, 88, 89, 90, 91, 92, 93, 94,
+        95, 96, 97, 98, 99, 100, 101, 102,
+        103, 104, 106, 107, 108, 109, 110, 111,
+        112, 113, 114, 115, 116, 117, 118, 119,
+        121, 122, 123, 124, 125, 126, 130, 132,
+        133, 134, 135, 136, 137, 138, 139, 140,
+        141, 142, 143, 144, 145, 146, 147, 148,
+        149, 150, 152, 153, 155, 156, 157, 158,
+        159, 160, 161, 162, 163, 164, 165, 166,
+        167, 168, 169, 171, 203, 227, 230, 231,
+        233, 242, 243, 246, 250, 268, 275, 277,
+        279, 281, 172, 173, 174, 175, 176, 177,
+        178, 179, 180, 181, 182, 183, 184, 185,
+        186, 187, 188, 189, 190, 191, 192, 193,
+        194, 195, 196, 197, 198, 199, 200, 201,
+        202, 204, 205, 206, 207, 208, 209, 210,
+        211, 212, 213, 214, 215, 216, 217, 218,
+        219, 220, 221, 222, 223, 224, 225, 226,
+        228, 229, 232, 234, 235, 236, 237, 238,
+        239, 240, 241, 244, 245, 247, 248, 249,
+        251, 252, 253, 254, 255, 256, 257, 258,
+        259, 260, 261, 262, 263, 264, 265, 266,
+        267, 269, 270, 271, 272, 273, 274, 276,
+        278, 280, 282, 284, 285, 300, 301, 302,
+        303, 304, 305, 306, 307, 308, 309, 310,
+        311, 312, 313, 314, 315, 316, 317, 318,
+        319, 320, 321, 322, 323, 324, 325, 326,
+        327, 329, 330, 331, 332, 333, 334, 335,
+        336, 337, 338, 339, 340, 341, 342, 343,
+        344, 345, 346, 347, 349, 350, 351, 352,
+        354, 355, 357, 358, 359, 360, 361, 362,
+        363, 364, 365, 366, 367, 368, 369, 370,
+        372, 373, 374, 376, 382, 404, 409, 411,
+        413, 377, 378, 379, 380, 381, 383, 384,
+        385, 386, 387, 388, 389, 390, 391, 392,
+        393, 394, 395, 396, 397, 398, 399, 400,
+        401, 402, 403, 405, 406, 407, 408, 410,
+        412, 414, 1459, 1471, 1459, 437, 438, 439,
+        440, 417, 441, 442, 443, 444, 445, 446,
+        447, 448, 449, 450, 451, 452, 453, 454,
+        455, 456, 457, 458, 459, 460, 461, 462,
+        463, 464, 465, 466, 467, 469, 470, 471,
+        472, 473, 474, 475, 476, 477, 478, 479,
+        480, 481, 482, 483, 484, 485, 419, 486,
+        487, 488, 489, 490, 491, 492, 493, 494,
+        495, 496, 497, 498, 499, 500, 501, 502,
+        503, 418, 504, 505, 506, 507, 508, 510,
+        511, 512, 513, 514, 515, 516, 517, 518,
+        519, 520, 521, 522, 523, 525, 526, 527,
+        528, 529, 530, 534, 536, 537, 538, 539,
+        434, 540, 541, 542, 543, 544, 545, 546,
+        547, 548, 549, 550, 551, 552, 553, 554,
+        556, 557, 559, 560, 561, 562, 563, 564,
+        432, 565, 566, 567, 568, 569, 570, 571,
+        572, 573, 575, 607, 631, 634, 635, 637,
+        646, 647, 650, 654, 672, 532, 679, 681,
+        683, 685, 576, 577, 578, 579, 580, 581,
+        582, 583, 584, 585, 586, 587, 588, 589,
+        590, 591, 592, 593, 594, 595, 596, 597,
+        598, 599, 600, 601, 602, 603, 604, 605,
+        606, 608, 609, 610, 611, 612, 613, 614,
+        615, 616, 617, 618, 619, 620, 621, 622,
+        623, 624, 625, 626, 627, 628, 629, 630,
+        632, 633, 636, 638, 639, 640, 641, 642,
+        643, 644, 645, 648, 649, 651, 652, 653,
+        655, 656, 657, 658, 659, 660, 661, 662,
+        663, 664, 665, 666, 667, 668, 669, 670,
+        671, 673, 674, 675, 676, 677, 678, 680,
+        682, 684, 686, 688, 689, 1459, 1459, 690,
+        827, 828, 759, 829, 830, 831, 832, 833,
+        834, 788, 835, 724, 836, 837, 838, 839,
+        840, 841, 842, 843, 744, 844, 845, 846,
+        847, 848, 849, 850, 851, 852, 853, 769,
+        854, 856, 857, 858, 859, 860, 861, 862,
+        863, 864, 865, 702, 866, 867, 868, 869,
+        870, 871, 872, 873, 874, 740, 875, 876,
+        877, 878, 879, 810, 881, 882, 885, 887,
+        888, 889, 890, 891, 892, 895, 896, 898,
+        899, 900, 902, 903, 904, 905, 906, 907,
+        908, 909, 910, 911, 912, 914, 915, 916,
+        917, 920, 922, 923, 925, 927, 1509, 1510,
+        929, 930, 931, 1509, 1509, 932, 1523, 1523,
+        1524, 935, 1523, 936, 1525, 1526, 1529, 1530,
+        1534, 1534, 1535, 941, 1534, 942, 1536, 1537,
+        1540, 1541, 1545, 1546, 1545, 968, 969, 970,
+        971, 948, 972, 973, 974, 975, 976, 977,
+        978, 979, 980, 981, 982, 983, 984, 985,
+        986, 987, 988, 989, 990, 991, 992, 993,
+        994, 995, 996, 997, 998, 1000, 1001, 1002,
+        1003, 1004, 1005, 1006, 1007, 1008, 1009, 1010,
+        1011, 1012, 1013, 1014, 1015, 1016, 950, 1017,
+        1018, 1019, 1020, 1021, 1022, 1023, 1024, 1025,
+        1026, 1027, 1028, 1029, 1030, 1031, 1032, 1033,
+        1034, 949, 1035, 1036, 1037, 1038, 1039, 1041,
+        1042, 1043, 1044, 1045, 1046, 1047, 1048, 1049,
+        1050, 1051, 1052, 1053, 1054, 1056, 1057, 1058,
+        1059, 1060, 1061, 1065, 1067, 1068, 1069, 1070,
+        965, 1071, 1072, 1073, 1074, 1075, 1076, 1077,
+        1078, 1079, 1080, 1081, 1082, 1083, 1084, 1085,
+        1087, 1088, 1090, 1091, 1092, 1093, 1094, 1095,
+        963, 1096, 1097, 1098, 1099, 1100, 1101, 1102,
+        1103, 1104, 1106, 1138, 1162, 1165, 1166, 1168,
+        1177, 1178, 1181, 1185, 1203, 1063, 1210, 1212,
+        1214, 1216, 1107, 1108, 1109, 1110, 1111, 1112,
+        1113, 1114, 1115, 1116, 1117, 1118, 1119, 1120,
+        1121, 1122, 1123, 1124, 1125, 1126, 1127, 1128,
+        1129, 1130, 1131, 1132, 1133, 1134, 1135, 1136,
+        1137, 1139, 1140, 1141, 1142, 1143, 1144, 1145,
+        1146, 1147, 1148, 1149, 1150, 1151, 1152, 1153,
+        1154, 1155, 1156, 1157, 1158, 1159, 1160, 1161,
+        1163, 1164, 1167, 1169, 1170, 1171, 1172, 1173,
+        1174, 1175, 1176, 1179, 1180, 1182, 1183, 1184,
+        1186, 1187, 1188, 1189, 1190, 1191, 1192, 1193,
+        1194, 1195, 1196, 1197, 1198, 1199, 1200, 1201,
+        1202, 1204, 1205, 1206, 1207, 1208, 1209, 1211,
+        1213, 1215, 1217, 1219, 1220, 1545, 1545, 1221,
+        1358, 1359, 1290, 1360, 1361, 1362, 1363, 1364,
+        1365, 1319, 1366, 1255, 1367, 1368, 1369, 1370,
+        1371, 1372, 1373, 1374, 1275, 1375, 1376, 1377,
+        1378, 1379, 1380, 1381, 1382, 1383, 1384, 1300,
+        1385, 1387, 1388, 1389, 1390, 1391, 1392, 1393,
+        1394, 1395, 1396, 1233, 1397, 1398, 1399, 1400,
+        1401, 1402, 1403, 1404, 1405, 1271, 1406, 1407,
+        1408, 1409, 1410, 1341, 1412, 1413, 1416, 1418,
+        1419, 1420, 1421, 1422, 1423, 1426, 1427, 1429,
+        1430, 1431, 1433, 1434, 1435, 1436, 1437, 1438,
+        1439, 1440, 1441, 1442, 1443, 1445, 1446, 1447,
+        1448, 1451, 1453, 1454, 1456, 1458, 1460, 1459,
+        1461, 1462, 1459, 1463, 1459, 1464, 1465, 1466,
+        1468, 1469, 1470, 1459, 1472, 1459, 1473, 1459,
+        1474, 1475, 1476, 1477, 1478, 1479, 1480, 1481,
+        1482, 1483, 1484, 1485, 1486, 1487, 1488, 1489,
+        1490, 1491, 1492, 1493, 1494, 1495, 1496, 1497,
+        1498, 1499, 1500, 1501, 1502, 1503, 1504, 1505,
+        1506, 1507, 1508, 1459, 1459, 1459, 1459, 1459,
+        1459, 1, 1459, 7, 1459, 1459, 1459, 1459,
+        1459, 415, 416, 420, 421, 422, 423, 424,
+        425, 426, 427, 428, 429, 430, 431, 433,
+        435, 436, 468, 509, 524, 531, 533, 535,
+        555, 558, 574, 687, 1459, 1459, 1459, 691,
+        692, 693, 694, 695, 696, 697, 698, 699,
+        700, 701, 703, 704, 705, 706, 707, 708,
+        709, 710, 711, 712, 713, 714, 715, 716,
+        717, 718, 719, 720, 721, 722, 723, 725,
+        726, 727, 728, 729, 730, 731, 732, 733,
+        734, 735, 736, 737, 738, 739, 741, 742,
+        743, 745, 746, 747, 748, 749, 750, 751,
+        752, 753, 754, 755, 756, 757, 758, 760,
+        761, 762, 763, 764, 765, 766, 767, 768,
+        770, 771, 772, 773, 774, 775, 776, 777,
+        778, 779, 780, 781, 782, 783, 784, 785,
+        786, 787, 789, 790, 791, 792, 793, 794,
+        795, 796, 797, 798, 799, 800, 801, 802,
+        803, 804, 805, 806, 807, 808, 809, 811,
+        812, 813, 814, 815, 816, 817, 818, 819,
+        820, 821, 822, 823, 824, 825, 826, 855,
+        880, 883, 884, 886, 893, 894, 897, 901,
+        913, 918, 919, 921, 924, 926, 1511, 1509,
+        1512, 1517, 1519, 1509, 1520, 1521, 1522, 1509,
+        928, 1509, 1509, 1513, 1514, 1516, 1509, 1515,
+        1509, 1509, 1509, 1518, 1509, 1509, 1509, 933,
+        934, 938, 939, 1523, 1531, 1532, 1533, 1523,
+        937, 1523, 1523, 934, 1527, 1528, 1523, 1523,
+        1523, 1523, 1523, 940, 944, 945, 1534, 1542,
+        1543, 1544, 1534, 943, 1534, 1534, 940, 1538,
+        1539, 1534, 1534, 1534, 1534, 1534, 1545, 1547,
+        1548, 1549, 1550, 1551, 1552, 1553, 1554, 1555,
+        1556, 1557, 1558, 1559, 1560, 1561, 1562, 1563,
+        1564, 1565, 1566, 1567, 1568, 1569, 1570, 1571,
+        1572, 1573, 1574, 1575, 1576, 1577, 1578, 1579,
+        1580, 1581, 1545, 946, 947, 951, 952, 953,
+        954, 955, 956, 957, 958, 959, 960, 961,
+        962, 964, 966, 967, 999, 1040, 1055, 1062,
+        1064, 1066, 1086, 1089, 1105, 1218, 1545, 1222,
+        1223, 1224, 1225, 1226, 1227, 1228, 1229, 1230,
+        1231, 1232, 1234, 1235, 1236, 1237, 1238, 1239,
         1240, 1241, 1242, 1243, 1244, 1245, 1246, 1247,
-        1248, 1249, 1250, 1251, 1252, 1253, 1254, 1255,
-        1256, 1257, 1258, 1259, 1261, 1262, 1263, 1264,
-        1265, 1266, 1267, 1268, 1269, 1270, 1271, 1272,
-        1273, 1274, 1275, 1277, 1278, 1279, 1281, 1282,
-        1283, 1284, 1285, 1286, 1287, 1288, 1289, 1290,
-        1291, 1292, 1293, 1294, 1296, 1297, 1298, 1299,
-        1300, 1301, 1302, 1303, 1304, 1306, 1307, 1308,
+        1248, 1249, 1250, 1251, 1252, 1253, 1254, 1256,
+        1257, 1258, 1259, 1260, 1261, 1262, 1263, 1264,
+        1265, 1266, 1267, 1268, 1269, 1270, 1272, 1273,
+        1274, 1276, 1277, 1278, 1279, 1280, 1281, 1282,
+        1283, 1284, 1285, 1286, 1287, 1288, 1289, 1291,
+        1292, 1293, 1294, 1295, 1296, 1297, 1298, 1299,
+        1301, 1302, 1303, 1304, 1305, 1306, 1307, 1308,
         1309, 1310, 1311, 1312, 1313, 1314, 1315, 1316,
-        1317, 1318, 1319, 1320, 1321, 1322, 1323, 1325,
+        1317, 1318, 1320, 1321, 1322, 1323, 1324, 1325,
         1326, 1327, 1328, 1329, 1330, 1331, 1332, 1333,
-        1334, 1335, 1336, 1337, 1338, 1339, 1340, 1341,
-        1342, 1343, 1344, 1345, 1347, 1348, 1349, 1350,
-        1351, 1352, 1353, 1354, 1355, 1356, 1357, 1358,
-        1359, 1360, 1361, 1362, 1391, 1416, 1419, 1420,
-        1422, 1429, 1430, 1433, 1437, 1449, 1454, 1455,
-        1457, 1460, 1462,
+        1334, 1335, 1336, 1337, 1338, 1339, 1340, 1342,
+        1343, 1344, 1345, 1346, 1347, 1348, 1349, 1350,
+        1351, 1352, 1353, 1354, 1355, 1356, 1357, 1386,
+        1411, 1414, 1415, 1417, 1424, 1425, 1428, 1432,
+        1444, 1449, 1450, 1452, 1455, 1457,
 }
 
 var _hcltok_trans_actions []byte = []byte{
-        151, 0, 93, 147, 109, 0, 0, 201,
-        143, 0, 13, 0, 0, 0, 0, 0,
+        145, 107, 0, 0, 91, 141, 0, 7,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 123,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 121, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3517,8 +3444,8 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 145, 198, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 143, 193, 149, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3548,9 +3475,8 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 149,
-        127, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 147, 125, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3561,11 +3487,12 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        35, 13, 13, 13, 0, 0, 37, 0,
-        57, 43, 55, 180, 180, 180, 0, 0,
-        0, 0, 77, 63, 75, 186, 0, 0,
-        0, 0, 87, 192, 91, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 31, 169,
+        0, 0, 0, 35, 33, 0, 55, 41,
+        175, 0, 53, 0, 175, 175, 0, 0,
+        75, 61, 181, 0, 73, 0, 181, 181,
+        0, 0, 85, 187, 89, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3595,8 +3522,8 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 89, 81, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 87, 79, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3607,20 +3534,20 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 95,
-        0, 0, 121, 210, 113, 0, 13, 204,
-        13, 0, 0, 115, 0, 117, 0, 125,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 93,
+        0, 0, 119, 0, 111, 0, 7, 7,
+        7, 0, 0, 113, 0, 115, 0, 123,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 13, 13,
-        13, 207, 207, 207, 207, 207, 207, 13,
-        13, 207, 13, 129, 141, 137, 99, 105,
-        0, 135, 131, 0, 103, 97, 111, 101,
-        133, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 7, 7,
+        7, 196, 196, 196, 196, 196, 196, 7,
+        7, 196, 7, 127, 139, 135, 97, 133,
+        103, 0, 129, 0, 101, 95, 109, 99,
+        131, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 107, 119, 139, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 105, 117, 137, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3637,32 +3564,24 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 21, 19,
-        0, 0, 13, 23, 0, 13, 13, 29,
-        0, 0, 0, 153, 174, 1, 1, 174,
-        1, 1, 1, 156, 177, 3, 3, 177,
-        3, 3, 3, 0, 0, 0, 0, 13,
-        13, 13, 13, 174, 1, 1, 174, 174,
-        174, 174, 174, 1, 1, 174, 174, 174,
-        174, 177, 3, 3, 177, 177, 177, 177,
-        1, 1, 0, 0, 13, 13, 13, 13,
-        177, 3, 3, 177, 177, 177, 177, 3,
-        3, 31, 0, 25, 15, 0, 27, 17,
-        33, 0, 0, 0, 0, 45, 0, 183,
-        183, 51, 0, 0, 0, 162, 213, 159,
-        5, 5, 5, 5, 5, 5, 168, 217,
-        165, 7, 7, 7, 7, 7, 7, 47,
-        39, 49, 41, 53, 0, 0, 0, 65,
-        0, 189, 189, 71, 0, 0, 67, 59,
-        69, 61, 73, 79, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 13,
+        0, 0, 172, 17, 0, 7, 7, 23,
+        0, 25, 27, 0, 0, 0, 151, 0,
+        15, 19, 9, 0, 21, 11, 29, 0,
+        0, 0, 0, 43, 0, 178, 178, 49,
+        0, 157, 154, 1, 175, 175, 45, 37,
+        47, 39, 51, 0, 0, 0, 63, 0,
+        184, 184, 69, 0, 163, 160, 1, 181,
+        181, 65, 57, 67, 59, 71, 77, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 13, 13, 13, 195, 195, 195,
-        195, 195, 195, 13, 13, 195, 13, 83,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 7, 7, 7,
+        190, 190, 190, 190, 190, 190, 7, 7,
+        190, 7, 81, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 85, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 83, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3680,7 +3599,7 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0,
+        0, 0, 0, 0, 0, 0,
 }
 
 var _hcltok_to_state_actions []byte = []byte{
@@ -3866,24 +3785,22 @@ var _hcltok_to_state_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        9, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 3, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 9, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 3, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 171, 0, 0,
-        0, 0, 0, 0, 0, 0, 171, 0,
-        0, 0, 0, 0, 0, 9, 0, 0,
+        0, 0, 0, 166, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 166, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 3, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0,
+        0, 0, 0, 0, 0, 0,
 }
 
 var _hcltok_from_state_actions []byte = []byte{
@@ -4069,147 +3986,144 @@ var _hcltok_from_state_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 5, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        11, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 5, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 11, 0, 0, 0, 0,
+        0, 0, 0, 5, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 5, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 5, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 11, 0, 0,
-        0, 0, 0, 0, 0, 0, 11, 0,
-        0, 0, 0, 0, 0, 11, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0,
+        0, 0, 0, 0, 0, 0,
 }
 
 var _hcltok_eof_trans []int16 = []int16{
-        0, 1, 4, 1, 1, 9, 9, 9,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        422, 422, 1, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 769, 769, 769, 769, 769, 775, 775,
-        777, 779, 779, 777, 777, 779, 0, 0,
-        787, 789, 787, 787, 789, 0, 0, 795,
-        795, 797, 795, 795, 795, 795, 795, 795,
+        0, 1, 1, 1, 6, 6, 6, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 419,
+        419, 421, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        767, 772, 772, 772, 773, 773, 775, 775,
+        775, 779, 0, 0, 785, 785, 785, 789,
+        0, 0, 795, 795, 797, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
@@ -4243,7 +4157,7 @@ var _hcltok_eof_trans []int16 = []int16{
         795, 795, 795, 795, 795, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
-        795, 795, 1046, 1046, 1046, 1046, 1046, 1046,
+        795, 795, 795, 795, 795, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
@@ -4273,45 +4187,49 @@ var _hcltok_eof_trans []int16 = []int16{
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
-        0, 1196, 1197, 1198, 1197, 1198, 1198, 1198,
-        1202, 1203, 1198, 1198, 1198, 1209, 1198, 1198,
+        1046, 1046, 1046, 0, 1196, 1197, 1198, 1200,
+        1198, 1198, 1198, 1203, 1198, 1198, 1198, 1209,
+        1198, 1198, 1239, 1239, 1239, 1239, 1239, 1239,
         1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
         1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
         1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
-        1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
-        1239, 1239, 1239, 0, 1392, 1396, 1404, 1392,
-        1392, 1396, 1396, 1404, 1396, 1392, 1404, 1404,
-        1404, 1404, 1404, 1396, 1396, 1396, 1458, 1460,
-        1458, 1463, 1465, 1465, 1465, 0, 1474, 1478,
-        1487, 1496, 1498, 1500, 1500, 1500, 0, 1508,
-        1511, 1513, 1515, 1515, 1515, 0, 1552, 1580,
-        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
-        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
-        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
-        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
-        1580, 1580,
+        1239, 1239, 1239, 1239, 1239, 0, 1392, 1394,
+        1395, 1399, 1399, 1392, 1402, 1395, 1405, 1395,
+        1407, 1407, 1407, 0, 1416, 1418, 1418, 1416,
+        1416, 1423, 1425, 1427, 1427, 1427, 0, 1435,
+        1437, 1437, 1435, 1435, 1442, 1444, 1446, 1446,
+        1446, 0, 1483, 1511, 1511, 1511, 1511, 1511,
+        1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511,
+        1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511,
+        1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511,
+        1511, 1511, 1511, 1511, 1511, 1511,
 }
 
-const hcltok_start int = 1464
-const hcltok_first_final int = 1464
+const hcltok_start int = 1459
+const hcltok_first_final int = 1459
 const hcltok_error int = 0
 
-const hcltok_en_stringTemplate int = 1515
-const hcltok_en_heredocTemplate int = 1541
-const hcltok_en_bareTemplate int = 1550
-const hcltok_en_identOnly int = 1557
-const hcltok_en_main int = 1464
+const hcltok_en_stringTemplate int = 1509
+const hcltok_en_heredocTemplate int = 1523
+const hcltok_en_bareTemplate int = 1534
+const hcltok_en_identOnly int = 1545
+const hcltok_en_main int = 1459
 
-// line 16 "scan_tokens.rl"
+//line scan_tokens.rl:16
 
 func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []Token {
+        stripData := stripUTF8BOM(data)
+        start.Byte += len(data) - len(stripData)
+        data = stripData
+
         f := &tokenAccum{
-                Filename: filename,
-                Bytes:    data,
-                Pos:      start,
+                Filename:  filename,
+                Bytes:     data,
+                Pos:       start,
+                StartByte: start.Byte,
         }
 
-        // line 294 "scan_tokens.rl"
+//line scan_tokens.rl:305
 
         // Ragel state
         p := 0          // "Pointer" into data
@@ -4339,7 +4257,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
         var retBraces []int              // stack of brace levels that cause us to use fret
         var heredocs []heredocInProgress // stack of heredocs we're currently processing
 
-        // line 329 "scan_tokens.rl"
+//line scan_tokens.rl:340
 
         // Make Go compiler happy
         _ = ts
@@ -4359,7 +4277,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 f.emitToken(TokenType(b[0]), ts, te)
         }
 
-        // line 4372 "scan_tokens.go"
+//line scan_tokens.go:4289
         {
                 top = 0
                 ts = 0
@@ -4367,7 +4285,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 act = 0
         }
 
-        // line 4380 "scan_tokens.go"
+//line scan_tokens.go:4297
         {
                 var _klen int
                 var _trans int
@@ -4387,12 +4305,11 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 for ; _nacts > 0; _nacts-- {
                         _acts++
                         switch _hcltok_actions[_acts-1] {
-                        case 6:
-                                // line 1 "NONE"
-
+                        case 3:
+//line NONE:1
                                 ts = p
 
-                                // line 4404 "scan_tokens.go"
+//line scan_tokens.go:4320
                         }
                 }
 
@@ -4464,33 +4381,21 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                         _acts++
                         switch _hcltok_actions[_acts-1] {
                         case 0:
-                                // line 218 "scan_tokens.rl"
-
-                                p--
-
-                        case 1:
-                                // line 219 "scan_tokens.rl"
-
-                                p--
-
-                        case 2:
-                                // line 224 "scan_tokens.rl"
-
-                                p--
-
-                        case 3:
-                                // line 225 "scan_tokens.rl"
-
+//line scan_tokens.rl:224
                                 p--
 
-                        case 7:
-                                // line 1 "NONE"
-
+                        case 4:
+//line NONE:1
                                 te = p + 1
 
-                        case 8:
-                                // line 155 "scan_tokens.rl"
-
+                        case 5:
+//line scan_tokens.rl:248
+                                act = 4
+                        case 6:
+//line scan_tokens.rl:250
+                                act = 6
+                        case 7:
+//line scan_tokens.rl:160
                                 te = p + 1
                                 {
                                         token(TokenTemplateInterp)
@@ -4503,13 +4408,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 9:
-                                // line 165 "scan_tokens.rl"
-
+                        case 8:
+//line scan_tokens.rl:170
                                 te = p + 1
                                 {
                                         token(TokenTemplateControl)
@@ -4522,13 +4426,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 10:
-                                // line 79 "scan_tokens.rl"
-
+                        case 9:
+//line scan_tokens.rl:84
                                 te = p + 1
                                 {
                                         token(TokenCQuote)
@@ -4540,23 +4443,20 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                         goto _again
 
                                 }
-                        case 11:
-                                // line 239 "scan_tokens.rl"
-
+                        case 10:
+//line scan_tokens.rl:248
                                 te = p + 1
                                 {
-                                        token(TokenInvalid)
+                                        token(TokenQuotedLit)
                                 }
-                        case 12:
-                                // line 240 "scan_tokens.rl"
-
+                        case 11:
+//line scan_tokens.rl:251
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 13:
-                                // line 155 "scan_tokens.rl"
-
+                        case 12:
+//line scan_tokens.rl:160
                                 te = p
                                 p--
                                 {
@@ -4570,13 +4470,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 14:
-                                // line 165 "scan_tokens.rl"
-
+                        case 13:
+//line scan_tokens.rl:170
                                 te = p
                                 p--
                                 {
@@ -4590,59 +4489,73 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 15:
-                                // line 238 "scan_tokens.rl"
-
+                        case 14:
+//line scan_tokens.rl:248
                                 te = p
                                 p--
                                 {
                                         token(TokenQuotedLit)
                                 }
+                        case 15:
+//line scan_tokens.rl:249
+                                te = p
+                                p--
+                                {
+                                        token(TokenQuotedNewline)
+                                }
                         case 16:
-                                // line 239 "scan_tokens.rl"
-
+//line scan_tokens.rl:250
                                 te = p
                                 p--
                                 {
                                         token(TokenInvalid)
                                 }
                         case 17:
-                                // line 240 "scan_tokens.rl"
-
+//line scan_tokens.rl:251
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
                         case 18:
-                                // line 238 "scan_tokens.rl"
-
+//line scan_tokens.rl:248
                                 p = (te) - 1
                                 {
                                         token(TokenQuotedLit)
                                 }
                         case 19:
-                                // line 240 "scan_tokens.rl"
-
+//line scan_tokens.rl:251
                                 p = (te) - 1
                                 {
                                         token(TokenBadUTF8)
                                 }
                         case 20:
-                                // line 143 "scan_tokens.rl"
+//line NONE:1
+                                switch act {
+                                case 4:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenQuotedLit)
+                                        }
+                                case 6:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenInvalid)
+                                        }
+                                }
 
-                                act = 10
                         case 21:
-                                // line 248 "scan_tokens.rl"
-
+//line scan_tokens.rl:148
                                 act = 11
                         case 22:
-                                // line 155 "scan_tokens.rl"
-
+//line scan_tokens.rl:259
+                                act = 12
+                        case 23:
+//line scan_tokens.rl:160
                                 te = p + 1
                                 {
                                         token(TokenTemplateInterp)
@@ -4655,13 +4568,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 23:
-                                // line 165 "scan_tokens.rl"
-
+                        case 24:
+//line scan_tokens.rl:170
                                 te = p + 1
                                 {
                                         token(TokenTemplateControl)
@@ -4674,13 +4586,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 24:
-                                // line 106 "scan_tokens.rl"
-
+                        case 25:
+//line scan_tokens.rl:111
                                 te = p + 1
                                 {
                                         // This action is called specificially when a heredoc literal
@@ -4724,16 +4635,14 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                         topdoc.StartOfLine = true
                                         token(TokenStringLit)
                                 }
-                        case 25:
-                                // line 248 "scan_tokens.rl"
-
+                        case 26:
+//line scan_tokens.rl:259
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 26:
-                                // line 155 "scan_tokens.rl"
-
+                        case 27:
+//line scan_tokens.rl:160
                                 te = p
                                 p--
                                 {
@@ -4747,13 +4656,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 27:
-                                // line 165 "scan_tokens.rl"
-
+                        case 28:
+//line scan_tokens.rl:170
                                 te = p
                                 p--
                                 {
@@ -4767,13 +4675,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 28:
-                                // line 143 "scan_tokens.rl"
-
+                        case 29:
+//line scan_tokens.rl:148
                                 te = p
                                 p--
                                 {
@@ -4783,17 +4690,15 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                         heredocs[len(heredocs)-1].StartOfLine = false
                                         token(TokenStringLit)
                                 }
-                        case 29:
-                                // line 248 "scan_tokens.rl"
-
+                        case 30:
+//line scan_tokens.rl:259
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 30:
-                                // line 143 "scan_tokens.rl"
-
+                        case 31:
+//line scan_tokens.rl:148
                                 p = (te) - 1
                                 {
                                         // This action is called when a heredoc literal _doesn't_ end
@@ -4802,16 +4707,15 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                         heredocs[len(heredocs)-1].StartOfLine = false
                                         token(TokenStringLit)
                                 }
-                        case 31:
-                                // line 1 "NONE"
-
+                        case 32:
+//line NONE:1
                                 switch act {
                                 case 0:
                                         {
                                                 cs = 0
                                                 goto _again
                                         }
-                                case 10:
+                                case 11:
                                         {
                                                 p = (te) - 1
 
@@ -4821,24 +4725,21 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 heredocs[len(heredocs)-1].StartOfLine = false
                                                 token(TokenStringLit)
                                         }
-                                case 11:
+                                case 12:
                                         {
                                                 p = (te) - 1
                                                 token(TokenBadUTF8)
                                         }
                                 }
 
-                        case 32:
-                                // line 151 "scan_tokens.rl"
-
-                                act = 14
                         case 33:
-                                // line 255 "scan_tokens.rl"
-
+//line scan_tokens.rl:156
                                 act = 15
                         case 34:
-                                // line 155 "scan_tokens.rl"
-
+//line scan_tokens.rl:266
+                                act = 16
+                        case 35:
+//line scan_tokens.rl:160
                                 te = p + 1
                                 {
                                         token(TokenTemplateInterp)
@@ -4851,13 +4752,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 35:
-                                // line 165 "scan_tokens.rl"
-
+                        case 36:
+//line scan_tokens.rl:170
                                 te = p + 1
                                 {
                                         token(TokenTemplateControl)
@@ -4870,27 +4770,24 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 36:
-                                // line 151 "scan_tokens.rl"
-
+                        case 37:
+//line scan_tokens.rl:156
                                 te = p + 1
                                 {
                                         token(TokenStringLit)
                                 }
-                        case 37:
-                                // line 255 "scan_tokens.rl"
-
+                        case 38:
+//line scan_tokens.rl:266
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 38:
-                                // line 155 "scan_tokens.rl"
-
+                        case 39:
+//line scan_tokens.rl:160
                                 te = p
                                 p--
                                 {
@@ -4904,13 +4801,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 39:
-                                // line 165 "scan_tokens.rl"
-
+                        case 40:
+//line scan_tokens.rl:170
                                 te = p
                                 p--
                                 {
@@ -4924,231 +4820,191 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 40:
-                                // line 151 "scan_tokens.rl"
-
+                        case 41:
+//line scan_tokens.rl:156
                                 te = p
                                 p--
                                 {
                                         token(TokenStringLit)
                                 }
-                        case 41:
-                                // line 255 "scan_tokens.rl"
-
+                        case 42:
+//line scan_tokens.rl:266
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 42:
-                                // line 151 "scan_tokens.rl"
-
+                        case 43:
+//line scan_tokens.rl:156
                                 p = (te) - 1
                                 {
                                         token(TokenStringLit)
                                 }
-                        case 43:
-                                // line 1 "NONE"
-
+                        case 44:
+//line NONE:1
                                 switch act {
                                 case 0:
                                         {
                                                 cs = 0
                                                 goto _again
                                         }
-                                case 14:
+                                case 15:
                                         {
                                                 p = (te) - 1
 
                                                 token(TokenStringLit)
                                         }
-                                case 15:
+                                case 16:
                                         {
                                                 p = (te) - 1
                                                 token(TokenBadUTF8)
                                         }
                                 }
 
-                        case 44:
-                                // line 259 "scan_tokens.rl"
-
-                                act = 16
                         case 45:
-                                // line 260 "scan_tokens.rl"
-
+//line scan_tokens.rl:270
                                 act = 17
                         case 46:
-                                // line 260 "scan_tokens.rl"
-
+//line scan_tokens.rl:271
+                                act = 18
+                        case 47:
+//line scan_tokens.rl:271
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 47:
-                                // line 261 "scan_tokens.rl"
-
+                        case 48:
+//line scan_tokens.rl:272
                                 te = p + 1
                                 {
                                         token(TokenInvalid)
                                 }
-                        case 48:
-                                // line 259 "scan_tokens.rl"
-
+                        case 49:
+//line scan_tokens.rl:270
                                 te = p
                                 p--
                                 {
                                         token(TokenIdent)
                                 }
-                        case 49:
-                                // line 260 "scan_tokens.rl"
-
+                        case 50:
+//line scan_tokens.rl:271
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 50:
-                                // line 259 "scan_tokens.rl"
-
+                        case 51:
+//line scan_tokens.rl:270
                                 p = (te) - 1
                                 {
                                         token(TokenIdent)
                                 }
-                        case 51:
-                                // line 260 "scan_tokens.rl"
-
+                        case 52:
+//line scan_tokens.rl:271
                                 p = (te) - 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 52:
-                                // line 1 "NONE"
-
+                        case 53:
+//line NONE:1
                                 switch act {
-                                case 16:
+                                case 17:
                                         {
                                                 p = (te) - 1
                                                 token(TokenIdent)
                                         }
-                                case 17:
+                                case 18:
                                         {
                                                 p = (te) - 1
                                                 token(TokenBadUTF8)
                                         }
                                 }
 
-                        case 53:
-                                // line 267 "scan_tokens.rl"
-
-                                act = 21
                         case 54:
-                                // line 269 "scan_tokens.rl"
-
+//line scan_tokens.rl:278
                                 act = 22
                         case 55:
-                                // line 280 "scan_tokens.rl"
-
-                                act = 32
-                        case 56:
-                                // line 290 "scan_tokens.rl"
-
-                                act = 38
-                        case 57:
-                                // line 291 "scan_tokens.rl"
-
+//line scan_tokens.rl:301
                                 act = 39
-                        case 58:
-                                // line 269 "scan_tokens.rl"
-
+                        case 56:
+//line scan_tokens.rl:280
                                 te = p + 1
                                 {
                                         token(TokenComment)
                                 }
-                        case 59:
-                                // line 270 "scan_tokens.rl"
-
+                        case 57:
+//line scan_tokens.rl:281
                                 te = p + 1
                                 {
                                         token(TokenNewline)
                                 }
-                        case 60:
-                                // line 272 "scan_tokens.rl"
-
+                        case 58:
+//line scan_tokens.rl:283
                                 te = p + 1
                                 {
                                         token(TokenEqualOp)
                                 }
-                        case 61:
-                                // line 273 "scan_tokens.rl"
-
+                        case 59:
+//line scan_tokens.rl:284
                                 te = p + 1
                                 {
                                         token(TokenNotEqual)
                                 }
-                        case 62:
-                                // line 274 "scan_tokens.rl"
-
+                        case 60:
+//line scan_tokens.rl:285
                                 te = p + 1
                                 {
                                         token(TokenGreaterThanEq)
                                 }
-                        case 63:
-                                // line 275 "scan_tokens.rl"
-
+                        case 61:
+//line scan_tokens.rl:286
                                 te = p + 1
                                 {
                                         token(TokenLessThanEq)
                                 }
-                        case 64:
-                                // line 276 "scan_tokens.rl"
-
+                        case 62:
+//line scan_tokens.rl:287
                                 te = p + 1
                                 {
                                         token(TokenAnd)
                                 }
-                        case 65:
-                                // line 277 "scan_tokens.rl"
-
+                        case 63:
+//line scan_tokens.rl:288
                                 te = p + 1
                                 {
                                         token(TokenOr)
                                 }
-                        case 66:
-                                // line 278 "scan_tokens.rl"
-
+                        case 64:
+//line scan_tokens.rl:289
                                 te = p + 1
                                 {
                                         token(TokenEllipsis)
                                 }
-                        case 67:
-                                // line 279 "scan_tokens.rl"
-
+                        case 65:
+//line scan_tokens.rl:290
                                 te = p + 1
                                 {
                                         token(TokenFatArrow)
                                 }
-                        case 68:
-                                // line 280 "scan_tokens.rl"
-
+                        case 66:
+//line scan_tokens.rl:291
                                 te = p + 1
                                 {
                                         selfToken()
                                 }
-                        case 69:
-                                // line 175 "scan_tokens.rl"
-
+                        case 67:
+//line scan_tokens.rl:180
                                 te = p + 1
                                 {
                                         token(TokenOBrace)
                                         braces++
                                 }
-                        case 70:
-                                // line 180 "scan_tokens.rl"
-
+                        case 68:
+//line scan_tokens.rl:185
                                 te = p + 1
                                 {
                                         if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces {
@@ -5167,9 +5023,8 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 braces--
                                         }
                                 }
-                        case 71:
-                                // line 192 "scan_tokens.rl"
-
+                        case 69:
+//line scan_tokens.rl:197
                                 te = p + 1
                                 {
                                         // Only consume from the retBraces stack and return if we are at
@@ -5197,9 +5052,8 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 braces--
                                         }
                                 }
-                        case 72:
-                                // line 74 "scan_tokens.rl"
-
+                        case 70:
+//line scan_tokens.rl:79
                                 te = p + 1
                                 {
                                         token(TokenOQuote)
@@ -5207,13 +5061,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1515
+                                                cs = 1509
                                                 goto _again
                                         }
                                 }
-                        case 73:
-                                // line 84 "scan_tokens.rl"
-
+                        case 71:
+//line scan_tokens.rl:89
                                 te = p + 1
                                 {
                                         token(TokenOHeredoc)
@@ -5238,138 +5091,109 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1541
+                                                cs = 1523
                                                 goto _again
                                         }
                                 }
-                        case 74:
-                                // line 290 "scan_tokens.rl"
-
+                        case 72:
+//line scan_tokens.rl:301
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 75:
-                                // line 291 "scan_tokens.rl"
-
+                        case 73:
+//line scan_tokens.rl:302
                                 te = p + 1
                                 {
                                         token(TokenInvalid)
                                 }
-                        case 76:
-                                // line 265 "scan_tokens.rl"
-
+                        case 74:
+//line scan_tokens.rl:276
                                 te = p
                                 p--
 
-                        case 77:
-                                // line 266 "scan_tokens.rl"
-
+                        case 75:
+//line scan_tokens.rl:277
                                 te = p
                                 p--
                                 {
                                         token(TokenNumberLit)
                                 }
-                        case 78:
-                                // line 267 "scan_tokens.rl"
-
+                        case 76:
+//line scan_tokens.rl:278
                                 te = p
                                 p--
                                 {
                                         token(TokenIdent)
                                 }
-                        case 79:
-                                // line 269 "scan_tokens.rl"
-
+                        case 77:
+//line scan_tokens.rl:280
                                 te = p
                                 p--
                                 {
                                         token(TokenComment)
                                 }
-                        case 80:
-                                // line 280 "scan_tokens.rl"
-
+                        case 78:
+//line scan_tokens.rl:291
                                 te = p
                                 p--
                                 {
                                         selfToken()
                                 }
-                        case 81:
-                                // line 290 "scan_tokens.rl"
-
+                        case 79:
+//line scan_tokens.rl:301
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 82:
-                                // line 291 "scan_tokens.rl"
-
+                        case 80:
+//line scan_tokens.rl:302
                                 te = p
                                 p--
                                 {
                                         token(TokenInvalid)
                                 }
-                        case 83:
-                                // line 266 "scan_tokens.rl"
-
+                        case 81:
+//line scan_tokens.rl:277
                                 p = (te) - 1
                                 {
                                         token(TokenNumberLit)
                                 }
-                        case 84:
-                                // line 267 "scan_tokens.rl"
-
+                        case 82:
+//line scan_tokens.rl:278
                                 p = (te) - 1
                                 {
                                         token(TokenIdent)
                                 }
-                        case 85:
-                                // line 280 "scan_tokens.rl"
-
+                        case 83:
+//line scan_tokens.rl:291
                                 p = (te) - 1
                                 {
                                         selfToken()
                                 }
-                        case 86:
-                                // line 290 "scan_tokens.rl"
-
+                        case 84:
+//line scan_tokens.rl:301
                                 p = (te) - 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 87:
-                                // line 1 "NONE"
-
+                        case 85:
+//line NONE:1
                                 switch act {
-                                case 21:
-                                        {
-                                                p = (te) - 1
-                                                token(TokenIdent)
-                                        }
                                 case 22:
                                         {
                                                 p = (te) - 1
-                                                token(TokenComment)
-                                        }
-                                case 32:
-                                        {
-                                                p = (te) - 1
-                                                selfToken()
-                                        }
-                                case 38:
-                                        {
-                                                p = (te) - 1
-                                                token(TokenBadUTF8)
+                                                token(TokenIdent)
                                         }
                                 case 39:
                                         {
                                                 p = (te) - 1
-                                                token(TokenInvalid)
+                                                token(TokenBadUTF8)
                                         }
                                 }
 
-                                // line 5232 "scan_tokens.go"
+//line scan_tokens.go:5055
                         }
                 }
 
@@ -5380,17 +5204,15 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 for ; _nacts > 0; _nacts-- {
                         _acts++
                         switch _hcltok_actions[_acts-1] {
-                        case 4:
-                                // line 1 "NONE"
-
+                        case 1:
+//line NONE:1
                                 ts = 0
 
-                        case 5:
-                                // line 1 "NONE"
-
+                        case 2:
+//line NONE:1
                                 act = 0
 
-                                // line 5252 "scan_tokens.go"
+//line scan_tokens.go:5073
                         }
                 }
 
@@ -5416,7 +5238,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 }
         }
 
-        // line 352 "scan_tokens.rl"
+//line scan_tokens.rl:363
 
         // If we fall out here without being in a final state then we've
         // encountered something that the scanner can't match, which we'll
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl
index 83ef65b..4443dc4 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl
@@ -9,17 +9,22 @@ import (
 
 // This file is generated from scan_tokens.rl. DO NOT EDIT.
 %%{
-  # (except you are actually in scan_tokens.rl here, so edit away!)
+  # (except when you are actually in scan_tokens.rl here, so edit away!)
 
   machine hcltok;
   write data;
 }%%
 
 func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []Token {
+    stripData := stripUTF8BOM(data)
+    start.Byte += len(data) - len(stripData)
+    data = stripData
+
     f := &tokenAccum{
-        Filename: filename,
-        Bytes:    data,
-        Pos:      start,
+        Filename:  filename,
+        Bytes:     data,
+        Pos:       start,
+        StartByte: start.Byte,
     }
 
     %%{
@@ -39,7 +44,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
         Ident = (ID_Start | '_') (ID_Continue | '-')*;
 
         # Symbols that just represent themselves are handled as a single rule.
-        SelfToken = "[" | "]" | "(" | ")" | "." | "," | "*" | "/" | "%" | "+" | "-" | "=" | "<" | ">" | "!" | "?" | ":" | "\n" | "&" | "|" | "~" | "^" | ";" | "`";
+        SelfToken = "[" | "]" | "(" | ")" | "." | "," | "*" | "/" | "%" | "+" | "-" | "=" | "<" | ">" | "!" | "?" | ":" | "\n" | "&" | "|" | "~" | "^" | ";" | "`" | "'";
 
         EqualOp = "==";
         NotEqual = "!=";
@@ -58,9 +63,17 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
         BeginHeredocTmpl = '<<' ('-')? Ident Newline;
 
         Comment = (
-            ("#" (any - EndOfLine)* EndOfLine) |
-            ("//" (any - EndOfLine)* EndOfLine) |
-            ("/*" any* "*/")
+            # The :>> operator in these is a "finish-guarded concatenation",
+            # which terminates the sequence on its left when it completes
+            # the sequence on its right.
+            # In the single-line comment cases this is allowing us to make
+            # the trailing EndOfLine optional while still having the overall
+            # pattern terminate. In the multi-line case it ensures that
+            # the first comment in the file ends at the first */, rather than
+            # gobbling up all of the "any*" until the _final_ */ in the file.
+            ("#" (any - EndOfLine)* :>> EndOfLine?) |
+            ("//" (any - EndOfLine)* :>> EndOfLine?) |
+            ("/*" any* :>> "*/")
         );
 
         # Note: hclwrite assumes that only ASCII spaces appear between tokens,
@@ -213,29 +226,35 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
         TemplateInterp = "${" ("~")?;
         TemplateControl = "%{" ("~")?;
         EndStringTmpl = '"';
-        StringLiteralChars = (AnyUTF8 - ("\r"|"\n"));
+        NewlineChars = ("\r"|"\n");
+        NewlineCharsSeq = NewlineChars+;
+        StringLiteralChars = (AnyUTF8 - NewlineChars);
+        TemplateIgnoredNonBrace = (^'{' %{ fhold; });
+        TemplateNotInterp = '$' (TemplateIgnoredNonBrace | TemplateInterp);
+        TemplateNotControl = '%' (TemplateIgnoredNonBrace | TemplateControl);
+        QuotedStringLiteralWithEsc = ('\\' StringLiteralChars) | (StringLiteralChars - ("$" | '%' | '"' | "\\"));
         TemplateStringLiteral = (
-            ('$' ^'{' %{ fhold; }) |
-            ('%' ^'{' %{ fhold; }) |
-            ('\\' StringLiteralChars) |
-            (StringLiteralChars - ("$" | '%' | '"'))
-        )+;
+            (TemplateNotInterp) |
+            (TemplateNotControl) |
+            (QuotedStringLiteralWithEsc)+
+        );
         HeredocStringLiteral = (
-            ('$' ^'{' %{ fhold; }) |
-            ('%' ^'{' %{ fhold; }) |
-            (StringLiteralChars - ("$" | '%'))
-        )*;
+            (TemplateNotInterp) |
+            (TemplateNotControl) |
+            (StringLiteralChars - ("$" | '%'))*
+        );
         BareStringLiteral = (
-            ('$' ^'{') |
-            ('%' ^'{') |
-            (StringLiteralChars - ("$" | '%'))
-        )* Newline?;
+            (TemplateNotInterp) |
+            (TemplateNotControl) |
+            (StringLiteralChars - ("$" | '%'))*
+        ) Newline?;
 
         stringTemplate := |*
             TemplateInterp        => beginTemplateInterp;
             TemplateControl       => beginTemplateControl;
             EndStringTmpl         => endStringTemplate;
             TemplateStringLiteral => { token(TokenQuotedLit); };
+            NewlineCharsSeq       => { token(TokenQuotedNewline); };
             AnyUTF8               => { token(TokenInvalid); };
             BrokenUTF8            => { token(TokenBadUTF8); };
         *|;
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md
index 49b9a3e..091c1c2 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md
@@ -4,18 +4,18 @@ This is the specification of the syntax and semantics of the native syntax
 for HCL. HCL is a system for defining configuration languages for applications.
 The HCL information model is designed to support multiple concrete syntaxes
 for configuration, but this native syntax is considered the primary format
-and is optimized for human authoring and maintenence, as opposed to machine
+and is optimized for human authoring and maintenance, as opposed to machine
 generation of configuration.
 
 The language consists of three integrated sub-languages:
 
-* The _structural_ language defines the overall heirarchical configuration
+- The _structural_ language defines the overall hierarchical configuration
   structure, and is a serialization of HCL bodies, blocks and attributes.
 
-* The _expression_ language is used to express attribute values, either as
+- The _expression_ language is used to express attribute values, either as
   literals or as derivations of other values.
 
-* The _template_ language is used to compose values together into strings,
+- The _template_ language is used to compose values together into strings,
   as one of several types of expression in the expression language.
 
 In normal use these three sub-languages are used together within configuration
@@ -30,19 +30,19 @@ Within this specification a semi-formal notation is used to illustrate the
 details of syntax. This notation is intended for human consumption rather
 than machine consumption, with the following conventions:
 
-* A naked name starting with an uppercase letter is a global production,
+- A naked name starting with an uppercase letter is a global production,
   common to all of the syntax specifications in this document.
-* A naked name starting with a lowercase letter is a local production,
+- A naked name starting with a lowercase letter is a local production,
   meaningful only within the specification where it is defined.
-* Double and single quotes (`"` and `'`) are used to mark literal character
+- Double and single quotes (`"` and `'`) are used to mark literal character
   sequences, which may be either punctuation markers or keywords.
-* The default operator for combining items, which has no punctuation,
+- The default operator for combining items, which has no punctuation,
   is concatenation.
-* The symbol `|` indicates that any one of its left and right operands may
+- The symbol `|` indicates that any one of its left and right operands may
   be present.
-* The `*` symbol indicates zero or more repetitions of the item to its left.
-* The `?` symbol indicates zero or one of the item to its left.
-* Parentheses (`(` and `)`) are used to group items together to apply
+- The `*` symbol indicates zero or more repetitions of the item to its left.
+- The `?` symbol indicates zero or one of the item to its left.
+- Parentheses (`(` and `)`) are used to group items together to apply
   the `|`, `*` and `?` operators to them collectively.
 
 The grammar notation does not fully describe the language. The prose may
@@ -77,11 +77,11 @@ are not valid within HCL native syntax.
 
 Comments serve as program documentation and come in two forms:
 
-* _Line comments_ start with either the `//` or `#` sequences and end with
+- _Line comments_ start with either the `//` or `#` sequences and end with
   the next newline sequence. A line comments is considered equivalent to a
   newline sequence.
 
-* _Inline comments_ start with the `/*` sequence and end with the `*/`
+- _Inline comments_ start with the `/*` sequence and end with the `*/`
   sequence, and may have any characters within except the ending sequence.
   An inline comments is considered equivalent to a whitespace sequence.
 
@@ -91,7 +91,7 @@ template literals except inside an interpolation sequence or template directive.
 ### Identifiers
 
 Identifiers name entities such as blocks, attributes and expression variables.
-Identifiers are interpreted as per [UAX #31][UAX31] Section 2. Specifically,
+Identifiers are interpreted as per [UAX #31][uax31] Section 2. Specifically,
 their syntax is defined in terms of the `ID_Start` and `ID_Continue`
 character properties as follows:
 
@@ -109,7 +109,7 @@ that is not part of the unicode `ID_Continue` definition. This is to allow
 attribute names and block type names to contain dashes, although underscores
 as word separators are considered the idiomatic usage.
 
-[UAX31]: http://unicode.org/reports/tr31/ "Unicode Identifier and Pattern Syntax"
+[uax31]: http://unicode.org/reports/tr31/ "Unicode Identifier and Pattern Syntax"
 
 ### Keywords
 
@@ -150,18 +150,19 @@ expmark    = ('e' | 'E') ("+" | "-")?;
 The structural language consists of syntax representing the following
 constructs:
 
-* _Attributes_, which assign a value to a specified name.
-* _Blocks_, which create a child body annotated by a type and optional labels.
-* _Body Content_, which consists of a collection of attributes and blocks.
+- _Attributes_, which assign a value to a specified name.
+- _Blocks_, which create a child body annotated by a type and optional labels.
+- _Body Content_, which consists of a collection of attributes and blocks.
 
 These constructs correspond to the similarly-named concepts in the
 language-agnostic HCL information model.
 
 ```ebnf
-ConfigFile = Body;
-Body       = (Attribute | Block)*;
-Attribute  = Identifier "=" Expression Newline;
-Block      = Identifier (StringLit|Identifier)* "{" Newline Body "}" Newline;
+ConfigFile   = Body;
+Body         = (Attribute | Block | OneLineBlock)*;
+Attribute    = Identifier "=" Expression Newline;
+Block        = Identifier (StringLit|Identifier)* "{" Newline Body "}" Newline;
+OneLineBlock = Identifier (StringLit|Identifier)* "{" (Identifier "=" Expression)? "}" Newline;
 ```
 
 ### Configuration Files
@@ -186,7 +187,7 @@ for later evaluation by the calling application.
 ### Blocks
 
 A _block_ creates a child body that is annotated with a block _type_ and
-zero or more block _labels_. Blocks create a structural heirachy which can be
+zero or more block _labels_. Blocks create a structural hierachy which can be
 interpreted by the calling application.
 
 Block labels can either be quoted literal strings or naked identifiers.
@@ -252,9 +253,9 @@ LiteralValue = (
 );
 ```
 
-* Numeric literals represent values of type _number_.
-* The `true` and `false` keywords represent values of type _bool_.
-* The `null` keyword represents a null value of the dynamic pseudo-type.
+- Numeric literals represent values of type _number_.
+- The `true` and `false` keywords represent values of type _bool_.
+- The `null` keyword represents a null value of the dynamic pseudo-type.
 
 String literals are not directly available in the expression sub-language, but
 are available via the template sub-language, which can in turn be incorporated
@@ -285,8 +286,8 @@ When specifying an object element, an identifier is interpreted as a literal
 attribute name as opposed to a variable reference. To populate an item key
 from a variable, use parentheses to disambiguate:
 
-* `{foo = "baz"}` is interpreted as an attribute literally named `foo`.
-* `{(foo) = "baz"}` is interpreted as an attribute whose name is taken
+- `{foo = "baz"}` is interpreted as an attribute literally named `foo`.
+- `{(foo) = "baz"}` is interpreted as an attribute whose name is taken
   from the variable named `foo`.
 
 Between the open and closing delimiters of these sequences, newline sequences
@@ -296,14 +297,14 @@ There is a syntax ambiguity between _for expressions_ and collection values
 whose first element is a reference to a variable named `for`. The
 _for expression_ interpretation has priority, so to produce a tuple whose
 first element is the value of a variable named `for`, or an object with a
-key named `for`, use paretheses to disambiguate:
+key named `for`, use parentheses to disambiguate:
 
-* `[for, foo, baz]` is a syntax error.
-* `[(for), foo, baz]` is a tuple whose first element is the value of variable
+- `[for, foo, baz]` is a syntax error.
+- `[(for), foo, baz]` is a tuple whose first element is the value of variable
   `for`.
-* `{for: 1, baz: 2}` is a syntax error.
-* `{(for): 1, baz: 2}` is an object with an attribute literally named `for`.
-* `{baz: 2, for: 1}` is equivalent to the previous example, and resolves the
+- `{for: 1, baz: 2}` is a syntax error.
+- `{(for): 1, baz: 2}` is an object with an attribute literally named `for`.
+- `{baz: 2, for: 1}` is equivalent to the previous example, and resolves the
   ambiguity by reordering.
 
 ### Template Expressions
@@ -311,9 +312,9 @@ key named `for`, use paretheses to disambiguate:
 A _template expression_ embeds a program written in the template sub-language
 as an expression. Template expressions come in two forms:
 
-* A _quoted_ template expression is delimited by quote characters (`"`) and
+- A _quoted_ template expression is delimited by quote characters (`"`) and
   defines a template as a single-line expression with escape characters.
-* A _heredoc_ template expression is introduced by a `<<` sequence and
+- A _heredoc_ template expression is introduced by a `<<` sequence and
   defines a template via a multi-line sequence terminated by a user-chosen
   delimiter.
 
@@ -321,7 +322,7 @@ In both cases the template interpolation and directive syntax is available for
 use within the delimiters, and any text outside of these special sequences is
 interpreted as a literal string.
 
-In _quoted_ template expressions any literal string sequences within the 
+In _quoted_ template expressions any literal string sequences within the
 template behave in a special way: literal newline sequences are not permitted
 and instead _escape sequences_ can be included, starting with the
 backslash `\`:
@@ -457,14 +458,14 @@ are provided, the first is the key and the second is the value.
 Tuple, object, list, map, and set types are iterable. The type of collection
 used defines how the key and value variables are populated:
 
-* For tuple and list types, the _key_ is the zero-based index into the
+- For tuple and list types, the _key_ is the zero-based index into the
   sequence for each element, and the _value_ is the element value. The
   elements are visited in index order.
-* For object and map types, the _key_ is the string attribute name or element
+- For object and map types, the _key_ is the string attribute name or element
   key, and the _value_ is the attribute or element value. The elements are
   visited in the order defined by a lexicographic sort of the attribute names
   or keys.
-* For set types, the _key_ and _value_ are both the element value. The elements
+- For set types, the _key_ and _value_ are both the element value. The elements
   are visited in an undefined but consistent order.
 
 The expression after the colon and (in the case of object `for`) the expression
@@ -482,16 +483,16 @@ object.
 In the case of object `for`, it is an error if two input elements produce
 the same result from the attribute name expression, since duplicate
 attributes are not possible. If the ellipsis symbol (`...`) appears
-immediately after the value experssion, this activates the grouping mode in
+immediately after the value expression, this activates the grouping mode in
 which each value in the resulting object is a _tuple_ of all of the values
 that were produced against each distinct key.
 
-* `[for v in ["a", "b"]: v]` returns `["a", "b"]`.
-* `[for i, v in ["a", "b"]: i]` returns `[0, 1]`.
-* `{for i, v in ["a", "b"]: v => i}` returns `{a = 0, b = 1}`.
-* `{for i, v in ["a", "a", "b"]: k => v}` produces an error, because attribute
+- `[for v in ["a", "b"]: v]` returns `["a", "b"]`.
+- `[for i, v in ["a", "b"]: i]` returns `[0, 1]`.
+- `{for i, v in ["a", "b"]: v => i}` returns `{a = 0, b = 1}`.
+- `{for i, v in ["a", "a", "b"]: k => v}` produces an error, because attribute
   `a` is defined twice.
-* `{for i, v in ["a", "a", "b"]: v => i...}` returns `{a = [0, 1], b = [2]}`.
+- `{for i, v in ["a", "a", "b"]: v => i...}` returns `{a = [0, 1], b = [2]}`.
 
 If the `if` keyword is used after the element expression(s), it applies an
 additional predicate that can be used to conditionally filter elements from
@@ -501,7 +502,7 @@ element expression(s). It must evaluate to a boolean value; if `true`, the
 element will be evaluated as normal, while if `false` the element will be
 skipped.
 
-* `[for i, v in ["a", "b", "c"]: v if i < 2]` returns `["a", "b"]`.
+- `[for i, v in ["a", "b", "c"]: v if i < 2]` returns `["a", "b"]`.
 
 If the collection value, element expression(s) or condition expression return
 unknown values that are otherwise type-valid, the result is a value of the
@@ -566,10 +567,10 @@ elements in a tuple, list, or set value.
 
 There are two kinds of "splat" operator:
 
-* The _attribute-only_ splat operator supports only attribute lookups into
+- The _attribute-only_ splat operator supports only attribute lookups into
   the elements from a list, but supports an arbitrary number of them.
 
-* The _full_ splat operator additionally supports indexing into the elements
+- The _full_ splat operator additionally supports indexing into the elements
   from a list, and allows any combination of attribute access and index
   operations.
 
@@ -582,9 +583,9 @@ fullSplat = "[" "*" "]" (GetAttr | Index)*;
 The splat operators can be thought of as shorthands for common operations that
 could otherwise be performed using _for expressions_:
 
-* `tuple.*.foo.bar[0]` is approximately equivalent to
+- `tuple.*.foo.bar[0]` is approximately equivalent to
   `[for v in tuple: v.foo.bar][0]`.
-* `tuple[*].foo.bar[0]` is approximately equivalent to
+- `tuple[*].foo.bar[0]` is approximately equivalent to
   `[for v in tuple: v.foo.bar[0]]`
 
 Note the difference in how the trailing index operator is interpreted in
@@ -596,13 +597,15 @@ _for expressions_ shown above: if a splat operator is applied to a value that
 is _not_ of tuple, list, or set type, the value is coerced automatically into
 a single-value list of the value type:
 
-* `any_object.*.id` is equivalent to `[any_object.id]`, assuming that `any_object`
+- `any_object.*.id` is equivalent to `[any_object.id]`, assuming that `any_object`
   is a single object.
-* `any_number.*` is equivalent to `[any_number]`, assuming that `any_number`
+- `any_number.*` is equivalent to `[any_number]`, assuming that `any_number`
   is a single number.
 
-If the left operand of a splat operator is an unknown value of any type, the
-result is a value of the dynamic pseudo-type.
+If applied to a null value that is not tuple, list, or set, the result is always
+an empty tuple, which allows conveniently converting a possibly-null scalar
+value into a tuple of zero or one elements. It is illegal to apply a splat
+operator to a null value of tuple, list, or set type.
 
 ### Operations
 
@@ -683,7 +686,7 @@ Arithmetic operations are considered to be performed in an arbitrary-precision
 number space.
 
 If either operand of an arithmetic operator is an unknown number or a value
-of the dynamic pseudo-type, the result is an unknown number. 
+of the dynamic pseudo-type, the result is an unknown number.
 
 ### Logic Operators
 
@@ -708,7 +711,7 @@ the outcome of a boolean expression.
 Conditional = Expression "?" Expression ":" Expression;
 ```
 
-The first expression is the _predicate_, which is  evaluated and must produce
+The first expression is the _predicate_, which is evaluated and must produce
 a boolean result. If the predicate value is `true`, the result of the second
 expression is the result of the conditional. If the predicate value is
 `false`, the result of the third expression is the result of the conditional.
@@ -769,15 +772,15 @@ sequence is escaped as `%%{`.
 
 When the template sub-language is embedded in the expression language via
 _template expressions_, additional constraints and transforms are applied to
-template literalsas described in the definition of template expressions.
+template literals as described in the definition of template expressions.
 
 The value of a template literal can be modified by _strip markers_ in any
 interpolations or directives that are adjacent to it. A strip marker is
 a tilde (`~`) placed immediately after the opening `{` or before the closing
 `}` of a template sequence:
 
-* `hello ${~ "world" }` produces `"helloworld"`.
-* `%{ if true ~} hello %{~ endif }` produces `"hello"`.
+- `hello ${~ "world" }` produces `"helloworld"`.
+- `%{ if true ~} hello %{~ endif }` produces `"hello"`.
 
 When a strip marker is present, any spaces adjacent to it in the corresponding
 string literal (if any) are removed before producing the final value. Space
@@ -786,7 +789,7 @@ characters are interpreted as per Unicode's definition.
 Stripping is done at syntax level rather than value level. Values returned
 by interpolations or directives are not subject to stripping:
 
-* `${"hello" ~}${" world"}` produces `"hello world"`, and not `"helloworld"`,
+- `${"hello" ~}${" world"}` produces `"hello world"`, and not `"helloworld"`,
   because the space is not in a template literal directly adjacent to the
   strip marker.
 
@@ -824,9 +827,9 @@ TemplateIf = (
 The evaluation of the `if` directive is equivalent to the conditional
 expression, with the following exceptions:
 
-* The two sub-templates always produce strings, and thus the result value is
+- The two sub-templates always produce strings, and thus the result value is
   also always a string.
-* The `else` clause may be omitted, in which case the conditional's third
+- The `else` clause may be omitted, in which case the conditional's third
   expression result is implied to be the empty string.
 
 ### Template For Directive
@@ -846,9 +849,9 @@ TemplateFor = (
 The evaluation of the `for` directive is equivalent to the _for expression_
 when producing a tuple, with the following exceptions:
 
-* The sub-template always produces a string.
-* There is no equivalent of the "if" clause on the for expression.
-* The elements of the resulting tuple are all converted to strings and
+- The sub-template always produces a string.
+- There is no equivalent of the "if" clause on the for expression.
+- The elements of the resulting tuple are all converted to strings and
   concatenated to produce a flat string result.
 
 ### Template Interpolation Unwrapping
@@ -864,13 +867,13 @@ template or expression syntax. Unwrapping allows arbitrary expressions to be
 used to populate attributes when strings in such languages are interpreted
 as templates.
 
-* `${true}` produces the boolean value `true`
-* `${"${true}"}` produces the boolean value `true`, because both the inner
+- `${true}` produces the boolean value `true`
+- `${"${true}"}` produces the boolean value `true`, because both the inner
   and outer interpolations are subject to unwrapping.
-* `hello ${true}` produces the string `"hello true"`
-* `${""}${true}` produces the string `"true"` because there are two
+- `hello ${true}` produces the string `"hello true"`
+- `${""}${true}` produces the string `"true"` because there are two
   interpolation sequences, even though one produces an empty result.
-* `%{ for v in [true] }${v}%{ endif }` produces the string `true` because
+- `%{ for v in [true] }${v}%{ endif }` produces the string `true` because
   the presence of the `for` directive circumvents the unwrapping even though
   the final result is a single value.
 
@@ -903,7 +906,7 @@ key/value pairs given are returned as the static pairs, with no further
 interpretation.
 
 The usual requirement that an attribute name be interpretable as a string
-does not apply to this static analyis, allowing callers to provide map-like
+does not apply to this static analysis, allowing callers to provide map-like
 constructs with different key types by building on the map syntax.
 
 ### Static Call
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go
index d69f65b..476025d 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go
@@ -9,6 +9,10 @@ import (
 
 // AsHCLBlock returns the block data expressed as a *hcl.Block.
 func (b *Block) AsHCLBlock() *hcl.Block {
+        if b == nil {
+                return nil
+        }
+
         lastHeaderRange := b.TypeRange
         if len(b.LabelRanges) > 0 {
                 lastHeaderRange = b.LabelRanges[len(b.LabelRanges)-1]
@@ -43,8 +47,8 @@ type Body struct {
 var assertBodyImplBody hcl.Body = &Body{}
 
 func (b *Body) walkChildNodes(w internalWalkFunc) {
-        b.Attributes = w(b.Attributes).(Attributes)
-        b.Blocks = w(b.Blocks).(Blocks)
+        w(b.Attributes)
+        w(b.Blocks)
 }
 
 func (b *Body) Range() hcl.Range {
@@ -82,8 +86,8 @@ func (b *Body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostic
 
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
-                                Summary:  "Unsupported attribute",
-                                Detail:   fmt.Sprintf("An attribute named %q is not expected here.%s", name, suggestion),
+                                Summary:  "Unsupported argument",
+                                Detail:   fmt.Sprintf("An argument named %q is not expected here.%s", name, suggestion),
                                 Subject:  &attr.NameRange,
                         })
                 }
@@ -103,7 +107,7 @@ func (b *Body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostic
                                 // Is there an attribute of the same name?
                                 for _, attrS := range schema.Attributes {
                                         if attrS.Name == blockTy {
-                                                suggestion = fmt.Sprintf(" Did you mean to define attribute %q?", blockTy)
+                                                suggestion = fmt.Sprintf(" Did you mean to define argument %q? If so, use the equals sign to assign it a value.", blockTy)
                                                 break
                                         }
                                 }
@@ -147,8 +151,8 @@ func (b *Body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Bod
                         if attrS.Required {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
-                                        Summary:  "Missing required attribute",
-                                        Detail:   fmt.Sprintf("The attribute %q is required, but no definition was found.", attrS.Name),
+                                        Summary:  "Missing required argument",
+                                        Detail:   fmt.Sprintf("The argument %q is required, but no definition was found.", attrS.Name),
                                         Subject:  b.MissingItemRange().Ptr(),
                                 })
                         }
@@ -251,9 +255,9 @@ func (b *Body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
                 example := b.Blocks[0]
                 diags = append(diags, &hcl.Diagnostic{
                         Severity: hcl.DiagError,
-                        Summary:  fmt.Sprintf("Unexpected %s block", example.Type),
+                        Summary:  fmt.Sprintf("Unexpected %q block", example.Type),
                         Detail:   "Blocks are not allowed here.",
-                        Context:  &example.TypeRange,
+                        Subject:  &example.TypeRange,
                 })
                 // we will continue processing anyway, and return the attributes
                 // we are able to find so that certain analyses can still be done
@@ -275,15 +279,19 @@ func (b *Body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
 }
 
 func (b *Body) MissingItemRange() hcl.Range {
-        return b.EndRange
+        return hcl.Range{
+                Filename: b.SrcRange.Filename,
+                Start:    b.SrcRange.Start,
+                End:      b.SrcRange.Start,
+        }
 }
 
 // Attributes is the collection of attribute definitions within a body.
 type Attributes map[string]*Attribute
 
 func (a Attributes) walkChildNodes(w internalWalkFunc) {
-        for k, attr := range a {
-                a[k] = w(attr).(*Attribute)
+        for _, attr := range a {
+                w(attr)
         }
 }
 
@@ -317,7 +325,7 @@ type Attribute struct {
 }
 
 func (a *Attribute) walkChildNodes(w internalWalkFunc) {
-        a.Expr = w(a.Expr).(Expression)
+        w(a.Expr)
 }
 
 func (a *Attribute) Range() hcl.Range {
@@ -326,6 +334,9 @@ func (a *Attribute) Range() hcl.Range {
 
 // AsHCLAttribute returns the block data expressed as a *hcl.Attribute.
 func (a *Attribute) AsHCLAttribute() *hcl.Attribute {
+        if a == nil {
+                return nil
+        }
         return &hcl.Attribute{
                 Name: a.Name,
                 Expr: a.Expr,
@@ -339,8 +350,8 @@ func (a *Attribute) AsHCLAttribute() *hcl.Attribute {
 type Blocks []*Block
 
 func (bs Blocks) walkChildNodes(w internalWalkFunc) {
-        for i, block := range bs {
-                bs[i] = w(block).(*Block)
+        for _, block := range bs {
+                w(block)
         }
 }
 
@@ -371,9 +382,13 @@ type Block struct {
 }
 
 func (b *Block) walkChildNodes(w internalWalkFunc) {
-        b.Body = w(b.Body).(*Body)
+        w(b.Body)
 }
 
 func (b *Block) Range() hcl.Range {
         return hcl.RangeBetween(b.TypeRange, b.CloseBraceRange)
 }
+
+func (b *Block) DefRange() hcl.Range {
+        return hcl.RangeBetween(b.TypeRange, b.OpenBraceRange)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure_at_pos.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure_at_pos.go
new file mode 100644
index 0000000..d8f023b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure_at_pos.go
@@ -0,0 +1,118 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// -----------------------------------------------------------------------------
+// The methods in this file are all optional extension methods that serve to
+// implement the methods of the same name on *hcl.File when its root body
+// is provided by this package.
+// -----------------------------------------------------------------------------
+
+// BlocksAtPos implements the method of the same name for an *hcl.File that
+// is backed by a *Body.
+func (b *Body) BlocksAtPos(pos hcl.Pos) []*hcl.Block {
+        list, _ := b.blocksAtPos(pos, true)
+        return list
+}
+
+// InnermostBlockAtPos implements the method of the same name for an *hcl.File
+// that is backed by a *Body.
+func (b *Body) InnermostBlockAtPos(pos hcl.Pos) *hcl.Block {
+        _, innermost := b.blocksAtPos(pos, false)
+        return innermost.AsHCLBlock()
+}
+
+// OutermostBlockAtPos implements the method of the same name for an *hcl.File
+// that is backed by a *Body.
+func (b *Body) OutermostBlockAtPos(pos hcl.Pos) *hcl.Block {
+        return b.outermostBlockAtPos(pos).AsHCLBlock()
+}
+
+// blocksAtPos is the internal engine of both BlocksAtPos and
+// InnermostBlockAtPos, which both need to do the same logic but return a
+// differently-shaped result.
+//
+// list is nil if makeList is false, avoiding an allocation. Innermost is
+// always set, and if the returned list is non-nil it will always match the
+// final element from that list.
+func (b *Body) blocksAtPos(pos hcl.Pos, makeList bool) (list []*hcl.Block, innermost *Block) {
+        current := b
+
+Blocks:
+        for current != nil {
+                for _, block := range current.Blocks {
+                        wholeRange := hcl.RangeBetween(block.TypeRange, block.CloseBraceRange)
+                        if wholeRange.ContainsPos(pos) {
+                                innermost = block
+                                if makeList {
+                                        list = append(list, innermost.AsHCLBlock())
+                                }
+                                current = block.Body
+                                continue Blocks
+                        }
+                }
+
+                // If we fall out here then none of the current body's nested blocks
+                // contain the position we are looking for, and so we're done.
+                break
+        }
+
+        return
+}
+
+// outermostBlockAtPos is the internal version of OutermostBlockAtPos that
+// returns a hclsyntax.Block rather than an hcl.Block, allowing for further
+// analysis if necessary.
+func (b *Body) outermostBlockAtPos(pos hcl.Pos) *Block {
+        // This is similar to blocksAtPos, but simpler because we know it only
+        // ever needs to search the first level of nested blocks.
+
+        for _, block := range b.Blocks {
+                wholeRange := hcl.RangeBetween(block.TypeRange, block.CloseBraceRange)
+                if wholeRange.ContainsPos(pos) {
+                        return block
+                }
+        }
+
+        return nil
+}
+
+// AttributeAtPos implements the method of the same name for an *hcl.File
+// that is backed by a *Body.
+func (b *Body) AttributeAtPos(pos hcl.Pos) *hcl.Attribute {
+        return b.attributeAtPos(pos).AsHCLAttribute()
+}
+
+// attributeAtPos is the internal version of AttributeAtPos that returns a
+// hclsyntax.Block rather than an hcl.Block, allowing for further analysis if
+// necessary.
+func (b *Body) attributeAtPos(pos hcl.Pos) *Attribute {
+        searchBody := b
+        _, block := b.blocksAtPos(pos, false)
+        if block != nil {
+                searchBody = block.Body
+        }
+
+        for _, attr := range searchBody.Attributes {
+                if attr.SrcRange.ContainsPos(pos) {
+                        return attr
+                }
+        }
+
+        return nil
+}
+
+// OutermostExprAtPos implements the method of the same name for an *hcl.File
+// that is backed by a *Body.
+func (b *Body) OutermostExprAtPos(pos hcl.Pos) hcl.Expression {
+        attr := b.attributeAtPos(pos)
+        if attr == nil {
+                return nil
+        }
+        if !attr.Expr.Range().ContainsPos(pos) {
+                return nil
+        }
+        return attr.Expr
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go
index bcaa15f..3d898fd 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go
@@ -1,6 +1,7 @@
 package hclsyntax
 
 import (
+        "bytes"
         "fmt"
 
         "github.com/apparentlymart/go-textseg/textseg"
@@ -84,16 +85,18 @@ const (
         // things that might work in other languages they are familiar with, or
         // simply make incorrect assumptions about the HCL language.
 
-        TokenBitwiseAnd TokenType = '&'
-        TokenBitwiseOr  TokenType = '|'
-        TokenBitwiseNot TokenType = '~'
-        TokenBitwiseXor TokenType = '^'
-        TokenStarStar   TokenType = '➚'
-        TokenBacktick   TokenType = '`'
-        TokenSemicolon  TokenType = ';'
-        TokenTabs       TokenType = '␉'
-        TokenInvalid    TokenType = '�'
-        TokenBadUTF8    TokenType = '💩'
+        TokenBitwiseAnd    TokenType = '&'
+        TokenBitwiseOr     TokenType = '|'
+        TokenBitwiseNot    TokenType = '~'
+        TokenBitwiseXor    TokenType = '^'
+        TokenStarStar      TokenType = '➚'
+        TokenApostrophe    TokenType = '\''
+        TokenBacktick      TokenType = '`'
+        TokenSemicolon     TokenType = ';'
+        TokenTabs          TokenType = '␉'
+        TokenInvalid       TokenType = '�'
+        TokenBadUTF8       TokenType = '💩'
+        TokenQuotedNewline TokenType = '␤'
 
         // TokenNil is a placeholder for when a token is required but none is
         // available, e.g. when reporting errors. The scanner will never produce
@@ -114,10 +117,11 @@ const (
 )
 
 type tokenAccum struct {
-        Filename string
-        Bytes    []byte
-        Pos      hcl.Pos
-        Tokens   []Token
+        Filename  string
+        Bytes     []byte
+        Pos       hcl.Pos
+        Tokens    []Token
+        StartByte int
 }
 
 func (f *tokenAccum) emitToken(ty TokenType, startOfs, endOfs int) {
@@ -125,11 +129,11 @@ func (f *tokenAccum) emitToken(ty TokenType, startOfs, endOfs int) {
         // the start pos to get our end pos.
 
         start := f.Pos
-        start.Column += startOfs - f.Pos.Byte // Safe because only ASCII spaces can be in the offset
-        start.Byte = startOfs
+        start.Column += startOfs + f.StartByte - f.Pos.Byte // Safe because only ASCII spaces can be in the offset
+        start.Byte = startOfs + f.StartByte
 
         end := start
-        end.Byte = endOfs
+        end.Byte = endOfs + f.StartByte
         b := f.Bytes[startOfs:endOfs]
         for len(b) > 0 {
                 advance, seq, _ := textseg.ScanGraphemeClusters(b, true)
@@ -160,6 +164,13 @@ type heredocInProgress struct {
         StartOfLine bool
 }
 
+func tokenOpensFlushHeredoc(tok Token) bool {
+        if tok.Type != TokenOHeredoc {
+                return false
+        }
+        return bytes.HasPrefix(tok.Bytes, []byte{'<', '<', '-'})
+}
+
 // checkInvalidTokens does a simple pass across the given tokens and generates
 // diagnostics for tokens that should _never_ appear in HCL source. This
 // is intended to avoid the need for the parser to have special support
@@ -174,11 +185,15 @@ func checkInvalidTokens(tokens Tokens) hcl.Diagnostics {
         toldBitwise := 0
         toldExponent := 0
         toldBacktick := 0
+        toldApostrophe := 0
         toldSemicolon := 0
         toldTabs := 0
         toldBadUTF8 := 0
 
         for _, tok := range tokens {
+                // copy token so it's safe to point to it
+                tok := tok
+
                 switch tok.Type {
                 case TokenBitwiseAnd, TokenBitwiseOr, TokenBitwiseXor, TokenBitwiseNot:
                         if toldBitwise < 4 {
@@ -214,22 +229,36 @@ func checkInvalidTokens(tokens Tokens) hcl.Diagnostics {
                 case TokenBacktick:
                         // Only report for alternating (even) backticks, so we won't report both start and ends of the same
                         // backtick-quoted string.
-                        if toldExponent < 4 && (toldExponent%2) == 0 {
+                        if (toldBacktick % 2) == 0 {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Invalid character",
                                         Detail:   "The \"`\" character is not valid. To create a multi-line string, use the \"heredoc\" syntax, like \"<<EOT\".",
                                         Subject:  &tok.Range,
                                 })
-
+                        }
+                        if toldBacktick <= 2 {
                                 toldBacktick++
                         }
+                case TokenApostrophe:
+                        if (toldApostrophe % 2) == 0 {
+                                newDiag := &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid character",
+                                        Detail:   "Single quotes are not valid. Use double quotes (\") to enclose strings.",
+                                        Subject:  &tok.Range,
+                                }
+                                diags = append(diags, newDiag)
+                        }
+                        if toldApostrophe <= 2 {
+                                toldApostrophe++
+                        }
                 case TokenSemicolon:
                         if toldSemicolon < 1 {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Invalid character",
-                                        Detail:   "The \";\" character is not valid. Use newlines to separate attributes and blocks, and commas to separate items in collection values.",
+                                        Detail:   "The \";\" character is not valid. Use newlines to separate arguments and blocks, and commas to separate items in collection values.",
                                         Subject:  &tok.Range,
                                 })
 
@@ -257,6 +286,13 @@ func checkInvalidTokens(tokens Tokens) hcl.Diagnostics {
 
                                 toldBadUTF8++
                         }
+                case TokenQuotedNewline:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid multi-line string",
+                                Detail:   "Quoted strings may not be split over multiple lines. To produce a multi-line string, either use the \\n escape to represent a newline character or use the \"heredoc\" multi-line template syntax.",
+                                Subject:  &tok.Range,
+                        })
                 case TokenInvalid:
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
@@ -264,9 +300,21 @@ func checkInvalidTokens(tokens Tokens) hcl.Diagnostics {
                                 Detail:   "This character is not used within the language.",
                                 Subject:  &tok.Range,
                         })
-
-                        toldTabs++
                 }
         }
         return diags
 }
+
+var utf8BOM = []byte{0xef, 0xbb, 0xbf}
+
+// stripUTF8BOM checks whether the given buffer begins with a UTF-8 byte order
+// mark (0xEF 0xBB 0xBF) and, if so, returns a truncated slice with the same
+// backing array but with the BOM skipped.
+//
+// If there is no BOM present, the given slice is returned verbatim.
+func stripUTF8BOM(src []byte) []byte {
+        if bytes.HasPrefix(src, utf8BOM) {
+                return src[3:]
+        }
+        return src
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go
index 93de7ee..c23c4f0 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go
@@ -4,7 +4,67 @@ package hclsyntax
 
 import "strconv"
 
-const _TokenType_name = "TokenNilTokenNewlineTokenBangTokenPercentTokenBitwiseAndTokenOParenTokenCParenTokenStarTokenPlusTokenCommaTokenMinusTokenDotTokenSlashTokenColonTokenSemicolonTokenLessThanTokenEqualTokenGreaterThanTokenQuestionTokenCommentTokenOHeredocTokenIdentTokenNumberLitTokenQuotedLitTokenStringLitTokenOBrackTokenCBrackTokenBitwiseXorTokenBacktickTokenCHeredocTokenOBraceTokenBitwiseOrTokenCBraceTokenBitwiseNotTokenOQuoteTokenCQuoteTokenTemplateControlTokenEllipsisTokenFatArrowTokenTemplateSeqEndTokenAndTokenOrTokenTemplateInterpTokenEqualOpTokenNotEqualTokenLessThanEqTokenGreaterThanEqTokenEOFTokenTabsTokenStarStarTokenInvalidTokenBadUTF8"
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TokenOBrace-123]
+        _ = x[TokenCBrace-125]
+        _ = x[TokenOBrack-91]
+        _ = x[TokenCBrack-93]
+        _ = x[TokenOParen-40]
+        _ = x[TokenCParen-41]
+        _ = x[TokenOQuote-171]
+        _ = x[TokenCQuote-187]
+        _ = x[TokenOHeredoc-72]
+        _ = x[TokenCHeredoc-104]
+        _ = x[TokenStar-42]
+        _ = x[TokenSlash-47]
+        _ = x[TokenPlus-43]
+        _ = x[TokenMinus-45]
+        _ = x[TokenPercent-37]
+        _ = x[TokenEqual-61]
+        _ = x[TokenEqualOp-8788]
+        _ = x[TokenNotEqual-8800]
+        _ = x[TokenLessThan-60]
+        _ = x[TokenLessThanEq-8804]
+        _ = x[TokenGreaterThan-62]
+        _ = x[TokenGreaterThanEq-8805]
+        _ = x[TokenAnd-8743]
+        _ = x[TokenOr-8744]
+        _ = x[TokenBang-33]
+        _ = x[TokenDot-46]
+        _ = x[TokenComma-44]
+        _ = x[TokenEllipsis-8230]
+        _ = x[TokenFatArrow-8658]
+        _ = x[TokenQuestion-63]
+        _ = x[TokenColon-58]
+        _ = x[TokenTemplateInterp-8747]
+        _ = x[TokenTemplateControl-955]
+        _ = x[TokenTemplateSeqEnd-8718]
+        _ = x[TokenQuotedLit-81]
+        _ = x[TokenStringLit-83]
+        _ = x[TokenNumberLit-78]
+        _ = x[TokenIdent-73]
+        _ = x[TokenComment-67]
+        _ = x[TokenNewline-10]
+        _ = x[TokenEOF-9220]
+        _ = x[TokenBitwiseAnd-38]
+        _ = x[TokenBitwiseOr-124]
+        _ = x[TokenBitwiseNot-126]
+        _ = x[TokenBitwiseXor-94]
+        _ = x[TokenStarStar-10138]
+        _ = x[TokenApostrophe-39]
+        _ = x[TokenBacktick-96]
+        _ = x[TokenSemicolon-59]
+        _ = x[TokenTabs-9225]
+        _ = x[TokenInvalid-65533]
+        _ = x[TokenBadUTF8-128169]
+        _ = x[TokenQuotedNewline-9252]
+        _ = x[TokenNil-0]
+}
+
+const _TokenType_name = "TokenNilTokenNewlineTokenBangTokenPercentTokenBitwiseAndTokenApostropheTokenOParenTokenCParenTokenStarTokenPlusTokenCommaTokenMinusTokenDotTokenSlashTokenColonTokenSemicolonTokenLessThanTokenEqualTokenGreaterThanTokenQuestionTokenCommentTokenOHeredocTokenIdentTokenNumberLitTokenQuotedLitTokenStringLitTokenOBrackTokenCBrackTokenBitwiseXorTokenBacktickTokenCHeredocTokenOBraceTokenBitwiseOrTokenCBraceTokenBitwiseNotTokenOQuoteTokenCQuoteTokenTemplateControlTokenEllipsisTokenFatArrowTokenTemplateSeqEndTokenAndTokenOrTokenTemplateInterpTokenEqualOpTokenNotEqualTokenLessThanEqTokenGreaterThanEqTokenEOFTokenTabsTokenQuotedNewlineTokenStarStarTokenInvalidTokenBadUTF8"
 
 var _TokenType_map = map[TokenType]string{
         0:      _TokenType_name[0:8],
@@ -12,53 +72,55 @@ var _TokenType_map = map[TokenType]string{
         33:     _TokenType_name[20:29],
         37:     _TokenType_name[29:41],
         38:     _TokenType_name[41:56],
-        40:     _TokenType_name[56:67],
-        41:     _TokenType_name[67:78],
-        42:     _TokenType_name[78:87],
-        43:     _TokenType_name[87:96],
-        44:     _TokenType_name[96:106],
-        45:     _TokenType_name[106:116],
-        46:     _TokenType_name[116:124],
-        47:     _TokenType_name[124:134],
-        58:     _TokenType_name[134:144],
-        59:     _TokenType_name[144:158],
-        60:     _TokenType_name[158:171],
-        61:     _TokenType_name[171:181],
-        62:     _TokenType_name[181:197],
-        63:     _TokenType_name[197:210],
-        67:     _TokenType_name[210:222],
-        72:     _TokenType_name[222:235],
-        73:     _TokenType_name[235:245],
-        78:     _TokenType_name[245:259],
-        81:     _TokenType_name[259:273],
-        83:     _TokenType_name[273:287],
-        91:     _TokenType_name[287:298],
-        93:     _TokenType_name[298:309],
-        94:     _TokenType_name[309:324],
-        96:     _TokenType_name[324:337],
-        104:    _TokenType_name[337:350],
-        123:    _TokenType_name[350:361],
-        124:    _TokenType_name[361:375],
-        125:    _TokenType_name[375:386],
-        126:    _TokenType_name[386:401],
-        171:    _TokenType_name[401:412],
-        187:    _TokenType_name[412:423],
-        955:    _TokenType_name[423:443],
-        8230:   _TokenType_name[443:456],
-        8658:   _TokenType_name[456:469],
-        8718:   _TokenType_name[469:488],
-        8743:   _TokenType_name[488:496],
-        8744:   _TokenType_name[496:503],
-        8747:   _TokenType_name[503:522],
-        8788:   _TokenType_name[522:534],
-        8800:   _TokenType_name[534:547],
-        8804:   _TokenType_name[547:562],
-        8805:   _TokenType_name[562:580],
-        9220:   _TokenType_name[580:588],
-        9225:   _TokenType_name[588:597],
-        10138:  _TokenType_name[597:610],
-        65533:  _TokenType_name[610:622],
-        128169: _TokenType_name[622:634],
+        39:     _TokenType_name[56:71],
+        40:     _TokenType_name[71:82],
+        41:     _TokenType_name[82:93],
+        42:     _TokenType_name[93:102],
+        43:     _TokenType_name[102:111],
+        44:     _TokenType_name[111:121],
+        45:     _TokenType_name[121:131],
+        46:     _TokenType_name[131:139],
+        47:     _TokenType_name[139:149],
+        58:     _TokenType_name[149:159],
+        59:     _TokenType_name[159:173],
+        60:     _TokenType_name[173:186],
+        61:     _TokenType_name[186:196],
+        62:     _TokenType_name[196:212],
+        63:     _TokenType_name[212:225],
+        67:     _TokenType_name[225:237],
+        72:     _TokenType_name[237:250],
+        73:     _TokenType_name[250:260],
+        78:     _TokenType_name[260:274],
+        81:     _TokenType_name[274:288],
+        83:     _TokenType_name[288:302],
+        91:     _TokenType_name[302:313],
+        93:     _TokenType_name[313:324],
+        94:     _TokenType_name[324:339],
+        96:     _TokenType_name[339:352],
+        104:    _TokenType_name[352:365],
+        123:    _TokenType_name[365:376],
+        124:    _TokenType_name[376:390],
+        125:    _TokenType_name[390:401],
+        126:    _TokenType_name[401:416],
+        171:    _TokenType_name[416:427],
+        187:    _TokenType_name[427:438],
+        955:    _TokenType_name[438:458],
+        8230:   _TokenType_name[458:471],
+        8658:   _TokenType_name[471:484],
+        8718:   _TokenType_name[484:503],
+        8743:   _TokenType_name[503:511],
+        8744:   _TokenType_name[511:518],
+        8747:   _TokenType_name[518:537],
+        8788:   _TokenType_name[537:549],
+        8800:   _TokenType_name[549:562],
+        8804:   _TokenType_name[562:577],
+        8805:   _TokenType_name[577:595],
+        9220:   _TokenType_name[595:603],
+        9225:   _TokenType_name[603:612],
+        9252:   _TokenType_name[612:630],
+        10138:  _TokenType_name[630:643],
+        65533:  _TokenType_name[643:655],
+        128169: _TokenType_name[655:667],
 }
 
 func (i TokenType) String() string {
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go
index eeee1a5..91f417f 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go
@@ -72,15 +72,15 @@ func (w *variablesWalker) Exit(n Node) hcl.Diagnostics {
 // that the child scope struct wraps.
 type ChildScope struct {
         LocalNames map[string]struct{}
-        Expr       *Expression // pointer because it can be replaced on walk
+        Expr       Expression
 }
 
 func (e ChildScope) walkChildNodes(w internalWalkFunc) {
-        *(e.Expr) = w(*(e.Expr)).(Expression)
+        w(e.Expr)
 }
 
 // Range returns the range of the expression that the ChildScope is
 // encapsulating. It isn't really very useful to call Range on a ChildScope.
 func (e ChildScope) Range() hcl.Range {
-        return (*e.Expr).Range()
+        return e.Expr.Range()
 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go
index 3405d26..90f81c9 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go
@@ -15,9 +15,8 @@ type VisitFunc func(node Node) hcl.Diagnostics
 // and returned as a single set.
 func VisitAll(node Node, f VisitFunc) hcl.Diagnostics {
         diags := f(node)
-        node.walkChildNodes(func(node Node) Node {
+        node.walkChildNodes(func(node Node) {
                 diags = append(diags, VisitAll(node, f)...)
-                return node
         })
         return diags
 }
@@ -33,45 +32,10 @@ type Walker interface {
 // Enter and Exit functions.
 func Walk(node Node, w Walker) hcl.Diagnostics {
         diags := w.Enter(node)
-        node.walkChildNodes(func(node Node) Node {
+        node.walkChildNodes(func(node Node) {
                 diags = append(diags, Walk(node, w)...)
-                return node
         })
+        moreDiags := w.Exit(node)
+        diags = append(diags, moreDiags...)
         return diags
 }
-
-// Transformer is an interface used with Transform
-type Transformer interface {
-        // Transform accepts a node and returns a replacement node along with
-        // a flag for whether to also visit child nodes. If the flag is false,
-        // none of the child nodes will be visited and the TransformExit method
-        // will not be called for the node.
-        //
-        // It is acceptable and appropriate for Transform to return the same node
-        // it was given, for situations where no transform is needed.
-        Transform(node Node) (Node, bool, hcl.Diagnostics)
-
-        // TransformExit signals the end of transformations of child nodes of the
-        // given node. If Transform returned a new node, the given node is the
-        // node that was returned, rather than the node that was originally
-        // encountered.
-        TransformExit(node Node) hcl.Diagnostics
-}
-
-// Transform allows for in-place transformations of an AST starting with a
-// particular node. The provider Transformer implementation drives the
-// transformation process. The return value is the node that replaced the
-// given top-level node.
-func Transform(node Node, t Transformer) (Node, hcl.Diagnostics) {
-        newNode, descend, diags := t.Transform(node)
-        if !descend {
-                return newNode, diags
-        }
-        node.walkChildNodes(func(node Node) Node {
-                newNode, newDiags := Transform(node, t)
-                diags = append(diags, newDiags...)
-                return newNode
-        })
-        diags = append(diags, t.TransformExit(newNode)...)
-        return newNode, diags
-}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go b/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go
index 246fd1c..d368ea8 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go
@@ -3,9 +3,9 @@ package json
 import (
         "encoding/json"
         "fmt"
-        "math/big"
 
         "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
 )
 
 func parseFileContent(buf []byte, filename string) (node, hcl.Diagnostics) {
@@ -55,7 +55,7 @@ func parseValue(p *peeker) (node, hcl.Diagnostics) {
                 return wrapInvalid(nil, hcl.Diagnostics{
                         {
                                 Severity: hcl.DiagError,
-                                Summary:  "Missing attribute value",
+                                Summary:  "Missing JSON value",
                                 Detail:   "A JSON value must start with a brace, a bracket, a number, a string, or a keyword.",
                                 Subject:  &tok.Range,
                         },
@@ -144,8 +144,8 @@ Token:
                 if !ok {
                         return nil, diags.Append(&hcl.Diagnostic{
                                 Severity: hcl.DiagError,
-                                Summary:  "Invalid object attribute name",
-                                Detail:   "A JSON object attribute name must be a string",
+                                Summary:  "Invalid object property name",
+                                Detail:   "A JSON object property name must be a string",
                                 Subject:  keyNode.StartRange().Ptr(),
                         })
                 }
@@ -171,7 +171,7 @@ Token:
                                 // Possible confusion with native HCL syntax.
                                 return nil, diags.Append(&hcl.Diagnostic{
                                         Severity: hcl.DiagError,
-                                        Summary:  "Missing attribute value colon",
+                                        Summary:  "Missing property value colon",
                                         Detail:   "JSON uses a colon as its name/value delimiter, not an equals sign.",
                                         Subject:  &colon.Range,
                                 })
@@ -179,8 +179,8 @@ Token:
 
                         return nil, diags.Append(&hcl.Diagnostic{
                                 Severity: hcl.DiagError,
-                                Summary:  "Missing attribute value colon",
-                                Detail:   "A colon must appear between an object attribute's name and its value.",
+                                Summary:  "Missing property value colon",
+                                Detail:   "A colon must appear between an object property's name and its value.",
                                 Subject:  &colon.Range,
                         })
                 }
@@ -205,7 +205,7 @@ Token:
                                 return nil, diags.Append(&hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Trailing comma in object",
-                                        Detail:   "JSON does not permit a trailing comma after the final attribute in an object.",
+                                        Detail:   "JSON does not permit a trailing comma after the final property in an object.",
                                         Subject:  &comma.Range,
                                 })
                         }
@@ -234,7 +234,7 @@ Token:
                         return nil, diags.Append(&hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Missing attribute seperator comma",
-                                Detail:   "A comma must appear between each attribute declaration in an object.",
+                                Detail:   "A comma must appear between each property definition in an object.",
                                 Subject:  p.Peek().Range.Ptr(),
                         })
                 }
@@ -301,7 +301,7 @@ Token:
                                 return nil, diags.Append(&hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Trailing comma in array",
-                                        Detail:   "JSON does not permit a trailing comma after the final attribute in an array.",
+                                        Detail:   "JSON does not permit a trailing comma after the final value in an array.",
                                         Subject:  &comma.Range,
                                 })
                         }
@@ -370,10 +370,15 @@ func parseNumber(p *peeker) (node, hcl.Diagnostics) {
                 }
         }
 
-        f, _, err := big.ParseFloat(string(num), 10, 512, big.ToNearestEven)
+        // We want to guarantee that we parse numbers the same way as cty (and thus
+        // native syntax HCL) would here, so we'll use the cty parser even though
+        // in most other cases we don't actually introduce cty concepts until
+        // decoding time. We'll unwrap the parsed float immediately afterwards, so
+        // the cty value is just a temporary helper.
+        nv, err := cty.ParseNumberVal(string(num))
         if err != nil {
                 // Should never happen if above passed, since JSON numbers are a subset
-                // of what big.Float can parse...
+                // of what cty can parse...
                 return nil, hcl.Diagnostics{
                         {
                                 Severity: hcl.DiagError,
@@ -385,7 +390,7 @@ func parseNumber(p *peeker) (node, hcl.Diagnostics) {
         }
 
         return &numberVal{
-                Value:    f,
+                Value:    nv.AsBigFloat(),
                 SrcRange: tok.Range,
         }, nil
 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go b/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go
index 0a8378b..da72884 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go
@@ -153,7 +153,7 @@ func byteCanStartKeyword(b byte) bool {
         // in the parser, where we can generate better diagnostics.
         // So e.g. we want to be able to say:
         //   unrecognized keyword "True". Did you mean "true"?
-        case b >= 'a' || b <= 'z' || b >= 'A' || b <= 'Z':
+        case isAlphabetical(b):
                 return true
         default:
                 return false
@@ -167,7 +167,7 @@ Byte:
         for i = 0; i < len(buf); i++ {
                 b := buf[i]
                 switch {
-                case (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z') || b == '_':
+                case isAlphabetical(b) || b == '_':
                         p.Pos.Byte++
                         p.Pos.Column++
                 default:
@@ -291,3 +291,7 @@ func posRange(start, end pos) hcl.Range {
 func (t token) GoString() string {
         return fmt.Sprintf("json.token{json.%s, []byte(%q), %#v}", t.Type, t.Bytes, t.Range)
 }
+
+func isAlphabetical(b byte) bool {
+        return (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z')
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md b/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md
index 9b33c7f..dac5729 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md
@@ -5,7 +5,7 @@ for defining configuration languages for applications. The HCL information
 model is designed to support multiple concrete syntaxes for configuration,
 and this JSON-based format complements [the native syntax](../hclsyntax/spec.md)
 by being easy to machine-generate, whereas the native syntax is oriented
-towards human authoring and maintenence.
+towards human authoring and maintenance
 
 This syntax is defined in terms of JSON as defined in
 [RFC7159](https://tools.ietf.org/html/rfc7159). As such it inherits the JSON
@@ -18,11 +18,11 @@ _Parsing_ such JSON has some additional constraints not beyond what is normally
 supported by JSON parsers, so a specialized parser may be required that
 is able to:
 
-* Preserve the relative ordering of properties defined in an object.
-* Preserve multiple definitions of the same property name.
-* Preserve numeric values to the precision required by the number type
+- Preserve the relative ordering of properties defined in an object.
+- Preserve multiple definitions of the same property name.
+- Preserve numeric values to the precision required by the number type
   in [the HCL syntax-agnostic information model](../spec.md).
-* Retain source location information for parsed tokens/constructs in order
+- Retain source location information for parsed tokens/constructs in order
   to produce good error messages.
 
 ## Structural Elements
@@ -118,6 +118,7 @@ type:
   ]
 }
 ```
+
 ```json
 {
   "foo": []
@@ -147,7 +148,7 @@ the following examples:
     "boz": {
       "baz": {
         "child_attr": "baz"
-      },
+      }
     }
   }
 }
@@ -189,7 +190,7 @@ the following examples:
         "boz": {
           "child_attr": "baz"
         }
-      },
+      }
     },
     {
       "bar": {
@@ -280,9 +281,9 @@ When interpreted as an expression, a JSON array represents a value of a HCL
 tuple type.
 
 Each element of the JSON array represents an element of the HCL tuple type.
-The tuple type is constructed by enumerationg the JSON array elements, creating
+The tuple type is constructed by enumerating the JSON array elements, creating
 for each an element whose type is the result of recursively applying the
-expression mapping rules. Correspondance is preserved between the array element
+expression mapping rules. Correspondence is preserved between the array element
 indices and the tuple element indices.
 
 An instance of the constructed tuple type is then created, whose values are
@@ -325,7 +326,7 @@ HCL null value of the dynamic pseudo-type.
 
 ### Strings
 
-When intepreted as an expression, a JSON string may be interpreted in one of
+When interpreted as an expression, a JSON string may be interpreted in one of
 two ways depending on the evaluation mode.
 
 If evaluating in literal-only mode (as defined by the syntax-agnostic
@@ -402,4 +403,3 @@ to that expression.
 
 If the original expression is not a string or its contents cannot be parsed
 as a native syntax expression then static call analysis is not supported.
-
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go b/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go
index 28dcf52..bdc0e98 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go
@@ -64,7 +64,7 @@ func (b *body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostic
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Extraneous JSON object property",
-                                Detail:   fmt.Sprintf("No attribute or block type is named %q.%s", k, suggestion),
+                                Detail:   fmt.Sprintf("No argument or block type is named %q.%s", k, suggestion),
                                 Subject:  &attr.NameRange,
                                 Context:  attr.Range().Ptr(),
                         })
@@ -114,8 +114,8 @@ func (b *body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Bod
                         if existing, exists := content.Attributes[attrName]; exists {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
-                                        Summary:  "Duplicate attribute definition",
-                                        Detail:   fmt.Sprintf("The attribute %q was already defined at %s.", attrName, existing.Range),
+                                        Summary:  "Duplicate argument",
+                                        Detail:   fmt.Sprintf("The argument %q was already set at %s.", attrName, existing.Range),
                                         Subject:  &jsonAttr.NameRange,
                                         Context:  jsonAttr.Range().Ptr(),
                                 })
@@ -149,8 +149,8 @@ func (b *body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Bod
                 if _, defined := content.Attributes[attrS.Name]; !defined {
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
-                                Summary:  "Missing required attribute",
-                                Detail:   fmt.Sprintf("The attribute %q is required, but no definition was found.", attrS.Name),
+                                Summary:  "Missing required argument",
+                                Detail:   fmt.Sprintf("The argument %q is required, but no definition was found.", attrS.Name),
                                 Subject:  b.MissingItemRange().Ptr(),
                         })
                 }
@@ -175,7 +175,7 @@ func (b *body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
                 diags = append(diags, &hcl.Diagnostic{
                         Severity: hcl.DiagError,
                         Summary:  "Incorrect JSON value type",
-                        Detail:   "A JSON object is required here, defining the attributes for this block.",
+                        Detail:   "A JSON object is required here, setting the arguments for this block.",
                         Subject:  b.val.StartRange().Ptr(),
                 })
                 return attrs, diags
@@ -197,7 +197,7 @@ func (b *body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Duplicate attribute definition",
-                                Detail:   fmt.Sprintf("The attribute %q was already defined at %s.", name, existing.Range),
+                                Detail:   fmt.Sprintf("The argument %q was already set at %s.", name, existing.Range),
                                 Subject:  &jsonAttr.NameRange,
                         })
                         continue
@@ -266,6 +266,9 @@ func (b *body) unpackBlock(v node, typeName string, typeRange *hcl.Range, labels
         copy(labelR, labelRanges)
 
         switch tv := v.(type) {
+        case *nullVal:
+                // There is no block content, e.g the value is null.
+                return
         case *objectVal:
                 // Single instance of the block
                 *blocks = append(*blocks, &hcl.Block{
@@ -324,6 +327,8 @@ func (b *body) collectDeepAttrs(v node, labelName *string) ([]*objectAttr, hcl.D
         var attrs []*objectAttr
 
         switch tv := v.(type) {
+        case *nullVal:
+                // If a value is null, then we don't return any attributes or return an error.
 
         case *objectVal:
                 attrs = append(attrs, tv.Attrs...)
@@ -345,7 +350,7 @@ func (b *body) collectDeepAttrs(v node, labelName *string) ([]*objectAttr, hcl.D
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
                                                 Summary:  "Incorrect JSON value type",
-                                                Detail:   "A JSON object is required here, to define attributes and child blocks.",
+                                                Detail:   "A JSON object is required here, to define arguments and child blocks.",
                                                 Subject:  ev.StartRange().Ptr(),
                                         })
                                 }
@@ -364,7 +369,7 @@ func (b *body) collectDeepAttrs(v node, labelName *string) ([]*objectAttr, hcl.D
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Incorrect JSON value type",
-                                Detail:   "Either a JSON object or JSON array of objects is required here, to define attributes and child blocks.",
+                                Detail:   "Either a JSON object or JSON array of objects is required here, to define arguments and child blocks.",
                                 Subject:  v.StartRange().Ptr(),
                         })
                 }
@@ -424,7 +429,7 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 known := true
                 for _, jsonAttr := range v.Attrs {
                         // In this one context we allow keys to contain interpolation
-                        // experessions too, assuming we're evaluating in interpolation
+                        // expressions too, assuming we're evaluating in interpolation
                         // mode. This achieves parity with the native syntax where
                         // object expressions can have dynamic keys, while block contents
                         // may not.
@@ -432,7 +437,8 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 Value:    jsonAttr.Name,
                                 SrcRange: jsonAttr.NameRange,
                         }}).Value(ctx)
-                        val, valDiags := (&expression{src: jsonAttr.Value}).Value(ctx)
+                        valExpr := &expression{src: jsonAttr.Value}
+                        val, valDiags := valExpr.Value(ctx)
                         diags = append(diags, nameDiags...)
                         diags = append(diags, valDiags...)
 
@@ -440,19 +446,23 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         name, err = convert.Convert(name, cty.String)
                         if err != nil {
                                 diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Invalid object key expression",
-                                        Detail:   fmt.Sprintf("Cannot use this expression as an object key: %s.", err),
-                                        Subject:  &jsonAttr.NameRange,
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Invalid object key expression",
+                                        Detail:      fmt.Sprintf("Cannot use this expression as an object key: %s.", err),
+                                        Subject:     &jsonAttr.NameRange,
+                                        Expression:  valExpr,
+                                        EvalContext: ctx,
                                 })
                                 continue
                         }
                         if name.IsNull() {
                                 diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Invalid object key expression",
-                                        Detail:   "Cannot use null value as an object key.",
-                                        Subject:  &jsonAttr.NameRange,
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Invalid object key expression",
+                                        Detail:      "Cannot use null value as an object key.",
+                                        Subject:     &jsonAttr.NameRange,
+                                        Expression:  valExpr,
+                                        EvalContext: ctx,
                                 })
                                 continue
                         }
@@ -471,10 +481,12 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         nameStr := name.AsString()
                         if _, defined := attrs[nameStr]; defined {
                                 diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Duplicate object attribute",
-                                        Detail:   fmt.Sprintf("An attribute named %q was already defined at %s.", nameStr, attrRanges[nameStr]),
-                                        Subject:  &jsonAttr.NameRange,
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Duplicate object attribute",
+                                        Detail:      fmt.Sprintf("An attribute named %q was already defined at %s.", nameStr, attrRanges[nameStr]),
+                                        Subject:     &jsonAttr.NameRange,
+                                        Expression:  e,
+                                        EvalContext: ctx,
                                 })
                                 continue
                         }
@@ -487,6 +499,8 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         return cty.DynamicVal, diags
                 }
                 return cty.ObjectVal(attrs), diags
+        case *nullVal:
+                return cty.NullVal(cty.DynamicPseudoType), nil
         default:
                 // Default to DynamicVal so that ASTs containing invalid nodes can
                 // still be partially-evaluated.
@@ -526,6 +540,11 @@ func (e *expression) Variables() []hcl.Traversal {
                 }
         case *objectVal:
                 for _, jsonAttr := range v.Attrs {
+                        keyExpr := &stringVal{ // we're going to treat key as an expression in this context
+                                Value:    jsonAttr.Name,
+                                SrcRange: jsonAttr.NameRange,
+                        }
+                        vars = append(vars, (&expression{src: keyExpr}).Variables()...)
                         vars = append(vars, (&expression{src: jsonAttr.Value}).Variables()...)
                 }
         }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/merged.go b/vendor/github.com/hashicorp/hcl2/hcl/merged.go
index ca2b728..96e62a5 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/merged.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/merged.go
@@ -109,9 +109,9 @@ func (mb mergedBodies) JustAttributes() (Attributes, Diagnostics) {
                                 if existing := attrs[name]; existing != nil {
                                         diags = diags.Append(&Diagnostic{
                                                 Severity: DiagError,
-                                                Summary:  "Duplicate attribute",
+                                                Summary:  "Duplicate argument",
                                                 Detail: fmt.Sprintf(
-                                                        "Attribute %q was already assigned at %s",
+                                                        "Argument %q was already set at %s",
                                                         name, existing.NameRange.String(),
                                                 ),
                                                 Subject: &attr.NameRange,
@@ -171,7 +171,7 @@ func (mb mergedBodies) mergedContent(schema *BodySchema, partial bool) (*BodyCon
                 }
 
                 if thisLeftovers != nil {
-                        mergedLeftovers = append(mergedLeftovers)
+                        mergedLeftovers = append(mergedLeftovers, thisLeftovers)
                 }
                 if len(thisDiags) != 0 {
                         diags = append(diags, thisDiags...)
@@ -182,9 +182,9 @@ func (mb mergedBodies) mergedContent(schema *BodySchema, partial bool) (*BodyCon
                                 if existing := content.Attributes[name]; existing != nil {
                                         diags = diags.Append(&Diagnostic{
                                                 Severity: DiagError,
-                                                Summary:  "Duplicate attribute",
+                                                Summary:  "Duplicate argument",
                                                 Detail: fmt.Sprintf(
-                                                        "Attribute %q was already assigned at %s",
+                                                        "Argument %q was already set at %s",
                                                         name, existing.NameRange.String(),
                                                 ),
                                                 Subject: &attr.NameRange,
@@ -212,9 +212,9 @@ func (mb mergedBodies) mergedContent(schema *BodySchema, partial bool) (*BodyCon
                         // use of required attributes on merged bodies.
                         diags = diags.Append(&Diagnostic{
                                 Severity: DiagError,
-                                Summary:  "Missing required attribute",
+                                Summary:  "Missing required argument",
                                 Detail: fmt.Sprintf(
-                                        "The attribute %q is required, but was not assigned.",
+                                        "The argument %q is required, but was not set.",
                                         attrS.Name,
                                 ),
                         })
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/ops.go b/vendor/github.com/hashicorp/hcl2/hcl/ops.go
index f4e30b0..5d2910c 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/ops.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/ops.go
@@ -2,6 +2,7 @@ package hcl
 
 import (
         "fmt"
+        "math/big"
 
         "github.com/zclconf/go-cty/cty"
         "github.com/zclconf/go-cty/cty/convert"
@@ -84,6 +85,27 @@ func Index(collection, key cty.Value, srcRange *Range) (cty.Value, Diagnostics)
                         }
                 }
                 if has.False() {
+                        // We have a more specialized error message for the situation of
+                        // using a fractional number to index into a sequence, because
+                        // that will tend to happen if the user is trying to use division
+                        // to calculate an index and not realizing that HCL does float
+                        // division rather than integer division.
+                        if (ty.IsListType() || ty.IsTupleType()) && key.Type().Equals(cty.Number) {
+                                if key.IsKnown() && !key.IsNull() {
+                                        bf := key.AsBigFloat()
+                                        if _, acc := bf.Int(nil); acc != big.Exact {
+                                                return cty.DynamicVal, Diagnostics{
+                                                        {
+                                                                Severity: DiagError,
+                                                                Summary:  "Invalid index",
+                                                                Detail:   fmt.Sprintf("The given key does not identify an element in this collection value: indexing a sequence requires a whole number, but the given index (%g) has a fractional part.", bf),
+                                                                Subject:  srcRange,
+                                                        },
+                                                }
+                                        }
+                                }
+                        }
+
                         return cty.DynamicVal, Diagnostics{
                                 {
                                         Severity: DiagError,
@@ -145,3 +167,122 @@ func Index(collection, key cty.Value, srcRange *Range) (cty.Value, Diagnostics)
         }
 
 }
+
+// GetAttr is a helper function that performs the same operation as the
+// attribute access in the HCL expression language. That is, the result is the
+// same as it would be for obj.attr in a configuration expression.
+//
+// This is exported so that applications can access attributes in a manner
+// consistent with how the language does it, including handling of null and
+// unknown values, etc.
+//
+// Diagnostics are produced if the given combination of values is not valid.
+// Therefore a pointer to a source range must be provided to use in diagnostics,
+// though nil can be provided if the calling application is going to
+// ignore the subject of the returned diagnostics anyway.
+func GetAttr(obj cty.Value, attrName string, srcRange *Range) (cty.Value, Diagnostics) {
+        if obj.IsNull() {
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Attempt to get attribute from null value",
+                                Detail:   "This value is null, so it does not have any attributes.",
+                                Subject:  srcRange,
+                        },
+                }
+        }
+
+        ty := obj.Type()
+        switch {
+        case ty.IsObjectType():
+                if !ty.HasAttribute(attrName) {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Unsupported attribute",
+                                        Detail:   fmt.Sprintf("This object does not have an attribute named %q.", attrName),
+                                        Subject:  srcRange,
+                                },
+                        }
+                }
+
+                if !obj.IsKnown() {
+                        return cty.UnknownVal(ty.AttributeType(attrName)), nil
+                }
+
+                return obj.GetAttr(attrName), nil
+        case ty.IsMapType():
+                if !obj.IsKnown() {
+                        return cty.UnknownVal(ty.ElementType()), nil
+                }
+
+                idx := cty.StringVal(attrName)
+                if obj.HasIndex(idx).False() {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Missing map element",
+                                        Detail:   fmt.Sprintf("This map does not have an element with the key %q.", attrName),
+                                        Subject:  srcRange,
+                                },
+                        }
+                }
+
+                return obj.Index(idx), nil
+        case ty == cty.DynamicPseudoType:
+                return cty.DynamicVal, nil
+        default:
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Unsupported attribute",
+                                Detail:   "This value does not have any attributes.",
+                                Subject:  srcRange,
+                        },
+                }
+        }
+
+}
+
+// ApplyPath is a helper function that applies a cty.Path to a value using the
+// indexing and attribute access operations from HCL.
+//
+// This is similar to calling the path's own Apply method, but ApplyPath uses
+// the more relaxed typing rules that apply to these operations in HCL, rather
+// than cty's relatively-strict rules. ApplyPath is implemented in terms of
+// Index and GetAttr, and so it has the same behavior for individual steps
+// but will stop and return any errors returned by intermediate steps.
+//
+// Diagnostics are produced if the given path cannot be applied to the given
+// value. Therefore a pointer to a source range must be provided to use in
+// diagnostics, though nil can be provided if the calling application is going
+// to ignore the subject of the returned diagnostics anyway.
+func ApplyPath(val cty.Value, path cty.Path, srcRange *Range) (cty.Value, Diagnostics) {
+        var diags Diagnostics
+
+        for _, step := range path {
+                var stepDiags Diagnostics
+                switch ts := step.(type) {
+                case cty.IndexStep:
+                        val, stepDiags = Index(val, ts.Key, srcRange)
+                case cty.GetAttrStep:
+                        val, stepDiags = GetAttr(val, ts.Name, srcRange)
+                default:
+                        // Should never happen because the above are all of the step types.
+                        diags = diags.Append(&Diagnostic{
+                                Severity: DiagError,
+                                Summary:  "Invalid path step",
+                                Detail:   fmt.Sprintf("Go type %T is not a valid path step. This is a bug in this program.", step),
+                                Subject:  srcRange,
+                        })
+                        return cty.DynamicVal, diags
+                }
+
+                diags = append(diags, stepDiags...)
+                if stepDiags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+        }
+
+        return val, diags
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/pos.go b/vendor/github.com/hashicorp/hcl2/hcl/pos.go
index 1a4b329..06db8bf 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/pos.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/pos.go
@@ -31,6 +31,9 @@ type Pos struct {
         Byte int
 }
 
+// InitialPos is a suitable position to use to mark the start of a file.
+var InitialPos = Pos{Byte: 0, Line: 1, Column: 1}
+
 // Range represents a span of characters between two positions in a source
 // file.
 //
@@ -94,6 +97,16 @@ func RangeOver(a, b Range) Range {
         }
 }
 
+// ContainsPos returns true if and only if the given position is contained within
+// the receiving range.
+//
+// In the unlikely case that the line/column information disagree with the byte
+// offset information in the given position or receiving range, the byte
+// offsets are given priority.
+func (r Range) ContainsPos(pos Pos) bool {
+        return r.ContainsOffset(pos.Byte)
+}
+
 // ContainsOffset returns true if and only if the given byte offset is within
 // the receiving Range.
 func (r Range) ContainsOffset(offset int) bool {
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go b/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go
index 7c8f2df..17c0d7c 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go
@@ -29,8 +29,8 @@ type RangeScanner struct {
         err error  // error from last scan, if any
 }
 
-// Create a new RangeScanner for the given buffer, producing ranges for the
-// given filename.
+// NewRangeScanner creates a new RangeScanner for the given buffer, producing
+// ranges for the given filename.
 //
 // Since ranges have grapheme-cluster granularity rather than byte granularity,
 // the scanner will produce incorrect results if the given SplitFunc creates
@@ -39,15 +39,19 @@ type RangeScanner struct {
 // around individual UTF-8 sequences, which will split any multi-sequence
 // grapheme clusters.
 func NewRangeScanner(b []byte, filename string, cb bufio.SplitFunc) *RangeScanner {
+        return NewRangeScannerFragment(b, filename, InitialPos, cb)
+}
+
+// NewRangeScannerFragment is like NewRangeScanner but the ranges it produces
+// will be offset by the given starting position, which is appropriate for
+// sub-slices of a file, whereas NewRangeScanner assumes it is scanning an
+// entire file.
+func NewRangeScannerFragment(b []byte, filename string, start Pos, cb bufio.SplitFunc) *RangeScanner {
         return &RangeScanner{
                 filename: filename,
                 b:        b,
                 cb:       cb,
-                pos: Pos{
-                        Byte:   0,
-                        Line:   1,
-                        Column: 1,
-                },
+                pos:      start,
         }
 }
 
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/spec.md b/vendor/github.com/hashicorp/hcl2/hcl/spec.md
index 58257bf..8bbaff8 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/spec.md
+++ b/vendor/github.com/hashicorp/hcl2/hcl/spec.md
@@ -29,7 +29,7 @@ which are discussed in detail in a later section.
 A _block_ is a nested structure that has a _type name_, zero or more string
 _labels_ (e.g. identifiers), and a nested body.
 
-Together the structural elements create a heirarchical data structure, with
+Together the structural elements create a hierarchical data structure, with
 attributes intended to represent the direct properties of a particular object
 in the calling application, and blocks intended to represent child objects
 of a particular object.
@@ -57,10 +57,10 @@ access to the specific attributes and blocks requested.
 A _body schema_ consists of a list of _attribute schemata_ and
 _block header schemata_:
 
-* An _attribute schema_ provides the name of an attribute and whether its
+- An _attribute schema_ provides the name of an attribute and whether its
   presence is required.
 
-* A _block header schema_ provides a block type name and the semantic names
+- A _block header schema_ provides a block type name and the semantic names
   assigned to each of the labels of that block type, if any.
 
 Within a schema, it is an error to request the same attribute name twice or
@@ -72,11 +72,11 @@ a block whose type name is identical to the attribute name.
 The result of applying a body schema to a body is _body content_, which
 consists of an _attribute map_ and a _block sequence_:
 
-* The _attribute map_ is a map data structure whose keys are attribute names
+- The _attribute map_ is a map data structure whose keys are attribute names
   and whose values are _expressions_ that represent the corresponding attribute
   values.
 
-* The _block sequence_ is an ordered sequence of blocks, with each specifying
+- The _block sequence_ is an ordered sequence of blocks, with each specifying
   a block _type name_, the sequence of _labels_ specified for the block,
   and the body object (not body _content_) representing the block's own body.
 
@@ -132,13 +132,13 @@ the schema has been processed.
 
 Specifically:
 
-* Any attribute whose name is specified in the schema is returned in body
+- Any attribute whose name is specified in the schema is returned in body
   content and elided from the new body.
 
-* Any block whose type is specified in the schema is returned in body content
+- Any block whose type is specified in the schema is returned in body content
   and elided from the new body.
 
-* Any attribute or block _not_ meeting the above conditions is placed into
+- Any attribute or block _not_ meeting the above conditions is placed into
   the new body, unmodified.
 
 The new body can then be recursively processed using any of the body
@@ -168,20 +168,20 @@ In order to obtain a concrete value, each expression must be _evaluated_.
 Evaluation is performed in terms of an evaluation context, which
 consists of the following:
 
-* An _evaluation mode_, which is defined below.
-* A _variable scope_, which provides a set of named variables for use in
+- An _evaluation mode_, which is defined below.
+- A _variable scope_, which provides a set of named variables for use in
   expressions.
-* A _function table_, which provides a set of named functions for use in
+- A _function table_, which provides a set of named functions for use in
   expressions.
 
 The _evaluation mode_ allows for two different interpretations of an
 expression:
 
-* In _literal-only mode_, variables and functions are not available and it
+- In _literal-only mode_, variables and functions are not available and it
   is assumed that the calling application's intent is to treat the attribute
   value as a literal.
 
-* In _full expression mode_, variables and functions are defined and it is
+- In _full expression mode_, variables and functions are defined and it is
   assumed that the calling application wishes to provide a full expression
   language for definition of the attribute value.
 
@@ -235,15 +235,15 @@ for interpretation into any suitable number representation. An implementation
 may in practice implement numbers with limited precision so long as the
 following constraints are met:
 
-* Integers are represented with at least 256 bits.
-* Non-integer numbers are represented as floating point values with a
+- Integers are represented with at least 256 bits.
+- Non-integer numbers are represented as floating point values with a
   mantissa of at least 256 bits and a signed binary exponent of at least
   16 bits.
-* An error is produced if an integer value given in source cannot be
+- An error is produced if an integer value given in source cannot be
   represented precisely.
-* An error is produced if a non-integer value cannot be represented due to
+- An error is produced if a non-integer value cannot be represented due to
   overflow.
-* A non-integer number is rounded to the nearest possible value when a
+- A non-integer number is rounded to the nearest possible value when a
   value is of too high a precision to be represented.
 
 The _number_ type also requires representation of both positive and negative
@@ -265,11 +265,11 @@ _Structural types_ are types that are constructed by combining other types.
 Each distinct combination of other types is itself a distinct type. There
 are two structural type _kinds_:
 
-* _Object types_ are constructed of a set of named attributes, each of which
+- _Object types_ are constructed of a set of named attributes, each of which
   has a type. Attribute names are always strings. (_Object_ attributes are a
   distinct idea from _body_ attributes, though calling applications
   may choose to blur the distinction by use of common naming schemes.)
-* _Tuple tupes_ are constructed of a sequence of elements, each of which
+- _Tuple types_ are constructed of a sequence of elements, each of which
   has a type.
 
 Values of structural types are compared for equality in terms of their
@@ -284,9 +284,9 @@ have attributes or elements with identical types.
 _Collection types_ are types that combine together an arbitrary number of
 values of some other single type. There are three collection type _kinds_:
 
-* _List types_ represent ordered sequences of values of their element type.
-* _Map types_ represent values of their element type accessed via string keys.
-* _Set types_ represent unordered sets of distinct values of their element type.
+- _List types_ represent ordered sequences of values of their element type.
+- _Map types_ represent values of their element type accessed via string keys.
+- _Set types_ represent unordered sets of distinct values of their element type.
 
 For each of these kinds and each distinct element type there is a distinct
 collection type. For example, "list of string" is a distinct type from
@@ -301,10 +301,10 @@ the same element type.
 
 ### Null values
 
-Each type has a null value. The null value of a type represents the absense
+Each type has a null value. The null value of a type represents the absence
 of a value, but with type information retained to allow for type checking.
 
-Null values are used primarily to represent the conditional absense of a
+Null values are used primarily to represent the conditional absence of a
 body attribute. In a syntax with a conditional operator, one of the result
 values of that conditional may be null to indicate that the attribute should be
 considered not present in that case.
@@ -376,9 +376,9 @@ a type has a non-commutative _matches_ relationship with a _type specification_.
 A type specification is, in practice, just a different interpretation of a
 type such that:
 
-* Any type _matches_ any type that it is identical to.
+- Any type _matches_ any type that it is identical to.
 
-* Any type _matches_ the dynamic pseudo-type.
+- Any type _matches_ the dynamic pseudo-type.
 
 For example, given a type specification "list of dynamic pseudo-type", the
 concrete types "list of string" and "list of map" match, but the
@@ -397,51 +397,51 @@ applications to provide functions that are interoperable with all syntaxes.
 
 A _function_ is defined from the following elements:
 
-* Zero or more _positional parameters_, each with a name used for documentation,
+- Zero or more _positional parameters_, each with a name used for documentation,
   a type specification for expected argument values, and a flag for whether
   each of null values, unknown values, and values of the dynamic pseudo-type
   are accepted.
 
-* Zero or one _variadic parameters_, with the same structure as the _positional_
+- Zero or one _variadic parameters_, with the same structure as the _positional_
   parameters, which if present collects any additional arguments provided at
   the function call site.
 
-* A _result type definition_, which specifies the value type returned for each
+- A _result type definition_, which specifies the value type returned for each
   valid sequence of argument values.
 
-* A _result value definition_, which specifies the value returned for each
+- A _result value definition_, which specifies the value returned for each
   valid sequence of argument values.
 
 A _function call_, regardless of source syntax, consists of a sequence of
 argument values. The argument values are each mapped to a corresponding
 parameter as follows:
 
-* For each of the function's positional parameters in sequence, take the next
+- For each of the function's positional parameters in sequence, take the next
   argument. If there are no more arguments, the call is erroneous.
 
-* If the function has a variadic parameter, take all remaining arguments that
+- If the function has a variadic parameter, take all remaining arguments that
   where not yet assigned to a positional parameter and collect them into
   a sequence of variadic arguments that each correspond to the variadic
   parameter.
 
-* If the function has _no_ variadic parameter, it is an error if any arguments
+- If the function has _no_ variadic parameter, it is an error if any arguments
   remain after taking one argument for each positional parameter.
 
 After mapping each argument to a parameter, semantic checking proceeds
 for each argument:
 
-* If the argument value corresponding to a parameter does not match the
+- If the argument value corresponding to a parameter does not match the
   parameter's type specification, the call is erroneous.
 
-* If the argument value corresponding to a parameter is null and the parameter
+- If the argument value corresponding to a parameter is null and the parameter
   is not specified as accepting nulls, the call is erroneous.
 
-* If the argument value corresponding to a parameter is the dynamic value
+- If the argument value corresponding to a parameter is the dynamic value
   and the parameter is not specified as accepting values of the dynamic
   pseudo-type, the call is valid but its _result type_ is forced to be the
   dynamic pseudo type.
 
-* If neither of the above conditions holds for any argument, the call is
+- If neither of the above conditions holds for any argument, the call is
   valid and the function's value type definition is used to determine the
   call's _result type_. A function _may_ vary its result type depending on
   the argument _values_ as well as the argument _types_; for example, a
@@ -450,15 +450,15 @@ for each argument:
 
 If semantic checking succeeds without error, the call is _executed_:
 
-* For each argument, if its value is unknown and its corresponding parameter
+- For each argument, if its value is unknown and its corresponding parameter
   is not specified as accepting unknowns, the _result value_ is forced to be an
   unknown value of the result type.
 
-* If the previous condition does not apply, the function's result value
+- If the previous condition does not apply, the function's result value
   definition is used to determine the call's _result value_.
 
 The result of a function call expression is either an error, if one of the
-erroenous conditions above applies, or the _result value_.
+erroneous conditions above applies, or the _result value_.
 
 ## Type Conversions and Unification
 
@@ -505,7 +505,7 @@ Bidirectional conversions are available between the string and number types,
 and between the string and boolean types.
 
 The bool value true corresponds to the string containing the characters "true",
-while the bool value false corresponds to teh string containing the characters
+while the bool value false corresponds to the string containing the characters
 "false". Conversion from bool to string is safe, while the converse is
 unsafe. The strings "1" and "0" are alternative string representations
 of true and false respectively. It is an error to convert a string other than
@@ -631,20 +631,20 @@ diagnostics if they are applied to inappropriate expressions.
 
 The following are the required static analysis functions:
 
-* **Static List**: Require list/tuple construction syntax to be used and
+- **Static List**: Require list/tuple construction syntax to be used and
   return a list of expressions for each of the elements given.
 
-* **Static Map**: Require map/object construction syntax to be used and
+- **Static Map**: Require map/object construction syntax to be used and
   return a list of key/value pairs -- both expressions -- for each of
   the elements given. The usual constraint that a map key must be a string
   must not apply to this analysis, thus allowing applications to interpret
   arbitrary keys as they see fit.
 
-* **Static Call**: Require function call syntax to be used and return an
+- **Static Call**: Require function call syntax to be used and return an
   object describing the called function name and a list of expressions
   representing each of the call arguments.
 
-* **Static Traversal**: Require a reference to a symbol in the variable
+- **Static Traversal**: Require a reference to a symbol in the variable
   scope and return a description of the path from the root scope to the
   accessed attribute or index.
 
@@ -670,18 +670,18 @@ with the goals of this specification.
 The language-agnosticism of this specification assumes that certain behaviors
 are implemented separately for each syntax:
 
-* Matching of a body schema with the physical elements of a body in the
-  source language, to determine correspondance between physical constructs
+- Matching of a body schema with the physical elements of a body in the
+  source language, to determine correspondence between physical constructs
   and schema elements.
 
-* Implementing the _dynamic attributes_ body processing mode by either
+- Implementing the _dynamic attributes_ body processing mode by either
   interpreting all physical constructs as attributes or producing an error
   if non-attribute constructs are present.
 
-* Providing an evaluation function for all possible expressions that produces
+- Providing an evaluation function for all possible expressions that produces
   a value given an evaluation context.
 
-* Providing the static analysis functionality described above in a manner that
+- Providing the static analysis functionality described above in a manner that
   makes sense within the convention of the syntax.
 
 The suggested implementation strategy is to use an implementation language's
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/structure_at_pos.go b/vendor/github.com/hashicorp/hcl2/hcl/structure_at_pos.go
new file mode 100644
index 0000000..8521814
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/structure_at_pos.go
@@ -0,0 +1,117 @@
+package hcl
+
+// -----------------------------------------------------------------------------
+// The methods in this file all have the general pattern of making a best-effort
+// to find one or more constructs that contain a given source position.
+//
+// These all operate by delegating to an optional method of the same name and
+// signature on the file's root body, allowing each syntax to potentially
+// provide its own implementations of these. For syntaxes that don't implement
+// them, the result is always nil.
+// -----------------------------------------------------------------------------
+
+// BlocksAtPos attempts to find all of the blocks that contain the given
+// position, ordered so that the outermost block is first and the innermost
+// block is last. This is a best-effort method that may not be able to produce
+// a complete result for all positions or for all HCL syntaxes.
+//
+// If the returned slice is non-empty, the first element is guaranteed to
+// represent the same block as would be the result of OutermostBlockAtPos and
+// the last element the result of InnermostBlockAtPos. However, the
+// implementation may return two different objects describing the same block,
+// so comparison by pointer identity is not possible.
+//
+// The result is nil if no blocks at all contain the given position.
+func (f *File) BlocksAtPos(pos Pos) []*Block {
+        // The root body of the file must implement this interface in order
+        // to support BlocksAtPos.
+        type Interface interface {
+                BlocksAtPos(pos Pos) []*Block
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.BlocksAtPos(pos)
+}
+
+// OutermostBlockAtPos attempts to find a top-level block in the receiving file
+// that contains the given position. This is a best-effort method that may not
+// be able to produce a result for all positions or for all HCL syntaxes.
+//
+// The result is nil if no single block could be selected for any reason.
+func (f *File) OutermostBlockAtPos(pos Pos) *Block {
+        // The root body of the file must implement this interface in order
+        // to support OutermostBlockAtPos.
+        type Interface interface {
+                OutermostBlockAtPos(pos Pos) *Block
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.OutermostBlockAtPos(pos)
+}
+
+// InnermostBlockAtPos attempts to find the most deeply-nested block in the
+// receiving file that contains the given position. This is a best-effort
+// method that may not be able to produce a result for all positions or for
+// all HCL syntaxes.
+//
+// The result is nil if no single block could be selected for any reason.
+func (f *File) InnermostBlockAtPos(pos Pos) *Block {
+        // The root body of the file must implement this interface in order
+        // to support InnermostBlockAtPos.
+        type Interface interface {
+                InnermostBlockAtPos(pos Pos) *Block
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.InnermostBlockAtPos(pos)
+}
+
+// OutermostExprAtPos attempts to find an expression in the receiving file
+// that contains the given position. This is a best-effort method that may not
+// be able to produce a result for all positions or for all HCL syntaxes.
+//
+// Since expressions are often nested inside one another, this method returns
+// the outermost "root" expression that is not contained by any other.
+//
+// The result is nil if no single expression could be selected for any reason.
+func (f *File) OutermostExprAtPos(pos Pos) Expression {
+        // The root body of the file must implement this interface in order
+        // to support OutermostExprAtPos.
+        type Interface interface {
+                OutermostExprAtPos(pos Pos) Expression
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.OutermostExprAtPos(pos)
+}
+
+// AttributeAtPos attempts to find an attribute definition in the receiving
+// file that contains the given position. This is a best-effort method that may
+// not be able to produce a result for all positions or for all HCL syntaxes.
+//
+// The result is nil if no single attribute could be selected for any reason.
+func (f *File) AttributeAtPos(pos Pos) *Attribute {
+        // The root body of the file must implement this interface in order
+        // to support OutermostExprAtPos.
+        type Interface interface {
+                AttributeAtPos(pos Pos) *Attribute
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.AttributeAtPos(pos)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/traversal.go b/vendor/github.com/hashicorp/hcl2/hcl/traversal.go
index 24f4c91..d710197 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/traversal.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/traversal.go
@@ -255,66 +255,7 @@ type TraverseAttr struct {
 }
 
 func (tn TraverseAttr) TraversalStep(val cty.Value) (cty.Value, Diagnostics) {
-        if val.IsNull() {
-                return cty.DynamicVal, Diagnostics{
-                        {
-                                Severity: DiagError,
-                                Summary:  "Attempt to get attribute from null value",
-                                Detail:   "This value is null, so it does not have any attributes.",
-                                Subject:  &tn.SrcRange,
-                        },
-                }
-        }
-
-        ty := val.Type()
-        switch {
-        case ty.IsObjectType():
-                if !ty.HasAttribute(tn.Name) {
-                        return cty.DynamicVal, Diagnostics{
-                                {
-                                        Severity: DiagError,
-                                        Summary:  "Unsupported attribute",
-                                        Detail:   fmt.Sprintf("This object does not have an attribute named %q.", tn.Name),
-                                        Subject:  &tn.SrcRange,
-                                },
-                        }
-                }
-
-                if !val.IsKnown() {
-                        return cty.UnknownVal(ty.AttributeType(tn.Name)), nil
-                }
-
-                return val.GetAttr(tn.Name), nil
-        case ty.IsMapType():
-                if !val.IsKnown() {
-                        return cty.UnknownVal(ty.ElementType()), nil
-                }
-
-                idx := cty.StringVal(tn.Name)
-                if val.HasIndex(idx).False() {
-                        return cty.DynamicVal, Diagnostics{
-                                {
-                                        Severity: DiagError,
-                                        Summary:  "Missing map element",
-                                        Detail:   fmt.Sprintf("This map does not have an element with the key %q.", tn.Name),
-                                        Subject:  &tn.SrcRange,
-                                },
-                        }
-                }
-
-                return val.Index(idx), nil
-        case ty == cty.DynamicPseudoType:
-                return cty.DynamicVal, nil
-        default:
-                return cty.DynamicVal, Diagnostics{
-                        {
-                                Severity: DiagError,
-                                Summary:  "Unsupported attribute",
-                                Detail:   "This value does not have any attributes.",
-                                Subject:  &tn.SrcRange,
-                        },
-                }
-        }
+        return GetAttr(val, tn.Name, &tn.SrcRange)
 }
 
 func (tn TraverseAttr) SourceRange() Range {
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go b/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go
index 5f52946..d4a565a 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go
@@ -52,11 +52,14 @@ func AbsTraversalForExpr(expr Expression) (Traversal, Diagnostics) {
 func RelTraversalForExpr(expr Expression) (Traversal, Diagnostics) {
         traversal, diags := AbsTraversalForExpr(expr)
         if len(traversal) > 0 {
+                ret := make(Traversal, len(traversal))
+                copy(ret, traversal)
                 root := traversal[0].(TraverseRoot)
-                traversal[0] = TraverseAttr{
+                ret[0] = TraverseAttr{
                         Name:     root.Name,
                         SrcRange: root.SrcRange,
                 }
+                return ret, diags
         }
         return traversal, diags
 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/public.go b/vendor/github.com/hashicorp/hcl2/hcldec/public.go
index 5d1f10a..3c80363 100644
--- a/vendor/github.com/hashicorp/hcl2/hcldec/public.go
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/public.go
@@ -65,7 +65,10 @@ func ChildBlockTypes(spec Spec) map[string]Spec {
         visit = func(s Spec) {
                 if bs, ok := s.(blockSpec); ok {
                         for _, blockS := range bs.blockHeaderSchemata() {
-                                ret[blockS.Type] = bs.nestedSpec()
+                                nested := bs.nestedSpec()
+                                if nested != nil { // nil can be returned to dynamically opt out of this interface
+                                        ret[blockS.Type] = nested
+                                }
                         }
                 }
 
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/spec.go b/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
index 25cafcd..f9da7f6 100644
--- a/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
@@ -3,6 +3,7 @@ package hcldec
 import (
         "bytes"
         "fmt"
+        "sort"
 
         "github.com/hashicorp/hcl2/hcl"
         "github.com/zclconf/go-cty/cty"
@@ -477,6 +478,44 @@ func (s *BlockListSpec) decode(content *hcl.BodyContent, blockLabels []blockLabe
         if len(elems) == 0 {
                 ret = cty.ListValEmpty(s.Nested.impliedType())
         } else {
+                // Since our target is a list, all of the decoded elements must have the
+                // same type or cty.ListVal will panic below. Different types can arise
+                // if there is an attribute spec of type cty.DynamicPseudoType in the
+                // nested spec; all given values must be convertable to a single type
+                // in order for the result to be considered valid.
+                etys := make([]cty.Type, len(elems))
+                for i, v := range elems {
+                        etys[i] = v.Type()
+                }
+                ety, convs := convert.UnifyUnsafe(etys)
+                if ety == cty.NilType {
+                        // FIXME: This is a pretty terrible error message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Unconsistent argument types in %s blocks", s.TypeName),
+                                Detail:   "Corresponding attributes in all blocks of this type must be the same.",
+                                Subject:  &sourceRanges[0],
+                        })
+                        return cty.DynamicVal, diags
+                }
+                for i, v := range elems {
+                        if convs[i] != nil {
+                                newV, err := convs[i](v)
+                                if err != nil {
+                                        // FIXME: This is a pretty terrible error message.
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  fmt.Sprintf("Unconsistent argument types in %s blocks", s.TypeName),
+                                                Detail:   fmt.Sprintf("Block with index %d has inconsistent argument types: %s.", i, err),
+                                                Subject:  &sourceRanges[i],
+                                        })
+                                        // Bail early here so we won't panic below in cty.ListVal
+                                        return cty.DynamicVal, diags
+                                }
+                                elems[i] = newV
+                        }
+                }
+
                 ret = cty.ListVal(elems)
         }
 
@@ -508,6 +547,127 @@ func (s *BlockListSpec) sourceRange(content *hcl.BodyContent, blockLabels []bloc
         return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
 }
 
+// A BlockTupleSpec is a Spec that produces a cty tuple of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+//
+// This is similar to BlockListSpec, but it permits the nested blocks to have
+// different result types in situations where cty.DynamicPseudoType attributes
+// are present.
+type BlockTupleSpec struct {
+        TypeName string
+        Nested   Spec
+        MinItems int
+        MaxItems int
+}
+
+func (s *BlockTupleSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockTupleSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: findLabelSpecs(s.Nested),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockTupleSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockTupleSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockTupleSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockListSpec with no Nested Spec")
+        }
+
+        var elems []cty.Value
+        var sourceRanges []hcl.Range
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false)
+                diags = append(diags, childDiags...)
+                elems = append(elems, val)
+                sourceRanges = append(sourceRanges, sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested))
+        }
+
+        if len(elems) < s.MinItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Insufficient %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("At least %d %q blocks are required.", s.MinItems, s.TypeName),
+                        Subject:  &content.MissingItemRange,
+                })
+        } else if s.MaxItems > 0 && len(elems) > s.MaxItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Too many %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("No more than %d %q blocks are allowed", s.MaxItems, s.TypeName),
+                        Subject:  &sourceRanges[s.MaxItems],
+                })
+        }
+
+        var ret cty.Value
+
+        if len(elems) == 0 {
+                ret = cty.EmptyTupleVal
+        } else {
+                ret = cty.TupleVal(elems)
+        }
+
+        return ret, diags
+}
+
+func (s *BlockTupleSpec) impliedType() cty.Type {
+        // We can't predict our type, because we don't know how many blocks
+        // there will be until we decode.
+        return cty.DynamicPseudoType
+}
+
+func (s *BlockTupleSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
 // A BlockSetSpec is a Spec that produces a cty set of the results of
 // decoding all of the nested blocks of a given type, using a nested spec.
 type BlockSetSpec struct {
@@ -592,6 +752,44 @@ func (s *BlockSetSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel
         if len(elems) == 0 {
                 ret = cty.SetValEmpty(s.Nested.impliedType())
         } else {
+                // Since our target is a set, all of the decoded elements must have the
+                // same type or cty.SetVal will panic below. Different types can arise
+                // if there is an attribute spec of type cty.DynamicPseudoType in the
+                // nested spec; all given values must be convertable to a single type
+                // in order for the result to be considered valid.
+                etys := make([]cty.Type, len(elems))
+                for i, v := range elems {
+                        etys[i] = v.Type()
+                }
+                ety, convs := convert.UnifyUnsafe(etys)
+                if ety == cty.NilType {
+                        // FIXME: This is a pretty terrible error message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Unconsistent argument types in %s blocks", s.TypeName),
+                                Detail:   "Corresponding attributes in all blocks of this type must be the same.",
+                                Subject:  &sourceRanges[0],
+                        })
+                        return cty.DynamicVal, diags
+                }
+                for i, v := range elems {
+                        if convs[i] != nil {
+                                newV, err := convs[i](v)
+                                if err != nil {
+                                        // FIXME: This is a pretty terrible error message.
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  fmt.Sprintf("Unconsistent argument types in %s blocks", s.TypeName),
+                                                Detail:   fmt.Sprintf("Block with index %d has inconsistent argument types: %s.", i, err),
+                                                Subject:  &sourceRanges[i],
+                                        })
+                                        // Bail early here so we won't panic below in cty.ListVal
+                                        return cty.DynamicVal, diags
+                                }
+                                elems[i] = newV
+                        }
+                }
+
                 ret = cty.SetVal(elems)
         }
 
@@ -672,7 +870,10 @@ func (s *BlockMapSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel
         var diags hcl.Diagnostics
 
         if s.Nested == nil {
-                panic("BlockSetSpec with no Nested Spec")
+                panic("BlockMapSpec with no Nested Spec")
+        }
+        if ImpliedType(s).HasDynamicTypes() {
+                panic("cty.DynamicPseudoType attributes may not be used inside a BlockMapSpec")
         }
 
         elems := map[string]interface{}{}
@@ -765,6 +966,307 @@ func (s *BlockMapSpec) sourceRange(content *hcl.BodyContent, blockLabels []block
         return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
 }
 
+// A BlockObjectSpec is a Spec that produces a cty object of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+//
+// One level of object structure is created for each of the given label names.
+// There must be at least one given label name.
+//
+// This is similar to BlockMapSpec, but it permits the nested blocks to have
+// different result types in situations where cty.DynamicPseudoType attributes
+// are present.
+type BlockObjectSpec struct {
+        TypeName   string
+        LabelNames []string
+        Nested     Spec
+}
+
+func (s *BlockObjectSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockObjectSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: append(s.LabelNames, findLabelSpecs(s.Nested)...),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockObjectSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockObjectSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockObjectSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockObjectSpec with no Nested Spec")
+        }
+
+        elems := map[string]interface{}{}
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                childLabels := labelsForBlock(childBlock)
+                val, _, childDiags := decode(childBlock.Body, childLabels[len(s.LabelNames):], ctx, s.Nested, false)
+                targetMap := elems
+                for _, key := range childBlock.Labels[:len(s.LabelNames)-1] {
+                        if _, exists := targetMap[key]; !exists {
+                                targetMap[key] = make(map[string]interface{})
+                        }
+                        targetMap = targetMap[key].(map[string]interface{})
+                }
+
+                diags = append(diags, childDiags...)
+
+                key := childBlock.Labels[len(s.LabelNames)-1]
+                if _, exists := targetMap[key]; exists {
+                        labelsBuf := bytes.Buffer{}
+                        for _, label := range childBlock.Labels {
+                                fmt.Fprintf(&labelsBuf, " %q", label)
+                        }
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "A block for %s%s was already defined. The %s labels must be unique.",
+                                        s.TypeName, labelsBuf.String(), s.TypeName,
+                                ),
+                                Subject: &childBlock.DefRange,
+                        })
+                        continue
+                }
+
+                targetMap[key] = val
+        }
+
+        if len(elems) == 0 {
+                return cty.EmptyObjectVal, diags
+        }
+
+        var ctyObj func(map[string]interface{}, int) cty.Value
+        ctyObj = func(raw map[string]interface{}, depth int) cty.Value {
+                vals := make(map[string]cty.Value, len(raw))
+                if depth == 1 {
+                        for k, v := range raw {
+                                vals[k] = v.(cty.Value)
+                        }
+                } else {
+                        for k, v := range raw {
+                                vals[k] = ctyObj(v.(map[string]interface{}), depth-1)
+                        }
+                }
+                return cty.ObjectVal(vals)
+        }
+
+        return ctyObj(elems, len(s.LabelNames)), diags
+}
+
+func (s *BlockObjectSpec) impliedType() cty.Type {
+        // We can't predict our type, since we don't know how many blocks are
+        // present and what labels they have until we decode.
+        return cty.DynamicPseudoType
+}
+
+func (s *BlockObjectSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockAttrsSpec is a Spec that interprets a single block as if it were
+// a map of some element type. That is, each attribute within the block
+// becomes a key in the resulting map and the attribute's value becomes the
+// element value, after conversion to the given element type. The resulting
+// value is a cty.Map of the given element type.
+//
+// This spec imposes a validation constraint that there be exactly one block
+// of the given type name and that this block may contain only attributes. The
+// block does not accept any labels.
+//
+// This is an alternative to an AttrSpec of a map type for situations where
+// block syntax is desired. Note that block syntax does not permit dynamic
+// keys, construction of the result via a "for" expression, etc. In most cases
+// an AttrSpec is preferred if the desired result is a map whose keys are
+// chosen by the user rather than by schema.
+type BlockAttrsSpec struct {
+        TypeName    string
+        ElementType cty.Type
+        Required    bool
+}
+
+func (s *BlockAttrsSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+// blockSpec implementation
+func (s *BlockAttrsSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: nil,
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockAttrsSpec) nestedSpec() Spec {
+        // This is an odd case: we aren't actually going to apply a nested spec
+        // in this case, since we're going to interpret the body directly as
+        // attributes, but we need to return something non-nil so that the
+        // decoder will recognize this as a block spec. We won't actually be
+        // using this for anything at decode time.
+        return noopSpec{}
+}
+
+// specNeedingVariables implementation
+func (s *BlockAttrsSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+
+        block, _ := s.findBlock(content)
+        if block == nil {
+                return nil
+        }
+
+        var vars []hcl.Traversal
+
+        attrs, diags := block.Body.JustAttributes()
+        if diags.HasErrors() {
+                return nil
+        }
+
+        for _, attr := range attrs {
+                vars = append(vars, attr.Expr.Variables()...)
+        }
+
+        // We'll return the variables references in source order so that any
+        // error messages that result are also in source order.
+        sort.Slice(vars, func(i, j int) bool {
+                return vars[i].SourceRange().Start.Byte < vars[j].SourceRange().Start.Byte
+        })
+
+        return vars
+}
+
+func (s *BlockAttrsSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        block, other := s.findBlock(content)
+        if block == nil {
+                if s.Required {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Missing %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "A block of type %q is required here.", s.TypeName,
+                                ),
+                                Subject: &content.MissingItemRange,
+                        })
+                }
+                return cty.NullVal(cty.Map(s.ElementType)), diags
+        }
+        if other != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Duplicate %s block", s.TypeName),
+                        Detail: fmt.Sprintf(
+                                "Only one block of type %q is allowed. Previous definition was at %s.",
+                                s.TypeName, block.DefRange.String(),
+                        ),
+                        Subject: &other.DefRange,
+                })
+        }
+
+        attrs, attrDiags := block.Body.JustAttributes()
+        diags = append(diags, attrDiags...)
+
+        if len(attrs) == 0 {
+                return cty.MapValEmpty(s.ElementType), diags
+        }
+
+        vals := make(map[string]cty.Value, len(attrs))
+        for name, attr := range attrs {
+                attrVal, attrDiags := attr.Expr.Value(ctx)
+                diags = append(diags, attrDiags...)
+
+                attrVal, err := convert.Convert(attrVal, s.ElementType)
+                if err != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid attribute value",
+                                Detail:   fmt.Sprintf("Invalid value for attribute of %q block: %s.", s.TypeName, err),
+                                Subject:  attr.Expr.Range().Ptr(),
+                        })
+                        attrVal = cty.UnknownVal(s.ElementType)
+                }
+
+                vals[name] = attrVal
+        }
+
+        return cty.MapVal(vals), diags
+}
+
+func (s *BlockAttrsSpec) impliedType() cty.Type {
+        return cty.Map(s.ElementType)
+}
+
+func (s *BlockAttrsSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        block, _ := s.findBlock(content)
+        if block == nil {
+                return content.MissingItemRange
+        }
+        return block.DefRange
+}
+
+func (s *BlockAttrsSpec) findBlock(content *hcl.BodyContent) (block *hcl.Block, other *hcl.Block) {
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+                if block != nil {
+                        return block, candidate
+                }
+                block = candidate
+        }
+
+        return block, nil
+}
+
 // A BlockLabelSpec is a Spec that returns a cty.String representing the
 // label of the block its given body belongs to, if indeed its given body
 // belongs to a block. It is a programming error to use this in a non-block
@@ -848,6 +1350,16 @@ func findLabelSpecs(spec Spec) []string {
 //
 // The two specifications must have the same implied result type for correct
 // operation. If not, the result is undefined.
+//
+// Any requirements imposed by the "Default" spec apply even if "Primary" does
+// not return null. For example, if the "Default" spec is for a required
+// attribute then that attribute is always required, regardless of the result
+// of the "Primary" spec.
+//
+// The "Default" spec must not describe a nested block, since otherwise the
+// result of ChildBlockTypes would not be decidable without evaluation. If
+// the default spec _does_ describe a nested block then the result is
+// undefined.
 type DefaultSpec struct {
         Primary Spec
         Default Spec
@@ -872,6 +1384,38 @@ func (s *DefaultSpec) impliedType() cty.Type {
         return s.Primary.impliedType()
 }
 
+// attrSpec implementation
+func (s *DefaultSpec) attrSchemata() []hcl.AttributeSchema {
+        // We must pass through the union of both of our nested specs so that
+        // we'll have both values available in the result.
+        var ret []hcl.AttributeSchema
+        if as, ok := s.Primary.(attrSpec); ok {
+                ret = append(ret, as.attrSchemata()...)
+        }
+        if as, ok := s.Default.(attrSpec); ok {
+                ret = append(ret, as.attrSchemata()...)
+        }
+        return ret
+}
+
+// blockSpec implementation
+func (s *DefaultSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        // Only the primary spec may describe a block, since otherwise
+        // our nestedSpec method below can't know which to return.
+        if bs, ok := s.Primary.(blockSpec); ok {
+                return bs.blockHeaderSchemata()
+        }
+        return nil
+}
+
+// blockSpec implementation
+func (s *DefaultSpec) nestedSpec() Spec {
+        if bs, ok := s.Primary.(blockSpec); ok {
+                return bs.nestedSpec()
+        }
+        return nil
+}
+
 func (s *DefaultSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
         // We can't tell from here which of the two specs will ultimately be used
         // in our result, so we'll just assume the first. This is usually the right
@@ -996,3 +1540,28 @@ func (s *TransformFuncSpec) sourceRange(content *hcl.BodyContent, blockLabels []
         // not super-accurate, because there's nothing better to return.
         return s.Wrapped.sourceRange(content, blockLabels)
 }
+
+// noopSpec is a placeholder spec that does nothing, used in situations where
+// a non-nil placeholder spec is required. It is not exported because there is
+// no reason to use it directly; it is always an implementation detail only.
+type noopSpec struct {
+}
+
+func (s noopSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        return cty.NullVal(cty.DynamicPseudoType), nil
+}
+
+func (s noopSpec) impliedType() cty.Type {
+        return cty.DynamicPseudoType
+}
+
+func (s noopSpec) visitSameBodyChildren(cb visitFunc) {
+        // nothing to do
+}
+
+func (s noopSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // No useful range for a noopSpec, and nobody should be calling this anyway.
+        return hcl.Range{
+                Filename: "noopSpec",
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/variables.go b/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
index 427b0d0..7662516 100644
--- a/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
@@ -15,20 +15,22 @@ import (
 // be incomplete, but that's assumed to be okay because the eventual call
 // to Decode will produce error diagnostics anyway.
 func Variables(body hcl.Body, spec Spec) []hcl.Traversal {
+        var vars []hcl.Traversal
         schema := ImpliedSchema(spec)
-
         content, _, _ := body.PartialContent(schema)
 
-        var vars []hcl.Traversal
-
         if vs, ok := spec.(specNeedingVariables); ok {
                 vars = append(vars, vs.variablesNeeded(content)...)
         }
-        spec.visitSameBodyChildren(func(s Spec) {
+
+        var visitFn visitFunc
+        visitFn = func(s Spec) {
                 if vs, ok := s.(specNeedingVariables); ok {
                         vars = append(vars, vs.variablesNeeded(content)...)
                 }
-        })
+                s.visitSameBodyChildren(visitFn)
+        }
+        spec.visitSameBodyChildren(visitFn)
 
         return vars
 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcled/doc.go b/vendor/github.com/hashicorp/hcl2/hcled/doc.go
new file mode 100644
index 0000000..1a80144
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcled/doc.go
@@ -0,0 +1,4 @@
+// Package hcled provides functionality intended to help an application
+// that embeds HCL to deliver relevant information to a text editor or IDE
+// for navigating around and analyzing configuration files.
+package hcled
diff --git a/vendor/github.com/hashicorp/hcl2/hcled/navigation.go b/vendor/github.com/hashicorp/hcl2/hcled/navigation.go
new file mode 100644
index 0000000..5d10cd8
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcled/navigation.go
@@ -0,0 +1,34 @@
+package hcled
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+type contextStringer interface {
+        ContextString(offset int) string
+}
+
+// ContextString returns a string describing the context of the given byte
+// offset, if available. An empty string is returned if no such information
+// is available, or otherwise the returned string is in a form that depends
+// on the language used to write the referenced file.
+func ContextString(file *hcl.File, offset int) string {
+        if cser, ok := file.Nav.(contextStringer); ok {
+                return cser.ContextString(offset)
+        }
+        return ""
+}
+
+type contextDefRanger interface {
+        ContextDefRange(offset int) hcl.Range
+}
+
+func ContextDefRange(file *hcl.File, offset int) hcl.Range {
+        if cser, ok := file.Nav.(contextDefRanger); ok {
+                defRange := cser.ContextDefRange(offset)
+                if !defRange.Empty() {
+                        return defRange
+                }
+        }
+        return file.Body.MissingItemRange()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast.go
new file mode 100644
index 0000000..0904165
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast.go
@@ -0,0 +1,121 @@
+package hclwrite
+
+import (
+        "bytes"
+        "io"
+)
+
+type File struct {
+        inTree
+
+        srcBytes []byte
+        body     *node
+}
+
+// NewEmptyFile constructs a new file with no content, ready to be mutated
+// by other calls that append to its body.
+func NewEmptyFile() *File {
+        f := &File{
+                inTree: newInTree(),
+        }
+        body := newBody()
+        f.body = f.children.Append(body)
+        return f
+}
+
+// Body returns the root body of the file, which contains the top-level
+// attributes and blocks.
+func (f *File) Body() *Body {
+        return f.body.content.(*Body)
+}
+
+// WriteTo writes the tokens underlying the receiving file to the given writer.
+//
+// The tokens first have a simple formatting pass applied that adjusts only
+// the spaces between them.
+func (f *File) WriteTo(wr io.Writer) (int64, error) {
+        tokens := f.inTree.children.BuildTokens(nil)
+        format(tokens)
+        return tokens.WriteTo(wr)
+}
+
+// Bytes returns a buffer containing the source code resulting from the
+// tokens underlying the receiving file. If any updates have been made via
+// the AST API, these will be reflected in the result.
+func (f *File) Bytes() []byte {
+        buf := &bytes.Buffer{}
+        f.WriteTo(buf)
+        return buf.Bytes()
+}
+
+type comments struct {
+        leafNode
+
+        parent *node
+        tokens Tokens
+}
+
+func newComments(tokens Tokens) *comments {
+        return &comments{
+                tokens: tokens,
+        }
+}
+
+func (c *comments) BuildTokens(to Tokens) Tokens {
+        return c.tokens.BuildTokens(to)
+}
+
+type identifier struct {
+        leafNode
+
+        parent *node
+        token  *Token
+}
+
+func newIdentifier(token *Token) *identifier {
+        return &identifier{
+                token: token,
+        }
+}
+
+func (i *identifier) BuildTokens(to Tokens) Tokens {
+        return append(to, i.token)
+}
+
+func (i *identifier) hasName(name string) bool {
+        return name == string(i.token.Bytes)
+}
+
+type number struct {
+        leafNode
+
+        parent *node
+        token  *Token
+}
+
+func newNumber(token *Token) *number {
+        return &number{
+                token: token,
+        }
+}
+
+func (n *number) BuildTokens(to Tokens) Tokens {
+        return append(to, n.token)
+}
+
+type quoted struct {
+        leafNode
+
+        parent *node
+        tokens Tokens
+}
+
+func newQuoted(tokens Tokens) *quoted {
+        return &quoted{
+                tokens: tokens,
+        }
+}
+
+func (q *quoted) BuildTokens(to Tokens) Tokens {
+        return q.tokens.BuildTokens(to)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast_attribute.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_attribute.go
new file mode 100644
index 0000000..975fa74
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_attribute.go
@@ -0,0 +1,48 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+type Attribute struct {
+        inTree
+
+        leadComments *node
+        name         *node
+        expr         *node
+        lineComments *node
+}
+
+func newAttribute() *Attribute {
+        return &Attribute{
+                inTree: newInTree(),
+        }
+}
+
+func (a *Attribute) init(name string, expr *Expression) {
+        expr.assertUnattached()
+
+        nameTok := newIdentToken(name)
+        nameObj := newIdentifier(nameTok)
+        a.leadComments = a.children.Append(newComments(nil))
+        a.name = a.children.Append(nameObj)
+        a.children.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenEqual,
+                        Bytes: []byte{'='},
+                },
+        })
+        a.expr = a.children.Append(expr)
+        a.expr.list = a.children
+        a.lineComments = a.children.Append(newComments(nil))
+        a.children.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenNewline,
+                        Bytes: []byte{'\n'},
+                },
+        })
+}
+
+func (a *Attribute) Expr() *Expression {
+        return a.expr.content.(*Expression)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast_block.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_block.go
new file mode 100644
index 0000000..d5fd32b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_block.go
@@ -0,0 +1,74 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type Block struct {
+        inTree
+
+        leadComments *node
+        typeName     *node
+        labels       nodeSet
+        open         *node
+        body         *node
+        close        *node
+}
+
+func newBlock() *Block {
+        return &Block{
+                inTree: newInTree(),
+                labels: newNodeSet(),
+        }
+}
+
+// NewBlock constructs a new, empty block with the given type name and labels.
+func NewBlock(typeName string, labels []string) *Block {
+        block := newBlock()
+        block.init(typeName, labels)
+        return block
+}
+
+func (b *Block) init(typeName string, labels []string) {
+        nameTok := newIdentToken(typeName)
+        nameObj := newIdentifier(nameTok)
+        b.leadComments = b.children.Append(newComments(nil))
+        b.typeName = b.children.Append(nameObj)
+        for _, label := range labels {
+                labelToks := TokensForValue(cty.StringVal(label))
+                labelObj := newQuoted(labelToks)
+                labelNode := b.children.Append(labelObj)
+                b.labels.Add(labelNode)
+        }
+        b.open = b.children.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenOBrace,
+                        Bytes: []byte{'{'},
+                },
+                {
+                        Type:  hclsyntax.TokenNewline,
+                        Bytes: []byte{'\n'},
+                },
+        })
+        body := newBody() // initially totally empty; caller can append to it subsequently
+        b.body = b.children.Append(body)
+        b.close = b.children.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenCBrace,
+                        Bytes: []byte{'}'},
+                },
+                {
+                        Type:  hclsyntax.TokenNewline,
+                        Bytes: []byte{'\n'},
+                },
+        })
+}
+
+// Body returns the body that represents the content of the receiving block.
+//
+// Appending to or otherwise modifying this body will make changes to the
+// tokens that are generated between the blocks open and close braces.
+func (b *Block) Body() *Body {
+        return b.body.content.(*Body)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast_body.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_body.go
new file mode 100644
index 0000000..cf69fee
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_body.go
@@ -0,0 +1,153 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type Body struct {
+        inTree
+
+        items nodeSet
+}
+
+func newBody() *Body {
+        return &Body{
+                inTree: newInTree(),
+                items:  newNodeSet(),
+        }
+}
+
+func (b *Body) appendItem(c nodeContent) *node {
+        nn := b.children.Append(c)
+        b.items.Add(nn)
+        return nn
+}
+
+func (b *Body) appendItemNode(nn *node) *node {
+        nn.assertUnattached()
+        b.children.AppendNode(nn)
+        b.items.Add(nn)
+        return nn
+}
+
+// Clear removes all of the items from the body, making it empty.
+func (b *Body) Clear() {
+        b.children.Clear()
+}
+
+func (b *Body) AppendUnstructuredTokens(ts Tokens) {
+        b.inTree.children.Append(ts)
+}
+
+// Attributes returns a new map of all of the attributes in the body, with
+// the attribute names as the keys.
+func (b *Body) Attributes() map[string]*Attribute {
+        ret := make(map[string]*Attribute)
+        for n := range b.items {
+                if attr, isAttr := n.content.(*Attribute); isAttr {
+                        nameObj := attr.name.content.(*identifier)
+                        name := string(nameObj.token.Bytes)
+                        ret[name] = attr
+                }
+        }
+        return ret
+}
+
+// Blocks returns a new slice of all the blocks in the body.
+func (b *Body) Blocks() []*Block {
+        ret := make([]*Block, 0, len(b.items))
+        for n := range b.items {
+                if block, isBlock := n.content.(*Block); isBlock {
+                        ret = append(ret, block)
+                }
+        }
+        return ret
+}
+
+// GetAttribute returns the attribute from the body that has the given name,
+// or returns nil if there is currently no matching attribute.
+func (b *Body) GetAttribute(name string) *Attribute {
+        for n := range b.items {
+                if attr, isAttr := n.content.(*Attribute); isAttr {
+                        nameObj := attr.name.content.(*identifier)
+                        if nameObj.hasName(name) {
+                                // We've found it!
+                                return attr
+                        }
+                }
+        }
+
+        return nil
+}
+
+// SetAttributeValue either replaces the expression of an existing attribute
+// of the given name or adds a new attribute definition to the end of the block.
+//
+// The value is given as a cty.Value, and must therefore be a literal. To set
+// a variable reference or other traversal, use SetAttributeTraversal.
+//
+// The return value is the attribute that was either modified in-place or
+// created.
+func (b *Body) SetAttributeValue(name string, val cty.Value) *Attribute {
+        attr := b.GetAttribute(name)
+        expr := NewExpressionLiteral(val)
+        if attr != nil {
+                attr.expr = attr.expr.ReplaceWith(expr)
+        } else {
+                attr := newAttribute()
+                attr.init(name, expr)
+                b.appendItem(attr)
+        }
+        return attr
+}
+
+// SetAttributeTraversal either replaces the expression of an existing attribute
+// of the given name or adds a new attribute definition to the end of the body.
+//
+// The new expression is given as a hcl.Traversal, which must be an absolute
+// traversal. To set a literal value, use SetAttributeValue.
+//
+// The return value is the attribute that was either modified in-place or
+// created.
+func (b *Body) SetAttributeTraversal(name string, traversal hcl.Traversal) *Attribute {
+        attr := b.GetAttribute(name)
+        expr := NewExpressionAbsTraversal(traversal)
+        if attr != nil {
+                attr.expr = attr.expr.ReplaceWith(expr)
+        } else {
+                attr := newAttribute()
+                attr.init(name, expr)
+                b.appendItem(attr)
+        }
+        return attr
+}
+
+// AppendBlock appends an existing block (which must not be already attached
+// to a body) to the end of the receiving body.
+func (b *Body) AppendBlock(block *Block) *Block {
+        b.appendItem(block)
+        return block
+}
+
+// AppendNewBlock appends a new nested block to the end of the receiving body
+// with the given type name and labels.
+func (b *Body) AppendNewBlock(typeName string, labels []string) *Block {
+        block := newBlock()
+        block.init(typeName, labels)
+        b.appendItem(block)
+        return block
+}
+
+// AppendNewline appends a newline token to th end of the receiving body,
+// which generally serves as a separator between different sets of body
+// contents.
+func (b *Body) AppendNewline() {
+        b.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenNewline,
+                        Bytes: []byte{'\n'},
+                },
+        })
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast_expression.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_expression.go
new file mode 100644
index 0000000..62d89fb
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_expression.go
@@ -0,0 +1,201 @@
+package hclwrite
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type Expression struct {
+        inTree
+
+        absTraversals nodeSet
+}
+
+func newExpression() *Expression {
+        return &Expression{
+                inTree:        newInTree(),
+                absTraversals: newNodeSet(),
+        }
+}
+
+// NewExpressionLiteral constructs an an expression that represents the given
+// literal value.
+//
+// Since an unknown value cannot be represented in source code, this function
+// will panic if the given value is unknown or contains a nested unknown value.
+// Use val.IsWhollyKnown before calling to be sure.
+//
+// HCL native syntax does not directly represent lists, maps, and sets, and
+// instead relies on the automatic conversions to those collection types from
+// either list or tuple constructor syntax. Therefore converting collection
+// values to source code and re-reading them will lose type information, and
+// the reader must provide a suitable type at decode time to recover the
+// original value.
+func NewExpressionLiteral(val cty.Value) *Expression {
+        toks := TokensForValue(val)
+        expr := newExpression()
+        expr.children.AppendUnstructuredTokens(toks)
+        return expr
+}
+
+// NewExpressionAbsTraversal constructs an expression that represents the
+// given traversal, which must be absolute or this function will panic.
+func NewExpressionAbsTraversal(traversal hcl.Traversal) *Expression {
+        if traversal.IsRelative() {
+                panic("can't construct expression from relative traversal")
+        }
+
+        physT := newTraversal()
+        rootName := traversal.RootName()
+        steps := traversal[1:]
+
+        {
+                tn := newTraverseName()
+                tn.name = tn.children.Append(newIdentifier(&Token{
+                        Type:  hclsyntax.TokenIdent,
+                        Bytes: []byte(rootName),
+                }))
+                physT.steps.Add(physT.children.Append(tn))
+        }
+
+        for _, step := range steps {
+                switch ts := step.(type) {
+                case hcl.TraverseAttr:
+                        tn := newTraverseName()
+                        tn.children.AppendUnstructuredTokens(Tokens{
+                                {
+                                        Type:  hclsyntax.TokenDot,
+                                        Bytes: []byte{'.'},
+                                },
+                        })
+                        tn.name = tn.children.Append(newIdentifier(&Token{
+                                Type:  hclsyntax.TokenIdent,
+                                Bytes: []byte(ts.Name),
+                        }))
+                        physT.steps.Add(physT.children.Append(tn))
+                case hcl.TraverseIndex:
+                        ti := newTraverseIndex()
+                        ti.children.AppendUnstructuredTokens(Tokens{
+                                {
+                                        Type:  hclsyntax.TokenOBrack,
+                                        Bytes: []byte{'['},
+                                },
+                        })
+                        indexExpr := NewExpressionLiteral(ts.Key)
+                        ti.key = ti.children.Append(indexExpr)
+                        ti.children.AppendUnstructuredTokens(Tokens{
+                                {
+                                        Type:  hclsyntax.TokenCBrack,
+                                        Bytes: []byte{']'},
+                                },
+                        })
+                        physT.steps.Add(physT.children.Append(ti))
+                }
+        }
+
+        expr := newExpression()
+        expr.absTraversals.Add(expr.children.Append(physT))
+        return expr
+}
+
+// Variables returns the absolute traversals that exist within the receiving
+// expression.
+func (e *Expression) Variables() []*Traversal {
+        nodes := e.absTraversals.List()
+        ret := make([]*Traversal, len(nodes))
+        for i, node := range nodes {
+                ret[i] = node.content.(*Traversal)
+        }
+        return ret
+}
+
+// RenameVariablePrefix examines each of the absolute traversals in the
+// receiving expression to see if they have the given sequence of names as
+// a prefix prefix. If so, they are updated in place to have the given
+// replacement names instead of that prefix.
+//
+// This can be used to implement symbol renaming. The calling application can
+// visit all relevant expressions in its input and apply the same renaming
+// to implement a global symbol rename.
+//
+// The search and replacement traversals must be the same length, or this
+// method will panic. Only attribute access operations can be matched and
+// replaced. Index steps never match the prefix.
+func (e *Expression) RenameVariablePrefix(search, replacement []string) {
+        if len(search) != len(replacement) {
+                panic(fmt.Sprintf("search and replacement length mismatch (%d and %d)", len(search), len(replacement)))
+        }
+Traversals:
+        for node := range e.absTraversals {
+                traversal := node.content.(*Traversal)
+                if len(traversal.steps) < len(search) {
+                        // If it's shorter then it can't have our prefix
+                        continue
+                }
+
+                stepNodes := traversal.steps.List()
+                for i, name := range search {
+                        step, isName := stepNodes[i].content.(*TraverseName)
+                        if !isName {
+                                continue Traversals // only name nodes can match
+                        }
+                        foundNameBytes := step.name.content.(*identifier).token.Bytes
+                        if len(foundNameBytes) != len(name) {
+                                continue Traversals
+                        }
+                        if string(foundNameBytes) != name {
+                                continue Traversals
+                        }
+                }
+
+                // If we get here then the prefix matched, so now we'll swap in
+                // the replacement strings.
+                for i, name := range replacement {
+                        step := stepNodes[i].content.(*TraverseName)
+                        token := step.name.content.(*identifier).token
+                        token.Bytes = []byte(name)
+                }
+        }
+}
+
+// Traversal represents a sequence of variable, attribute, and/or index
+// operations.
+type Traversal struct {
+        inTree
+
+        steps nodeSet
+}
+
+func newTraversal() *Traversal {
+        return &Traversal{
+                inTree: newInTree(),
+                steps:  newNodeSet(),
+        }
+}
+
+type TraverseName struct {
+        inTree
+
+        name *node
+}
+
+func newTraverseName() *TraverseName {
+        return &TraverseName{
+                inTree: newInTree(),
+        }
+}
+
+type TraverseIndex struct {
+        inTree
+
+        key *node
+}
+
+func newTraverseIndex() *TraverseIndex {
+        return &TraverseIndex{
+                inTree: newInTree(),
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/doc.go b/vendor/github.com/hashicorp/hcl2/hclwrite/doc.go
new file mode 100644
index 0000000..56d5b77
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/doc.go
@@ -0,0 +1,11 @@
+// Package hclwrite deals with the problem of generating HCL configuration
+// and of making specific surgical changes to existing HCL configurations.
+//
+// It operates at a different level of abstraction than the main HCL parser
+// and AST, since details such as the placement of comments and newlines
+// are preserved when unchanged.
+//
+// The hclwrite API follows a similar principle to XML/HTML DOM, allowing nodes
+// to be read out, created and inserted, etc. Nodes represent syntax constructs
+// rather than semantic concepts.
+package hclwrite
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/format.go b/vendor/github.com/hashicorp/hcl2/hclwrite/format.go
new file mode 100644
index 0000000..f20ae23
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/format.go
@@ -0,0 +1,492 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+var inKeyword = hclsyntax.Keyword([]byte{'i', 'n'})
+
+// placeholder token used when we don't have a token but we don't want
+// to pass a real "nil" and complicate things with nil pointer checks
+var nilToken = &Token{
+        Type:         hclsyntax.TokenNil,
+        Bytes:        []byte{},
+        SpacesBefore: 0,
+}
+
+// format rewrites tokens within the given sequence, in-place, to adjust the
+// whitespace around their content to achieve canonical formatting.
+func format(tokens Tokens) {
+        // Formatting is a multi-pass process. More details on the passes below,
+        // but this is the overview:
+        // - adjust the leading space on each line to create appropriate
+        //   indentation
+        // - adjust spaces between tokens in a single cell using a set of rules
+        // - adjust the leading space in the "assign" and "comment" cells on each
+        //   line to vertically align with neighboring lines.
+        // All of these steps operate in-place on the given tokens, so a caller
+        // may collect a flat sequence of all of the tokens underlying an AST
+        // and pass it here and we will then indirectly modify the AST itself.
+        // Formatting must change only whitespace. Specifically, that means
+        // changing the SpacesBefore attribute on a token while leaving the
+        // other token attributes unchanged.
+
+        lines := linesForFormat(tokens)
+        formatIndent(lines)
+        formatSpaces(lines)
+        formatCells(lines)
+}
+
+func formatIndent(lines []formatLine) {
+        // Our methodology for indents is to take the input one line at a time
+        // and count the bracketing delimiters on each line. If a line has a net
+        // increase in open brackets, we increase the indent level by one and
+        // remember how many new openers we had. If the line has a net _decrease_,
+        // we'll compare it to the most recent number of openers and decrease the
+        // dedent level by one each time we pass an indent level remembered
+        // earlier.
+        // The "indent stack" used here allows for us to recognize degenerate
+        // input where brackets are not symmetrical within lines and avoid
+        // pushing things too far left or right, creating confusion.
+
+        // We'll start our indent stack at a reasonable capacity to minimize the
+        // chance of us needing to grow it; 10 here means 10 levels of indent,
+        // which should be more than enough for reasonable HCL uses.
+        indents := make([]int, 0, 10)
+
+        inHeredoc := false
+        for i := range lines {
+                line := &lines[i]
+                if len(line.lead) == 0 {
+                        continue
+                }
+
+                if inHeredoc {
+                        for _, token := range line.lead {
+                                if token.Type == hclsyntax.TokenCHeredoc {
+                                        inHeredoc = false
+                                }
+                        }
+                        continue // don't touch indentation inside heredocs
+                }
+
+                if line.lead[0].Type == hclsyntax.TokenNewline {
+                        // Never place spaces before a newline
+                        line.lead[0].SpacesBefore = 0
+                        continue
+                }
+
+                netBrackets := 0
+                for _, token := range line.lead {
+                        netBrackets += tokenBracketChange(token)
+                        if token.Type == hclsyntax.TokenOHeredoc {
+                                inHeredoc = true
+                        }
+                }
+                for _, token := range line.assign {
+                        netBrackets += tokenBracketChange(token)
+                }
+
+                switch {
+                case netBrackets > 0:
+                        line.lead[0].SpacesBefore = 2 * len(indents)
+                        indents = append(indents, netBrackets)
+                case netBrackets < 0:
+                        closed := -netBrackets
+                        for closed > 0 && len(indents) > 0 {
+                                switch {
+
+                                case closed > indents[len(indents)-1]:
+                                        closed -= indents[len(indents)-1]
+                                        indents = indents[:len(indents)-1]
+
+                                case closed < indents[len(indents)-1]:
+                                        indents[len(indents)-1] -= closed
+                                        closed = 0
+
+                                default:
+                                        indents = indents[:len(indents)-1]
+                                        closed = 0
+                                }
+                        }
+                        line.lead[0].SpacesBefore = 2 * len(indents)
+                default:
+                        line.lead[0].SpacesBefore = 2 * len(indents)
+                }
+        }
+}
+
+func formatSpaces(lines []formatLine) {
+        for _, line := range lines {
+                for i, token := range line.lead {
+                        var before, after *Token
+                        if i > 0 {
+                                before = line.lead[i-1]
+                        } else {
+                                before = nilToken
+                        }
+                        if i < (len(line.lead) - 1) {
+                                after = line.lead[i+1]
+                        } else {
+                                after = nilToken
+                        }
+                        if spaceAfterToken(token, before, after) {
+                                after.SpacesBefore = 1
+                        } else {
+                                after.SpacesBefore = 0
+                        }
+                }
+                for i, token := range line.assign {
+                        if i == 0 {
+                                // first token in "assign" always has one space before to
+                                // separate the equals sign from what it's assigning.
+                                token.SpacesBefore = 1
+                        }
+
+                        var before, after *Token
+                        if i > 0 {
+                                before = line.assign[i-1]
+                        } else {
+                                before = nilToken
+                        }
+                        if i < (len(line.assign) - 1) {
+                                after = line.assign[i+1]
+                        } else {
+                                after = nilToken
+                        }
+                        if spaceAfterToken(token, before, after) {
+                                after.SpacesBefore = 1
+                        } else {
+                                after.SpacesBefore = 0
+                        }
+                }
+
+        }
+}
+
+func formatCells(lines []formatLine) {
+
+        chainStart := -1
+        maxColumns := 0
+
+        // We'll deal with the "assign" cell first, since moving that will
+        // also impact the "comment" cell.
+        closeAssignChain := func(i int) {
+                for _, chainLine := range lines[chainStart:i] {
+                        columns := chainLine.lead.Columns()
+                        spaces := (maxColumns - columns) + 1
+                        chainLine.assign[0].SpacesBefore = spaces
+                }
+                chainStart = -1
+                maxColumns = 0
+        }
+        for i, line := range lines {
+                if line.assign == nil {
+                        if chainStart != -1 {
+                                closeAssignChain(i)
+                        }
+                } else {
+                        if chainStart == -1 {
+                                chainStart = i
+                        }
+                        columns := line.lead.Columns()
+                        if columns > maxColumns {
+                                maxColumns = columns
+                        }
+                }
+        }
+        if chainStart != -1 {
+                closeAssignChain(len(lines))
+        }
+
+        // Now we'll deal with the comments
+        closeCommentChain := func(i int) {
+                for _, chainLine := range lines[chainStart:i] {
+                        columns := chainLine.lead.Columns() + chainLine.assign.Columns()
+                        spaces := (maxColumns - columns) + 1
+                        chainLine.comment[0].SpacesBefore = spaces
+                }
+                chainStart = -1
+                maxColumns = 0
+        }
+        for i, line := range lines {
+                if line.comment == nil {
+                        if chainStart != -1 {
+                                closeCommentChain(i)
+                        }
+                } else {
+                        if chainStart == -1 {
+                                chainStart = i
+                        }
+                        columns := line.lead.Columns() + line.assign.Columns()
+                        if columns > maxColumns {
+                                maxColumns = columns
+                        }
+                }
+        }
+        if chainStart != -1 {
+                closeCommentChain(len(lines))
+        }
+
+}
+
+// spaceAfterToken decides whether a particular subject token should have a
+// space after it when surrounded by the given before and after tokens.
+// "before" can be TokenNil, if the subject token is at the start of a sequence.
+func spaceAfterToken(subject, before, after *Token) bool {
+        switch {
+
+        case after.Type == hclsyntax.TokenNewline || after.Type == hclsyntax.TokenNil:
+                // Never add spaces before a newline
+                return false
+
+        case subject.Type == hclsyntax.TokenIdent && after.Type == hclsyntax.TokenOParen:
+                // Don't split a function name from open paren in a call
+                return false
+
+        case subject.Type == hclsyntax.TokenDot || after.Type == hclsyntax.TokenDot:
+                // Don't use spaces around attribute access dots
+                return false
+
+        case after.Type == hclsyntax.TokenComma || after.Type == hclsyntax.TokenEllipsis:
+                // No space right before a comma or ... in an argument list
+                return false
+
+        case subject.Type == hclsyntax.TokenComma:
+                // Always a space after a comma
+                return true
+
+        case subject.Type == hclsyntax.TokenQuotedLit || subject.Type == hclsyntax.TokenStringLit || subject.Type == hclsyntax.TokenOQuote || subject.Type == hclsyntax.TokenOHeredoc || after.Type == hclsyntax.TokenQuotedLit || after.Type == hclsyntax.TokenStringLit || after.Type == hclsyntax.TokenCQuote || after.Type == hclsyntax.TokenCHeredoc:
+                // No extra spaces within templates
+                return false
+
+        case inKeyword.TokenMatches(subject.asHCLSyntax()) && before.Type == hclsyntax.TokenIdent:
+                // This is a special case for inside for expressions where a user
+                // might want to use a literal tuple constructor:
+                // [for x in [foo]: x]
+                // ... in that case, we would normally produce in[foo] thinking that
+                // in is a reference, but we'll recognize it as a keyword here instead
+                // to make the result less confusing.
+                return true
+
+        case after.Type == hclsyntax.TokenOBrack && (subject.Type == hclsyntax.TokenIdent || subject.Type == hclsyntax.TokenNumberLit || tokenBracketChange(subject) < 0):
+                return false
+
+        case subject.Type == hclsyntax.TokenMinus:
+                // Since a minus can either be subtraction or negation, and the latter
+                // should _not_ have a space after it, we need to use some heuristics
+                // to decide which case this is.
+                // We guess that we have a negation if the token before doesn't look
+                // like it could be the end of an expression.
+
+                switch before.Type {
+
+                case hclsyntax.TokenNil:
+                        // Minus at the start of input must be a negation
+                        return false
+
+                case hclsyntax.TokenOParen, hclsyntax.TokenOBrace, hclsyntax.TokenOBrack, hclsyntax.TokenEqual, hclsyntax.TokenColon, hclsyntax.TokenComma, hclsyntax.TokenQuestion:
+                        // Minus immediately after an opening bracket or separator must be a negation.
+                        return false
+
+                case hclsyntax.TokenPlus, hclsyntax.TokenStar, hclsyntax.TokenSlash, hclsyntax.TokenPercent, hclsyntax.TokenMinus:
+                        // Minus immediately after another arithmetic operator must be negation.
+                        return false
+
+                case hclsyntax.TokenEqualOp, hclsyntax.TokenNotEqual, hclsyntax.TokenGreaterThan, hclsyntax.TokenGreaterThanEq, hclsyntax.TokenLessThan, hclsyntax.TokenLessThanEq:
+                        // Minus immediately after another comparison operator must be negation.
+                        return false
+
+                case hclsyntax.TokenAnd, hclsyntax.TokenOr, hclsyntax.TokenBang:
+                        // Minus immediately after logical operator doesn't make sense but probably intended as negation.
+                        return false
+
+                default:
+                        return true
+                }
+
+        case subject.Type == hclsyntax.TokenOBrace || after.Type == hclsyntax.TokenCBrace:
+                // Unlike other bracket types, braces have spaces on both sides of them,
+                // both in single-line nested blocks foo { bar = baz } and in object
+                // constructor expressions foo = { bar = baz }.
+                if subject.Type == hclsyntax.TokenOBrace && after.Type == hclsyntax.TokenCBrace {
+                        // An open brace followed by a close brace is an exception, however.
+                        // e.g. foo {} rather than foo { }
+                        return false
+                }
+                return true
+
+        // In the unlikely event that an interpolation expression is just
+        // a single object constructor, we'll put a space between the ${ and
+        // the following { to make this more obvious, and then the same
+        // thing for the two braces at the end.
+        case (subject.Type == hclsyntax.TokenTemplateInterp || subject.Type == hclsyntax.TokenTemplateControl) && after.Type == hclsyntax.TokenOBrace:
+                return true
+        case subject.Type == hclsyntax.TokenCBrace && after.Type == hclsyntax.TokenTemplateSeqEnd:
+                return true
+
+        // Don't add spaces between interpolated items
+        case subject.Type == hclsyntax.TokenTemplateSeqEnd && after.Type == hclsyntax.TokenTemplateInterp:
+                return false
+
+        case tokenBracketChange(subject) > 0:
+                // No spaces after open brackets
+                return false
+
+        case tokenBracketChange(after) < 0:
+                // No spaces before close brackets
+                return false
+
+        default:
+                // Most tokens are space-separated
+                return true
+
+        }
+}
+
+func linesForFormat(tokens Tokens) []formatLine {
+        if len(tokens) == 0 {
+                return make([]formatLine, 0)
+        }
+
+        // first we'll count our lines, so we can allocate the array for them in
+        // a single block. (We want to minimize memory pressure in this codepath,
+        // so it can be run somewhat-frequently by editor integrations.)
+        lineCount := 1 // if there are zero newlines then there is one line
+        for _, tok := range tokens {
+                if tokenIsNewline(tok) {
+                        lineCount++
+                }
+        }
+
+        // To start, we'll just put everything in the "lead" cell on each line,
+        // and then do another pass over the lines afterwards to adjust.
+        lines := make([]formatLine, lineCount)
+        li := 0
+        lineStart := 0
+        for i, tok := range tokens {
+                if tok.Type == hclsyntax.TokenEOF {
+                        // The EOF token doesn't belong to any line, and terminates the
+                        // token sequence.
+                        lines[li].lead = tokens[lineStart:i]
+                        break
+                }
+
+                if tokenIsNewline(tok) {
+                        lines[li].lead = tokens[lineStart : i+1]
+                        lineStart = i + 1
+                        li++
+                }
+        }
+
+        // If a set of tokens doesn't end in TokenEOF (e.g. because it's a
+        // fragment of tokens from the middle of a file) then we might fall
+        // out here with a line still pending.
+        if lineStart < len(tokens) {
+                lines[li].lead = tokens[lineStart:]
+                if lines[li].lead[len(lines[li].lead)-1].Type == hclsyntax.TokenEOF {
+                        lines[li].lead = lines[li].lead[:len(lines[li].lead)-1]
+                }
+        }
+
+        // Now we'll pick off any trailing comments and attribute assignments
+        // to shuffle off into the "comment" and "assign" cells.
+        inHeredoc := false
+        for i := range lines {
+                line := &lines[i]
+                if len(line.lead) == 0 {
+                        // if the line is empty then there's nothing for us to do
+                        // (this should happen only for the final line, because all other
+                        // lines would have a newline token of some kind)
+                        continue
+                }
+
+                if inHeredoc {
+                        for _, tok := range line.lead {
+                                if tok.Type == hclsyntax.TokenCHeredoc {
+                                        inHeredoc = false
+                                        break
+                                }
+                        }
+                        // Inside a heredoc everything is "lead", even if there's a
+                        // template interpolation embedded in there that might otherwise
+                        // confuse our logic below.
+                        continue
+                }
+
+                for _, tok := range line.lead {
+                        if tok.Type == hclsyntax.TokenOHeredoc {
+                                inHeredoc = true
+                                break
+                        }
+                }
+
+                if len(line.lead) > 1 && line.lead[len(line.lead)-1].Type == hclsyntax.TokenComment {
+                        line.comment = line.lead[len(line.lead)-1:]
+                        line.lead = line.lead[:len(line.lead)-1]
+                }
+
+                for i, tok := range line.lead {
+                        if i > 0 && tok.Type == hclsyntax.TokenEqual {
+                                // We only move the tokens into "assign" if the RHS seems to
+                                // be a whole expression, which we determine by counting
+                                // brackets. If there's a net positive number of brackets
+                                // then that suggests we're introducing a multi-line expression.
+                                netBrackets := 0
+                                for _, token := range line.lead[i:] {
+                                        netBrackets += tokenBracketChange(token)
+                                }
+
+                                if netBrackets == 0 {
+                                        line.assign = line.lead[i:]
+                                        line.lead = line.lead[:i]
+                                }
+                                break
+                        }
+                }
+        }
+
+        return lines
+}
+
+func tokenIsNewline(tok *Token) bool {
+        if tok.Type == hclsyntax.TokenNewline {
+                return true
+        } else if tok.Type == hclsyntax.TokenComment {
+                // Single line tokens (# and //) consume their terminating newline,
+                // so we need to treat them as newline tokens as well.
+                if len(tok.Bytes) > 0 && tok.Bytes[len(tok.Bytes)-1] == '\n' {
+                        return true
+                }
+        }
+        return false
+}
+
+func tokenBracketChange(tok *Token) int {
+        switch tok.Type {
+        case hclsyntax.TokenOBrace, hclsyntax.TokenOBrack, hclsyntax.TokenOParen, hclsyntax.TokenTemplateControl, hclsyntax.TokenTemplateInterp:
+                return 1
+        case hclsyntax.TokenCBrace, hclsyntax.TokenCBrack, hclsyntax.TokenCParen, hclsyntax.TokenTemplateSeqEnd:
+                return -1
+        default:
+                return 0
+        }
+}
+
+// formatLine represents a single line of source code for formatting purposes,
+// splitting its tokens into up to three "cells":
+//
+// lead: always present, representing everything up to one of the others
+// assign: if line contains an attribute assignment, represents the tokens
+//    starting at (and including) the equals symbol
+// comment: if line contains any non-comment tokens and ends with a
+//    single-line comment token, represents the comment.
+//
+// When formatting, the leading spaces of the first tokens in each of these
+// cells is adjusted to align vertically their occurences on consecutive
+// rows.
+type formatLine struct {
+        lead    Tokens
+        assign  Tokens
+        comment Tokens
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/generate.go b/vendor/github.com/hashicorp/hcl2/hclwrite/generate.go
new file mode 100644
index 0000000..d249cfd
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/generate.go
@@ -0,0 +1,250 @@
+package hclwrite
+
+import (
+        "fmt"
+        "unicode"
+        "unicode/utf8"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// TokensForValue returns a sequence of tokens that represents the given
+// constant value.
+//
+// This function only supports types that are used by HCL. In particular, it
+// does not support capsule types and will panic if given one.
+//
+// It is not possible to express an unknown value in source code, so this
+// function will panic if the given value is unknown or contains any unknown
+// values. A caller can call the value's IsWhollyKnown method to verify that
+// no unknown values are present before calling TokensForValue.
+func TokensForValue(val cty.Value) Tokens {
+        toks := appendTokensForValue(val, nil)
+        format(toks) // fiddle with the SpacesBefore field to get canonical spacing
+        return toks
+}
+
+// TokensForTraversal returns a sequence of tokens that represents the given
+// traversal.
+//
+// If the traversal is absolute then the result is a self-contained, valid
+// reference expression. If the traversal is relative then the returned tokens
+// could be appended to some other expression tokens to traverse into the
+// represented expression.
+func TokensForTraversal(traversal hcl.Traversal) Tokens {
+        toks := appendTokensForTraversal(traversal, nil)
+        format(toks) // fiddle with the SpacesBefore field to get canonical spacing
+        return toks
+}
+
+func appendTokensForValue(val cty.Value, toks Tokens) Tokens {
+        switch {
+
+        case !val.IsKnown():
+                panic("cannot produce tokens for unknown value")
+
+        case val.IsNull():
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenIdent,
+                        Bytes: []byte(`null`),
+                })
+
+        case val.Type() == cty.Bool:
+                var src []byte
+                if val.True() {
+                        src = []byte(`true`)
+                } else {
+                        src = []byte(`false`)
+                }
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenIdent,
+                        Bytes: src,
+                })
+
+        case val.Type() == cty.Number:
+                bf := val.AsBigFloat()
+                srcStr := bf.Text('f', -1)
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenNumberLit,
+                        Bytes: []byte(srcStr),
+                })
+
+        case val.Type() == cty.String:
+                // TODO: If it's a multi-line string ending in a newline, format
+                // it as a HEREDOC instead.
+                src := escapeQuotedStringLit(val.AsString())
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenOQuote,
+                        Bytes: []byte{'"'},
+                })
+                if len(src) > 0 {
+                        toks = append(toks, &Token{
+                                Type:  hclsyntax.TokenQuotedLit,
+                                Bytes: src,
+                        })
+                }
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenCQuote,
+                        Bytes: []byte{'"'},
+                })
+
+        case val.Type().IsListType() || val.Type().IsSetType() || val.Type().IsTupleType():
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenOBrack,
+                        Bytes: []byte{'['},
+                })
+
+                i := 0
+                for it := val.ElementIterator(); it.Next(); {
+                        if i > 0 {
+                                toks = append(toks, &Token{
+                                        Type:  hclsyntax.TokenComma,
+                                        Bytes: []byte{','},
+                                })
+                        }
+                        _, eVal := it.Element()
+                        toks = appendTokensForValue(eVal, toks)
+                        i++
+                }
+
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenCBrack,
+                        Bytes: []byte{']'},
+                })
+
+        case val.Type().IsMapType() || val.Type().IsObjectType():
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenOBrace,
+                        Bytes: []byte{'{'},
+                })
+
+                i := 0
+                for it := val.ElementIterator(); it.Next(); {
+                        if i > 0 {
+                                toks = append(toks, &Token{
+                                        Type:  hclsyntax.TokenComma,
+                                        Bytes: []byte{','},
+                                })
+                        }
+                        eKey, eVal := it.Element()
+                        if hclsyntax.ValidIdentifier(eKey.AsString()) {
+                                toks = append(toks, &Token{
+                                        Type:  hclsyntax.TokenIdent,
+                                        Bytes: []byte(eKey.AsString()),
+                                })
+                        } else {
+                                toks = appendTokensForValue(eKey, toks)
+                        }
+                        toks = append(toks, &Token{
+                                Type:  hclsyntax.TokenEqual,
+                                Bytes: []byte{'='},
+                        })
+                        toks = appendTokensForValue(eVal, toks)
+                        i++
+                }
+
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenCBrace,
+                        Bytes: []byte{'}'},
+                })
+
+        default:
+                panic(fmt.Sprintf("cannot produce tokens for %#v", val))
+        }
+
+        return toks
+}
+
+func appendTokensForTraversal(traversal hcl.Traversal, toks Tokens) Tokens {
+        for _, step := range traversal {
+                appendTokensForTraversalStep(step, toks)
+        }
+        return toks
+}
+
+func appendTokensForTraversalStep(step hcl.Traverser, toks Tokens) {
+        switch ts := step.(type) {
+        case hcl.TraverseRoot:
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenIdent,
+                        Bytes: []byte(ts.Name),
+                })
+        case hcl.TraverseAttr:
+                toks = append(
+                        toks,
+                        &Token{
+                                Type:  hclsyntax.TokenDot,
+                                Bytes: []byte{'.'},
+                        },
+                        &Token{
+                                Type:  hclsyntax.TokenIdent,
+                                Bytes: []byte(ts.Name),
+                        },
+                )
+        case hcl.TraverseIndex:
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenOBrack,
+                        Bytes: []byte{'['},
+                })
+                appendTokensForValue(ts.Key, toks)
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenCBrack,
+                        Bytes: []byte{']'},
+                })
+        default:
+                panic(fmt.Sprintf("unsupported traversal step type %T", step))
+        }
+}
+
+func escapeQuotedStringLit(s string) []byte {
+        if len(s) == 0 {
+                return nil
+        }
+        buf := make([]byte, 0, len(s))
+        for i, r := range s {
+                switch r {
+                case '\n':
+                        buf = append(buf, '\\', 'n')
+                case '\r':
+                        buf = append(buf, '\\', 'r')
+                case '\t':
+                        buf = append(buf, '\\', 't')
+                case '"':
+                        buf = append(buf, '\\', '"')
+                case '\\':
+                        buf = append(buf, '\\', '\\')
+                case '$', '%':
+                        buf = appendRune(buf, r)
+                        remain := s[i+1:]
+                        if len(remain) > 0 && remain[0] == '{' {
+                                // Double up our template introducer symbol to escape it.
+                                buf = appendRune(buf, r)
+                        }
+                default:
+                        if !unicode.IsPrint(r) {
+                                var fmted string
+                                if r < 65536 {
+                                        fmted = fmt.Sprintf("\\u%04x", r)
+                                } else {
+                                        fmted = fmt.Sprintf("\\U%08x", r)
+                                }
+                                buf = append(buf, fmted...)
+                        } else {
+                                buf = appendRune(buf, r)
+                        }
+                }
+        }
+        return buf
+}
+
+func appendRune(b []byte, r rune) []byte {
+        l := utf8.RuneLen(r)
+        for i := 0; i < l; i++ {
+                b = append(b, 0) // make room at the end of our buffer
+        }
+        ch := b[len(b)-l:]
+        utf8.EncodeRune(ch, r)
+        return b
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/native_node_sorter.go b/vendor/github.com/hashicorp/hcl2/hclwrite/native_node_sorter.go
new file mode 100644
index 0000000..a13c0ec
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/native_node_sorter.go
@@ -0,0 +1,23 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+type nativeNodeSorter struct {
+        Nodes []hclsyntax.Node
+}
+
+func (s nativeNodeSorter) Len() int {
+        return len(s.Nodes)
+}
+
+func (s nativeNodeSorter) Less(i, j int) bool {
+        rangeI := s.Nodes[i].Range()
+        rangeJ := s.Nodes[j].Range()
+        return rangeI.Start.Byte < rangeJ.Start.Byte
+}
+
+func (s nativeNodeSorter) Swap(i, j int) {
+        s.Nodes[i], s.Nodes[j] = s.Nodes[j], s.Nodes[i]
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/node.go b/vendor/github.com/hashicorp/hcl2/hclwrite/node.go
new file mode 100644
index 0000000..71fd00f
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/node.go
@@ -0,0 +1,236 @@
+package hclwrite
+
+import (
+        "fmt"
+
+        "github.com/google/go-cmp/cmp"
+)
+
+// node represents a node in the AST.
+type node struct {
+        content nodeContent
+
+        list          *nodes
+        before, after *node
+}
+
+func newNode(c nodeContent) *node {
+        return &node{
+                content: c,
+        }
+}
+
+func (n *node) Equal(other *node) bool {
+        return cmp.Equal(n.content, other.content)
+}
+
+func (n *node) BuildTokens(to Tokens) Tokens {
+        return n.content.BuildTokens(to)
+}
+
+// Detach removes the receiver from the list it currently belongs to. If the
+// node is not currently in a list, this is a no-op.
+func (n *node) Detach() {
+        if n.list == nil {
+                return
+        }
+        if n.before != nil {
+                n.before.after = n.after
+        }
+        if n.after != nil {
+                n.after.before = n.before
+        }
+        if n.list.first == n {
+                n.list.first = n.after
+        }
+        if n.list.last == n {
+                n.list.last = n.before
+        }
+        n.list = nil
+        n.before = nil
+        n.after = nil
+}
+
+// ReplaceWith removes the receiver from the list it currently belongs to and
+// inserts a new node with the given content in its place. If the node is not
+// currently in a list, this function will panic.
+//
+// The return value is the newly-constructed node, containing the given content.
+// After this function returns, the reciever is no longer attached to a list.
+func (n *node) ReplaceWith(c nodeContent) *node {
+        if n.list == nil {
+                panic("can't replace node that is not in a list")
+        }
+
+        before := n.before
+        after := n.after
+        list := n.list
+        n.before, n.after, n.list = nil, nil, nil
+
+        nn := newNode(c)
+        nn.before = before
+        nn.after = after
+        nn.list = list
+        if before != nil {
+                before.after = nn
+        }
+        if after != nil {
+                after.before = nn
+        }
+        return nn
+}
+
+func (n *node) assertUnattached() {
+        if n.list != nil {
+                panic(fmt.Sprintf("attempt to attach already-attached node %#v", n))
+        }
+}
+
+// nodeContent is the interface type implemented by all AST content types.
+type nodeContent interface {
+        walkChildNodes(w internalWalkFunc)
+        BuildTokens(to Tokens) Tokens
+}
+
+// nodes is a list of nodes.
+type nodes struct {
+        first, last *node
+}
+
+func (ns *nodes) BuildTokens(to Tokens) Tokens {
+        for n := ns.first; n != nil; n = n.after {
+                to = n.BuildTokens(to)
+        }
+        return to
+}
+
+func (ns *nodes) Clear() {
+        ns.first = nil
+        ns.last = nil
+}
+
+func (ns *nodes) Append(c nodeContent) *node {
+        n := &node{
+                content: c,
+        }
+        ns.AppendNode(n)
+        n.list = ns
+        return n
+}
+
+func (ns *nodes) AppendNode(n *node) {
+        if ns.last != nil {
+                n.before = ns.last
+                ns.last.after = n
+        }
+        n.list = ns
+        ns.last = n
+        if ns.first == nil {
+                ns.first = n
+        }
+}
+
+func (ns *nodes) AppendUnstructuredTokens(tokens Tokens) *node {
+        if len(tokens) == 0 {
+                return nil
+        }
+        n := newNode(tokens)
+        ns.AppendNode(n)
+        n.list = ns
+        return n
+}
+
+// nodeSet is an unordered set of nodes. It is used to describe a set of nodes
+// that all belong to the same list that have some role or characteristic
+// in common.
+type nodeSet map[*node]struct{}
+
+func newNodeSet() nodeSet {
+        return make(nodeSet)
+}
+
+func (ns nodeSet) Has(n *node) bool {
+        if ns == nil {
+                return false
+        }
+        _, exists := ns[n]
+        return exists
+}
+
+func (ns nodeSet) Add(n *node) {
+        ns[n] = struct{}{}
+}
+
+func (ns nodeSet) Remove(n *node) {
+        delete(ns, n)
+}
+
+func (ns nodeSet) List() []*node {
+        if len(ns) == 0 {
+                return nil
+        }
+
+        ret := make([]*node, 0, len(ns))
+
+        // Determine which list we are working with. We assume here that all of
+        // the nodes belong to the same list, since that is part of the contract
+        // for nodeSet.
+        var list *nodes
+        for n := range ns {
+                list = n.list
+                break
+        }
+
+        // We recover the order by iterating over the whole list. This is not
+        // the most efficient way to do it, but our node lists should always be
+        // small so not worth making things more complex.
+        for n := list.first; n != nil; n = n.after {
+                if ns.Has(n) {
+                        ret = append(ret, n)
+                }
+        }
+        return ret
+}
+
+type internalWalkFunc func(*node)
+
+// inTree can be embedded into a content struct that has child nodes to get
+// a standard implementation of the NodeContent interface and a record of
+// a potential parent node.
+type inTree struct {
+        parent   *node
+        children *nodes
+}
+
+func newInTree() inTree {
+        return inTree{
+                children: &nodes{},
+        }
+}
+
+func (it *inTree) assertUnattached() {
+        if it.parent != nil {
+                panic(fmt.Sprintf("node is already attached to %T", it.parent.content))
+        }
+}
+
+func (it *inTree) walkChildNodes(w internalWalkFunc) {
+        for n := it.children.first; n != nil; n = n.after {
+                w(n)
+        }
+}
+
+func (it *inTree) BuildTokens(to Tokens) Tokens {
+        for n := it.children.first; n != nil; n = n.after {
+                to = n.BuildTokens(to)
+        }
+        return to
+}
+
+// leafNode can be embedded into a content struct to give it a do-nothing
+// implementation of walkChildNodes
+type leafNode struct {
+}
+
+func (n *leafNode) walkChildNodes(w internalWalkFunc) {
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/parser.go b/vendor/github.com/hashicorp/hcl2/hclwrite/parser.go
new file mode 100644
index 0000000..1876818
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/parser.go
@@ -0,0 +1,594 @@
+package hclwrite
+
+import (
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Our "parser" here is actually not doing any parsing of its own. Instead,
+// it leans on the native parser in hclsyntax, and then uses the source ranges
+// from the AST to partition the raw token sequence to match the raw tokens
+// up to AST nodes.
+//
+// This strategy feels somewhat counter-intuitive, since most of the work the
+// parser does is thrown away here, but this strategy is chosen because the
+// normal parsing work done by hclsyntax is considered to be the "main case",
+// while modifying and re-printing source is more of an edge case, used only
+// in ancillary tools, and so it's good to keep all the main parsing logic
+// with the main case but keep all of the extra complexity of token wrangling
+// out of the main parser, which is already rather complex just serving the
+// use-cases it already serves.
+//
+// If the parsing step produces any errors, the returned File is nil because
+// we can't reliably extract tokens from the partial AST produced by an
+// erroneous parse.
+func parse(src []byte, filename string, start hcl.Pos) (*File, hcl.Diagnostics) {
+        file, diags := hclsyntax.ParseConfig(src, filename, start)
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        // To do our work here, we use the "native" tokens (those from hclsyntax)
+        // to match against source ranges in the AST, but ultimately produce
+        // slices from our sequence of "writer" tokens, which contain only
+        // *relative* position information that is more appropriate for
+        // transformation/writing use-cases.
+        nativeTokens, diags := hclsyntax.LexConfig(src, filename, start)
+        if diags.HasErrors() {
+                // should never happen, since we would've caught these diags in
+                // the first call above.
+                return nil, diags
+        }
+        writerTokens := writerTokens(nativeTokens)
+
+        from := inputTokens{
+                nativeTokens: nativeTokens,
+                writerTokens: writerTokens,
+        }
+
+        before, root, after := parseBody(file.Body.(*hclsyntax.Body), from)
+        ret := &File{
+                inTree: newInTree(),
+
+                srcBytes: src,
+                body:     root,
+        }
+
+        nodes := ret.inTree.children
+        nodes.Append(before.Tokens())
+        nodes.AppendNode(root)
+        nodes.Append(after.Tokens())
+
+        return ret, diags
+}
+
+type inputTokens struct {
+        nativeTokens hclsyntax.Tokens
+        writerTokens Tokens
+}
+
+func (it inputTokens) Partition(rng hcl.Range) (before, within, after inputTokens) {
+        start, end := partitionTokens(it.nativeTokens, rng)
+        before = it.Slice(0, start)
+        within = it.Slice(start, end)
+        after = it.Slice(end, len(it.nativeTokens))
+        return
+}
+
+func (it inputTokens) PartitionType(ty hclsyntax.TokenType) (before, within, after inputTokens) {
+        for i, t := range it.writerTokens {
+                if t.Type == ty {
+                        return it.Slice(0, i), it.Slice(i, i+1), it.Slice(i+1, len(it.nativeTokens))
+                }
+        }
+        panic(fmt.Sprintf("didn't find any token of type %s", ty))
+}
+
+func (it inputTokens) PartitionTypeSingle(ty hclsyntax.TokenType) (before inputTokens, found *Token, after inputTokens) {
+        before, within, after := it.PartitionType(ty)
+        if within.Len() != 1 {
+                panic("PartitionType found more than one token")
+        }
+        return before, within.Tokens()[0], after
+}
+
+// PartitionIncludeComments is like Partition except the returned "within"
+// range includes any lead and line comments associated with the range.
+func (it inputTokens) PartitionIncludingComments(rng hcl.Range) (before, within, after inputTokens) {
+        start, end := partitionTokens(it.nativeTokens, rng)
+        start = partitionLeadCommentTokens(it.nativeTokens[:start])
+        _, afterNewline := partitionLineEndTokens(it.nativeTokens[end:])
+        end += afterNewline
+
+        before = it.Slice(0, start)
+        within = it.Slice(start, end)
+        after = it.Slice(end, len(it.nativeTokens))
+        return
+
+}
+
+// PartitionBlockItem is similar to PartitionIncludeComments but it returns
+// the comments as separate token sequences so that they can be captured into
+// AST attributes. It makes assumptions that apply only to block items, so
+// should not be used for other constructs.
+func (it inputTokens) PartitionBlockItem(rng hcl.Range) (before, leadComments, within, lineComments, newline, after inputTokens) {
+        before, within, after = it.Partition(rng)
+        before, leadComments = before.PartitionLeadComments()
+        lineComments, newline, after = after.PartitionLineEndTokens()
+        return
+}
+
+func (it inputTokens) PartitionLeadComments() (before, within inputTokens) {
+        start := partitionLeadCommentTokens(it.nativeTokens)
+        before = it.Slice(0, start)
+        within = it.Slice(start, len(it.nativeTokens))
+        return
+}
+
+func (it inputTokens) PartitionLineEndTokens() (comments, newline, after inputTokens) {
+        afterComments, afterNewline := partitionLineEndTokens(it.nativeTokens)
+        comments = it.Slice(0, afterComments)
+        newline = it.Slice(afterComments, afterNewline)
+        after = it.Slice(afterNewline, len(it.nativeTokens))
+        return
+}
+
+func (it inputTokens) Slice(start, end int) inputTokens {
+        // When we slice, we create a new slice with no additional capacity because
+        // we expect that these slices will be mutated in order to insert
+        // new code into the AST, and we want to ensure that a new underlying
+        // array gets allocated in that case, rather than writing into some
+        // following slice and corrupting it.
+        return inputTokens{
+                nativeTokens: it.nativeTokens[start:end:end],
+                writerTokens: it.writerTokens[start:end:end],
+        }
+}
+
+func (it inputTokens) Len() int {
+        return len(it.nativeTokens)
+}
+
+func (it inputTokens) Tokens() Tokens {
+        return it.writerTokens
+}
+
+func (it inputTokens) Types() []hclsyntax.TokenType {
+        ret := make([]hclsyntax.TokenType, len(it.nativeTokens))
+        for i, tok := range it.nativeTokens {
+                ret[i] = tok.Type
+        }
+        return ret
+}
+
+// parseBody locates the given body within the given input tokens and returns
+// the resulting *Body object as well as the tokens that appeared before and
+// after it.
+func parseBody(nativeBody *hclsyntax.Body, from inputTokens) (inputTokens, *node, inputTokens) {
+        before, within, after := from.PartitionIncludingComments(nativeBody.SrcRange)
+
+        // The main AST doesn't retain the original source ordering of the
+        // body items, so we need to reconstruct that ordering by inspecting
+        // their source ranges.
+        nativeItems := make([]hclsyntax.Node, 0, len(nativeBody.Attributes)+len(nativeBody.Blocks))
+        for _, nativeAttr := range nativeBody.Attributes {
+                nativeItems = append(nativeItems, nativeAttr)
+        }
+        for _, nativeBlock := range nativeBody.Blocks {
+                nativeItems = append(nativeItems, nativeBlock)
+        }
+        sort.Sort(nativeNodeSorter{nativeItems})
+
+        body := &Body{
+                inTree: newInTree(),
+                items:  newNodeSet(),
+        }
+
+        remain := within
+        for _, nativeItem := range nativeItems {
+                beforeItem, item, afterItem := parseBodyItem(nativeItem, remain)
+
+                if beforeItem.Len() > 0 {
+                        body.AppendUnstructuredTokens(beforeItem.Tokens())
+                }
+                body.appendItemNode(item)
+
+                remain = afterItem
+        }
+
+        if remain.Len() > 0 {
+                body.AppendUnstructuredTokens(remain.Tokens())
+        }
+
+        return before, newNode(body), after
+}
+
+func parseBodyItem(nativeItem hclsyntax.Node, from inputTokens) (inputTokens, *node, inputTokens) {
+        before, leadComments, within, lineComments, newline, after := from.PartitionBlockItem(nativeItem.Range())
+
+        var item *node
+
+        switch tItem := nativeItem.(type) {
+        case *hclsyntax.Attribute:
+                item = parseAttribute(tItem, within, leadComments, lineComments, newline)
+        case *hclsyntax.Block:
+                item = parseBlock(tItem, within, leadComments, lineComments, newline)
+        default:
+                // should never happen if caller is behaving
+                panic("unsupported native item type")
+        }
+
+        return before, item, after
+}
+
+func parseAttribute(nativeAttr *hclsyntax.Attribute, from, leadComments, lineComments, newline inputTokens) *node {
+        attr := &Attribute{
+                inTree: newInTree(),
+        }
+        children := attr.inTree.children
+
+        {
+                cn := newNode(newComments(leadComments.Tokens()))
+                attr.leadComments = cn
+                children.AppendNode(cn)
+        }
+
+        before, nameTokens, from := from.Partition(nativeAttr.NameRange)
+        {
+                children.AppendUnstructuredTokens(before.Tokens())
+                if nameTokens.Len() != 1 {
+                        // Should never happen with valid input
+                        panic("attribute name is not exactly one token")
+                }
+                token := nameTokens.Tokens()[0]
+                in := newNode(newIdentifier(token))
+                attr.name = in
+                children.AppendNode(in)
+        }
+
+        before, equalsTokens, from := from.Partition(nativeAttr.EqualsRange)
+        children.AppendUnstructuredTokens(before.Tokens())
+        children.AppendUnstructuredTokens(equalsTokens.Tokens())
+
+        before, exprTokens, from := from.Partition(nativeAttr.Expr.Range())
+        {
+                children.AppendUnstructuredTokens(before.Tokens())
+                exprNode := parseExpression(nativeAttr.Expr, exprTokens)
+                attr.expr = exprNode
+                children.AppendNode(exprNode)
+        }
+
+        {
+                cn := newNode(newComments(lineComments.Tokens()))
+                attr.lineComments = cn
+                children.AppendNode(cn)
+        }
+
+        children.AppendUnstructuredTokens(newline.Tokens())
+
+        // Collect any stragglers, though there shouldn't be any
+        children.AppendUnstructuredTokens(from.Tokens())
+
+        return newNode(attr)
+}
+
+func parseBlock(nativeBlock *hclsyntax.Block, from, leadComments, lineComments, newline inputTokens) *node {
+        block := &Block{
+                inTree: newInTree(),
+                labels: newNodeSet(),
+        }
+        children := block.inTree.children
+
+        {
+                cn := newNode(newComments(leadComments.Tokens()))
+                block.leadComments = cn
+                children.AppendNode(cn)
+        }
+
+        before, typeTokens, from := from.Partition(nativeBlock.TypeRange)
+        {
+                children.AppendUnstructuredTokens(before.Tokens())
+                if typeTokens.Len() != 1 {
+                        // Should never happen with valid input
+                        panic("block type name is not exactly one token")
+                }
+                token := typeTokens.Tokens()[0]
+                in := newNode(newIdentifier(token))
+                block.typeName = in
+                children.AppendNode(in)
+        }
+
+        for _, rng := range nativeBlock.LabelRanges {
+                var labelTokens inputTokens
+                before, labelTokens, from = from.Partition(rng)
+                children.AppendUnstructuredTokens(before.Tokens())
+                tokens := labelTokens.Tokens()
+                ln := newNode(newQuoted(tokens))
+                block.labels.Add(ln)
+                children.AppendNode(ln)
+        }
+
+        before, oBrace, from := from.Partition(nativeBlock.OpenBraceRange)
+        children.AppendUnstructuredTokens(before.Tokens())
+        children.AppendUnstructuredTokens(oBrace.Tokens())
+
+        // We go a bit out of order here: we go hunting for the closing brace
+        // so that we have a delimited body, but then we'll deal with the body
+        // before we actually append the closing brace and any straggling tokens
+        // that appear after it.
+        bodyTokens, cBrace, from := from.Partition(nativeBlock.CloseBraceRange)
+        before, body, after := parseBody(nativeBlock.Body, bodyTokens)
+        children.AppendUnstructuredTokens(before.Tokens())
+        block.body = body
+        children.AppendNode(body)
+        children.AppendUnstructuredTokens(after.Tokens())
+
+        children.AppendUnstructuredTokens(cBrace.Tokens())
+
+        // stragglers
+        children.AppendUnstructuredTokens(from.Tokens())
+        if lineComments.Len() > 0 {
+                // blocks don't actually have line comments, so we'll just treat
+                // them as extra stragglers
+                children.AppendUnstructuredTokens(lineComments.Tokens())
+        }
+        children.AppendUnstructuredTokens(newline.Tokens())
+
+        return newNode(block)
+}
+
+func parseExpression(nativeExpr hclsyntax.Expression, from inputTokens) *node {
+        expr := newExpression()
+        children := expr.inTree.children
+
+        nativeVars := nativeExpr.Variables()
+
+        for _, nativeTraversal := range nativeVars {
+                before, traversal, after := parseTraversal(nativeTraversal, from)
+                children.AppendUnstructuredTokens(before.Tokens())
+                children.AppendNode(traversal)
+                expr.absTraversals.Add(traversal)
+                from = after
+        }
+        // Attach any stragglers that don't belong to a traversal to the expression
+        // itself. In an expression with no traversals at all, this is just the
+        // entirety of "from".
+        children.AppendUnstructuredTokens(from.Tokens())
+
+        return newNode(expr)
+}
+
+func parseTraversal(nativeTraversal hcl.Traversal, from inputTokens) (before inputTokens, n *node, after inputTokens) {
+        traversal := newTraversal()
+        children := traversal.inTree.children
+        before, from, after = from.Partition(nativeTraversal.SourceRange())
+
+        stepAfter := from
+        for _, nativeStep := range nativeTraversal {
+                before, step, after := parseTraversalStep(nativeStep, stepAfter)
+                children.AppendUnstructuredTokens(before.Tokens())
+                children.AppendNode(step)
+                traversal.steps.Add(step)
+                stepAfter = after
+        }
+
+        return before, newNode(traversal), after
+}
+
+func parseTraversalStep(nativeStep hcl.Traverser, from inputTokens) (before inputTokens, n *node, after inputTokens) {
+        var children *nodes
+        switch tNativeStep := nativeStep.(type) {
+
+        case hcl.TraverseRoot, hcl.TraverseAttr:
+                step := newTraverseName()
+                children = step.inTree.children
+                before, from, after = from.Partition(nativeStep.SourceRange())
+                inBefore, token, inAfter := from.PartitionTypeSingle(hclsyntax.TokenIdent)
+                name := newIdentifier(token)
+                children.AppendUnstructuredTokens(inBefore.Tokens())
+                step.name = children.Append(name)
+                children.AppendUnstructuredTokens(inAfter.Tokens())
+                return before, newNode(step), after
+
+        case hcl.TraverseIndex:
+                step := newTraverseIndex()
+                children = step.inTree.children
+                before, from, after = from.Partition(nativeStep.SourceRange())
+
+                var inBefore, oBrack, keyTokens, cBrack inputTokens
+                inBefore, oBrack, from = from.PartitionType(hclsyntax.TokenOBrack)
+                children.AppendUnstructuredTokens(inBefore.Tokens())
+                children.AppendUnstructuredTokens(oBrack.Tokens())
+                keyTokens, cBrack, from = from.PartitionType(hclsyntax.TokenCBrack)
+
+                keyVal := tNativeStep.Key
+                switch keyVal.Type() {
+                case cty.String:
+                        key := newQuoted(keyTokens.Tokens())
+                        step.key = children.Append(key)
+                case cty.Number:
+                        valBefore, valToken, valAfter := keyTokens.PartitionTypeSingle(hclsyntax.TokenNumberLit)
+                        children.AppendUnstructuredTokens(valBefore.Tokens())
+                        key := newNumber(valToken)
+                        step.key = children.Append(key)
+                        children.AppendUnstructuredTokens(valAfter.Tokens())
+                }
+
+                children.AppendUnstructuredTokens(cBrack.Tokens())
+                children.AppendUnstructuredTokens(from.Tokens())
+
+                return before, newNode(step), after
+        default:
+                panic(fmt.Sprintf("unsupported traversal step type %T", nativeStep))
+        }
+
+}
+
+// writerTokens takes a sequence of tokens as produced by the main hclsyntax
+// package and transforms it into an equivalent sequence of tokens using
+// this package's own token model.
+//
+// The resulting list contains the same number of tokens and uses the same
+// indices as the input, allowing the two sets of tokens to be correlated
+// by index.
+func writerTokens(nativeTokens hclsyntax.Tokens) Tokens {
+        // Ultimately we want a slice of token _pointers_, but since we can
+        // predict how much memory we're going to devote to tokens we'll allocate
+        // it all as a single flat buffer and thus give the GC less work to do.
+        tokBuf := make([]Token, len(nativeTokens))
+        var lastByteOffset int
+        for i, mainToken := range nativeTokens {
+                // Create a copy of the bytes so that we can mutate without
+                // corrupting the original token stream.
+                bytes := make([]byte, len(mainToken.Bytes))
+                copy(bytes, mainToken.Bytes)
+
+                tokBuf[i] = Token{
+                        Type:  mainToken.Type,
+                        Bytes: bytes,
+
+                        // We assume here that spaces are always ASCII spaces, since
+                        // that's what the scanner also assumes, and thus the number
+                        // of bytes skipped is also the number of space characters.
+                        SpacesBefore: mainToken.Range.Start.Byte - lastByteOffset,
+                }
+
+                lastByteOffset = mainToken.Range.End.Byte
+        }
+
+        // Now make a slice of pointers into the previous slice.
+        ret := make(Tokens, len(tokBuf))
+        for i := range ret {
+                ret[i] = &tokBuf[i]
+        }
+
+        return ret
+}
+
+// partitionTokens takes a sequence of tokens and a hcl.Range and returns
+// two indices within the token sequence that correspond with the range
+// boundaries, such that the slice operator could be used to produce
+// three token sequences for before, within, and after respectively:
+//
+//     start, end := partitionTokens(toks, rng)
+//     before := toks[:start]
+//     within := toks[start:end]
+//     after := toks[end:]
+//
+// This works best when the range is aligned with token boundaries (e.g.
+// because it was produced in terms of the scanner's result) but if that isn't
+// true then it will make a best effort that may produce strange results at
+// the boundaries.
+//
+// Native hclsyntax tokens are used here, because they contain the necessary
+// absolute position information. However, since writerTokens produces a
+// correlatable sequence of writer tokens, the resulting indices can be
+// used also to index into its result, allowing the partitioning of writer
+// tokens to be driven by the partitioning of native tokens.
+//
+// The tokens are assumed to be in source order and non-overlapping, which
+// will be true if the token sequence from the scanner is used directly.
+func partitionTokens(toks hclsyntax.Tokens, rng hcl.Range) (start, end int) {
+        // We us a linear search here because we assume tha in most cases our
+        // target range is close to the beginning of the sequence, and the seqences
+        // are generally small for most reasonable files anyway.
+        for i := 0; ; i++ {
+                if i >= len(toks) {
+                        // No tokens for the given range at all!
+                        return len(toks), len(toks)
+                }
+
+                if toks[i].Range.Start.Byte >= rng.Start.Byte {
+                        start = i
+                        break
+                }
+        }
+
+        for i := start; ; i++ {
+                if i >= len(toks) {
+                        // The range "hangs off" the end of the token sequence
+                        return start, len(toks)
+                }
+
+                if toks[i].Range.Start.Byte >= rng.End.Byte {
+                        end = i // end marker is exclusive
+                        break
+                }
+        }
+
+        return start, end
+}
+
+// partitionLeadCommentTokens takes a sequence of tokens that is assumed
+// to immediately precede a construct that can have lead comment tokens,
+// and returns the index into that sequence where the lead comments begin.
+//
+// Lead comments are defined as whole lines containing only comment tokens
+// with no blank lines between. If no such lines are found, the returned
+// index will be len(toks).
+func partitionLeadCommentTokens(toks hclsyntax.Tokens) int {
+        // single-line comments (which is what we're interested in here)
+        // consume their trailing newline, so we can just walk backwards
+        // until we stop seeing comment tokens.
+        for i := len(toks) - 1; i >= 0; i-- {
+                if toks[i].Type != hclsyntax.TokenComment {
+                        return i + 1
+                }
+        }
+        return 0
+}
+
+// partitionLineEndTokens takes a sequence of tokens that is assumed
+// to immediately follow a construct that can have a line comment, and
+// returns first the index where any line comments end and then second
+// the index immediately after the trailing newline.
+//
+// Line comments are defined as comments that appear immediately after
+// a construct on the same line where its significant tokens ended.
+//
+// Since single-line comment tokens (# and //) include the newline that
+// terminates them, in the presence of these the two returned indices
+// will be the same since the comment itself serves as the line end.
+func partitionLineEndTokens(toks hclsyntax.Tokens) (afterComment, afterNewline int) {
+        for i := 0; i < len(toks); i++ {
+                tok := toks[i]
+                if tok.Type != hclsyntax.TokenComment {
+                        switch tok.Type {
+                        case hclsyntax.TokenNewline:
+                                return i, i + 1
+                        case hclsyntax.TokenEOF:
+                                // Although this is valid, we mustn't include the EOF
+                                // itself as our "newline" or else strange things will
+                                // happen when we try to append new items.
+                                return i, i
+                        default:
+                                // If we have well-formed input here then nothing else should be
+                                // possible. This path should never happen, because we only try
+                                // to extract tokens from the sequence if the parser succeeded,
+                                // and it should catch this problem itself.
+                                panic("malformed line trailers: expected only comments and newlines")
+                        }
+                }
+
+                if len(tok.Bytes) > 0 && tok.Bytes[len(tok.Bytes)-1] == '\n' {
+                        // Newline at the end of a single-line comment serves both as
+                        // the end of comments *and* the end of the line.
+                        return i + 1, i + 1
+                }
+        }
+        return len(toks), len(toks)
+}
+
+// lexConfig uses the hclsyntax scanner to get a token stream and then
+// rewrites it into this package's token model.
+//
+// Any errors produced during scanning are ignored, so the results of this
+// function should be used with care.
+func lexConfig(src []byte) Tokens {
+        mainTokens, _ := hclsyntax.LexConfig(src, "", hcl.Pos{Byte: 0, Line: 1, Column: 1})
+        return writerTokens(mainTokens)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/public.go b/vendor/github.com/hashicorp/hcl2/hclwrite/public.go
new file mode 100644
index 0000000..4d5ce2a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/public.go
@@ -0,0 +1,44 @@
+package hclwrite
+
+import (
+        "bytes"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// NewFile creates a new file object that is empty and ready to have constructs
+// added t it.
+func NewFile() *File {
+        body := &Body{
+                inTree: newInTree(),
+                items:  newNodeSet(),
+        }
+        file := &File{
+                inTree: newInTree(),
+        }
+        file.body = file.inTree.children.Append(body)
+        return file
+}
+
+// ParseConfig interprets the given source bytes into a *hclwrite.File. The
+// resulting AST can be used to perform surgical edits on the source code
+// before turning it back into bytes again.
+func ParseConfig(src []byte, filename string, start hcl.Pos) (*File, hcl.Diagnostics) {
+        return parse(src, filename, start)
+}
+
+// Format takes source code and performs simple whitespace changes to transform
+// it to a canonical layout style.
+//
+// Format skips constructing an AST and works directly with tokens, so it
+// is less expensive than formatting via the AST for situations where no other
+// changes will be made. It also ignores syntax errors and can thus be applied
+// to partial source code, although the result in that case may not be
+// desirable.
+func Format(src []byte) []byte {
+        tokens := lexConfig(src)
+        format(tokens)
+        buf := &bytes.Buffer{}
+        tokens.WriteTo(buf)
+        return buf.Bytes()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/tokens.go b/vendor/github.com/hashicorp/hcl2/hclwrite/tokens.go
new file mode 100644
index 0000000..d87f818
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/tokens.go
@@ -0,0 +1,122 @@
+package hclwrite
+
+import (
+        "bytes"
+        "io"
+
+        "github.com/apparentlymart/go-textseg/textseg"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// Token is a single sequence of bytes annotated with a type. It is similar
+// in purpose to hclsyntax.Token, but discards the source position information
+// since that is not useful in code generation.
+type Token struct {
+        Type  hclsyntax.TokenType
+        Bytes []byte
+
+        // We record the number of spaces before each token so that we can
+        // reproduce the exact layout of the original file when we're making
+        // surgical changes in-place. When _new_ code is created it will always
+        // be in the canonical style, but we preserve layout of existing code.
+        SpacesBefore int
+}
+
+// asHCLSyntax returns the receiver expressed as an incomplete hclsyntax.Token.
+// A complete token is not possible since we don't have source location
+// information here, and so this method is unexported so we can be sure it will
+// only be used for internal purposes where we know the range isn't important.
+//
+// This is primarily intended to allow us to re-use certain functionality from
+// hclsyntax rather than re-implementing it against our own token type here.
+func (t *Token) asHCLSyntax() hclsyntax.Token {
+        return hclsyntax.Token{
+                Type:  t.Type,
+                Bytes: t.Bytes,
+                Range: hcl.Range{
+                        Filename: "<invalid>",
+                },
+        }
+}
+
+// Tokens is a flat list of tokens.
+type Tokens []*Token
+
+func (ts Tokens) Bytes() []byte {
+        buf := &bytes.Buffer{}
+        ts.WriteTo(buf)
+        return buf.Bytes()
+}
+
+func (ts Tokens) testValue() string {
+        return string(ts.Bytes())
+}
+
+// Columns returns the number of columns (grapheme clusters) the token sequence
+// occupies. The result is not meaningful if there are newline or single-line
+// comment tokens in the sequence.
+func (ts Tokens) Columns() int {
+        ret := 0
+        for _, token := range ts {
+                ret += token.SpacesBefore // spaces are always worth one column each
+                ct, _ := textseg.TokenCount(token.Bytes, textseg.ScanGraphemeClusters)
+                ret += ct
+        }
+        return ret
+}
+
+// WriteTo takes an io.Writer and writes the bytes for each token to it,
+// along with the spacing that separates each token. In other words, this
+// allows serializing the tokens to a file or other such byte stream.
+func (ts Tokens) WriteTo(wr io.Writer) (int64, error) {
+        // We know we're going to be writing a lot of small chunks of repeated
+        // space characters, so we'll prepare a buffer of these that we can
+        // easily pass to wr.Write without any further allocation.
+        spaces := make([]byte, 40)
+        for i := range spaces {
+                spaces[i] = ' '
+        }
+
+        var n int64
+        var err error
+        for _, token := range ts {
+                if err != nil {
+                        return n, err
+                }
+
+                for spacesBefore := token.SpacesBefore; spacesBefore > 0; spacesBefore -= len(spaces) {
+                        thisChunk := spacesBefore
+                        if thisChunk > len(spaces) {
+                                thisChunk = len(spaces)
+                        }
+                        var thisN int
+                        thisN, err = wr.Write(spaces[:thisChunk])
+                        n += int64(thisN)
+                        if err != nil {
+                                return n, err
+                        }
+                }
+
+                var thisN int
+                thisN, err = wr.Write(token.Bytes)
+                n += int64(thisN)
+        }
+
+        return n, err
+}
+
+func (ts Tokens) walkChildNodes(w internalWalkFunc) {
+        // Unstructured tokens have no child nodes
+}
+
+func (ts Tokens) BuildTokens(to Tokens) Tokens {
+        return append(to, ts...)
+}
+
+func newIdentToken(name string) *Token {
+        return &Token{
+                Type:  hclsyntax.TokenIdent,
+                Bytes: []byte(name),
+        }
+}
diff --git a/vendor/github.com/hashicorp/hil/convert.go b/vendor/github.com/hashicorp/hil/convert.go
index f2024d0..184e029 100644
--- a/vendor/github.com/hashicorp/hil/convert.go
+++ b/vendor/github.com/hashicorp/hil/convert.go
@@ -47,8 +47,23 @@ func hilMapstructureWeakDecode(m interface{}, rawVal interface{}) error {
 }
 
 func InterfaceToVariable(input interface{}) (ast.Variable, error) {
-        if inputVariable, ok := input.(ast.Variable); ok {
-                return inputVariable, nil
+        if iv, ok := input.(ast.Variable); ok {
+                return iv, nil
+        }
+
+        // This is just to maintain backward compatibility
+        // after https://github.com/mitchellh/mapstructure/pull/98
+        if v, ok := input.([]ast.Variable); ok {
+                return ast.Variable{
+                        Type:  ast.TypeList,
+                        Value: v,
+                }, nil
+        }
+        if v, ok := input.(map[string]ast.Variable); ok {
+                return ast.Variable{
+                        Type:  ast.TypeMap,
+                        Value: v,
+                }, nil
         }
 
         var stringVal string
diff --git a/vendor/github.com/hashicorp/hil/go.mod b/vendor/github.com/hashicorp/hil/go.mod
new file mode 100644
index 0000000..45719a6
--- /dev/null
+++ b/vendor/github.com/hashicorp/hil/go.mod
@@ -0,0 +1,6 @@
+module github.com/hashicorp/hil
+
+require (
+        github.com/mitchellh/mapstructure v1.1.2
+        github.com/mitchellh/reflectwalk v1.0.0
+)
diff --git a/vendor/github.com/hashicorp/hil/go.sum b/vendor/github.com/hashicorp/hil/go.sum
new file mode 100644
index 0000000..83639b6
--- /dev/null
+++ b/vendor/github.com/hashicorp/hil/go.sum
@@ -0,0 +1,4 @@
+github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
+github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
diff --git a/vendor/github.com/hashicorp/logutils/go.mod b/vendor/github.com/hashicorp/logutils/go.mod
new file mode 100644
index 0000000..ba38a45
--- /dev/null
+++ b/vendor/github.com/hashicorp/logutils/go.mod
@@ -0,0 +1 @@
+module github.com/hashicorp/logutils
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/LICENSE b/vendor/github.com/hashicorp/terraform-config-inspect/LICENSE
new file mode 100644
index 0000000..82b4de9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/LICENSE
@@ -0,0 +1,353 @@
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. “Contributor”
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. “Contributor Version”
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor’s Contribution.
+
+1.3. “Contribution”
+
+     means Covered Software of a particular Contributor.
+
+1.4. “Covered Software”
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. “Incompatible With Secondary Licenses”
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of version
+        1.1 or earlier of the License, but not also under the terms of a
+        Secondary License.
+
+1.6. “Executable Form”
+
+     means any form of the work other than Source Code Form.
+
+1.7. “Larger Work”
+
+     means a work that combines Covered Software with other material, in a separate
+     file or files, that is not Covered Software.
+
+1.8. “License”
+
+     means this document.
+
+1.9. “Licensable”
+
+     means having the right to grant, to the maximum extent possible, whether at the
+     time of the initial grant or subsequently, any and all of the rights conveyed by
+     this License.
+
+1.10. “Modifications”
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to, deletion
+        from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. “Patent Claims” of a Contributor
+
+      means any patent claim(s), including without limitation, method, process,
+      and apparatus claims, in any patent Licensable by such Contributor that
+      would be infringed, but for the grant of the License, by the making,
+      using, selling, offering for sale, having made, import, or transfer of
+      either its Contributions or its Contributor Version.
+
+1.12. “Secondary License”
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. “Source Code Form”
+
+      means the form of the work preferred for making modifications.
+
+1.14. “You” (or “Your”)
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, “You” includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, “control” means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or as
+        part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its Contributions
+        or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution become
+     effective for each Contribution on the date the Contributor first distributes
+     such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under this
+     License. No additional rights or licenses will be implied from the distribution
+     or licensing of Covered Software under this License. Notwithstanding Section
+     2.1(b) above, no patent license is granted by a Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party’s
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of its
+        Contributions.
+
+     This License does not grant any rights in the trademarks, service marks, or
+     logos of any Contributor (except as may be necessary to comply with the
+     notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this License
+     (see Section 10.2) or under the terms of a Secondary License (if permitted
+     under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its Contributions
+     are its original creation(s) or it has sufficient rights to grant the
+     rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under applicable
+     copyright doctrines of fair use, fair dealing, or other equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under the
+     terms of this License. You must inform recipients that the Source Code Form
+     of the Covered Software is governed by the terms of this License, and how
+     they can obtain a copy of this License. You may not attempt to alter or
+     restrict the recipients’ rights in the Source Code Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this License,
+        or sublicense it under different terms, provided that the license for
+        the Executable Form does not attempt to limit or alter the recipients’
+        rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for the
+     Covered Software. If the Larger Work is a combination of Covered Software
+     with a work governed by one or more Secondary Licenses, and the Covered
+     Software is not Incompatible With Secondary Licenses, this License permits
+     You to additionally distribute such Covered Software under the terms of
+     such Secondary License(s), so that the recipient of the Larger Work may, at
+     their option, further distribute the Covered Software under the terms of
+     either this License or such Secondary License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices (including
+     copyright notices, patent notices, disclaimers of warranty, or limitations
+     of liability) contained within the Source Code Form of the Covered
+     Software, except that You may alter any license notices to the extent
+     required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on behalf
+     of any Contributor. You must make it absolutely clear that any such
+     warranty, support, indemnity, or liability obligation is offered by You
+     alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute, judicial
+   order, or regulation then You must: (a) comply with the terms of this License
+   to the maximum extent possible; and (b) describe the limitations and the code
+   they affect. Such description must be placed in a text file included with all
+   distributions of the Covered Software under this License. Except to the
+   extent prohibited by statute or regulation, such description must be
+   sufficiently detailed for a recipient of ordinary skill to be able to
+   understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing basis,
+     if such Contributor fails to notify You of the non-compliance by some
+     reasonable means prior to 60 days after You have come back into compliance.
+     Moreover, Your grants from a particular Contributor are reinstated on an
+     ongoing basis if such Contributor notifies You of the non-compliance by
+     some reasonable means, this is the first time You have received notice of
+     non-compliance with this License from such Contributor, and You become
+     compliant prior to 30 days after Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions, counter-claims,
+     and cross-claims) alleging that a Contributor Version directly or
+     indirectly infringes any patent, then the rights granted to You by any and
+     all Contributors for the Covered Software under Section 2.1 of this License
+     shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an “as is” basis, without
+   warranty of any kind, either expressed, implied, or statutory, including,
+   without limitation, warranties that the Covered Software is free of defects,
+   merchantable, fit for a particular purpose or non-infringing. The entire
+   risk as to the quality and performance of the Covered Software is with You.
+   Should any Covered Software prove defective in any respect, You (not any
+   Contributor) assume the cost of any necessary servicing, repair, or
+   correction. This disclaimer of warranty constitutes an essential part of this
+   License. No use of  any Covered Software is authorized under this License
+   except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from such
+   party’s negligence to the extent applicable law prohibits such limitation.
+   Some jurisdictions do not allow the exclusion or limitation of incidental or
+   consequential damages, so this exclusion and limitation may not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts of
+   a jurisdiction where the defendant maintains its principal place of business
+   and such litigation shall be governed by laws of that jurisdiction, without
+   reference to its conflict-of-law provisions. Nothing in this Section shall
+   prevent a party’s ability to bring cross-claims or counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject matter
+   hereof. If any provision of this License is held to be unenforceable, such
+   provision shall be reformed only to the extent necessary to make it
+   enforceable. Any law or regulation which provides that the language of a
+   contract shall be construed against the drafter shall not be used to construe
+   this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version of
+      the License under which You originally received the Covered Software, or
+      under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a modified
+      version of this License if you rename the license and remove any
+      references to the name of the license steward (except to note that such
+      modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
+      If You choose to distribute Source Code Form that is Incompatible With
+      Secondary Licenses under the terms of this version of the License, the
+      notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file, then
+You may include the notice in a location (such as a LICENSE file in a relevant
+directory) where a recipient would be likely to look for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - “Incompatible With Secondary Licenses” Notice
+
+      This Source Code Form is “Incompatible
+      With Secondary Licenses”, as defined by
+      the Mozilla Public License, v. 2.0.
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/diagnostic.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/diagnostic.go
new file mode 100644
index 0000000..8d04ad4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/diagnostic.go
@@ -0,0 +1,138 @@
+package tfconfig
+
+import (
+        "fmt"
+
+        legacyhclparser "github.com/hashicorp/hcl/hcl/parser"
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Diagnostic describes a problem (error or warning) encountered during
+// configuration loading.
+type Diagnostic struct {
+        Severity DiagSeverity `json:"severity"`
+        Summary  string       `json:"summary"`
+        Detail   string       `json:"detail,omitempty"`
+
+        // Pos is not populated for all diagnostics, but when populated should
+        // indicate a particular line that the described problem relates to.
+        Pos *SourcePos `json:"pos,omitempty"`
+}
+
+// Diagnostics represents a sequence of diagnostics. This is the type that
+// should be returned from a function that might generate diagnostics.
+type Diagnostics []Diagnostic
+
+// HasErrors returns true if there is at least one Diagnostic of severity
+// DiagError in the receiever.
+//
+// If a function returns a Diagnostics without errors then the result can
+// be assumed to be complete within the "best effort" constraints of this
+// library. If errors are present then the caller may wish to employ more
+// caution in relying on the result.
+func (diags Diagnostics) HasErrors() bool {
+        for _, diag := range diags {
+                if diag.Severity == DiagError {
+                        return true
+                }
+        }
+        return false
+}
+
+func (diags Diagnostics) Error() string {
+        switch len(diags) {
+        case 0:
+                return "no problems"
+        case 1:
+                return fmt.Sprintf("%s: %s", diags[0].Summary, diags[0].Detail)
+        default:
+                return fmt.Sprintf("%s: %s (and %d other messages)", diags[0].Summary, diags[0].Detail, len(diags)-1)
+        }
+}
+
+// Err returns an error representing the receiver if the receiver HasErrors, or
+// nil otherwise.
+//
+// The returned error can be type-asserted back to a Diagnostics if needed.
+func (diags Diagnostics) Err() error {
+        if diags.HasErrors() {
+                return diags
+        }
+        return nil
+}
+
+// DiagSeverity describes the severity of a Diagnostic.
+type DiagSeverity rune
+
+// DiagError indicates a problem that prevented proper processing of the
+// configuration. In the precense of DiagError diagnostics the result is
+// likely to be incomplete.
+const DiagError DiagSeverity = 'E'
+
+// DiagWarning indicates a problem that the user may wish to consider but
+// that did not prevent proper processing of the configuration.
+const DiagWarning DiagSeverity = 'W'
+
+// MarshalJSON is an implementation of encoding/json.Marshaler
+func (s DiagSeverity) MarshalJSON() ([]byte, error) {
+        switch s {
+        case DiagError:
+                return []byte(`"error"`), nil
+        case DiagWarning:
+                return []byte(`"warning"`), nil
+        default:
+                return []byte(`"invalid"`), nil
+        }
+}
+
+func diagnosticsHCL(diags hcl.Diagnostics) Diagnostics {
+        if len(diags) == 0 {
+                return nil
+        }
+        ret := make(Diagnostics, len(diags))
+        for i, diag := range diags {
+                ret[i] = Diagnostic{
+                        Summary: diag.Summary,
+                        Detail:  diag.Detail,
+                }
+                switch diag.Severity {
+                case hcl.DiagError:
+                        ret[i].Severity = DiagError
+                case hcl.DiagWarning:
+                        ret[i].Severity = DiagWarning
+                }
+                if diag.Subject != nil {
+                        pos := sourcePosHCL(*diag.Subject)
+                        ret[i].Pos = &pos
+                }
+        }
+        return ret
+}
+
+func diagnosticsError(err error) Diagnostics {
+        if err == nil {
+                return nil
+        }
+
+        if posErr, ok := err.(*legacyhclparser.PosError); ok {
+                pos := sourcePosLegacyHCL(posErr.Pos, "")
+                return Diagnostics{
+                        Diagnostic{
+                                Severity: DiagError,
+                                Summary:  posErr.Err.Error(),
+                                Pos:      &pos,
+                        },
+                }
+        }
+
+        return Diagnostics{
+                Diagnostic{
+                        Severity: DiagError,
+                        Summary:  err.Error(),
+                },
+        }
+}
+
+func diagnosticsErrorf(format string, args ...interface{}) Diagnostics {
+        return diagnosticsError(fmt.Errorf(format, args...))
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/doc.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/doc.go
new file mode 100644
index 0000000..1604a6e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/doc.go
@@ -0,0 +1,21 @@
+// Package tfconfig is a helper library that does careful, shallow parsing of
+// Terraform modules to provide access to high-level metadata while
+// remaining broadly compatible with configurations targeting various
+// different Terraform versions.
+//
+// This packge focuses on describing top-level objects only, and in particular
+// does not attempt any sort of processing that would require access to plugins.
+// Currently it allows callers to extract high-level information about
+// variables, outputs, resource blocks, provider dependencies, and Terraform
+// Core dependencies.
+//
+// This package only works at the level of single modules. A full configuration
+// is a tree of potentially several modules, some of which may be references
+// to remote packages. There are some basic helpers for traversing calls to
+// modules at relative local paths, however.
+//
+// This package employs a "best effort" parsing strategy, producing as complete
+// a result as possible even though the input may not be entirely valid. The
+// intended use-case is high-level analysis and indexing of externally-facing
+// module characteristics, as opposed to validating or even applying the module.
+package tfconfig
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load.go
new file mode 100644
index 0000000..2d13fe1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load.go
@@ -0,0 +1,130 @@
+package tfconfig
+
+import (
+        "fmt"
+        "io/ioutil"
+        "path/filepath"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// LoadModule reads the directory at the given path and attempts to interpret
+// it as a Terraform module.
+func LoadModule(dir string) (*Module, Diagnostics) {
+
+        // For broad compatibility here we actually have two separate loader
+        // codepaths. The main one uses the new HCL parser and API and is intended
+        // for configurations from Terraform 0.12 onwards (though will work for
+        // many older configurations too), but we'll also fall back on one that
+        // uses the _old_ HCL implementation so we can deal with some edge-cases
+        // that are not valid in new HCL.
+
+        module, diags := loadModule(dir)
+        if diags.HasErrors() {
+                // Try using the legacy HCL parser and see if we fare better.
+                legacyModule, legacyDiags := loadModuleLegacyHCL(dir)
+                if !legacyDiags.HasErrors() {
+                        legacyModule.init(legacyDiags)
+                        return legacyModule, legacyDiags
+                }
+        }
+
+        module.init(diags)
+        return module, diags
+}
+
+// IsModuleDir checks if the given path contains terraform configuration files.
+// This allows the caller to decide how to handle directories that do not have tf files.
+func IsModuleDir(dir string) bool {
+        primaryPaths, _ := dirFiles(dir)
+        if len(primaryPaths) == 0 {
+                return false
+        }
+        return true
+}
+
+func (m *Module) init(diags Diagnostics) {
+        // Fill in any additional provider requirements that are implied by
+        // resource configurations, to avoid the caller from needing to apply
+        // this logic itself. Implied requirements don't have version constraints,
+        // but we'll make sure the requirement value is still non-nil in this
+        // case so callers can easily recognize it.
+        for _, r := range m.ManagedResources {
+                if _, exists := m.RequiredProviders[r.Provider.Name]; !exists {
+                        m.RequiredProviders[r.Provider.Name] = []string{}
+                }
+        }
+        for _, r := range m.DataResources {
+                if _, exists := m.RequiredProviders[r.Provider.Name]; !exists {
+                        m.RequiredProviders[r.Provider.Name] = []string{}
+                }
+        }
+
+        // We redundantly also reference the diagnostics from inside the module
+        // object, primarily so that we can easily included in JSON-serialized
+        // versions of the module object.
+        m.Diagnostics = diags
+}
+
+func dirFiles(dir string) (primary []string, diags hcl.Diagnostics) {
+        infos, err := ioutil.ReadDir(dir)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Failed to read module directory",
+                        Detail:   fmt.Sprintf("Module directory %s does not exist or cannot be read.", dir),
+                })
+                return
+        }
+
+        var override []string
+        for _, info := range infos {
+                if info.IsDir() {
+                        // We only care about files
+                        continue
+                }
+
+                name := info.Name()
+                ext := fileExt(name)
+                if ext == "" || isIgnoredFile(name) {
+                        continue
+                }
+
+                baseName := name[:len(name)-len(ext)] // strip extension
+                isOverride := baseName == "override" || strings.HasSuffix(baseName, "_override")
+
+                fullPath := filepath.Join(dir, name)
+                if isOverride {
+                        override = append(override, fullPath)
+                } else {
+                        primary = append(primary, fullPath)
+                }
+        }
+
+        // We are assuming that any _override files will be logically named,
+        // and processing the files in alphabetical order. Primaries first, then overrides.
+        primary = append(primary, override...)
+
+        return
+}
+
+// fileExt returns the Terraform configuration extension of the given
+// path, or a blank string if it is not a recognized extension.
+func fileExt(path string) string {
+        if strings.HasSuffix(path, ".tf") {
+                return ".tf"
+        } else if strings.HasSuffix(path, ".tf.json") {
+                return ".tf.json"
+        } else {
+                return ""
+        }
+}
+
+// isIgnoredFile returns true if the given filename (which must not have a
+// directory path ahead of it) should be ignored as e.g. an editor swap file.
+func isIgnoredFile(name string) bool {
+        return strings.HasPrefix(name, ".") || // Unix-like hidden files
+                strings.HasSuffix(name, "~") || // vim
+                strings.HasPrefix(name, "#") && strings.HasSuffix(name, "#") // emacs
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_hcl.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_hcl.go
new file mode 100644
index 0000000..72b5d4a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_hcl.go
@@ -0,0 +1,322 @@
+package tfconfig
+
+import (
+        "encoding/json"
+        "fmt"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hclparse"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+)
+
+func loadModule(dir string) (*Module, Diagnostics) {
+        mod := newModule(dir)
+        primaryPaths, diags := dirFiles(dir)
+
+        parser := hclparse.NewParser()
+
+        for _, filename := range primaryPaths {
+                var file *hcl.File
+                var fileDiags hcl.Diagnostics
+                if strings.HasSuffix(filename, ".json") {
+                        file, fileDiags = parser.ParseJSONFile(filename)
+                } else {
+                        file, fileDiags = parser.ParseHCLFile(filename)
+                }
+                diags = append(diags, fileDiags...)
+                if file == nil {
+                        continue
+                }
+
+                content, _, contentDiags := file.Body.PartialContent(rootSchema)
+                diags = append(diags, contentDiags...)
+
+                for _, block := range content.Blocks {
+                        switch block.Type {
+
+                        case "terraform":
+                                content, _, contentDiags := block.Body.PartialContent(terraformBlockSchema)
+                                diags = append(diags, contentDiags...)
+
+                                if attr, defined := content.Attributes["required_version"]; defined {
+                                        var version string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &version)
+                                        diags = append(diags, valDiags...)
+                                        if !valDiags.HasErrors() {
+                                                mod.RequiredCore = append(mod.RequiredCore, version)
+                                        }
+                                }
+
+                                for _, block := range content.Blocks {
+                                        // Our schema only allows required_providers here, so we
+                                        // assume that we'll only get that block type.
+                                        attrs, attrDiags := block.Body.JustAttributes()
+                                        diags = append(diags, attrDiags...)
+
+                                        for name, attr := range attrs {
+                                                var version string
+                                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &version)
+                                                diags = append(diags, valDiags...)
+                                                if !valDiags.HasErrors() {
+                                                        mod.RequiredProviders[name] = append(mod.RequiredProviders[name], version)
+                                                }
+                                        }
+                                }
+
+                        case "variable":
+                                content, _, contentDiags := block.Body.PartialContent(variableSchema)
+                                diags = append(diags, contentDiags...)
+
+                                name := block.Labels[0]
+                                v := &Variable{
+                                        Name: name,
+                                        Pos:  sourcePosHCL(block.DefRange),
+                                }
+
+                                mod.Variables[name] = v
+
+                                if attr, defined := content.Attributes["type"]; defined {
+                                        // We handle this particular attribute in a somewhat-tricky way:
+                                        // since Terraform may evolve its type expression syntax in
+                                        // future versions, we don't want to be overly-strict in how
+                                        // we handle it here, and so we'll instead just take the raw
+                                        // source provided by the user, using the source location
+                                        // information in the expression object.
+                                        //
+                                        // However, older versions of Terraform expected the type
+                                        // to be a string containing a keyword, so we'll need to
+                                        // handle that as a special case first for backward compatibility.
+
+                                        var typeExpr string
+
+                                        var typeExprAsStr string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &typeExprAsStr)
+                                        if !valDiags.HasErrors() {
+                                                typeExpr = typeExprAsStr
+                                        } else {
+
+                                                rng := attr.Expr.Range()
+                                                sourceFilename := rng.Filename
+                                                source, exists := parser.Sources()[sourceFilename]
+                                                if exists {
+                                                        typeExpr = string(rng.SliceBytes(source))
+                                                } else {
+                                                        // This should never happen, so we'll just warn about it and leave the type unspecified.
+                                                        diags = append(diags, &hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Source code not available",
+                                                                Detail:   fmt.Sprintf("Source code is not available for the file %q, which declares the variable %q.", sourceFilename, name),
+                                                                Subject:  &block.DefRange,
+                                                        })
+                                                        typeExpr = ""
+                                                }
+
+                                        }
+
+                                        v.Type = typeExpr
+                                }
+
+                                if attr, defined := content.Attributes["description"]; defined {
+                                        var description string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &description)
+                                        diags = append(diags, valDiags...)
+                                        v.Description = description
+                                }
+
+                                if attr, defined := content.Attributes["default"]; defined {
+                                        // To avoid the caller needing to deal with cty here, we'll
+                                        // use its JSON encoding to convert into an
+                                        // approximately-equivalent plain Go interface{} value
+                                        // to return.
+                                        val, valDiags := attr.Expr.Value(nil)
+                                        diags = append(diags, valDiags...)
+                                        if val.IsWhollyKnown() { // should only be false if there are errors in the input
+                                                valJSON, err := ctyjson.Marshal(val, val.Type())
+                                                if err != nil {
+                                                        // Should never happen, since all possible known
+                                                        // values have a JSON mapping.
+                                                        panic(fmt.Errorf("failed to serialize default value as JSON: %s", err))
+                                                }
+                                                var def interface{}
+                                                err = json.Unmarshal(valJSON, &def)
+                                                if err != nil {
+                                                        // Again should never happen, because valJSON is
+                                                        // guaranteed valid by ctyjson.Marshal.
+                                                        panic(fmt.Errorf("failed to re-parse default value from JSON: %s", err))
+                                                }
+                                                v.Default = def
+                                        }
+                                }
+
+                        case "output":
+
+                                content, _, contentDiags := block.Body.PartialContent(outputSchema)
+                                diags = append(diags, contentDiags...)
+
+                                name := block.Labels[0]
+                                o := &Output{
+                                        Name: name,
+                                        Pos:  sourcePosHCL(block.DefRange),
+                                }
+
+                                mod.Outputs[name] = o
+
+                                if attr, defined := content.Attributes["description"]; defined {
+                                        var description string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &description)
+                                        diags = append(diags, valDiags...)
+                                        o.Description = description
+                                }
+
+                        case "provider":
+
+                                content, _, contentDiags := block.Body.PartialContent(providerConfigSchema)
+                                diags = append(diags, contentDiags...)
+
+                                name := block.Labels[0]
+
+                                if attr, defined := content.Attributes["version"]; defined {
+                                        var version string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &version)
+                                        diags = append(diags, valDiags...)
+                                        if !valDiags.HasErrors() {
+                                                mod.RequiredProviders[name] = append(mod.RequiredProviders[name], version)
+                                        }
+                                }
+
+                                // Even if there wasn't an explicit version required, we still
+                                // need an entry in our map to signal the unversioned dependency.
+                                if _, exists := mod.RequiredProviders[name]; !exists {
+                                        mod.RequiredProviders[name] = []string{}
+                                }
+
+                        case "resource", "data":
+
+                                content, _, contentDiags := block.Body.PartialContent(resourceSchema)
+                                diags = append(diags, contentDiags...)
+
+                                typeName := block.Labels[0]
+                                name := block.Labels[1]
+
+                                r := &Resource{
+                                        Type: typeName,
+                                        Name: name,
+                                        Pos:  sourcePosHCL(block.DefRange),
+                                }
+
+                                var resourcesMap map[string]*Resource
+
+                                switch block.Type {
+                                case "resource":
+                                        r.Mode = ManagedResourceMode
+                                        resourcesMap = mod.ManagedResources
+                                case "data":
+                                        r.Mode = DataResourceMode
+                                        resourcesMap = mod.DataResources
+                                }
+
+                                key := r.MapKey()
+
+                                resourcesMap[key] = r
+
+                                if attr, defined := content.Attributes["provider"]; defined {
+                                        // New style here is to provide this as a naked traversal
+                                        // expression, but we also support quoted references for
+                                        // older configurations that predated this convention.
+                                        traversal, travDiags := hcl.AbsTraversalForExpr(attr.Expr)
+                                        if travDiags.HasErrors() {
+                                                traversal = nil // in case we got any partial results
+
+                                                // Fall back on trying to parse as a string
+                                                var travStr string
+                                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &travStr)
+                                                if !valDiags.HasErrors() {
+                                                        var strDiags hcl.Diagnostics
+                                                        traversal, strDiags = hclsyntax.ParseTraversalAbs([]byte(travStr), "", hcl.Pos{})
+                                                        if strDiags.HasErrors() {
+                                                                traversal = nil
+                                                        }
+                                                }
+                                        }
+
+                                        // If we get out here with a nil traversal then we didn't
+                                        // succeed in processing the input.
+                                        if len(traversal) > 0 {
+                                                providerName := traversal.RootName()
+                                                alias := ""
+                                                if len(traversal) > 1 {
+                                                        if getAttr, ok := traversal[1].(hcl.TraverseAttr); ok {
+                                                                alias = getAttr.Name
+                                                        }
+                                                }
+                                                r.Provider = ProviderRef{
+                                                        Name:  providerName,
+                                                        Alias: alias,
+                                                }
+                                        } else {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid provider reference",
+                                                        Detail:   "Provider argument requires a provider name followed by an optional alias, like \"aws.foo\".",
+                                                        Subject:  attr.Expr.Range().Ptr(),
+                                                })
+                                        }
+                                } else {
+                                        // If provider _isn't_ set then we'll infer it from the
+                                        // resource type.
+                                        r.Provider = ProviderRef{
+                                                Name: resourceTypeDefaultProviderName(r.Type),
+                                        }
+                                }
+
+                        case "module":
+
+                                content, _, contentDiags := block.Body.PartialContent(moduleCallSchema)
+                                diags = append(diags, contentDiags...)
+
+                                name := block.Labels[0]
+                                mc := &ModuleCall{
+                                        Name: block.Labels[0],
+                                        Pos:  sourcePosHCL(block.DefRange),
+                                }
+
+                                // check if this is overriding an existing module
+                                var origSource string
+                                if origMod, exists := mod.ModuleCalls[name]; exists {
+                                        origSource = origMod.Source
+                                }
+
+                                mod.ModuleCalls[name] = mc
+
+                                if attr, defined := content.Attributes["source"]; defined {
+                                        var source string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &source)
+                                        diags = append(diags, valDiags...)
+                                        mc.Source = source
+                                }
+
+                                if mc.Source == "" {
+                                        mc.Source = origSource
+                                }
+
+                                if attr, defined := content.Attributes["version"]; defined {
+                                        var version string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &version)
+                                        diags = append(diags, valDiags...)
+                                        mc.Version = version
+                                }
+
+                        default:
+                                // Should never happen because our cases above should be
+                                // exhaustive for our schema.
+                                panic(fmt.Errorf("unhandled block type %q", block.Type))
+                        }
+                }
+        }
+
+        return mod, diagnosticsHCL(diags)
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_legacy.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_legacy.go
new file mode 100644
index 0000000..86ffdf1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_legacy.go
@@ -0,0 +1,325 @@
+package tfconfig
+
+import (
+        "io/ioutil"
+        "strings"
+
+        legacyhcl "github.com/hashicorp/hcl"
+        legacyast "github.com/hashicorp/hcl/hcl/ast"
+)
+
+func loadModuleLegacyHCL(dir string) (*Module, Diagnostics) {
+        // This implementation is intentionally more quick-and-dirty than the
+        // main loader. In particular, it doesn't bother to keep careful track
+        // of multiple error messages because we always fall back on returning
+        // the main parser's error message if our fallback parsing produces
+        // an error, and thus the errors here are not seen by the end-caller.
+        mod := newModule(dir)
+
+        primaryPaths, diags := dirFiles(dir)
+        if diags.HasErrors() {
+                return mod, diagnosticsHCL(diags)
+        }
+
+        for _, filename := range primaryPaths {
+                src, err := ioutil.ReadFile(filename)
+                if err != nil {
+                        return mod, diagnosticsErrorf("Error reading %s: %s", filename, err)
+                }
+
+                hclRoot, err := legacyhcl.Parse(string(src))
+                if err != nil {
+                        return mod, diagnosticsErrorf("Error parsing %s: %s", filename, err)
+                }
+
+                list, ok := hclRoot.Node.(*legacyast.ObjectList)
+                if !ok {
+                        return mod, diagnosticsErrorf("Error parsing %s: no root object", filename)
+                }
+
+                for _, item := range list.Filter("terraform").Items {
+                        if len(item.Keys) > 0 {
+                                item = &legacyast.ObjectItem{
+                                        Val: &legacyast.ObjectType{
+                                                List: &legacyast.ObjectList{
+                                                        Items: []*legacyast.ObjectItem{item},
+                                                },
+                                        },
+                                }
+                        }
+
+                        type TerraformBlock struct {
+                                RequiredVersion string `hcl:"required_version"`
+                        }
+                        var block TerraformBlock
+                        err = legacyhcl.DecodeObject(&block, item.Val)
+                        if err != nil {
+                                return nil, diagnosticsErrorf("terraform block: %s", err)
+                        }
+
+                        if block.RequiredVersion != "" {
+                                mod.RequiredCore = append(mod.RequiredCore, block.RequiredVersion)
+                        }
+                }
+
+                if vars := list.Filter("variable"); len(vars.Items) > 0 {
+                        vars = vars.Children()
+                        type VariableBlock struct {
+                                Type        string `hcl:"type"`
+                                Default     interface{}
+                                Description string
+                                Fields      []string `hcl:",decodedFields"`
+                        }
+
+                        for _, item := range vars.Items {
+                                unwrapLegacyHCLObjectKeysFromJSON(item, 1)
+
+                                if len(item.Keys) != 1 {
+                                        return nil, diagnosticsErrorf("variable block at %s has no label", item.Pos())
+                                }
+
+                                name := item.Keys[0].Token.Value().(string)
+
+                                var block VariableBlock
+                                err := legacyhcl.DecodeObject(&block, item.Val)
+                                if err != nil {
+                                        return nil, diagnosticsErrorf("invalid variable block at %s: %s", item.Pos(), err)
+                                }
+
+                                // Clean up legacy HCL decoding ambiguity by unwrapping list of maps
+                                if ms, ok := block.Default.([]map[string]interface{}); ok {
+                                        def := make(map[string]interface{})
+                                        for _, m := range ms {
+                                                for k, v := range m {
+                                                        def[k] = v
+                                                }
+                                        }
+                                        block.Default = def
+                                }
+
+                                v := &Variable{
+                                        Name:        name,
+                                        Type:        block.Type,
+                                        Description: block.Description,
+                                        Default:     block.Default,
+                                        Pos:         sourcePosLegacyHCL(item.Pos(), filename),
+                                }
+                                if _, exists := mod.Variables[name]; exists {
+                                        return nil, diagnosticsErrorf("duplicate variable block for %q", name)
+                                }
+                                mod.Variables[name] = v
+
+                        }
+                }
+
+                if outputs := list.Filter("output"); len(outputs.Items) > 0 {
+                        outputs = outputs.Children()
+                        type OutputBlock struct {
+                                Description string
+                        }
+
+                        for _, item := range outputs.Items {
+                                unwrapLegacyHCLObjectKeysFromJSON(item, 1)
+
+                                if len(item.Keys) != 1 {
+                                        return nil, diagnosticsErrorf("output block at %s has no label", item.Pos())
+                                }
+
+                                name := item.Keys[0].Token.Value().(string)
+
+                                var block OutputBlock
+                                err := legacyhcl.DecodeObject(&block, item.Val)
+                                if err != nil {
+                                        return nil, diagnosticsErrorf("invalid output block at %s: %s", item.Pos(), err)
+                                }
+
+                                o := &Output{
+                                        Name:        name,
+                                        Description: block.Description,
+                                        Pos:         sourcePosLegacyHCL(item.Pos(), filename),
+                                }
+                                if _, exists := mod.Outputs[name]; exists {
+                                        return nil, diagnosticsErrorf("duplicate output block for %q", name)
+                                }
+                                mod.Outputs[name] = o
+                        }
+                }
+
+                for _, blockType := range []string{"resource", "data"} {
+                        if resources := list.Filter(blockType); len(resources.Items) > 0 {
+                                resources = resources.Children()
+                                type ResourceBlock struct {
+                                        Provider string
+                                }
+
+                                for _, item := range resources.Items {
+                                        unwrapLegacyHCLObjectKeysFromJSON(item, 2)
+
+                                        if len(item.Keys) != 2 {
+                                                return nil, diagnosticsErrorf("resource block at %s has wrong label count", item.Pos())
+                                        }
+
+                                        typeName := item.Keys[0].Token.Value().(string)
+                                        name := item.Keys[1].Token.Value().(string)
+                                        var mode ResourceMode
+                                        var rMap map[string]*Resource
+                                        switch blockType {
+                                        case "resource":
+                                                mode = ManagedResourceMode
+                                                rMap = mod.ManagedResources
+                                        case "data":
+                                                mode = DataResourceMode
+                                                rMap = mod.DataResources
+                                        }
+
+                                        var block ResourceBlock
+                                        err := legacyhcl.DecodeObject(&block, item.Val)
+                                        if err != nil {
+                                                return nil, diagnosticsErrorf("invalid resource block at %s: %s", item.Pos(), err)
+                                        }
+
+                                        var providerName, providerAlias string
+                                        if dotPos := strings.IndexByte(block.Provider, '.'); dotPos != -1 {
+                                                providerName = block.Provider[:dotPos]
+                                                providerAlias = block.Provider[dotPos+1:]
+                                        } else {
+                                                providerName = block.Provider
+                                        }
+                                        if providerName == "" {
+                                                providerName = resourceTypeDefaultProviderName(typeName)
+                                        }
+
+                                        r := &Resource{
+                                                Mode: mode,
+                                                Type: typeName,
+                                                Name: name,
+                                                Provider: ProviderRef{
+                                                        Name:  providerName,
+                                                        Alias: providerAlias,
+                                                },
+                                                Pos: sourcePosLegacyHCL(item.Pos(), filename),
+                                        }
+                                        key := r.MapKey()
+                                        if _, exists := rMap[key]; exists {
+                                                return nil, diagnosticsErrorf("duplicate resource block for %q", key)
+                                        }
+                                        rMap[key] = r
+                                }
+                        }
+
+                }
+
+                if moduleCalls := list.Filter("module"); len(moduleCalls.Items) > 0 {
+                        moduleCalls = moduleCalls.Children()
+                        type ModuleBlock struct {
+                                Source  string
+                                Version string
+                        }
+
+                        for _, item := range moduleCalls.Items {
+                                unwrapLegacyHCLObjectKeysFromJSON(item, 1)
+
+                                if len(item.Keys) != 1 {
+                                        return nil, diagnosticsErrorf("module block at %s has no label", item.Pos())
+                                }
+
+                                name := item.Keys[0].Token.Value().(string)
+
+                                var block ModuleBlock
+                                err := legacyhcl.DecodeObject(&block, item.Val)
+                                if err != nil {
+                                        return nil, diagnosticsErrorf("module block at %s: %s", item.Pos(), err)
+                                }
+
+                                mc := &ModuleCall{
+                                        Name:    name,
+                                        Source:  block.Source,
+                                        Version: block.Version,
+                                        Pos:     sourcePosLegacyHCL(item.Pos(), filename),
+                                }
+                                // it's possible this module call is from an override file
+                                if origMod, exists := mod.ModuleCalls[name]; exists {
+                                        if mc.Source == "" {
+                                                mc.Source = origMod.Source
+                                        }
+                                }
+                                mod.ModuleCalls[name] = mc
+                        }
+                }
+
+                if providerConfigs := list.Filter("provider"); len(providerConfigs.Items) > 0 {
+                        providerConfigs = providerConfigs.Children()
+                        type ProviderBlock struct {
+                                Version string
+                        }
+
+                        for _, item := range providerConfigs.Items {
+                                unwrapLegacyHCLObjectKeysFromJSON(item, 1)
+
+                                if len(item.Keys) != 1 {
+                                        return nil, diagnosticsErrorf("provider block at %s has no label", item.Pos())
+                                }
+
+                                name := item.Keys[0].Token.Value().(string)
+
+                                var block ProviderBlock
+                                err := legacyhcl.DecodeObject(&block, item.Val)
+                                if err != nil {
+                                        return nil, diagnosticsErrorf("invalid provider block at %s: %s", item.Pos(), err)
+                                }
+
+                                if block.Version != "" {
+                                        mod.RequiredProviders[name] = append(mod.RequiredProviders[name], block.Version)
+                                }
+
+                                // Even if there wasn't an explicit version required, we still
+                                // need an entry in our map to signal the unversioned dependency.
+                                if _, exists := mod.RequiredProviders[name]; !exists {
+                                        mod.RequiredProviders[name] = []string{}
+                                }
+
+                        }
+                }
+        }
+
+        return mod, nil
+}
+
+// unwrapLegacyHCLObjectKeysFromJSON cleans up an edge case that can occur when
+// parsing JSON as input: if we're parsing JSON then directly nested
+// items will show up as additional "keys".
+//
+// For objects that expect a fixed number of keys, this breaks the
+// decoding process. This function unwraps the object into what it would've
+// looked like if it came directly from HCL by specifying the number of keys
+// you expect.
+//
+// Example:
+//
+// { "foo": { "baz": {} } }
+//
+// Will show up with Keys being: []string{"foo", "baz"}
+// when we really just want the first two. This function will fix this.
+func unwrapLegacyHCLObjectKeysFromJSON(item *legacyast.ObjectItem, depth int) {
+        if len(item.Keys) > depth && item.Keys[0].Token.JSON {
+                for len(item.Keys) > depth {
+                        // Pop off the last key
+                        n := len(item.Keys)
+                        key := item.Keys[n-1]
+                        item.Keys[n-1] = nil
+                        item.Keys = item.Keys[:n-1]
+
+                        // Wrap our value in a list
+                        item.Val = &legacyast.ObjectType{
+                                List: &legacyast.ObjectList{
+                                        Items: []*legacyast.ObjectItem{
+                                                &legacyast.ObjectItem{
+                                                        Keys: []*legacyast.ObjectKey{key},
+                                                        Val:  item.Val,
+                                                },
+                                        },
+                                },
+                        }
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module.go
new file mode 100644
index 0000000..65ddb23
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module.go
@@ -0,0 +1,35 @@
+package tfconfig
+
+// Module is the top-level type representing a parsed and processed Terraform
+// module.
+type Module struct {
+        // Path is the local filesystem directory where the module was loaded from.
+        Path string `json:"path"`
+
+        Variables map[string]*Variable `json:"variables"`
+        Outputs   map[string]*Output   `json:"outputs"`
+
+        RequiredCore      []string            `json:"required_core,omitempty"`
+        RequiredProviders map[string][]string `json:"required_providers"`
+
+        ManagedResources map[string]*Resource   `json:"managed_resources"`
+        DataResources    map[string]*Resource   `json:"data_resources"`
+        ModuleCalls      map[string]*ModuleCall `json:"module_calls"`
+
+        // Diagnostics records any errors and warnings that were detected during
+        // loading, primarily for inclusion in serialized forms of the module
+        // since this slice is also returned as a second argument from LoadModule.
+        Diagnostics Diagnostics `json:"diagnostics,omitempty"`
+}
+
+func newModule(path string) *Module {
+        return &Module{
+                Path:              path,
+                Variables:         make(map[string]*Variable),
+                Outputs:           make(map[string]*Output),
+                RequiredProviders: make(map[string][]string),
+                ManagedResources:  make(map[string]*Resource),
+                DataResources:     make(map[string]*Resource),
+                ModuleCalls:       make(map[string]*ModuleCall),
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module_call.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module_call.go
new file mode 100644
index 0000000..5e1e05a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module_call.go
@@ -0,0 +1,11 @@
+package tfconfig
+
+// ModuleCall represents a "module" block within a module. That is, a
+// declaration of a child module from inside its parent.
+type ModuleCall struct {
+        Name    string `json:"name"`
+        Source  string `json:"source"`
+        Version string `json:"version,omitempty"`
+
+        Pos SourcePos `json:"pos"`
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/output.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/output.go
new file mode 100644
index 0000000..890b25e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/output.go
@@ -0,0 +1,9 @@
+package tfconfig
+
+// Output represents a single output from a Terraform module.
+type Output struct {
+        Name        string `json:"name"`
+        Description string `json:"description,omitempty"`
+
+        Pos SourcePos `json:"pos"`
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/provider_ref.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/provider_ref.go
new file mode 100644
index 0000000..d924837
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/provider_ref.go
@@ -0,0 +1,9 @@
+package tfconfig
+
+// ProviderRef is a reference to a provider configuration within a module.
+// It represents the contents of a "provider" argument in a resource, or
+// a value in the "providers" map for a module call.
+type ProviderRef struct {
+        Name  string `json:"name"`
+        Alias string `json:"alias,omitempty"` // Empty if the default provider configuration is referenced
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/resource.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/resource.go
new file mode 100644
index 0000000..401c8fc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/resource.go
@@ -0,0 +1,64 @@
+package tfconfig
+
+import (
+        "fmt"
+        "strconv"
+        "strings"
+)
+
+// Resource represents a single "resource" or "data" block within a module.
+type Resource struct {
+        Mode ResourceMode `json:"mode"`
+        Type string       `json:"type"`
+        Name string       `json:"name"`
+
+        Provider ProviderRef `json:"provider"`
+
+        Pos SourcePos `json:"pos"`
+}
+
+// MapKey returns a string that can be used to uniquely identify the receiver
+// in a map[string]*Resource.
+func (r *Resource) MapKey() string {
+        switch r.Mode {
+        case ManagedResourceMode:
+                return fmt.Sprintf("%s.%s", r.Type, r.Name)
+        case DataResourceMode:
+                return fmt.Sprintf("data.%s.%s", r.Type, r.Name)
+        default:
+                // should never happen
+                return fmt.Sprintf("[invalid_mode!].%s.%s", r.Type, r.Name)
+        }
+}
+
+// ResourceMode represents the "mode" of a resource, which is used to
+// distinguish between managed resources ("resource" blocks in config) and
+// data resources ("data" blocks in config).
+type ResourceMode rune
+
+const InvalidResourceMode ResourceMode = 0
+const ManagedResourceMode ResourceMode = 'M'
+const DataResourceMode ResourceMode = 'D'
+
+func (m ResourceMode) String() string {
+        switch m {
+        case ManagedResourceMode:
+                return "managed"
+        case DataResourceMode:
+                return "data"
+        default:
+                return ""
+        }
+}
+
+// MarshalJSON implements encoding/json.Marshaler.
+func (m ResourceMode) MarshalJSON() ([]byte, error) {
+        return []byte(strconv.Quote(m.String())), nil
+}
+
+func resourceTypeDefaultProviderName(typeName string) string {
+        if underPos := strings.IndexByte(typeName, '_'); underPos != -1 {
+                return typeName[:underPos]
+        }
+        return typeName
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/schema.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/schema.go
new file mode 100644
index 0000000..3af742f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/schema.go
@@ -0,0 +1,106 @@
+package tfconfig
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+var rootSchema = &hcl.BodySchema{
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type:       "terraform",
+                        LabelNames: nil,
+                },
+                {
+                        Type:       "variable",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "output",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "provider",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "resource",
+                        LabelNames: []string{"type", "name"},
+                },
+                {
+                        Type:       "data",
+                        LabelNames: []string{"type", "name"},
+                },
+                {
+                        Type:       "module",
+                        LabelNames: []string{"name"},
+                },
+        },
+}
+
+var terraformBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "required_version",
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "required_providers",
+                },
+        },
+}
+
+var providerConfigSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "version",
+                },
+                {
+                        Name: "alias",
+                },
+        },
+}
+
+var variableSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "type",
+                },
+                {
+                        Name: "description",
+                },
+                {
+                        Name: "default",
+                },
+        },
+}
+
+var outputSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "description",
+                },
+        },
+}
+
+var moduleCallSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "source",
+                },
+                {
+                        Name: "version",
+                },
+                {
+                        Name: "providers",
+                },
+        },
+}
+
+var resourceSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "provider",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/source_pos.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/source_pos.go
new file mode 100644
index 0000000..883914e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/source_pos.go
@@ -0,0 +1,50 @@
+package tfconfig
+
+import (
+        legacyhcltoken "github.com/hashicorp/hcl/hcl/token"
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// SourcePos is a pointer to a particular location in a source file.
+//
+// This type is embedded into other structs to allow callers to locate the
+// definition of each described module element. The SourcePos of an element
+// is usually the first line of its definition, although the definition can
+// be a little "fuzzy" with JSON-based config files.
+type SourcePos struct {
+        Filename string `json:"filename"`
+        Line     int    `json:"line"`
+}
+
+func sourcePos(filename string, line int) SourcePos {
+        return SourcePos{
+                Filename: filename,
+                Line:     line,
+        }
+}
+
+func sourcePosHCL(rng hcl.Range) SourcePos {
+        // We intentionally throw away the column information here because
+        // current and legacy HCL both disagree on the definition of a column
+        // and so a line-only reference is the best granularity we can do
+        // such that the result is consistent between both parsers.
+        return SourcePos{
+                Filename: rng.Filename,
+                Line:     rng.Start.Line,
+        }
+}
+
+func sourcePosLegacyHCL(pos legacyhcltoken.Pos, filename string) SourcePos {
+        useFilename := pos.Filename
+        // We'll try to use the filename given in legacy HCL position, but
+        // in practice there's no way to actually get this populated via
+        // the HCL API so it's usually empty except in some specialized
+        // situations, such as positions in error objects.
+        if useFilename == "" {
+                useFilename = filename
+        }
+        return SourcePos{
+                Filename: useFilename,
+                Line:     pos.Line,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/variable.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/variable.go
new file mode 100644
index 0000000..0f73fc9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/variable.go
@@ -0,0 +1,16 @@
+package tfconfig
+
+// Variable represents a single variable from a Terraform module.
+type Variable struct {
+        Name        string `json:"name"`
+        Type        string `json:"type,omitempty"`
+        Description string `json:"description,omitempty"`
+
+        // Default is an approximate representation of the default value in
+        // the native Go type system. The conversion from the value given in
+        // configuration may be slightly lossy. Only values that can be
+        // serialized by json.Marshal will be included here.
+        Default interface{} `json:"default,omitempty"`
+
+        Pos SourcePos `json:"pos"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/count_attr.go b/vendor/github.com/hashicorp/terraform/addrs/count_attr.go
new file mode 100644
index 0000000..90a5faf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/count_attr.go
@@ -0,0 +1,12 @@
+package addrs
+
+// CountAttr is the address of an attribute of the "count" object in
+// the interpolation scope, like "count.index".
+type CountAttr struct {
+        referenceable
+        Name string
+}
+
+func (ca CountAttr) String() string {
+        return "count." + ca.Name
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/doc.go b/vendor/github.com/hashicorp/terraform/addrs/doc.go
new file mode 100644
index 0000000..4609331
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/doc.go
@@ -0,0 +1,17 @@
+// Package addrs contains types that represent "addresses", which are
+// references to specific objects within a Terraform configuration or
+// state.
+//
+// All addresses have string representations based on HCL traversal syntax
+// which should be used in the user-interface, and also in-memory
+// representations that can be used internally.
+//
+// For object types that exist within Terraform modules a pair of types is
+// used. The "local" part of the address is represented by a type, and then
+// an absolute path to that object in the context of its module is represented
+// by a type of the same name with an "Abs" prefix added, for "absolute".
+//
+// All types within this package should be treated as immutable, even if this
+// is not enforced by the Go compiler. It is always an implementation error
+// to modify an address object in-place after it is initially constructed.
+package addrs
diff --git a/vendor/github.com/hashicorp/terraform/addrs/input_variable.go b/vendor/github.com/hashicorp/terraform/addrs/input_variable.go
new file mode 100644
index 0000000..d2c046c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/input_variable.go
@@ -0,0 +1,41 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// InputVariable is the address of an input variable.
+type InputVariable struct {
+        referenceable
+        Name string
+}
+
+func (v InputVariable) String() string {
+        return "var." + v.Name
+}
+
+// AbsInputVariableInstance is the address of an input variable within a
+// particular module instance.
+type AbsInputVariableInstance struct {
+        Module   ModuleInstance
+        Variable InputVariable
+}
+
+// InputVariable returns the absolute address of the input variable of the
+// given name inside the receiving module instance.
+func (m ModuleInstance) InputVariable(name string) AbsInputVariableInstance {
+        return AbsInputVariableInstance{
+                Module: m,
+                Variable: InputVariable{
+                        Name: name,
+                },
+        }
+}
+
+func (v AbsInputVariableInstance) String() string {
+        if len(v.Module) == 0 {
+                return v.String()
+        }
+
+        return fmt.Sprintf("%s.%s", v.Module.String(), v.Variable.String())
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/instance_key.go b/vendor/github.com/hashicorp/terraform/addrs/instance_key.go
new file mode 100644
index 0000000..cef8b27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/instance_key.go
@@ -0,0 +1,123 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// InstanceKey represents the key of an instance within an object that
+// contains multiple instances due to using "count" or "for_each" arguments
+// in configuration.
+//
+// IntKey and StringKey are the two implementations of this type. No other
+// implementations are allowed. The single instance of an object that _isn't_
+// using "count" or "for_each" is represented by NoKey, which is a nil
+// InstanceKey.
+type InstanceKey interface {
+        instanceKeySigil()
+        String() string
+}
+
+// ParseInstanceKey returns the instance key corresponding to the given value,
+// which must be known and non-null.
+//
+// If an unknown or null value is provided then this function will panic. This
+// function is intended to deal with the values that would naturally be found
+// in a hcl.TraverseIndex, which (when parsed from source, at least) can never
+// contain unknown or null values.
+func ParseInstanceKey(key cty.Value) (InstanceKey, error) {
+        switch key.Type() {
+        case cty.String:
+                return StringKey(key.AsString()), nil
+        case cty.Number:
+                var idx int
+                err := gocty.FromCtyValue(key, &idx)
+                return IntKey(idx), err
+        default:
+                return NoKey, fmt.Errorf("either a string or an integer is required")
+        }
+}
+
+// NoKey represents the absense of an InstanceKey, for the single instance
+// of a configuration object that does not use "count" or "for_each" at all.
+var NoKey InstanceKey
+
+// IntKey is the InstanceKey representation representing integer indices, as
+// used when the "count" argument is specified or if for_each is used with
+// a sequence type.
+type IntKey int
+
+func (k IntKey) instanceKeySigil() {
+}
+
+func (k IntKey) String() string {
+        return fmt.Sprintf("[%d]", int(k))
+}
+
+// StringKey is the InstanceKey representation representing string indices, as
+// used when the "for_each" argument is specified with a map or object type.
+type StringKey string
+
+func (k StringKey) instanceKeySigil() {
+}
+
+func (k StringKey) String() string {
+        // FIXME: This isn't _quite_ right because Go's quoted string syntax is
+        // slightly different than HCL's, but we'll accept it for now.
+        return fmt.Sprintf("[%q]", string(k))
+}
+
+// InstanceKeyLess returns true if the first given instance key i should sort
+// before the second key j, and false otherwise.
+func InstanceKeyLess(i, j InstanceKey) bool {
+        iTy := instanceKeyType(i)
+        jTy := instanceKeyType(j)
+
+        switch {
+        case i == j:
+                return false
+        case i == NoKey:
+                return true
+        case j == NoKey:
+                return false
+        case iTy != jTy:
+                // The ordering here is arbitrary except that we want NoKeyType
+                // to sort before the others, so we'll just use the enum values
+                // of InstanceKeyType here (where NoKey is zero, sorting before
+                // any other).
+                return uint32(iTy) < uint32(jTy)
+        case iTy == IntKeyType:
+                return int(i.(IntKey)) < int(j.(IntKey))
+        case iTy == StringKeyType:
+                return string(i.(StringKey)) < string(j.(StringKey))
+        default:
+                // Shouldn't be possible to get down here in practice, since the
+                // above is exhaustive.
+                return false
+        }
+}
+
+func instanceKeyType(k InstanceKey) InstanceKeyType {
+        if _, ok := k.(StringKey); ok {
+                return StringKeyType
+        }
+        if _, ok := k.(IntKey); ok {
+                return IntKeyType
+        }
+        return NoKeyType
+}
+
+// InstanceKeyType represents the different types of instance key that are
+// supported. Usually it is sufficient to simply type-assert an InstanceKey
+// value to either IntKey or StringKey, but this type and its values can be
+// used to represent the types themselves, rather than specific values
+// of those types.
+type InstanceKeyType rune
+
+const (
+        NoKeyType     InstanceKeyType = 0
+        IntKeyType    InstanceKeyType = 'I'
+        StringKeyType InstanceKeyType = 'S'
+)
diff --git a/vendor/github.com/hashicorp/terraform/addrs/local_value.go b/vendor/github.com/hashicorp/terraform/addrs/local_value.go
new file mode 100644
index 0000000..61a07b9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/local_value.go
@@ -0,0 +1,48 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// LocalValue is the address of a local value.
+type LocalValue struct {
+        referenceable
+        Name string
+}
+
+func (v LocalValue) String() string {
+        return "local." + v.Name
+}
+
+// Absolute converts the receiver into an absolute address within the given
+// module instance.
+func (v LocalValue) Absolute(m ModuleInstance) AbsLocalValue {
+        return AbsLocalValue{
+                Module:     m,
+                LocalValue: v,
+        }
+}
+
+// AbsLocalValue is the absolute address of a local value within a module instance.
+type AbsLocalValue struct {
+        Module     ModuleInstance
+        LocalValue LocalValue
+}
+
+// LocalValue returns the absolute address of a local value of the given
+// name within the receiving module instance.
+func (m ModuleInstance) LocalValue(name string) AbsLocalValue {
+        return AbsLocalValue{
+                Module: m,
+                LocalValue: LocalValue{
+                        Name: name,
+                },
+        }
+}
+
+func (v AbsLocalValue) String() string {
+        if len(v.Module) == 0 {
+                return v.LocalValue.String()
+        }
+        return fmt.Sprintf("%s.%s", v.Module.String(), v.LocalValue.String())
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/module.go b/vendor/github.com/hashicorp/terraform/addrs/module.go
new file mode 100644
index 0000000..6420c63
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/module.go
@@ -0,0 +1,75 @@
+package addrs
+
+import (
+        "strings"
+)
+
+// Module is an address for a module call within configuration. This is
+// the static counterpart of ModuleInstance, representing a traversal through
+// the static module call tree in configuration and does not take into account
+// the potentially-multiple instances of a module that might be created by
+// "count" and "for_each" arguments within those calls.
+//
+// This type should be used only in very specialized cases when working with
+// the static module call tree. Type ModuleInstance is appropriate in more cases.
+//
+// Although Module is a slice, it should be treated as immutable after creation.
+type Module []string
+
+// RootModule is the module address representing the root of the static module
+// call tree, which is also the zero value of Module.
+//
+// Note that this is not the root of the dynamic module tree, which is instead
+// represented by RootModuleInstance.
+var RootModule Module
+
+// IsRoot returns true if the receiver is the address of the root module,
+// or false otherwise.
+func (m Module) IsRoot() bool {
+        return len(m) == 0
+}
+
+func (m Module) String() string {
+        if len(m) == 0 {
+                return ""
+        }
+        return strings.Join([]string(m), ".")
+}
+
+// Child returns the address of a child call in the receiver, identified by the
+// given name.
+func (m Module) Child(name string) Module {
+        ret := make(Module, 0, len(m)+1)
+        ret = append(ret, m...)
+        return append(ret, name)
+}
+
+// Parent returns the address of the parent module of the receiver, or the
+// receiver itself if there is no parent (if it's the root module address).
+func (m Module) Parent() Module {
+        if len(m) == 0 {
+                return m
+        }
+        return m[:len(m)-1]
+}
+
+// Call returns the module call address that corresponds to the given module
+// instance, along with the address of the module that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCall and then returns a slice of the receiever that excludes that
+// last part. This is just a convenience for situations where a call address
+// is required, such as when dealing with *Reference and Referencable values.
+func (m Module) Call() (Module, ModuleCall) {
+        if len(m) == 0 {
+                panic("cannot produce ModuleCall for root module")
+        }
+
+        caller, callName := m[:len(m)-1], m[len(m)-1]
+        return caller, ModuleCall{
+                Name: callName,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/module_call.go b/vendor/github.com/hashicorp/terraform/addrs/module_call.go
new file mode 100644
index 0000000..09596cc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/module_call.go
@@ -0,0 +1,81 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// ModuleCall is the address of a call from the current module to a child
+// module.
+//
+// There is no "Abs" version of ModuleCall because an absolute module path
+// is represented by ModuleInstance.
+type ModuleCall struct {
+        referenceable
+        Name string
+}
+
+func (c ModuleCall) String() string {
+        return "module." + c.Name
+}
+
+// Instance returns the address of an instance of the receiver identified by
+// the given key.
+func (c ModuleCall) Instance(key InstanceKey) ModuleCallInstance {
+        return ModuleCallInstance{
+                Call: c,
+                Key:  key,
+        }
+}
+
+// ModuleCallInstance is the address of one instance of a module created from
+// a module call, which might create multiple instances using "count" or
+// "for_each" arguments.
+type ModuleCallInstance struct {
+        referenceable
+        Call ModuleCall
+        Key  InstanceKey
+}
+
+func (c ModuleCallInstance) String() string {
+        if c.Key == NoKey {
+                return c.Call.String()
+        }
+        return fmt.Sprintf("module.%s%s", c.Call.Name, c.Key)
+}
+
+// ModuleInstance returns the address of the module instance that corresponds
+// to the receiving call instance when resolved in the given calling module.
+// In other words, it returns the child module instance that the receving
+// call instance creates.
+func (c ModuleCallInstance) ModuleInstance(caller ModuleInstance) ModuleInstance {
+        return caller.Child(c.Call.Name, c.Key)
+}
+
+// Output returns the address of an output of the receiver identified by its
+// name.
+func (c ModuleCallInstance) Output(name string) ModuleCallOutput {
+        return ModuleCallOutput{
+                Call: c,
+                Name: name,
+        }
+}
+
+// ModuleCallOutput is the address of a particular named output produced by
+// an instance of a module call.
+type ModuleCallOutput struct {
+        referenceable
+        Call ModuleCallInstance
+        Name string
+}
+
+func (co ModuleCallOutput) String() string {
+        return fmt.Sprintf("%s.%s", co.Call.String(), co.Name)
+}
+
+// AbsOutputValue returns the absolute output value address that corresponds
+// to the receving module call output address, once resolved in the given
+// calling module.
+func (co ModuleCallOutput) AbsOutputValue(caller ModuleInstance) AbsOutputValue {
+        moduleAddr := co.Call.ModuleInstance(caller)
+        return moduleAddr.OutputValue(co.Name)
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/module_instance.go b/vendor/github.com/hashicorp/terraform/addrs/module_instance.go
new file mode 100644
index 0000000..67e73e5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/module_instance.go
@@ -0,0 +1,415 @@
+package addrs
+
+import (
+        "bytes"
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// ModuleInstance is an address for a particular module instance within the
+// dynamic module tree. This is an extension of the static traversals
+// represented by type Module that deals with the possibility of a single
+// module call producing multiple instances via the "count" and "for_each"
+// arguments.
+//
+// Although ModuleInstance is a slice, it should be treated as immutable after
+// creation.
+type ModuleInstance []ModuleInstanceStep
+
+var (
+        _ Targetable = ModuleInstance(nil)
+)
+
+func ParseModuleInstance(traversal hcl.Traversal) (ModuleInstance, tfdiags.Diagnostics) {
+        mi, remain, diags := parseModuleInstancePrefix(traversal)
+        if len(remain) != 0 {
+                if len(remain) == len(traversal) {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid module instance address",
+                                Detail:   "A module instance address must begin with \"module.\".",
+                                Subject:  remain.SourceRange().Ptr(),
+                        })
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid module instance address",
+                                Detail:   "The module instance address is followed by additional invalid content.",
+                                Subject:  remain.SourceRange().Ptr(),
+                        })
+                }
+        }
+        return mi, diags
+}
+
+// ParseModuleInstanceStr is a helper wrapper around ParseModuleInstance
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseProviderConfigCompact.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// then the returned address is invalid.
+func ParseModuleInstanceStr(str string) (ModuleInstance, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return nil, diags
+        }
+
+        addr, addrDiags := ParseModuleInstance(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+func parseModuleInstancePrefix(traversal hcl.Traversal) (ModuleInstance, hcl.Traversal, tfdiags.Diagnostics) {
+        remain := traversal
+        var mi ModuleInstance
+        var diags tfdiags.Diagnostics
+
+        for len(remain) > 0 {
+                var next string
+                switch tt := remain[0].(type) {
+                case hcl.TraverseRoot:
+                        next = tt.Name
+                case hcl.TraverseAttr:
+                        next = tt.Name
+                default:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address operator",
+                                Detail:   "Module address prefix must be followed by dot and then a name.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                        break
+                }
+
+                if next != "module" {
+                        break
+                }
+
+                kwRange := remain[0].SourceRange()
+                remain = remain[1:]
+                // If we have the prefix "module" then we should be followed by an
+                // module call name, as an attribute, and then optionally an index step
+                // giving the instance key.
+                if len(remain) == 0 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address operator",
+                                Detail:   "Prefix \"module.\" must be followed by a module name.",
+                                Subject:  &kwRange,
+                        })
+                        break
+                }
+
+                var moduleName string
+                switch tt := remain[0].(type) {
+                case hcl.TraverseAttr:
+                        moduleName = tt.Name
+                default:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address operator",
+                                Detail:   "Prefix \"module.\" must be followed by a module name.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                        break
+                }
+                remain = remain[1:]
+                step := ModuleInstanceStep{
+                        Name: moduleName,
+                }
+
+                if len(remain) > 0 {
+                        if idx, ok := remain[0].(hcl.TraverseIndex); ok {
+                                remain = remain[1:]
+
+                                switch idx.Key.Type() {
+                                case cty.String:
+                                        step.InstanceKey = StringKey(idx.Key.AsString())
+                                case cty.Number:
+                                        var idxInt int
+                                        err := gocty.FromCtyValue(idx.Key, &idxInt)
+                                        if err == nil {
+                                                step.InstanceKey = IntKey(idxInt)
+                                        } else {
+                                                diags = diags.Append(&hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid address operator",
+                                                        Detail:   fmt.Sprintf("Invalid module index: %s.", err),
+                                                        Subject:  idx.SourceRange().Ptr(),
+                                                })
+                                        }
+                                default:
+                                        // Should never happen, because no other types are allowed in traversal indices.
+                                        diags = diags.Append(&hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid address operator",
+                                                Detail:   "Invalid module key: must be either a string or an integer.",
+                                                Subject:  idx.SourceRange().Ptr(),
+                                        })
+                                }
+                        }
+                }
+
+                mi = append(mi, step)
+        }
+
+        var retRemain hcl.Traversal
+        if len(remain) > 0 {
+                retRemain = make(hcl.Traversal, len(remain))
+                copy(retRemain, remain)
+                // The first element here might be either a TraverseRoot or a
+                // TraverseAttr, depending on whether we had a module address on the
+                // front. To make life easier for callers, we'll normalize to always
+                // start with a TraverseRoot.
+                if tt, ok := retRemain[0].(hcl.TraverseAttr); ok {
+                        retRemain[0] = hcl.TraverseRoot{
+                                Name:     tt.Name,
+                                SrcRange: tt.SrcRange,
+                        }
+                }
+        }
+
+        return mi, retRemain, diags
+}
+
+// UnkeyedInstanceShim is a shim method for converting a Module address to the
+// equivalent ModuleInstance address that assumes that no modules have
+// keyed instances.
+//
+// This is a temporary allowance for the fact that Terraform does not presently
+// support "count" and "for_each" on modules, and thus graph building code that
+// derives graph nodes from configuration must just assume unkeyed modules
+// in order to construct the graph. At a later time when "count" and "for_each"
+// support is added for modules, all callers of this method will need to be
+// reworked to allow for keyed module instances.
+func (m Module) UnkeyedInstanceShim() ModuleInstance {
+        path := make(ModuleInstance, len(m))
+        for i, name := range m {
+                path[i] = ModuleInstanceStep{Name: name}
+        }
+        return path
+}
+
+// ModuleInstanceStep is a single traversal step through the dynamic module
+// tree. It is used only as part of ModuleInstance.
+type ModuleInstanceStep struct {
+        Name        string
+        InstanceKey InstanceKey
+}
+
+// RootModuleInstance is the module instance address representing the root
+// module, which is also the zero value of ModuleInstance.
+var RootModuleInstance ModuleInstance
+
+// IsRoot returns true if the receiver is the address of the root module instance,
+// or false otherwise.
+func (m ModuleInstance) IsRoot() bool {
+        return len(m) == 0
+}
+
+// Child returns the address of a child module instance of the receiver,
+// identified by the given name and key.
+func (m ModuleInstance) Child(name string, key InstanceKey) ModuleInstance {
+        ret := make(ModuleInstance, 0, len(m)+1)
+        ret = append(ret, m...)
+        return append(ret, ModuleInstanceStep{
+                Name:        name,
+                InstanceKey: key,
+        })
+}
+
+// Parent returns the address of the parent module instance of the receiver, or
+// the receiver itself if there is no parent (if it's the root module address).
+func (m ModuleInstance) Parent() ModuleInstance {
+        if len(m) == 0 {
+                return m
+        }
+        return m[:len(m)-1]
+}
+
+// String returns a string representation of the receiver, in the format used
+// within e.g. user-provided resource addresses.
+//
+// The address of the root module has the empty string as its representation.
+func (m ModuleInstance) String() string {
+        var buf bytes.Buffer
+        sep := ""
+        for _, step := range m {
+                buf.WriteString(sep)
+                buf.WriteString("module.")
+                buf.WriteString(step.Name)
+                if step.InstanceKey != NoKey {
+                        buf.WriteString(step.InstanceKey.String())
+                }
+                sep = "."
+        }
+        return buf.String()
+}
+
+// Equal returns true if the receiver and the given other value
+// contains the exact same parts.
+func (m ModuleInstance) Equal(o ModuleInstance) bool {
+        return m.String() == o.String()
+}
+
+// Less returns true if the receiver should sort before the given other value
+// in a sorted list of addresses.
+func (m ModuleInstance) Less(o ModuleInstance) bool {
+        if len(m) != len(o) {
+                // Shorter path sorts first.
+                return len(m) < len(o)
+        }
+
+        for i := range m {
+                mS, oS := m[i], o[i]
+                switch {
+                case mS.Name != oS.Name:
+                        return mS.Name < oS.Name
+                case mS.InstanceKey != oS.InstanceKey:
+                        return InstanceKeyLess(mS.InstanceKey, oS.InstanceKey)
+                }
+        }
+
+        return false
+}
+
+// Ancestors returns a slice containing the receiver and all of its ancestor
+// module instances, all the way up to (and including) the root module.
+// The result is ordered by depth, with the root module always first.
+//
+// Since the result always includes the root module, a caller may choose to
+// ignore it by slicing the result with [1:].
+func (m ModuleInstance) Ancestors() []ModuleInstance {
+        ret := make([]ModuleInstance, 0, len(m)+1)
+        for i := 0; i <= len(m); i++ {
+                ret = append(ret, m[:i])
+        }
+        return ret
+}
+
+// IsAncestor returns true if the receiver is an ancestor of the given
+// other value.
+func (m ModuleInstance) IsAncestor(o ModuleInstance) bool {
+        // Longer or equal sized paths means the receiver cannot
+        // be an ancestor of the given module insatnce.
+        if len(m) >= len(o) {
+                return false
+        }
+
+        for i, ms := range m {
+                if ms.Name != o[i].Name {
+                        return false
+                }
+                if ms.InstanceKey != NoKey && ms.InstanceKey != o[i].InstanceKey {
+                        return false
+                }
+        }
+
+        return true
+}
+
+// Call returns the module call address that corresponds to the given module
+// instance, along with the address of the module instance that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// A single module call can produce potentially many module instances, so the
+// result discards any instance key that might be present on the last step
+// of the instance. To retain this, use CallInstance instead.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCall and then returns a slice of the receiever that excludes that
+// last part. This is just a convenience for situations where a call address
+// is required, such as when dealing with *Reference and Referencable values.
+func (m ModuleInstance) Call() (ModuleInstance, ModuleCall) {
+        if len(m) == 0 {
+                panic("cannot produce ModuleCall for root module")
+        }
+
+        inst, lastStep := m[:len(m)-1], m[len(m)-1]
+        return inst, ModuleCall{
+                Name: lastStep.Name,
+        }
+}
+
+// CallInstance returns the module call instance address that corresponds to
+// the given module instance, along with the address of the module instance
+// that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCallInstance and then returns a slice of the receiever that excludes
+// that last part. This is just a convenience for situations where a call\
+// address is required, such as when dealing with *Reference and Referencable
+// values.
+func (m ModuleInstance) CallInstance() (ModuleInstance, ModuleCallInstance) {
+        if len(m) == 0 {
+                panic("cannot produce ModuleCallInstance for root module")
+        }
+
+        inst, lastStep := m[:len(m)-1], m[len(m)-1]
+        return inst, ModuleCallInstance{
+                Call: ModuleCall{
+                        Name: lastStep.Name,
+                },
+                Key: lastStep.InstanceKey,
+        }
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address either matches the receiver, is a sub-module-instance of the
+// receiver, or is a targetable absolute address within a module that
+// is contained within the reciever.
+func (m ModuleInstance) TargetContains(other Targetable) bool {
+        switch to := other.(type) {
+
+        case ModuleInstance:
+                if len(to) < len(m) {
+                        // Can't be contained if the path is shorter
+                        return false
+                }
+                // Other is contained if its steps match for the length of our own path.
+                for i, ourStep := range m {
+                        otherStep := to[i]
+                        if ourStep != otherStep {
+                                return false
+                        }
+                }
+                // If we fall out here then the prefixed matched, so it's contained.
+                return true
+
+        case AbsResource:
+                return m.TargetContains(to.Module)
+
+        case AbsResourceInstance:
+                return m.TargetContains(to.Module)
+
+        default:
+                return false
+        }
+}
+
+func (m ModuleInstance) targetableSigil() {
+        // ModuleInstance is targetable
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/output_value.go b/vendor/github.com/hashicorp/terraform/addrs/output_value.go
new file mode 100644
index 0000000..bcd923a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/output_value.go
@@ -0,0 +1,75 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// OutputValue is the address of an output value, in the context of the module
+// that is defining it.
+//
+// This is related to but separate from ModuleCallOutput, which represents
+// a module output from the perspective of its parent module. Since output
+// values cannot be represented from the module where they are defined,
+// OutputValue is not Referenceable, while ModuleCallOutput is.
+type OutputValue struct {
+        Name string
+}
+
+func (v OutputValue) String() string {
+        return "output." + v.Name
+}
+
+// Absolute converts the receiver into an absolute address within the given
+// module instance.
+func (v OutputValue) Absolute(m ModuleInstance) AbsOutputValue {
+        return AbsOutputValue{
+                Module:      m,
+                OutputValue: v,
+        }
+}
+
+// AbsOutputValue is the absolute address of an output value within a module instance.
+//
+// This represents an output globally within the namespace of a particular
+// configuration. It is related to but separate from ModuleCallOutput, which
+// represents a module output from the perspective of its parent module.
+type AbsOutputValue struct {
+        Module      ModuleInstance
+        OutputValue OutputValue
+}
+
+// OutputValue returns the absolute address of an output value of the given
+// name within the receiving module instance.
+func (m ModuleInstance) OutputValue(name string) AbsOutputValue {
+        return AbsOutputValue{
+                Module: m,
+                OutputValue: OutputValue{
+                        Name: name,
+                },
+        }
+}
+
+func (v AbsOutputValue) String() string {
+        if v.Module.IsRoot() {
+                return v.OutputValue.String()
+        }
+        return fmt.Sprintf("%s.%s", v.Module.String(), v.OutputValue.String())
+}
+
+// ModuleCallOutput converts an AbsModuleOutput into a ModuleCallOutput,
+// returning also the module instance that the ModuleCallOutput is relative
+// to.
+//
+// The root module does not have a call, and so this method cannot be used
+// with outputs in the root module, and will panic in that case.
+func (v AbsOutputValue) ModuleCallOutput() (ModuleInstance, ModuleCallOutput) {
+        if v.Module.IsRoot() {
+                panic("ReferenceFromCall used with root module output")
+        }
+
+        caller, call := v.Module.CallInstance()
+        return caller, ModuleCallOutput{
+                Call: call,
+                Name: v.OutputValue.Name,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/parse_ref.go b/vendor/github.com/hashicorp/terraform/addrs/parse_ref.go
new file mode 100644
index 0000000..84fe8a0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/parse_ref.go
@@ -0,0 +1,338 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Reference describes a reference to an address with source location
+// information.
+type Reference struct {
+        Subject     Referenceable
+        SourceRange tfdiags.SourceRange
+        Remaining   hcl.Traversal
+}
+
+// ParseRef attempts to extract a referencable address from the prefix of the
+// given traversal, which must be an absolute traversal or this function
+// will panic.
+//
+// If no error diagnostics are returned, the returned reference includes the
+// address that was extracted, the source range it was extracted from, and any
+// remaining relative traversal that was not consumed as part of the
+// reference.
+//
+// If error diagnostics are returned then the Reference value is invalid and
+// must not be used.
+func ParseRef(traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+        ref, diags := parseRef(traversal)
+
+        // Normalize a little to make life easier for callers.
+        if ref != nil {
+                if len(ref.Remaining) == 0 {
+                        ref.Remaining = nil
+                }
+        }
+
+        return ref, diags
+}
+
+// ParseRefStr is a helper wrapper around ParseRef that takes a string
+// and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseRef.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned reference may be nil or incomplete.
+func ParseRefStr(str string) (*Reference, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return nil, diags
+        }
+
+        ref, targetDiags := ParseRef(traversal)
+        diags = diags.Append(targetDiags)
+        return ref, diags
+}
+
+func parseRef(traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        root := traversal.RootName()
+        rootRange := traversal[0].SourceRange()
+
+        switch root {
+
+        case "count":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     CountAttr{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "data":
+                if len(traversal) < 3 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid reference",
+                                Detail:   `The "data" object must be followed by two attribute names: the data source type and the resource name.`,
+                                Subject:  traversal.SourceRange().Ptr(),
+                        })
+                        return nil, diags
+                }
+                remain := traversal[1:] // trim off "data" so we can use our shared resource reference parser
+                return parseResourceRef(DataResourceMode, rootRange, remain)
+
+        case "local":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     LocalValue{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "module":
+                callName, callRange, remain, diags := parseSingleAttrRef(traversal)
+                if diags.HasErrors() {
+                        return nil, diags
+                }
+
+                // A traversal starting with "module" can either be a reference to
+                // an entire module instance or to a single output from a module
+                // instance, depending on what we find after this introducer.
+
+                callInstance := ModuleCallInstance{
+                        Call: ModuleCall{
+                                Name: callName,
+                        },
+                        Key: NoKey,
+                }
+
+                if len(remain) == 0 {
+                        // Reference to an entire module instance. Might alternatively
+                        // be a reference to a collection of instances of a particular
+                        // module, but the caller will need to deal with that ambiguity
+                        // since we don't have enough context here.
+                        return &Reference{
+                                Subject:     callInstance,
+                                SourceRange: tfdiags.SourceRangeFromHCL(callRange),
+                                Remaining:   remain,
+                        }, diags
+                }
+
+                if idxTrav, ok := remain[0].(hcl.TraverseIndex); ok {
+                        var err error
+                        callInstance.Key, err = ParseInstanceKey(idxTrav.Key)
+                        if err != nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid index key",
+                                        Detail:   fmt.Sprintf("Invalid index for module instance: %s.", err),
+                                        Subject:  &idxTrav.SrcRange,
+                                })
+                                return nil, diags
+                        }
+                        remain = remain[1:]
+
+                        if len(remain) == 0 {
+                                // Also a reference to an entire module instance, but we have a key
+                                // now.
+                                return &Reference{
+                                        Subject:     callInstance,
+                                        SourceRange: tfdiags.SourceRangeFromHCL(hcl.RangeBetween(callRange, idxTrav.SrcRange)),
+                                        Remaining:   remain,
+                                }, diags
+                        }
+                }
+
+                if attrTrav, ok := remain[0].(hcl.TraverseAttr); ok {
+                        remain = remain[1:]
+                        return &Reference{
+                                Subject: ModuleCallOutput{
+                                        Name: attrTrav.Name,
+                                        Call: callInstance,
+                                },
+                                SourceRange: tfdiags.SourceRangeFromHCL(hcl.RangeBetween(callRange, attrTrav.SrcRange)),
+                                Remaining:   remain,
+                        }, diags
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   "Module instance objects do not support this operation.",
+                        Subject:  remain[0].SourceRange().Ptr(),
+                })
+                return nil, diags
+
+        case "path":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     PathAttr{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "self":
+                return &Reference{
+                        Subject:     Self,
+                        SourceRange: tfdiags.SourceRangeFromHCL(rootRange),
+                        Remaining:   traversal[1:],
+                }, diags
+
+        case "terraform":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     TerraformAttr{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "var":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     InputVariable{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        default:
+                return parseResourceRef(ManagedResourceMode, rootRange, traversal)
+        }
+}
+
+func parseResourceRef(mode ResourceMode, startRange hcl.Range, traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if len(traversal) < 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   `A reference to a resource type must be followed by at least one attribute access, specifying the resource name.`,
+                        Subject:  hcl.RangeBetween(traversal[0].SourceRange(), traversal[len(traversal)-1].SourceRange()).Ptr(),
+                })
+                return nil, diags
+        }
+
+        var typeName, name string
+        switch tt := traversal[0].(type) { // Could be either root or attr, depending on our resource mode
+        case hcl.TraverseRoot:
+                typeName = tt.Name
+        case hcl.TraverseAttr:
+                typeName = tt.Name
+        default:
+                // If it isn't a TraverseRoot then it must be a "data" reference.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   `The "data" object does not support this operation.`,
+                        Subject:  traversal[0].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        attrTrav, ok := traversal[1].(hcl.TraverseAttr)
+        if !ok {
+                var what string
+                switch mode {
+                case DataResourceMode:
+                        what = "data source"
+                default:
+                        what = "resource type"
+                }
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   fmt.Sprintf(`A reference to a %s must be followed by at least one attribute access, specifying the resource name.`, what),
+                        Subject:  traversal[1].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+        name = attrTrav.Name
+        rng := hcl.RangeBetween(startRange, attrTrav.SrcRange)
+        remain := traversal[2:]
+
+        resourceAddr := Resource{
+                Mode: mode,
+                Type: typeName,
+                Name: name,
+        }
+        resourceInstAddr := ResourceInstance{
+                Resource: resourceAddr,
+                Key:      NoKey,
+        }
+
+        if len(remain) == 0 {
+                // This might actually be a reference to the collection of all instances
+                // of the resource, but we don't have enough context here to decide
+                // so we'll let the caller resolve that ambiguity.
+                return &Reference{
+                        Subject:     resourceInstAddr,
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                }, diags
+        }
+
+        if idxTrav, ok := remain[0].(hcl.TraverseIndex); ok {
+                var err error
+                resourceInstAddr.Key, err = ParseInstanceKey(idxTrav.Key)
+                if err != nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid index key",
+                                Detail:   fmt.Sprintf("Invalid index for resource instance: %s.", err),
+                                Subject:  &idxTrav.SrcRange,
+                        })
+                        return nil, diags
+                }
+                remain = remain[1:]
+                rng = hcl.RangeBetween(rng, idxTrav.SrcRange)
+        }
+
+        return &Reference{
+                Subject:     resourceInstAddr,
+                SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                Remaining:   remain,
+        }, diags
+}
+
+func parseSingleAttrRef(traversal hcl.Traversal) (string, hcl.Range, hcl.Traversal, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        root := traversal.RootName()
+        rootRange := traversal[0].SourceRange()
+
+        if len(traversal) < 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   fmt.Sprintf("The %q object cannot be accessed directly. Instead, access one of its attributes.", root),
+                        Subject:  &rootRange,
+                })
+                return "", hcl.Range{}, nil, diags
+        }
+        if attrTrav, ok := traversal[1].(hcl.TraverseAttr); ok {
+                return attrTrav.Name, hcl.RangeBetween(rootRange, attrTrav.SrcRange), traversal[2:], diags
+        }
+        diags = diags.Append(&hcl.Diagnostic{
+                Severity: hcl.DiagError,
+                Summary:  "Invalid reference",
+                Detail:   fmt.Sprintf("The %q object does not support this operation.", root),
+                Subject:  traversal[1].SourceRange().Ptr(),
+        })
+        return "", hcl.Range{}, nil, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/parse_target.go b/vendor/github.com/hashicorp/terraform/addrs/parse_target.go
new file mode 100644
index 0000000..057443a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/parse_target.go
@@ -0,0 +1,318 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Target describes a targeted address with source location information.
+type Target struct {
+        Subject     Targetable
+        SourceRange tfdiags.SourceRange
+}
+
+// ParseTarget attempts to interpret the given traversal as a targetable
+// address. The given traversal must be absolute, or this function will
+// panic.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the Target value is invalid and
+// must not be used.
+func ParseTarget(traversal hcl.Traversal) (*Target, tfdiags.Diagnostics) {
+        path, remain, diags := parseModuleInstancePrefix(traversal)
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        rng := tfdiags.SourceRangeFromHCL(traversal.SourceRange())
+
+        if len(remain) == 0 {
+                return &Target{
+                        Subject:     path,
+                        SourceRange: rng,
+                }, diags
+        }
+
+        mode := ManagedResourceMode
+        if remain.RootName() == "data" {
+                mode = DataResourceMode
+                remain = remain[1:]
+        }
+
+        if len(remain) < 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "Resource specification must include a resource type and name.",
+                        Subject:  remain.SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        var typeName, name string
+        switch tt := remain[0].(type) {
+        case hcl.TraverseRoot:
+                typeName = tt.Name
+        case hcl.TraverseAttr:
+                typeName = tt.Name
+        default:
+                switch mode {
+                case ManagedResourceMode:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address",
+                                Detail:   "A resource type name is required.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                case DataResourceMode:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address",
+                                Detail:   "A data source name is required.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                default:
+                        panic("unknown mode")
+                }
+                return nil, diags
+        }
+
+        switch tt := remain[1].(type) {
+        case hcl.TraverseAttr:
+                name = tt.Name
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource name is required.",
+                        Subject:  remain[1].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        var subject Targetable
+        remain = remain[2:]
+        switch len(remain) {
+        case 0:
+                subject = path.Resource(mode, typeName, name)
+        case 1:
+                if tt, ok := remain[0].(hcl.TraverseIndex); ok {
+                        key, err := ParseInstanceKey(tt.Key)
+                        if err != nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid address",
+                                        Detail:   fmt.Sprintf("Invalid resource instance key: %s.", err),
+                                        Subject:  remain[0].SourceRange().Ptr(),
+                                })
+                                return nil, diags
+                        }
+
+                        subject = path.ResourceInstance(mode, typeName, name, key)
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address",
+                                Detail:   "Resource instance key must be given in square brackets.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                        return nil, diags
+                }
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "Unexpected extra operators after address.",
+                        Subject:  remain[1].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        return &Target{
+                Subject:     subject,
+                SourceRange: rng,
+        }, diags
+}
+
+// ParseTargetStr is a helper wrapper around ParseTarget that takes a string
+// and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a target string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseTarget.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned target may be nil or incomplete.
+func ParseTargetStr(str string) (*Target, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return nil, diags
+        }
+
+        target, targetDiags := ParseTarget(traversal)
+        diags = diags.Append(targetDiags)
+        return target, diags
+}
+
+// ParseAbsResource attempts to interpret the given traversal as an absolute
+// resource address, using the same syntax as expected by ParseTarget.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the AbsResource value is invalid and
+// must not be used.
+func ParseAbsResource(traversal hcl.Traversal) (AbsResource, tfdiags.Diagnostics) {
+        addr, diags := ParseTarget(traversal)
+        if diags.HasErrors() {
+                return AbsResource{}, diags
+        }
+
+        switch tt := addr.Subject.(type) {
+
+        case AbsResource:
+                return tt, diags
+
+        case AbsResourceInstance: // Catch likely user error with specialized message
+                // Assume that the last element of the traversal must be the index,
+                // since that's required for a valid resource instance address.
+                indexStep := traversal[len(traversal)-1]
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required. This instance key identifies a specific resource instance, which is not expected here.",
+                        Subject:  indexStep.SourceRange().Ptr(),
+                })
+                return AbsResource{}, diags
+
+        case ModuleInstance: // Catch likely user error with specialized message
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required here. The module path must be followed by a resource specification.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResource{}, diags
+
+        default: // Generic message for other address types
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required here.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResource{}, diags
+
+        }
+}
+
+// ParseAbsResourceStr is a helper wrapper around ParseAbsResource that takes a
+// string and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address may be incomplete.
+//
+// Since this function has no context about the source of the given string,
+// any returned diagnostics will not have meaningful source location
+// information.
+func ParseAbsResourceStr(str string) (AbsResource, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return AbsResource{}, diags
+        }
+
+        addr, addrDiags := ParseAbsResource(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+// ParseAbsResourceInstance attempts to interpret the given traversal as an
+// absolute resource instance address, using the same syntax as expected by
+// ParseTarget.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the AbsResource value is invalid and
+// must not be used.
+func ParseAbsResourceInstance(traversal hcl.Traversal) (AbsResourceInstance, tfdiags.Diagnostics) {
+        addr, diags := ParseTarget(traversal)
+        if diags.HasErrors() {
+                return AbsResourceInstance{}, diags
+        }
+
+        switch tt := addr.Subject.(type) {
+
+        case AbsResource:
+                return tt.Instance(NoKey), diags
+
+        case AbsResourceInstance:
+                return tt, diags
+
+        case ModuleInstance: // Catch likely user error with specialized message
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource instance address is required here. The module path must be followed by a resource instance specification.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResourceInstance{}, diags
+
+        default: // Generic message for other address types
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required here.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResourceInstance{}, diags
+
+        }
+}
+
+// ParseAbsResourceInstanceStr is a helper wrapper around
+// ParseAbsResourceInstance that takes a string and parses it with the HCL
+// native syntax traversal parser before interpreting it.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address may be incomplete.
+//
+// Since this function has no context about the source of the given string,
+// any returned diagnostics will not have meaningful source location
+// information.
+func ParseAbsResourceInstanceStr(str string) (AbsResourceInstance, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return AbsResourceInstance{}, diags
+        }
+
+        addr, addrDiags := ParseAbsResourceInstance(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/path_attr.go b/vendor/github.com/hashicorp/terraform/addrs/path_attr.go
new file mode 100644
index 0000000..cfc13f4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/path_attr.go
@@ -0,0 +1,12 @@
+package addrs
+
+// PathAttr is the address of an attribute of the "path" object in
+// the interpolation scope, like "path.module".
+type PathAttr struct {
+        referenceable
+        Name string
+}
+
+func (pa PathAttr) String() string {
+        return "path." + pa.Name
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/provider_config.go b/vendor/github.com/hashicorp/terraform/addrs/provider_config.go
new file mode 100644
index 0000000..340dd19
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/provider_config.go
@@ -0,0 +1,297 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// ProviderConfig is the address of a provider configuration.
+type ProviderConfig struct {
+        Type string
+
+        // If not empty, Alias identifies which non-default (aliased) provider
+        // configuration this address refers to.
+        Alias string
+}
+
+// NewDefaultProviderConfig returns the address of the default (un-aliased)
+// configuration for the provider with the given type name.
+func NewDefaultProviderConfig(typeName string) ProviderConfig {
+        return ProviderConfig{
+                Type: typeName,
+        }
+}
+
+// ParseProviderConfigCompact parses the given absolute traversal as a relative
+// provider address in compact form. The following are examples of traversals
+// that can be successfully parsed as compact relative provider configuration
+// addresses:
+//
+//     aws
+//     aws.foo
+//
+// This function will panic if given a relative traversal.
+//
+// If the returned diagnostics contains errors then the result value is invalid
+// and must not be used.
+func ParseProviderConfigCompact(traversal hcl.Traversal) (ProviderConfig, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        ret := ProviderConfig{
+                Type: traversal.RootName(),
+        }
+
+        if len(traversal) < 2 {
+                // Just a type name, then.
+                return ret, diags
+        }
+
+        aliasStep := traversal[1]
+        switch ts := aliasStep.(type) {
+        case hcl.TraverseAttr:
+                ret.Alias = ts.Name
+                return ret, diags
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "The provider type name must either stand alone or be followed by an alias name separated with a dot.",
+                        Subject:  aliasStep.SourceRange().Ptr(),
+                })
+        }
+
+        if len(traversal) > 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "Extraneous extra operators after provider configuration address.",
+                        Subject:  traversal[2:].SourceRange().Ptr(),
+                })
+        }
+
+        return ret, diags
+}
+
+// ParseProviderConfigCompactStr is a helper wrapper around ParseProviderConfigCompact
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseProviderConfigCompact.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// then the returned address is invalid.
+func ParseProviderConfigCompactStr(str string) (ProviderConfig, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return ProviderConfig{}, diags
+        }
+
+        addr, addrDiags := ParseProviderConfigCompact(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+// Absolute returns an AbsProviderConfig from the receiver and the given module
+// instance address.
+func (pc ProviderConfig) Absolute(module ModuleInstance) AbsProviderConfig {
+        return AbsProviderConfig{
+                Module:         module,
+                ProviderConfig: pc,
+        }
+}
+
+func (pc ProviderConfig) String() string {
+        if pc.Type == "" {
+                // Should never happen; always indicates a bug
+                return "provider.<invalid>"
+        }
+
+        if pc.Alias != "" {
+                return fmt.Sprintf("provider.%s.%s", pc.Type, pc.Alias)
+        }
+
+        return "provider." + pc.Type
+}
+
+// StringCompact is an alternative to String that returns the form that can
+// be parsed by ParseProviderConfigCompact, without the "provider." prefix.
+func (pc ProviderConfig) StringCompact() string {
+        if pc.Alias != "" {
+                return fmt.Sprintf("%s.%s", pc.Type, pc.Alias)
+        }
+        return pc.Type
+}
+
+// AbsProviderConfig is the absolute address of a provider configuration
+// within a particular module instance.
+type AbsProviderConfig struct {
+        Module         ModuleInstance
+        ProviderConfig ProviderConfig
+}
+
+// ParseAbsProviderConfig parses the given traversal as an absolute provider
+// address. The following are examples of traversals that can be successfully
+// parsed as absolute provider configuration addresses:
+//
+//     provider.aws
+//     provider.aws.foo
+//     module.bar.provider.aws
+//     module.bar.module.baz.provider.aws.foo
+//     module.foo[1].provider.aws.foo
+//
+// This type of address is used, for example, to record the relationships
+// between resources and provider configurations in the state structure.
+// This type of address is not generally used in the UI, except in error
+// messages that refer to provider configurations.
+func ParseAbsProviderConfig(traversal hcl.Traversal) (AbsProviderConfig, tfdiags.Diagnostics) {
+        modInst, remain, diags := parseModuleInstancePrefix(traversal)
+        ret := AbsProviderConfig{
+                Module: modInst,
+        }
+        if len(remain) < 2 || remain.RootName() != "provider" {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "Provider address must begin with \"provider.\", followed by a provider type name.",
+                        Subject:  remain.SourceRange().Ptr(),
+                })
+                return ret, diags
+        }
+        if len(remain) > 3 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "Extraneous operators after provider configuration alias.",
+                        Subject:  hcl.Traversal(remain[3:]).SourceRange().Ptr(),
+                })
+                return ret, diags
+        }
+
+        if tt, ok := remain[1].(hcl.TraverseAttr); ok {
+                ret.ProviderConfig.Type = tt.Name
+        } else {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "The prefix \"provider.\" must be followed by a provider type name.",
+                        Subject:  remain[1].SourceRange().Ptr(),
+                })
+                return ret, diags
+        }
+
+        if len(remain) == 3 {
+                if tt, ok := remain[2].(hcl.TraverseAttr); ok {
+                        ret.ProviderConfig.Alias = tt.Name
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration address",
+                                Detail:   "Provider type name must be followed by a configuration alias name.",
+                                Subject:  remain[2].SourceRange().Ptr(),
+                        })
+                        return ret, diags
+                }
+        }
+
+        return ret, diags
+}
+
+// ParseAbsProviderConfigStr is a helper wrapper around ParseAbsProviderConfig
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseAbsProviderConfig.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address is invalid.
+func ParseAbsProviderConfigStr(str string) (AbsProviderConfig, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return AbsProviderConfig{}, diags
+        }
+
+        addr, addrDiags := ParseAbsProviderConfig(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+// ProviderConfigDefault returns the address of the default provider config
+// of the given type inside the recieving module instance.
+func (m ModuleInstance) ProviderConfigDefault(name string) AbsProviderConfig {
+        return AbsProviderConfig{
+                Module: m,
+                ProviderConfig: ProviderConfig{
+                        Type: name,
+                },
+        }
+}
+
+// ProviderConfigAliased returns the address of an aliased provider config
+// of with given type and alias inside the recieving module instance.
+func (m ModuleInstance) ProviderConfigAliased(name, alias string) AbsProviderConfig {
+        return AbsProviderConfig{
+                Module: m,
+                ProviderConfig: ProviderConfig{
+                        Type:  name,
+                        Alias: alias,
+                },
+        }
+}
+
+// Inherited returns an address that the receiving configuration address might
+// inherit from in a parent module. The second bool return value indicates if
+// such inheritance is possible, and thus whether the returned address is valid.
+//
+// Inheritance is possible only for default (un-aliased) providers in modules
+// other than the root module. Even if a valid address is returned, inheritence
+// may not be performed for other reasons, such as if the calling module
+// provided explicit provider configurations within the call for this module.
+// The ProviderTransformer graph transform in the main terraform module has
+// the authoritative logic for provider inheritance, and this method is here
+// mainly just for its benefit.
+func (pc AbsProviderConfig) Inherited() (AbsProviderConfig, bool) {
+        // Can't inherit if we're already in the root.
+        if len(pc.Module) == 0 {
+                return AbsProviderConfig{}, false
+        }
+
+        // Can't inherit if we have an alias.
+        if pc.ProviderConfig.Alias != "" {
+                return AbsProviderConfig{}, false
+        }
+
+        // Otherwise, we might inherit from a configuration with the same
+        // provider name in the parent module instance.
+        parentMod := pc.Module.Parent()
+        return pc.ProviderConfig.Absolute(parentMod), true
+}
+
+func (pc AbsProviderConfig) String() string {
+        if len(pc.Module) == 0 {
+                return pc.ProviderConfig.String()
+        }
+        return fmt.Sprintf("%s.%s", pc.Module.String(), pc.ProviderConfig.String())
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/referenceable.go b/vendor/github.com/hashicorp/terraform/addrs/referenceable.go
new file mode 100644
index 0000000..211083a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/referenceable.go
@@ -0,0 +1,20 @@
+package addrs
+
+// Referenceable is an interface implemented by all address types that can
+// appear as references in configuration language expressions.
+type Referenceable interface {
+        // All implementations of this interface must be covered by the type switch
+        // in lang.Scope.buildEvalContext.
+        referenceableSigil()
+
+        // String produces a string representation of the address that could be
+        // parsed as a HCL traversal and passed to ParseRef to produce an identical
+        // result.
+        String() string
+}
+
+type referenceable struct {
+}
+
+func (r referenceable) referenceableSigil() {
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/resource.go b/vendor/github.com/hashicorp/terraform/addrs/resource.go
new file mode 100644
index 0000000..2866770
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/resource.go
@@ -0,0 +1,270 @@
+package addrs
+
+import (
+        "fmt"
+        "strings"
+)
+
+// Resource is an address for a resource block within configuration, which
+// contains potentially-multiple resource instances if that configuration
+// block uses "count" or "for_each".
+type Resource struct {
+        referenceable
+        Mode ResourceMode
+        Type string
+        Name string
+}
+
+func (r Resource) String() string {
+        switch r.Mode {
+        case ManagedResourceMode:
+                return fmt.Sprintf("%s.%s", r.Type, r.Name)
+        case DataResourceMode:
+                return fmt.Sprintf("data.%s.%s", r.Type, r.Name)
+        default:
+                // Should never happen, but we'll return a string here rather than
+                // crashing just in case it does.
+                return fmt.Sprintf("<invalid>.%s.%s", r.Type, r.Name)
+        }
+}
+
+func (r Resource) Equal(o Resource) bool {
+        return r.String() == o.String()
+}
+
+// Instance produces the address for a specific instance of the receiver
+// that is idenfied by the given key.
+func (r Resource) Instance(key InstanceKey) ResourceInstance {
+        return ResourceInstance{
+                Resource: r,
+                Key:      key,
+        }
+}
+
+// Absolute returns an AbsResource from the receiver and the given module
+// instance address.
+func (r Resource) Absolute(module ModuleInstance) AbsResource {
+        return AbsResource{
+                Module:   module,
+                Resource: r,
+        }
+}
+
+// DefaultProviderConfig returns the address of the provider configuration
+// that should be used for the resource identified by the reciever if it
+// does not have a provider configuration address explicitly set in
+// configuration.
+//
+// This method is not able to verify that such a configuration exists, nor
+// represent the behavior of automatically inheriting certain provider
+// configurations from parent modules. It just does a static analysis of the
+// receiving address and returns an address to start from, relative to the
+// same module that contains the resource.
+func (r Resource) DefaultProviderConfig() ProviderConfig {
+        typeName := r.Type
+        if under := strings.Index(typeName, "_"); under != -1 {
+                typeName = typeName[:under]
+        }
+        return ProviderConfig{
+                Type: typeName,
+        }
+}
+
+// ResourceInstance is an address for a specific instance of a resource.
+// When a resource is defined in configuration with "count" or "for_each" it
+// produces zero or more instances, which can be addressed using this type.
+type ResourceInstance struct {
+        referenceable
+        Resource Resource
+        Key      InstanceKey
+}
+
+func (r ResourceInstance) ContainingResource() Resource {
+        return r.Resource
+}
+
+func (r ResourceInstance) String() string {
+        if r.Key == NoKey {
+                return r.Resource.String()
+        }
+        return r.Resource.String() + r.Key.String()
+}
+
+func (r ResourceInstance) Equal(o ResourceInstance) bool {
+        return r.String() == o.String()
+}
+
+// Absolute returns an AbsResourceInstance from the receiver and the given module
+// instance address.
+func (r ResourceInstance) Absolute(module ModuleInstance) AbsResourceInstance {
+        return AbsResourceInstance{
+                Module:   module,
+                Resource: r,
+        }
+}
+
+// AbsResource is an absolute address for a resource under a given module path.
+type AbsResource struct {
+        targetable
+        Module   ModuleInstance
+        Resource Resource
+}
+
+// Resource returns the address of a particular resource within the receiver.
+func (m ModuleInstance) Resource(mode ResourceMode, typeName string, name string) AbsResource {
+        return AbsResource{
+                Module: m,
+                Resource: Resource{
+                        Mode: mode,
+                        Type: typeName,
+                        Name: name,
+                },
+        }
+}
+
+// Instance produces the address for a specific instance of the receiver
+// that is idenfied by the given key.
+func (r AbsResource) Instance(key InstanceKey) AbsResourceInstance {
+        return AbsResourceInstance{
+                Module:   r.Module,
+                Resource: r.Resource.Instance(key),
+        }
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address is either equal to the receiver or is an instance of the
+// receiver.
+func (r AbsResource) TargetContains(other Targetable) bool {
+        switch to := other.(type) {
+
+        case AbsResource:
+                // We'll use our stringification as a cheat-ish way to test for equality.
+                return to.String() == r.String()
+
+        case AbsResourceInstance:
+                return r.TargetContains(to.ContainingResource())
+
+        default:
+                return false
+
+        }
+}
+
+func (r AbsResource) String() string {
+        if len(r.Module) == 0 {
+                return r.Resource.String()
+        }
+        return fmt.Sprintf("%s.%s", r.Module.String(), r.Resource.String())
+}
+
+func (r AbsResource) Equal(o AbsResource) bool {
+        return r.String() == o.String()
+}
+
+// AbsResourceInstance is an absolute address for a resource instance under a
+// given module path.
+type AbsResourceInstance struct {
+        targetable
+        Module   ModuleInstance
+        Resource ResourceInstance
+}
+
+// ResourceInstance returns the address of a particular resource instance within the receiver.
+func (m ModuleInstance) ResourceInstance(mode ResourceMode, typeName string, name string, key InstanceKey) AbsResourceInstance {
+        return AbsResourceInstance{
+                Module: m,
+                Resource: ResourceInstance{
+                        Resource: Resource{
+                                Mode: mode,
+                                Type: typeName,
+                                Name: name,
+                        },
+                        Key: key,
+                },
+        }
+}
+
+// ContainingResource returns the address of the resource that contains the
+// receving resource instance. In other words, it discards the key portion
+// of the address to produce an AbsResource value.
+func (r AbsResourceInstance) ContainingResource() AbsResource {
+        return AbsResource{
+                Module:   r.Module,
+                Resource: r.Resource.ContainingResource(),
+        }
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address is equal to the receiver.
+func (r AbsResourceInstance) TargetContains(other Targetable) bool {
+        switch to := other.(type) {
+
+        case AbsResourceInstance:
+                // We'll use our stringification as a cheat-ish way to test for equality.
+                return to.String() == r.String()
+
+        default:
+                return false
+
+        }
+}
+
+func (r AbsResourceInstance) String() string {
+        if len(r.Module) == 0 {
+                return r.Resource.String()
+        }
+        return fmt.Sprintf("%s.%s", r.Module.String(), r.Resource.String())
+}
+
+func (r AbsResourceInstance) Equal(o AbsResourceInstance) bool {
+        return r.String() == o.String()
+}
+
+// Less returns true if the receiver should sort before the given other value
+// in a sorted list of addresses.
+func (r AbsResourceInstance) Less(o AbsResourceInstance) bool {
+        switch {
+
+        case len(r.Module) != len(o.Module):
+                return len(r.Module) < len(o.Module)
+
+        case r.Module.String() != o.Module.String():
+                return r.Module.Less(o.Module)
+
+        case r.Resource.Resource.Mode != o.Resource.Resource.Mode:
+                return r.Resource.Resource.Mode == DataResourceMode
+
+        case r.Resource.Resource.Type != o.Resource.Resource.Type:
+                return r.Resource.Resource.Type < o.Resource.Resource.Type
+
+        case r.Resource.Resource.Name != o.Resource.Resource.Name:
+                return r.Resource.Resource.Name < o.Resource.Resource.Name
+
+        case r.Resource.Key != o.Resource.Key:
+                return InstanceKeyLess(r.Resource.Key, o.Resource.Key)
+
+        default:
+                return false
+
+        }
+}
+
+// ResourceMode defines which lifecycle applies to a given resource. Each
+// resource lifecycle has a slightly different address format.
+type ResourceMode rune
+
+//go:generate stringer -type ResourceMode
+
+const (
+        // InvalidResourceMode is the zero value of ResourceMode and is not
+        // a valid resource mode.
+        InvalidResourceMode ResourceMode = 0
+
+        // ManagedResourceMode indicates a managed resource, as defined by
+        // "resource" blocks in configuration.
+        ManagedResourceMode ResourceMode = 'M'
+
+        // DataResourceMode indicates a data resource, as defined by
+        // "data" blocks in configuration.
+        DataResourceMode ResourceMode = 'D'
+)
diff --git a/vendor/github.com/hashicorp/terraform/addrs/resource_phase.go b/vendor/github.com/hashicorp/terraform/addrs/resource_phase.go
new file mode 100644
index 0000000..9bdbdc4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/resource_phase.go
@@ -0,0 +1,105 @@
+package addrs
+
+import "fmt"
+
+// ResourceInstancePhase is a special kind of reference used only internally
+// during graph building to represent resource instances that are in a
+// non-primary state.
+//
+// Graph nodes can declare themselves referenceable via an instance phase
+// or can declare that they reference an instance phase in order to accomodate
+// secondary graph nodes dealing with, for example, destroy actions.
+//
+// This special reference type cannot be accessed directly by end-users, and
+// should never be shown in the UI.
+type ResourceInstancePhase struct {
+        referenceable
+        ResourceInstance ResourceInstance
+        Phase            ResourceInstancePhaseType
+}
+
+var _ Referenceable = ResourceInstancePhase{}
+
+// Phase returns a special "phase address" for the receving instance. See the
+// documentation of ResourceInstancePhase for the limited situations where this
+// is intended to be used.
+func (r ResourceInstance) Phase(rpt ResourceInstancePhaseType) ResourceInstancePhase {
+        return ResourceInstancePhase{
+                ResourceInstance: r,
+                Phase:            rpt,
+        }
+}
+
+// ContainingResource returns an address for the same phase of the resource
+// that this instance belongs to.
+func (rp ResourceInstancePhase) ContainingResource() ResourcePhase {
+        return rp.ResourceInstance.Resource.Phase(rp.Phase)
+}
+
+func (rp ResourceInstancePhase) String() string {
+        // We use a different separator here than usual to ensure that we'll
+        // never conflict with any non-phased resource instance string. This
+        // is intentionally something that would fail parsing with ParseRef,
+        // because this special address type should never be exposed in the UI.
+        return fmt.Sprintf("%s#%s", rp.ResourceInstance, rp.Phase)
+}
+
+// ResourceInstancePhaseType is an enumeration used with ResourceInstancePhase.
+type ResourceInstancePhaseType string
+
+const (
+        // ResourceInstancePhaseDestroy represents the "destroy" phase of a
+        // resource instance.
+        ResourceInstancePhaseDestroy ResourceInstancePhaseType = "destroy"
+
+        // ResourceInstancePhaseDestroyCBD is similar to ResourceInstancePhaseDestroy
+        // but is used for resources that have "create_before_destroy" set, thus
+        // requiring a different dependency ordering.
+        ResourceInstancePhaseDestroyCBD ResourceInstancePhaseType = "destroy-cbd"
+)
+
+func (rpt ResourceInstancePhaseType) String() string {
+        return string(rpt)
+}
+
+// ResourcePhase is a special kind of reference used only internally
+// during graph building to represent resources that are in a
+// non-primary state.
+//
+// Graph nodes can declare themselves referenceable via a resource phase
+// or can declare that they reference a resource phase in order to accomodate
+// secondary graph nodes dealing with, for example, destroy actions.
+//
+// Since resources (as opposed to instances) aren't actually phased, this
+// address type is used only as an approximation during initial construction
+// of the resource-oriented plan graph, under the assumption that resource
+// instances with ResourceInstancePhase addresses will be created in dynamic
+// subgraphs during the graph walk.
+//
+// This special reference type cannot be accessed directly by end-users, and
+// should never be shown in the UI.
+type ResourcePhase struct {
+        referenceable
+        Resource Resource
+        Phase    ResourceInstancePhaseType
+}
+
+var _ Referenceable = ResourcePhase{}
+
+// Phase returns a special "phase address" for the receving instance. See the
+// documentation of ResourceInstancePhase for the limited situations where this
+// is intended to be used.
+func (r Resource) Phase(rpt ResourceInstancePhaseType) ResourcePhase {
+        return ResourcePhase{
+                Resource: r,
+                Phase:    rpt,
+        }
+}
+
+func (rp ResourcePhase) String() string {
+        // We use a different separator here than usual to ensure that we'll
+        // never conflict with any non-phased resource instance string. This
+        // is intentionally something that would fail parsing with ParseRef,
+        // because this special address type should never be exposed in the UI.
+        return fmt.Sprintf("%s#%s", rp.Resource, rp.Phase)
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/resourcemode_string.go b/vendor/github.com/hashicorp/terraform/addrs/resourcemode_string.go
new file mode 100644
index 0000000..0b5c33f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/resourcemode_string.go
@@ -0,0 +1,33 @@
+// Code generated by "stringer -type ResourceMode"; DO NOT EDIT.
+
+package addrs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[InvalidResourceMode-0]
+        _ = x[ManagedResourceMode-77]
+        _ = x[DataResourceMode-68]
+}
+
+const (
+        _ResourceMode_name_0 = "InvalidResourceMode"
+        _ResourceMode_name_1 = "DataResourceMode"
+        _ResourceMode_name_2 = "ManagedResourceMode"
+)
+
+func (i ResourceMode) String() string {
+        switch {
+        case i == 0:
+                return _ResourceMode_name_0
+        case i == 68:
+                return _ResourceMode_name_1
+        case i == 77:
+                return _ResourceMode_name_2
+        default:
+                return "ResourceMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/self.go b/vendor/github.com/hashicorp/terraform/addrs/self.go
new file mode 100644
index 0000000..7f24eaf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/self.go
@@ -0,0 +1,14 @@
+package addrs
+
+// Self is the address of the special object "self" that behaves as an alias
+// for a containing object currently in scope.
+const Self selfT = 0
+
+type selfT int
+
+func (s selfT) referenceableSigil() {
+}
+
+func (s selfT) String() string {
+        return "self"
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/targetable.go b/vendor/github.com/hashicorp/terraform/addrs/targetable.go
new file mode 100644
index 0000000..16819a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/targetable.go
@@ -0,0 +1,26 @@
+package addrs
+
+// Targetable is an interface implemented by all address types that can be
+// used as "targets" for selecting sub-graphs of a graph.
+type Targetable interface {
+        targetableSigil()
+
+        // TargetContains returns true if the receiver is considered to contain
+        // the given other address. Containment, for the purpose of targeting,
+        // means that if a container address is targeted then all of the
+        // addresses within it are also implicitly targeted.
+        //
+        // A targetable address always contains at least itself.
+        TargetContains(other Targetable) bool
+
+        // String produces a string representation of the address that could be
+        // parsed as a HCL traversal and passed to ParseTarget to produce an
+        // identical result.
+        String() string
+}
+
+type targetable struct {
+}
+
+func (r targetable) targetableSigil() {
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/terraform_attr.go b/vendor/github.com/hashicorp/terraform/addrs/terraform_attr.go
new file mode 100644
index 0000000..a880182
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/terraform_attr.go
@@ -0,0 +1,12 @@
+package addrs
+
+// TerraformAttr is the address of an attribute of the "terraform" object in
+// the interpolation scope, like "terraform.workspace".
+type TerraformAttr struct {
+        referenceable
+        Name string
+}
+
+func (ta TerraformAttr) String() string {
+        return "terraform." + ta.Name
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/diagnostic.go b/vendor/github.com/hashicorp/terraform/command/format/diagnostic.go
new file mode 100644
index 0000000..3dd9238
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/diagnostic.go
@@ -0,0 +1,295 @@
+package format
+
+import (
+        "bufio"
+        "bytes"
+        "fmt"
+        "sort"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcled"
+        "github.com/hashicorp/hcl2/hclparse"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/mitchellh/colorstring"
+        wordwrap "github.com/mitchellh/go-wordwrap"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Diagnostic formats a single diagnostic message.
+//
+// The width argument specifies at what column the diagnostic messages will
+// be wrapped. If set to zero, messages will not be wrapped by this function
+// at all. Although the long-form text parts of the message are wrapped,
+// not all aspects of the message are guaranteed to fit within the specified
+// terminal width.
+func Diagnostic(diag tfdiags.Diagnostic, sources map[string][]byte, color *colorstring.Colorize, width int) string {
+        if diag == nil {
+                // No good reason to pass a nil diagnostic in here...
+                return ""
+        }
+
+        var buf bytes.Buffer
+
+        switch diag.Severity() {
+        case tfdiags.Error:
+                buf.WriteString(color.Color("\n[bold][red]Error: [reset]"))
+        case tfdiags.Warning:
+                buf.WriteString(color.Color("\n[bold][yellow]Warning: [reset]"))
+        default:
+                // Clear out any coloring that might be applied by Terraform's UI helper,
+                // so our result is not context-sensitive.
+                buf.WriteString(color.Color("\n[reset]"))
+        }
+
+        desc := diag.Description()
+        sourceRefs := diag.Source()
+
+        // We don't wrap the summary, since we expect it to be terse, and since
+        // this is where we put the text of a native Go error it may not always
+        // be pure text that lends itself well to word-wrapping.
+        fmt.Fprintf(&buf, color.Color("[bold]%s[reset]\n\n"), desc.Summary)
+
+        if sourceRefs.Subject != nil {
+                // We'll borrow HCL's range implementation here, because it has some
+                // handy features to help us produce a nice source code snippet.
+                highlightRange := sourceRefs.Subject.ToHCL()
+                snippetRange := highlightRange
+                if sourceRefs.Context != nil {
+                        snippetRange = sourceRefs.Context.ToHCL()
+                }
+
+                // Make sure the snippet includes the highlight. This should be true
+                // for any reasonable diagnostic, but we'll make sure.
+                snippetRange = hcl.RangeOver(snippetRange, highlightRange)
+                if snippetRange.Empty() {
+                        snippetRange.End.Byte++
+                        snippetRange.End.Column++
+                }
+                if highlightRange.Empty() {
+                        highlightRange.End.Byte++
+                        highlightRange.End.Column++
+                }
+
+                var src []byte
+                if sources != nil {
+                        src = sources[snippetRange.Filename]
+                }
+                if src == nil {
+                        // This should generally not happen, as long as sources are always
+                        // loaded through the main loader. We may load things in other
+                        // ways in weird cases, so we'll tolerate it at the expense of
+                        // a not-so-helpful error message.
+                        fmt.Fprintf(&buf, "  on %s line %d:\n  (source code not available)\n", highlightRange.Filename, highlightRange.Start.Line)
+                } else {
+                        file, offset := parseRange(src, highlightRange)
+
+                        headerRange := highlightRange
+
+                        contextStr := hcled.ContextString(file, offset-1)
+                        if contextStr != "" {
+                                contextStr = ", in " + contextStr
+                        }
+
+                        fmt.Fprintf(&buf, "  on %s line %d%s:\n", headerRange.Filename, headerRange.Start.Line, contextStr)
+
+                        // Config snippet rendering
+                        sc := hcl.NewRangeScanner(src, highlightRange.Filename, bufio.ScanLines)
+                        for sc.Scan() {
+                                lineRange := sc.Range()
+                                if !lineRange.Overlaps(snippetRange) {
+                                        continue
+                                }
+                                beforeRange, highlightedRange, afterRange := lineRange.PartitionAround(highlightRange)
+                                before := beforeRange.SliceBytes(src)
+                                highlighted := highlightedRange.SliceBytes(src)
+                                after := afterRange.SliceBytes(src)
+                                fmt.Fprintf(
+                                        &buf, color.Color("%4d: %s[underline]%s[reset]%s\n"),
+                                        lineRange.Start.Line,
+                                        before, highlighted, after,
+                                )
+                        }
+
+                }
+
+                if fromExpr := diag.FromExpr(); fromExpr != nil {
+                        // We may also be able to generate information about the dynamic
+                        // values of relevant variables at the point of evaluation, then.
+                        // This is particularly useful for expressions that get evaluated
+                        // multiple times with different values, such as blocks using
+                        // "count" and "for_each", or within "for" expressions.
+                        expr := fromExpr.Expression
+                        ctx := fromExpr.EvalContext
+                        vars := expr.Variables()
+                        stmts := make([]string, 0, len(vars))
+                        seen := make(map[string]struct{}, len(vars))
+                Traversals:
+                        for _, traversal := range vars {
+                                for len(traversal) > 1 {
+                                        val, diags := traversal.TraverseAbs(ctx)
+                                        if diags.HasErrors() {
+                                                // Skip anything that generates errors, since we probably
+                                                // already have the same error in our diagnostics set
+                                                // already.
+                                                traversal = traversal[:len(traversal)-1]
+                                                continue
+                                        }
+
+                                        traversalStr := traversalStr(traversal)
+                                        if _, exists := seen[traversalStr]; exists {
+                                                continue Traversals // don't show duplicates when the same variable is referenced multiple times
+                                        }
+                                        switch {
+                                        case !val.IsKnown():
+                                                // Can't say anything about this yet, then.
+                                                continue Traversals
+                                        case val.IsNull():
+                                                stmts = append(stmts, fmt.Sprintf(color.Color("[bold]%s[reset] is null"), traversalStr))
+                                        default:
+                                                stmts = append(stmts, fmt.Sprintf(color.Color("[bold]%s[reset] is %s"), traversalStr, compactValueStr(val)))
+                                        }
+                                        seen[traversalStr] = struct{}{}
+                                }
+                        }
+
+                        sort.Strings(stmts) // FIXME: Should maybe use a traversal-aware sort that can sort numeric indexes properly?
+
+                        if len(stmts) > 0 {
+                                fmt.Fprint(&buf, color.Color("    [dark_gray]|----------------[reset]\n"))
+                        }
+                        for _, stmt := range stmts {
+                                fmt.Fprintf(&buf, color.Color("    [dark_gray]|[reset] %s\n"), stmt)
+                        }
+                }
+
+                buf.WriteByte('\n')
+        }
+
+        if desc.Detail != "" {
+                detail := desc.Detail
+                if width != 0 {
+                        detail = wordwrap.WrapString(detail, uint(width))
+                }
+                fmt.Fprintf(&buf, "%s\n", detail)
+        }
+
+        return buf.String()
+}
+
+func parseRange(src []byte, rng hcl.Range) (*hcl.File, int) {
+        filename := rng.Filename
+        offset := rng.Start.Byte
+
+        // We need to re-parse here to get a *hcl.File we can interrogate. This
+        // is not awesome since we presumably already parsed the file earlier too,
+        // but this re-parsing is architecturally simpler than retaining all of
+        // the hcl.File objects and we only do this in the case of an error anyway
+        // so the overhead here is not a big problem.
+        parser := hclparse.NewParser()
+        var file *hcl.File
+        var diags hcl.Diagnostics
+        if strings.HasSuffix(filename, ".json") {
+                file, diags = parser.ParseJSON(src, filename)
+        } else {
+                file, diags = parser.ParseHCL(src, filename)
+        }
+        if diags.HasErrors() {
+                return file, offset
+        }
+
+        return file, offset
+}
+
+// traversalStr produces a representation of an HCL traversal that is compact,
+// resembles HCL native syntax, and is suitable for display in the UI.
+func traversalStr(traversal hcl.Traversal) string {
+        // This is a specialized subset of traversal rendering tailored to
+        // producing helpful contextual messages in diagnostics. It is not
+        // comprehensive nor intended to be used for other purposes.
+
+        var buf bytes.Buffer
+        for _, step := range traversal {
+                switch tStep := step.(type) {
+                case hcl.TraverseRoot:
+                        buf.WriteString(tStep.Name)
+                case hcl.TraverseAttr:
+                        buf.WriteByte('.')
+                        buf.WriteString(tStep.Name)
+                case hcl.TraverseIndex:
+                        buf.WriteByte('[')
+                        if keyTy := tStep.Key.Type(); keyTy.IsPrimitiveType() {
+                                buf.WriteString(compactValueStr(tStep.Key))
+                        } else {
+                                // We'll just use a placeholder for more complex values,
+                                // since otherwise our result could grow ridiculously long.
+                                buf.WriteString("...")
+                        }
+                        buf.WriteByte(']')
+                }
+        }
+        return buf.String()
+}
+
+// compactValueStr produces a compact, single-line summary of a given value
+// that is suitable for display in the UI.
+//
+// For primitives it returns a full representation, while for more complex
+// types it instead summarizes the type, size, etc to produce something
+// that is hopefully still somewhat useful but not as verbose as a rendering
+// of the entire data structure.
+func compactValueStr(val cty.Value) string {
+        // This is a specialized subset of value rendering tailored to producing
+        // helpful but concise messages in diagnostics. It is not comprehensive
+        // nor intended to be used for other purposes.
+
+        ty := val.Type()
+        switch {
+        case val.IsNull():
+                return "null"
+        case !val.IsKnown():
+                // Should never happen here because we should filter before we get
+                // in here, but we'll do something reasonable rather than panic.
+                return "(not yet known)"
+        case ty == cty.Bool:
+                if val.True() {
+                        return "true"
+                }
+                return "false"
+        case ty == cty.Number:
+                bf := val.AsBigFloat()
+                return bf.Text('g', 10)
+        case ty == cty.String:
+                // Go string syntax is not exactly the same as HCL native string syntax,
+                // but we'll accept the minor edge-cases where this is different here
+                // for now, just to get something reasonable here.
+                return fmt.Sprintf("%q", val.AsString())
+        case ty.IsCollectionType() || ty.IsTupleType():
+                l := val.LengthInt()
+                switch l {
+                case 0:
+                        return "empty " + ty.FriendlyName()
+                case 1:
+                        return ty.FriendlyName() + " with 1 element"
+                default:
+                        return fmt.Sprintf("%s with %d elements", ty.FriendlyName(), l)
+                }
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                l := len(atys)
+                switch l {
+                case 0:
+                        return "object with no attributes"
+                case 1:
+                        var name string
+                        for k := range atys {
+                                name = k
+                        }
+                        return fmt.Sprintf("object with 1 attribute %q", name)
+                default:
+                        return fmt.Sprintf("object with %d attributes", l)
+                }
+        default:
+                return ty.FriendlyName()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/diff.go b/vendor/github.com/hashicorp/terraform/command/format/diff.go
new file mode 100644
index 0000000..c726f0e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/diff.go
@@ -0,0 +1,1192 @@
+package format
+
+import (
+        "bufio"
+        "bytes"
+        "fmt"
+        "sort"
+        "strings"
+
+        "github.com/mitchellh/colorstring"
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ResourceChange returns a string representation of a change to a particular
+// resource, for inclusion in user-facing plan output.
+//
+// The resource schema must be provided along with the change so that the
+// formatted change can reflect the configuration structure for the associated
+// resource.
+//
+// If "color" is non-nil, it will be used to color the result. Otherwise,
+// no color codes will be included.
+func ResourceChange(
+        change *plans.ResourceInstanceChangeSrc,
+        tainted bool,
+        schema *configschema.Block,
+        color *colorstring.Colorize,
+) string {
+        addr := change.Addr
+        var buf bytes.Buffer
+
+        if color == nil {
+                color = &colorstring.Colorize{
+                        Colors:  colorstring.DefaultColors,
+                        Disable: true,
+                        Reset:   false,
+                }
+        }
+
+        dispAddr := addr.String()
+        if change.DeposedKey != states.NotDeposed {
+                dispAddr = fmt.Sprintf("%s (deposed object %s)", dispAddr, change.DeposedKey)
+        }
+
+        switch change.Action {
+        case plans.Create:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be created", dispAddr)))
+        case plans.Read:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be read during apply\n  # (config refers to values not yet known)", dispAddr)))
+        case plans.Update:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be updated in-place", dispAddr)))
+        case plans.CreateThenDelete, plans.DeleteThenCreate:
+                if tainted {
+                        buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] is tainted, so must be [bold][red]replaced", dispAddr)))
+                } else {
+                        buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] must be [bold][red]replaced", dispAddr)))
+                }
+        case plans.Delete:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be [bold][red]destroyed", dispAddr)))
+        default:
+                // should never happen, since the above is exhaustive
+                buf.WriteString(fmt.Sprintf("%s has an action the plan renderer doesn't support (this is a bug)", dispAddr))
+        }
+        buf.WriteString(color.Color("[reset]\n"))
+
+        switch change.Action {
+        case plans.Create:
+                buf.WriteString(color.Color("[green]  +[reset] "))
+        case plans.Read:
+                buf.WriteString(color.Color("[cyan] <=[reset] "))
+        case plans.Update:
+                buf.WriteString(color.Color("[yellow]  ~[reset] "))
+        case plans.DeleteThenCreate:
+                buf.WriteString(color.Color("[red]-[reset]/[green]+[reset] "))
+        case plans.CreateThenDelete:
+                buf.WriteString(color.Color("[green]+[reset]/[red]-[reset] "))
+        case plans.Delete:
+                buf.WriteString(color.Color("[red]  -[reset] "))
+        default:
+                buf.WriteString(color.Color("??? "))
+        }
+
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                buf.WriteString(fmt.Sprintf(
+                        "resource %q %q",
+                        addr.Resource.Resource.Type,
+                        addr.Resource.Resource.Name,
+                ))
+        case addrs.DataResourceMode:
+                buf.WriteString(fmt.Sprintf(
+                        "data %q %q ",
+                        addr.Resource.Resource.Type,
+                        addr.Resource.Resource.Name,
+                ))
+        default:
+                // should never happen, since the above is exhaustive
+                buf.WriteString(addr.String())
+        }
+
+        buf.WriteString(" {")
+
+        p := blockBodyDiffPrinter{
+                buf:             &buf,
+                color:           color,
+                action:          change.Action,
+                requiredReplace: change.RequiredReplace,
+        }
+
+        // Most commonly-used resources have nested blocks that result in us
+        // going at least three traversals deep while we recurse here, so we'll
+        // start with that much capacity and then grow as needed for deeper
+        // structures.
+        path := make(cty.Path, 0, 3)
+
+        changeV, err := change.Decode(schema.ImpliedType())
+        if err != nil {
+                // Should never happen in here, since we've already been through
+                // loads of layers of encode/decode of the planned changes before now.
+                panic(fmt.Sprintf("failed to decode plan for %s while rendering diff: %s", addr, err))
+        }
+
+        // We currently have an opt-out that permits the legacy SDK to return values
+        // that defy our usual conventions around handling of nesting blocks. To
+        // avoid the rendering code from needing to handle all of these, we'll
+        // normalize first.
+        // (Ideally we'd do this as part of the SDK opt-out implementation in core,
+        // but we've added it here for now to reduce risk of unexpected impacts
+        // on other code in core.)
+        changeV.Change.Before = objchange.NormalizeObjectFromLegacySDK(changeV.Change.Before, schema)
+        changeV.Change.After = objchange.NormalizeObjectFromLegacySDK(changeV.Change.After, schema)
+
+        bodyWritten := p.writeBlockBodyDiff(schema, changeV.Before, changeV.After, 6, path)
+        if bodyWritten {
+                buf.WriteString("\n")
+                buf.WriteString(strings.Repeat(" ", 4))
+        }
+        buf.WriteString("}\n")
+
+        return buf.String()
+}
+
+type blockBodyDiffPrinter struct {
+        buf             *bytes.Buffer
+        color           *colorstring.Colorize
+        action          plans.Action
+        requiredReplace cty.PathSet
+}
+
+const forcesNewResourceCaption = " [red]# forces replacement[reset]"
+
+// writeBlockBodyDiff writes attribute or block differences
+// and returns true if any differences were found and written
+func (p *blockBodyDiffPrinter) writeBlockBodyDiff(schema *configschema.Block, old, new cty.Value, indent int, path cty.Path) bool {
+        path = ctyEnsurePathCapacity(path, 1)
+
+        bodyWritten := false
+        blankBeforeBlocks := false
+        {
+                attrNames := make([]string, 0, len(schema.Attributes))
+                attrNameLen := 0
+                for name := range schema.Attributes {
+                        oldVal := ctyGetAttrMaybeNull(old, name)
+                        newVal := ctyGetAttrMaybeNull(new, name)
+                        if oldVal.IsNull() && newVal.IsNull() {
+                                // Skip attributes where both old and new values are null
+                                // (we do this early here so that we'll do our value alignment
+                                // based on the longest attribute name that has a change, rather
+                                // than the longest attribute name in the full set.)
+                                continue
+                        }
+
+                        attrNames = append(attrNames, name)
+                        if len(name) > attrNameLen {
+                                attrNameLen = len(name)
+                        }
+                }
+                sort.Strings(attrNames)
+                if len(attrNames) > 0 {
+                        blankBeforeBlocks = true
+                }
+
+                for _, name := range attrNames {
+                        attrS := schema.Attributes[name]
+                        oldVal := ctyGetAttrMaybeNull(old, name)
+                        newVal := ctyGetAttrMaybeNull(new, name)
+
+                        bodyWritten = true
+                        p.writeAttrDiff(name, attrS, oldVal, newVal, attrNameLen, indent, path)
+                }
+        }
+
+        {
+                blockTypeNames := make([]string, 0, len(schema.BlockTypes))
+                for name := range schema.BlockTypes {
+                        blockTypeNames = append(blockTypeNames, name)
+                }
+                sort.Strings(blockTypeNames)
+
+                for _, name := range blockTypeNames {
+                        blockS := schema.BlockTypes[name]
+                        oldVal := ctyGetAttrMaybeNull(old, name)
+                        newVal := ctyGetAttrMaybeNull(new, name)
+
+                        bodyWritten = true
+                        p.writeNestedBlockDiffs(name, blockS, oldVal, newVal, blankBeforeBlocks, indent, path)
+
+                        // Always include a blank for any subsequent block types.
+                        blankBeforeBlocks = true
+                }
+        }
+
+        return bodyWritten
+}
+
+func (p *blockBodyDiffPrinter) writeAttrDiff(name string, attrS *configschema.Attribute, old, new cty.Value, nameLen, indent int, path cty.Path) {
+        path = append(path, cty.GetAttrStep{Name: name})
+        p.buf.WriteString("\n")
+        p.buf.WriteString(strings.Repeat(" ", indent))
+        showJustNew := false
+        var action plans.Action
+        switch {
+        case old.IsNull():
+                action = plans.Create
+                showJustNew = true
+        case new.IsNull():
+                action = plans.Delete
+        case ctyEqualWithUnknown(old, new):
+                action = plans.NoOp
+                showJustNew = true
+        default:
+                action = plans.Update
+        }
+
+        p.writeActionSymbol(action)
+
+        p.buf.WriteString(p.color.Color("[bold]"))
+        p.buf.WriteString(name)
+        p.buf.WriteString(p.color.Color("[reset]"))
+        p.buf.WriteString(strings.Repeat(" ", nameLen-len(name)))
+        p.buf.WriteString(" = ")
+
+        if attrS.Sensitive {
+                p.buf.WriteString("(sensitive value)")
+        } else {
+                switch {
+                case showJustNew:
+                        p.writeValue(new, action, indent+2)
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                default:
+                        // We show new even if it is null to emphasize the fact
+                        // that it is being unset, since otherwise it is easy to
+                        // misunderstand that the value is still set to the old value.
+                        p.writeValueDiff(old, new, indent+2, path)
+                }
+        }
+}
+
+func (p *blockBodyDiffPrinter) writeNestedBlockDiffs(name string, blockS *configschema.NestedBlock, old, new cty.Value, blankBefore bool, indent int, path cty.Path) {
+        path = append(path, cty.GetAttrStep{Name: name})
+        if old.IsNull() && new.IsNull() {
+                // Nothing to do if both old and new is null
+                return
+        }
+
+        // Where old/new are collections representing a nesting mode other than
+        // NestingSingle, we assume the collection value can never be unknown
+        // since we always produce the container for the nested objects, even if
+        // the objects within are computed.
+
+        switch blockS.Nesting {
+        case configschema.NestingSingle, configschema.NestingGroup:
+                var action plans.Action
+                eqV := new.Equals(old)
+                switch {
+                case old.IsNull():
+                        action = plans.Create
+                case new.IsNull():
+                        action = plans.Delete
+                case !new.IsWhollyKnown() || !old.IsWhollyKnown():
+                        // "old" should actually always be known due to our contract
+                        // that old values must never be unknown, but we'll allow it
+                        // anyway to be robust.
+                        action = plans.Update
+                case !eqV.IsKnown() || !eqV.True():
+                        action = plans.Update
+                }
+
+                if blankBefore {
+                        p.buf.WriteRune('\n')
+                }
+                p.writeNestedBlockDiff(name, nil, &blockS.Block, action, old, new, indent, path)
+        case configschema.NestingList:
+                // For the sake of handling nested blocks, we'll treat a null list
+                // the same as an empty list since the config language doesn't
+                // distinguish these anyway.
+                old = ctyNullBlockListAsEmpty(old)
+                new = ctyNullBlockListAsEmpty(new)
+
+                oldItems := ctyCollectionValues(old)
+                newItems := ctyCollectionValues(new)
+
+                // Here we intentionally preserve the index-based correspondance
+                // between old and new, rather than trying to detect insertions
+                // and removals in the list, because this more accurately reflects
+                // how Terraform Core and providers will understand the change,
+                // particularly when the nested block contains computed attributes
+                // that will themselves maintain correspondance by index.
+
+                // commonLen is number of elements that exist in both lists, which
+                // will be presented as updates (~). Any additional items in one
+                // of the lists will be presented as either creates (+) or deletes (-)
+                // depending on which list they belong to.
+                var commonLen int
+                switch {
+                case len(oldItems) < len(newItems):
+                        commonLen = len(oldItems)
+                default:
+                        commonLen = len(newItems)
+                }
+
+                if blankBefore && (len(oldItems) > 0 || len(newItems) > 0) {
+                        p.buf.WriteRune('\n')
+                }
+
+                for i := 0; i < commonLen; i++ {
+                        path := append(path, cty.IndexStep{Key: cty.NumberIntVal(int64(i))})
+                        oldItem := oldItems[i]
+                        newItem := newItems[i]
+                        action := plans.Update
+                        if oldItem.RawEquals(newItem) {
+                                action = plans.NoOp
+                        }
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, action, oldItem, newItem, indent, path)
+                }
+                for i := commonLen; i < len(oldItems); i++ {
+                        path := append(path, cty.IndexStep{Key: cty.NumberIntVal(int64(i))})
+                        oldItem := oldItems[i]
+                        newItem := cty.NullVal(oldItem.Type())
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, plans.Delete, oldItem, newItem, indent, path)
+                }
+                for i := commonLen; i < len(newItems); i++ {
+                        path := append(path, cty.IndexStep{Key: cty.NumberIntVal(int64(i))})
+                        newItem := newItems[i]
+                        oldItem := cty.NullVal(newItem.Type())
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, plans.Create, oldItem, newItem, indent, path)
+                }
+        case configschema.NestingSet:
+                // For the sake of handling nested blocks, we'll treat a null set
+                // the same as an empty set since the config language doesn't
+                // distinguish these anyway.
+                old = ctyNullBlockSetAsEmpty(old)
+                new = ctyNullBlockSetAsEmpty(new)
+
+                oldItems := ctyCollectionValues(old)
+                newItems := ctyCollectionValues(new)
+
+                if (len(oldItems) + len(newItems)) == 0 {
+                        // Nothing to do if both sets are empty
+                        return
+                }
+
+                allItems := make([]cty.Value, 0, len(oldItems)+len(newItems))
+                allItems = append(allItems, oldItems...)
+                allItems = append(allItems, newItems...)
+                all := cty.SetVal(allItems)
+
+                if blankBefore {
+                        p.buf.WriteRune('\n')
+                }
+
+                for it := all.ElementIterator(); it.Next(); {
+                        _, val := it.Element()
+                        var action plans.Action
+                        var oldValue, newValue cty.Value
+                        switch {
+                        case !val.IsKnown():
+                                action = plans.Update
+                                newValue = val
+                        case !old.HasElement(val).True():
+                                action = plans.Create
+                                oldValue = cty.NullVal(val.Type())
+                                newValue = val
+                        case !new.HasElement(val).True():
+                                action = plans.Delete
+                                oldValue = val
+                                newValue = cty.NullVal(val.Type())
+                        default:
+                                action = plans.NoOp
+                                oldValue = val
+                                newValue = val
+                        }
+                        path := append(path, cty.IndexStep{Key: val})
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, action, oldValue, newValue, indent, path)
+                }
+
+        case configschema.NestingMap:
+                // For the sake of handling nested blocks, we'll treat a null map
+                // the same as an empty map since the config language doesn't
+                // distinguish these anyway.
+                old = ctyNullBlockMapAsEmpty(old)
+                new = ctyNullBlockMapAsEmpty(new)
+
+                oldItems := old.AsValueMap()
+                newItems := new.AsValueMap()
+                if (len(oldItems) + len(newItems)) == 0 {
+                        // Nothing to do if both maps are empty
+                        return
+                }
+
+                allKeys := make(map[string]bool)
+                for k := range oldItems {
+                        allKeys[k] = true
+                }
+                for k := range newItems {
+                        allKeys[k] = true
+                }
+                allKeysOrder := make([]string, 0, len(allKeys))
+                for k := range allKeys {
+                        allKeysOrder = append(allKeysOrder, k)
+                }
+                sort.Strings(allKeysOrder)
+
+                if blankBefore {
+                        p.buf.WriteRune('\n')
+                }
+
+                for _, k := range allKeysOrder {
+                        var action plans.Action
+                        oldValue := oldItems[k]
+                        newValue := newItems[k]
+                        switch {
+                        case oldValue == cty.NilVal:
+                                oldValue = cty.NullVal(newValue.Type())
+                                action = plans.Create
+                        case newValue == cty.NilVal:
+                                newValue = cty.NullVal(oldValue.Type())
+                                action = plans.Delete
+                        case !newValue.RawEquals(oldValue):
+                                action = plans.Update
+                        default:
+                                action = plans.NoOp
+                        }
+
+                        path := append(path, cty.IndexStep{Key: cty.StringVal(k)})
+                        p.writeNestedBlockDiff(name, &k, &blockS.Block, action, oldValue, newValue, indent, path)
+                }
+        }
+}
+
+func (p *blockBodyDiffPrinter) writeNestedBlockDiff(name string, label *string, blockS *configschema.Block, action plans.Action, old, new cty.Value, indent int, path cty.Path) {
+        p.buf.WriteString("\n")
+        p.buf.WriteString(strings.Repeat(" ", indent))
+        p.writeActionSymbol(action)
+
+        if label != nil {
+                fmt.Fprintf(p.buf, "%s %q {", name, *label)
+        } else {
+                fmt.Fprintf(p.buf, "%s {", name)
+        }
+
+        if action != plans.NoOp && (p.pathForcesNewResource(path) || p.pathForcesNewResource(path[:len(path)-1])) {
+                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+        }
+
+        bodyWritten := p.writeBlockBodyDiff(blockS, old, new, indent+4, path)
+        if bodyWritten {
+                p.buf.WriteString("\n")
+                p.buf.WriteString(strings.Repeat(" ", indent+2))
+        }
+        p.buf.WriteString("}")
+}
+
+func (p *blockBodyDiffPrinter) writeValue(val cty.Value, action plans.Action, indent int) {
+        if !val.IsKnown() {
+                p.buf.WriteString("(known after apply)")
+                return
+        }
+        if val.IsNull() {
+                p.buf.WriteString(p.color.Color("[dark_gray]null[reset]"))
+                return
+        }
+
+        ty := val.Type()
+
+        switch {
+        case ty.IsPrimitiveType():
+                switch ty {
+                case cty.String:
+                        {
+                                // Special behavior for JSON strings containing array or object
+                                src := []byte(val.AsString())
+                                ty, err := ctyjson.ImpliedType(src)
+                                // check for the special case of "null", which decodes to nil,
+                                // and just allow it to be printed out directly
+                                if err == nil && !ty.IsPrimitiveType() && val.AsString() != "null" {
+                                        jv, err := ctyjson.Unmarshal(src, ty)
+                                        if err == nil {
+                                                p.buf.WriteString("jsonencode(")
+                                                if jv.LengthInt() == 0 {
+                                                        p.writeValue(jv, action, 0)
+                                                } else {
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent+4))
+                                                        p.writeValue(jv, action, indent+4)
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent))
+                                                }
+                                                p.buf.WriteByte(')')
+                                                break // don't *also* do the normal behavior below
+                                        }
+                                }
+                        }
+                        fmt.Fprintf(p.buf, "%q", val.AsString())
+                case cty.Bool:
+                        if val.True() {
+                                p.buf.WriteString("true")
+                        } else {
+                                p.buf.WriteString("false")
+                        }
+                case cty.Number:
+                        bf := val.AsBigFloat()
+                        p.buf.WriteString(bf.Text('f', -1))
+                default:
+                        // should never happen, since the above is exhaustive
+                        fmt.Fprintf(p.buf, "%#v", val)
+                }
+        case ty.IsListType() || ty.IsSetType() || ty.IsTupleType():
+                p.buf.WriteString("[")
+
+                it := val.ElementIterator()
+                for it.Next() {
+                        _, val := it.Element()
+
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                        p.writeActionSymbol(action)
+                        p.writeValue(val, action, indent+4)
+                        p.buf.WriteString(",")
+                }
+
+                if val.LengthInt() > 0 {
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                }
+                p.buf.WriteString("]")
+        case ty.IsMapType():
+                p.buf.WriteString("{")
+
+                keyLen := 0
+                for it := val.ElementIterator(); it.Next(); {
+                        key, _ := it.Element()
+                        if keyStr := key.AsString(); len(keyStr) > keyLen {
+                                keyLen = len(keyStr)
+                        }
+                }
+
+                for it := val.ElementIterator(); it.Next(); {
+                        key, val := it.Element()
+
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                        p.writeActionSymbol(action)
+                        p.writeValue(key, action, indent+4)
+                        p.buf.WriteString(strings.Repeat(" ", keyLen-len(key.AsString())))
+                        p.buf.WriteString(" = ")
+                        p.writeValue(val, action, indent+4)
+                }
+
+                if val.LengthInt() > 0 {
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                }
+                p.buf.WriteString("}")
+        case ty.IsObjectType():
+                p.buf.WriteString("{")
+
+                atys := ty.AttributeTypes()
+                attrNames := make([]string, 0, len(atys))
+                nameLen := 0
+                for attrName := range atys {
+                        attrNames = append(attrNames, attrName)
+                        if len(attrName) > nameLen {
+                                nameLen = len(attrName)
+                        }
+                }
+                sort.Strings(attrNames)
+
+                for _, attrName := range attrNames {
+                        val := val.GetAttr(attrName)
+
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                        p.writeActionSymbol(action)
+                        p.buf.WriteString(attrName)
+                        p.buf.WriteString(strings.Repeat(" ", nameLen-len(attrName)))
+                        p.buf.WriteString(" = ")
+                        p.writeValue(val, action, indent+4)
+                }
+
+                if len(attrNames) > 0 {
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                }
+                p.buf.WriteString("}")
+        }
+}
+
+func (p *blockBodyDiffPrinter) writeValueDiff(old, new cty.Value, indent int, path cty.Path) {
+        ty := old.Type()
+        typesEqual := ctyTypesEqual(ty, new.Type())
+
+        // We have some specialized diff implementations for certain complex
+        // values where it's useful to see a visualization of the diff of
+        // the nested elements rather than just showing the entire old and
+        // new values verbatim.
+        // However, these specialized implementations can apply only if both
+        // values are known and non-null.
+        if old.IsKnown() && new.IsKnown() && !old.IsNull() && !new.IsNull() && typesEqual {
+                switch {
+                case ty == cty.String:
+                        // We have special behavior for both multi-line strings in general
+                        // and for strings that can parse as JSON. For the JSON handling
+                        // to apply, both old and new must be valid JSON.
+                        // For single-line strings that don't parse as JSON we just fall
+                        // out of this switch block and do the default old -> new rendering.
+                        oldS := old.AsString()
+                        newS := new.AsString()
+
+                        {
+                                // Special behavior for JSON strings containing object or
+                                // list values.
+                                oldBytes := []byte(oldS)
+                                newBytes := []byte(newS)
+                                oldType, oldErr := ctyjson.ImpliedType(oldBytes)
+                                newType, newErr := ctyjson.ImpliedType(newBytes)
+                                if oldErr == nil && newErr == nil && !(oldType.IsPrimitiveType() && newType.IsPrimitiveType()) {
+                                        oldJV, oldErr := ctyjson.Unmarshal(oldBytes, oldType)
+                                        newJV, newErr := ctyjson.Unmarshal(newBytes, newType)
+                                        if oldErr == nil && newErr == nil {
+                                                if !oldJV.RawEquals(newJV) { // two JSON values may differ only in insignificant whitespace
+                                                        p.buf.WriteString("jsonencode(")
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                                        p.writeActionSymbol(plans.Update)
+                                                        p.writeValueDiff(oldJV, newJV, indent+4, path)
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent))
+                                                        p.buf.WriteByte(')')
+                                                } else {
+                                                        // if they differ only in insigificant whitespace
+                                                        // then we'll note that but still expand out the
+                                                        // effective value.
+                                                        if p.pathForcesNewResource(path) {
+                                                                p.buf.WriteString(p.color.Color("jsonencode( [red]# whitespace changes force replacement[reset]"))
+                                                        } else {
+                                                                p.buf.WriteString(p.color.Color("jsonencode( [dim]# whitespace changes[reset]"))
+                                                        }
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent+4))
+                                                        p.writeValue(oldJV, plans.NoOp, indent+4)
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent))
+                                                        p.buf.WriteByte(')')
+                                                }
+                                                return
+                                        }
+                                }
+                        }
+
+                        if strings.Index(oldS, "\n") < 0 && strings.Index(newS, "\n") < 0 {
+                                break
+                        }
+
+                        p.buf.WriteString("<<~EOT")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        var oldLines, newLines []cty.Value
+                        {
+                                r := strings.NewReader(oldS)
+                                sc := bufio.NewScanner(r)
+                                for sc.Scan() {
+                                        oldLines = append(oldLines, cty.StringVal(sc.Text()))
+                                }
+                        }
+                        {
+                                r := strings.NewReader(newS)
+                                sc := bufio.NewScanner(r)
+                                for sc.Scan() {
+                                        newLines = append(newLines, cty.StringVal(sc.Text()))
+                                }
+                        }
+
+                        diffLines := ctySequenceDiff(oldLines, newLines)
+                        for _, diffLine := range diffLines {
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                p.writeActionSymbol(diffLine.Action)
+
+                                switch diffLine.Action {
+                                case plans.NoOp, plans.Delete:
+                                        p.buf.WriteString(diffLine.Before.AsString())
+                                case plans.Create:
+                                        p.buf.WriteString(diffLine.After.AsString())
+                                default:
+                                        // Should never happen since the above covers all
+                                        // actions that ctySequenceDiff can return for strings
+                                        p.buf.WriteString(diffLine.After.AsString())
+
+                                }
+                                p.buf.WriteString("\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent)) // +4 here because there's no symbol
+                        p.buf.WriteString("EOT")
+
+                        return
+
+                case ty.IsSetType():
+                        p.buf.WriteString("[")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        var addedVals, removedVals, allVals []cty.Value
+                        for it := old.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+                                allVals = append(allVals, val)
+                                if new.HasElement(val).False() {
+                                        removedVals = append(removedVals, val)
+                                }
+                        }
+                        for it := new.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+                                allVals = append(allVals, val)
+                                if val.IsKnown() && old.HasElement(val).False() {
+                                        addedVals = append(addedVals, val)
+                                }
+                        }
+
+                        var all, added, removed cty.Value
+                        if len(allVals) > 0 {
+                                all = cty.SetVal(allVals)
+                        } else {
+                                all = cty.SetValEmpty(ty.ElementType())
+                        }
+                        if len(addedVals) > 0 {
+                                added = cty.SetVal(addedVals)
+                        } else {
+                                added = cty.SetValEmpty(ty.ElementType())
+                        }
+                        if len(removedVals) > 0 {
+                                removed = cty.SetVal(removedVals)
+                        } else {
+                                removed = cty.SetValEmpty(ty.ElementType())
+                        }
+
+                        for it := all.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+
+                                var action plans.Action
+                                switch {
+                                case !val.IsKnown():
+                                        action = plans.Update
+                                case added.HasElement(val).True():
+                                        action = plans.Create
+                                case removed.HasElement(val).True():
+                                        action = plans.Delete
+                                default:
+                                        action = plans.NoOp
+                                }
+
+                                p.writeActionSymbol(action)
+                                p.writeValue(val, action, indent+4)
+                                p.buf.WriteString(",\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("]")
+                        return
+                case ty.IsListType() || ty.IsTupleType():
+                        p.buf.WriteString("[")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        elemDiffs := ctySequenceDiff(old.AsValueSlice(), new.AsValueSlice())
+                        for _, elemDiff := range elemDiffs {
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                p.writeActionSymbol(elemDiff.Action)
+                                switch elemDiff.Action {
+                                case plans.NoOp, plans.Delete:
+                                        p.writeValue(elemDiff.Before, elemDiff.Action, indent+4)
+                                case plans.Update:
+                                        p.writeValueDiff(elemDiff.Before, elemDiff.After, indent+4, path)
+                                case plans.Create:
+                                        p.writeValue(elemDiff.After, elemDiff.Action, indent+4)
+                                default:
+                                        // Should never happen since the above covers all
+                                        // actions that ctySequenceDiff can return.
+                                        p.writeValue(elemDiff.After, elemDiff.Action, indent+4)
+                                }
+
+                                p.buf.WriteString(",\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("]")
+                        return
+
+                case ty.IsMapType():
+                        p.buf.WriteString("{")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        var allKeys []string
+                        keyLen := 0
+                        for it := old.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+                        for it := new.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+
+                        sort.Strings(allKeys)
+
+                        lastK := ""
+                        for i, k := range allKeys {
+                                if i > 0 && lastK == k {
+                                        continue // skip duplicates (list is sorted)
+                                }
+                                lastK = k
+
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                kV := cty.StringVal(k)
+                                var action plans.Action
+                                if old.HasIndex(kV).False() {
+                                        action = plans.Create
+                                } else if new.HasIndex(kV).False() {
+                                        action = plans.Delete
+                                } else if eqV := old.Index(kV).Equals(new.Index(kV)); eqV.IsKnown() && eqV.True() {
+                                        action = plans.NoOp
+                                } else {
+                                        action = plans.Update
+                                }
+
+                                path := append(path, cty.IndexStep{Key: kV})
+
+                                p.writeActionSymbol(action)
+                                p.writeValue(kV, action, indent+4)
+                                p.buf.WriteString(strings.Repeat(" ", keyLen-len(k)))
+                                p.buf.WriteString(" = ")
+                                switch action {
+                                case plans.Create, plans.NoOp:
+                                        v := new.Index(kV)
+                                        p.writeValue(v, action, indent+4)
+                                case plans.Delete:
+                                        oldV := old.Index(kV)
+                                        newV := cty.NullVal(oldV.Type())
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                default:
+                                        oldV := old.Index(kV)
+                                        newV := new.Index(kV)
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                }
+
+                                p.buf.WriteByte('\n')
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("}")
+                        return
+                case ty.IsObjectType():
+                        p.buf.WriteString("{")
+                        p.buf.WriteString("\n")
+
+                        forcesNewResource := p.pathForcesNewResource(path)
+
+                        var allKeys []string
+                        keyLen := 0
+                        for it := old.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+                        for it := new.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+
+                        sort.Strings(allKeys)
+
+                        lastK := ""
+                        for i, k := range allKeys {
+                                if i > 0 && lastK == k {
+                                        continue // skip duplicates (list is sorted)
+                                }
+                                lastK = k
+
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                kV := k
+                                var action plans.Action
+                                if !old.Type().HasAttribute(kV) {
+                                        action = plans.Create
+                                } else if !new.Type().HasAttribute(kV) {
+                                        action = plans.Delete
+                                } else if eqV := old.GetAttr(kV).Equals(new.GetAttr(kV)); eqV.IsKnown() && eqV.True() {
+                                        action = plans.NoOp
+                                } else {
+                                        action = plans.Update
+                                }
+
+                                path := append(path, cty.GetAttrStep{Name: kV})
+
+                                p.writeActionSymbol(action)
+                                p.buf.WriteString(k)
+                                p.buf.WriteString(strings.Repeat(" ", keyLen-len(k)))
+                                p.buf.WriteString(" = ")
+
+                                switch action {
+                                case plans.Create, plans.NoOp:
+                                        v := new.GetAttr(kV)
+                                        p.writeValue(v, action, indent+4)
+                                case plans.Delete:
+                                        oldV := old.GetAttr(kV)
+                                        newV := cty.NullVal(oldV.Type())
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                default:
+                                        oldV := old.GetAttr(kV)
+                                        newV := new.GetAttr(kV)
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                }
+
+                                p.buf.WriteString("\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("}")
+
+                        if forcesNewResource {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        return
+                }
+        }
+
+        // In all other cases, we just show the new and old values as-is
+        p.writeValue(old, plans.Delete, indent)
+        if new.IsNull() {
+                p.buf.WriteString(p.color.Color(" [dark_gray]->[reset] "))
+        } else {
+                p.buf.WriteString(p.color.Color(" [yellow]->[reset] "))
+        }
+
+        p.writeValue(new, plans.Create, indent)
+        if p.pathForcesNewResource(path) {
+                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+        }
+}
+
+// writeActionSymbol writes a symbol to represent the given action, followed
+// by a space.
+//
+// It only supports the actions that can be represented with a single character:
+// Create, Delete, Update and NoAction.
+func (p *blockBodyDiffPrinter) writeActionSymbol(action plans.Action) {
+        switch action {
+        case plans.Create:
+                p.buf.WriteString(p.color.Color("[green]+[reset] "))
+        case plans.Delete:
+                p.buf.WriteString(p.color.Color("[red]-[reset] "))
+        case plans.Update:
+                p.buf.WriteString(p.color.Color("[yellow]~[reset] "))
+        case plans.NoOp:
+                p.buf.WriteString("  ")
+        default:
+                // Should never happen
+                p.buf.WriteString(p.color.Color("? "))
+        }
+}
+
+func (p *blockBodyDiffPrinter) pathForcesNewResource(path cty.Path) bool {
+        if !p.action.IsReplace() {
+                // "requiredReplace" only applies when the instance is being replaced
+                return false
+        }
+        return p.requiredReplace.Has(path)
+}
+
+func ctyEmptyString(value cty.Value) bool {
+        if !value.IsNull() && value.IsKnown() {
+                valueType := value.Type()
+                if valueType == cty.String && value.AsString() == "" {
+                        return true
+                }
+        }
+        return false
+}
+
+func ctyGetAttrMaybeNull(val cty.Value, name string) cty.Value {
+        attrType := val.Type().AttributeType(name)
+
+        if val.IsNull() {
+                return cty.NullVal(attrType)
+        }
+
+        // We treat "" as null here
+        // as existing SDK doesn't support null yet.
+        // This allows us to avoid spurious diffs
+        // until we introduce null to the SDK.
+        attrValue := val.GetAttr(name)
+        if ctyEmptyString(attrValue) {
+                return cty.NullVal(attrType)
+        }
+
+        return attrValue
+}
+
+func ctyCollectionValues(val cty.Value) []cty.Value {
+        if !val.IsKnown() || val.IsNull() {
+                return nil
+        }
+
+        ret := make([]cty.Value, 0, val.LengthInt())
+        for it := val.ElementIterator(); it.Next(); {
+                _, value := it.Element()
+                ret = append(ret, value)
+        }
+        return ret
+}
+
+// ctySequenceDiff returns differences between given sequences of cty.Value(s)
+// in the form of Create, Delete, or Update actions (for objects).
+func ctySequenceDiff(old, new []cty.Value) []*plans.Change {
+        var ret []*plans.Change
+        lcs := objchange.LongestCommonSubsequence(old, new)
+        var oldI, newI, lcsI int
+        for oldI < len(old) || newI < len(new) || lcsI < len(lcs) {
+                for oldI < len(old) && (lcsI >= len(lcs) || !old[oldI].RawEquals(lcs[lcsI])) {
+                        isObjectDiff := old[oldI].Type().IsObjectType() && (newI >= len(new) || new[newI].Type().IsObjectType())
+                        if isObjectDiff && newI < len(new) {
+                                ret = append(ret, &plans.Change{
+                                        Action: plans.Update,
+                                        Before: old[oldI],
+                                        After:  new[newI],
+                                })
+                                oldI++
+                                newI++ // we also consume the next "new" in this case
+                                continue
+                        }
+
+                        ret = append(ret, &plans.Change{
+                                Action: plans.Delete,
+                                Before: old[oldI],
+                                After:  cty.NullVal(old[oldI].Type()),
+                        })
+                        oldI++
+                }
+                for newI < len(new) && (lcsI >= len(lcs) || !new[newI].RawEquals(lcs[lcsI])) {
+                        ret = append(ret, &plans.Change{
+                                Action: plans.Create,
+                                Before: cty.NullVal(new[newI].Type()),
+                                After:  new[newI],
+                        })
+                        newI++
+                }
+                if lcsI < len(lcs) {
+                        ret = append(ret, &plans.Change{
+                                Action: plans.NoOp,
+                                Before: lcs[lcsI],
+                                After:  lcs[lcsI],
+                        })
+
+                        // All of our indexes advance together now, since the line
+                        // is common to all three sequences.
+                        lcsI++
+                        oldI++
+                        newI++
+                }
+        }
+        return ret
+}
+
+func ctyEqualWithUnknown(old, new cty.Value) bool {
+        if !old.IsWhollyKnown() || !new.IsWhollyKnown() {
+                return false
+        }
+        return old.Equals(new).True()
+}
+
+// ctyTypesEqual checks equality of two types more loosely
+// by avoiding checks of object/tuple elements
+// as we render differences on element-by-element basis anyway
+func ctyTypesEqual(oldT, newT cty.Type) bool {
+        if oldT.IsObjectType() && newT.IsObjectType() {
+                return true
+        }
+        if oldT.IsTupleType() && newT.IsTupleType() {
+                return true
+        }
+        return oldT.Equals(newT)
+}
+
+func ctyEnsurePathCapacity(path cty.Path, minExtra int) cty.Path {
+        if cap(path)-len(path) >= minExtra {
+                return path
+        }
+        newCap := cap(path) * 2
+        if newCap < (len(path) + minExtra) {
+                newCap = len(path) + minExtra
+        }
+        newPath := make(cty.Path, len(path), newCap)
+        copy(newPath, path)
+        return newPath
+}
+
+// ctyNullBlockListAsEmpty either returns the given value verbatim if it is non-nil
+// or returns an empty value of a suitable type to serve as a placeholder for it.
+//
+// In particular, this function handles the special situation where a "list" is
+// actually represented as a tuple type where nested blocks contain
+// dynamically-typed values.
+func ctyNullBlockListAsEmpty(in cty.Value) cty.Value {
+        if !in.IsNull() {
+                return in
+        }
+        if ty := in.Type(); ty.IsListType() {
+                return cty.ListValEmpty(ty.ElementType())
+        }
+        return cty.EmptyTupleVal // must need a tuple, then
+}
+
+// ctyNullBlockMapAsEmpty either returns the given value verbatim if it is non-nil
+// or returns an empty value of a suitable type to serve as a placeholder for it.
+//
+// In particular, this function handles the special situation where a "map" is
+// actually represented as an object type where nested blocks contain
+// dynamically-typed values.
+func ctyNullBlockMapAsEmpty(in cty.Value) cty.Value {
+        if !in.IsNull() {
+                return in
+        }
+        if ty := in.Type(); ty.IsMapType() {
+                return cty.MapValEmpty(ty.ElementType())
+        }
+        return cty.EmptyObjectVal // must need an object, then
+}
+
+// ctyNullBlockSetAsEmpty either returns the given value verbatim if it is non-nil
+// or returns an empty value of a suitable type to serve as a placeholder for it.
+func ctyNullBlockSetAsEmpty(in cty.Value) cty.Value {
+        if !in.IsNull() {
+                return in
+        }
+        // Dynamically-typed attributes are not supported inside blocks backed by
+        // sets, so our result here is always a set.
+        return cty.SetValEmpty(in.Type().ElementType())
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/format.go b/vendor/github.com/hashicorp/terraform/command/format/format.go
new file mode 100644
index 0000000..aa8d7de
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/format.go
@@ -0,0 +1,8 @@
+// Package format contains helpers for formatting various Terraform
+// structures for human-readabout output.
+//
+// This package is used by the official Terraform CLI in formatting any
+// output and is exported to encourage non-official frontends to mimic the
+// output formatting as much as possible so that text formats of Terraform
+// structures have a consistent look and feel.
+package format
diff --git a/vendor/github.com/hashicorp/terraform/command/format/object_id.go b/vendor/github.com/hashicorp/terraform/command/format/object_id.go
new file mode 100644
index 0000000..85ebbfe
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/object_id.go
@@ -0,0 +1,123 @@
+package format
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ObjectValueID takes a value that is assumed to be an object representation
+// of some resource instance object and attempts to heuristically find an
+// attribute of it that is likely to be a unique identifier in the remote
+// system that it belongs to which will be useful to the user.
+//
+// If such an attribute is found, its name and string value intended for
+// display are returned. Both returned strings are empty if no such attribute
+// exists, in which case the caller should assume that the resource instance
+// address within the Terraform configuration is the best available identifier.
+//
+// This is only a best-effort sort of thing, relying on naming conventions in
+// our resource type schemas. The result is not guaranteed to be unique, but
+// should generally be suitable for display to an end-user anyway.
+//
+// This function will panic if the given value is not of an object type.
+func ObjectValueID(obj cty.Value) (k, v string) {
+        if obj.IsNull() || !obj.IsKnown() {
+                return "", ""
+        }
+
+        atys := obj.Type().AttributeTypes()
+
+        switch {
+
+        case atys["id"] == cty.String:
+                v := obj.GetAttr("id")
+                if v.IsKnown() && !v.IsNull() {
+                        return "id", v.AsString()
+                }
+
+        case atys["name"] == cty.String:
+                // "name" isn't always globally unique, but if there isn't also an
+                // "id" then it _often_ is, in practice.
+                v := obj.GetAttr("name")
+                if v.IsKnown() && !v.IsNull() {
+                        return "name", v.AsString()
+                }
+        }
+
+        return "", ""
+}
+
+// ObjectValueName takes a value that is assumed to be an object representation
+// of some resource instance object and attempts to heuristically find an
+// attribute of it that is likely to be a human-friendly name in the remote
+// system that it belongs to which will be useful to the user.
+//
+// If such an attribute is found, its name and string value intended for
+// display are returned. Both returned strings are empty if no such attribute
+// exists, in which case the caller should assume that the resource instance
+// address within the Terraform configuration is the best available identifier.
+//
+// This is only a best-effort sort of thing, relying on naming conventions in
+// our resource type schemas. The result is not guaranteed to be unique, but
+// should generally be suitable for display to an end-user anyway.
+//
+// Callers that use both ObjectValueName and ObjectValueID at the same time
+// should be prepared to get the same attribute key and value from both in
+// some cases, since there is overlap betweek the id-extraction and
+// name-extraction heuristics.
+//
+// This function will panic if the given value is not of an object type.
+func ObjectValueName(obj cty.Value) (k, v string) {
+        if obj.IsNull() || !obj.IsKnown() {
+                return "", ""
+        }
+
+        atys := obj.Type().AttributeTypes()
+
+        switch {
+
+        case atys["name"] == cty.String:
+                v := obj.GetAttr("name")
+                if v.IsKnown() && !v.IsNull() {
+                        return "name", v.AsString()
+                }
+
+        case atys["tags"].IsMapType() && atys["tags"].ElementType() == cty.String:
+                tags := obj.GetAttr("tags")
+                if tags.IsNull() || !tags.IsWhollyKnown() {
+                        break
+                }
+
+                switch {
+                case tags.HasIndex(cty.StringVal("name")).RawEquals(cty.True):
+                        v := tags.Index(cty.StringVal("name"))
+                        if v.IsKnown() && !v.IsNull() {
+                                return "tags.name", v.AsString()
+                        }
+                case tags.HasIndex(cty.StringVal("Name")).RawEquals(cty.True):
+                        // AWS-style naming convention
+                        v := tags.Index(cty.StringVal("Name"))
+                        if v.IsKnown() && !v.IsNull() {
+                                return "tags.Name", v.AsString()
+                        }
+                }
+        }
+
+        return "", ""
+}
+
+// ObjectValueIDOrName is a convenience wrapper around both ObjectValueID
+// and ObjectValueName (in that preference order) to try to extract some sort
+// of human-friendly descriptive string value for an object as additional
+// context about an object when it is being displayed in a compact way (where
+// not all of the attributes are visible.)
+//
+// Just as with the two functions it wraps, it is a best-effort and may return
+// two empty strings if no suitable attribute can be found for a given object.
+func ObjectValueIDOrName(obj cty.Value) (k, v string) {
+        k, v = ObjectValueID(obj)
+        if k != "" {
+                return
+        }
+        k, v = ObjectValueName(obj)
+        return
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/plan.go b/vendor/github.com/hashicorp/terraform/command/format/plan.go
new file mode 100644
index 0000000..098653f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/plan.go
@@ -0,0 +1,302 @@
+package format
+
+import (
+        "bytes"
+        "fmt"
+        "log"
+        "sort"
+        "strings"
+
+        "github.com/mitchellh/colorstring"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// Plan is a representation of a plan optimized for display to
+// an end-user, as opposed to terraform.Plan which is for internal use.
+//
+// DisplayPlan excludes implementation details that may otherwise appear
+// in the main plan, such as destroy actions on data sources (which are
+// there only to clean up the state).
+type Plan struct {
+        Resources []*InstanceDiff
+}
+
+// InstanceDiff is a representation of an instance diff optimized
+// for display, in conjunction with DisplayPlan.
+type InstanceDiff struct {
+        Addr   *terraform.ResourceAddress
+        Action plans.Action
+
+        // Attributes describes changes to the attributes of the instance.
+        //
+        // For destroy diffs this is always nil.
+        Attributes []*AttributeDiff
+
+        Tainted bool
+        Deposed bool
+}
+
+// AttributeDiff is a representation of an attribute diff optimized
+// for display, in conjunction with DisplayInstanceDiff.
+type AttributeDiff struct {
+        // Path is a dot-delimited traversal through possibly many levels of list and map structure,
+        // intended for display purposes only.
+        Path string
+
+        Action plans.Action
+
+        OldValue string
+        NewValue string
+
+        NewComputed bool
+        Sensitive   bool
+        ForcesNew   bool
+}
+
+// PlanStats gives summary counts for a Plan.
+type PlanStats struct {
+        ToAdd, ToChange, ToDestroy int
+}
+
+// NewPlan produces a display-oriented Plan from a terraform.Plan.
+func NewPlan(changes *plans.Changes) *Plan {
+        log.Printf("[TRACE] NewPlan for %#v", changes)
+        ret := &Plan{}
+        if changes == nil {
+                // Nothing to do!
+                return ret
+        }
+
+        for _, rc := range changes.Resources {
+                addr := rc.Addr
+                log.Printf("[TRACE] NewPlan found %s (%s)", addr, rc.Action)
+                dataSource := addr.Resource.Resource.Mode == addrs.DataResourceMode
+
+                // We create "delete" actions for data resources so we can clean
+                // up their entries in state, but this is an implementation detail
+                // that users shouldn't see.
+                if dataSource && rc.Action == plans.Delete {
+                        continue
+                }
+
+                // For now we'll shim this to work with our old types.
+                // TODO: Update for the new plan types, ideally also switching over to
+                // a structural diff renderer instead of a flat renderer.
+                did := &InstanceDiff{
+                        Addr:   terraform.NewLegacyResourceInstanceAddress(addr),
+                        Action: rc.Action,
+                }
+
+                if rc.DeposedKey != states.NotDeposed {
+                        did.Deposed = true
+                }
+
+                // Since this is just a temporary stub implementation on the way
+                // to us replacing this with the structural diff renderer, we currently
+                // don't include any attributes here.
+                // FIXME: Implement the structural diff renderer to replace this
+                // codepath altogether.
+
+                ret.Resources = append(ret.Resources, did)
+        }
+
+        // Sort the instance diffs by their addresses for display.
+        sort.Slice(ret.Resources, func(i, j int) bool {
+                iAddr := ret.Resources[i].Addr
+                jAddr := ret.Resources[j].Addr
+                return iAddr.Less(jAddr)
+        })
+
+        return ret
+}
+
+// Format produces and returns a text representation of the receiving plan
+// intended for display in a terminal.
+//
+// If color is not nil, it is used to colorize the output.
+func (p *Plan) Format(color *colorstring.Colorize) string {
+        if p.Empty() {
+                return "This plan does nothing."
+        }
+
+        if color == nil {
+                color = &colorstring.Colorize{
+                        Colors: colorstring.DefaultColors,
+                        Reset:  false,
+                }
+        }
+
+        // Find the longest path length of all the paths that are changing,
+        // so we can align them all.
+        keyLen := 0
+        for _, r := range p.Resources {
+                for _, attr := range r.Attributes {
+                        key := attr.Path
+
+                        if len(key) > keyLen {
+                                keyLen = len(key)
+                        }
+                }
+        }
+
+        buf := new(bytes.Buffer)
+        for _, r := range p.Resources {
+                formatPlanInstanceDiff(buf, r, keyLen, color)
+        }
+
+        return strings.TrimSpace(buf.String())
+}
+
+// Stats returns statistics about the plan
+func (p *Plan) Stats() PlanStats {
+        var ret PlanStats
+        for _, r := range p.Resources {
+                switch r.Action {
+                case plans.Create:
+                        ret.ToAdd++
+                case plans.Update:
+                        ret.ToChange++
+                case plans.DeleteThenCreate, plans.CreateThenDelete:
+                        ret.ToAdd++
+                        ret.ToDestroy++
+                case plans.Delete:
+                        ret.ToDestroy++
+                }
+        }
+        return ret
+}
+
+// ActionCounts returns the number of diffs for each action type
+func (p *Plan) ActionCounts() map[plans.Action]int {
+        ret := map[plans.Action]int{}
+        for _, r := range p.Resources {
+                ret[r.Action]++
+        }
+        return ret
+}
+
+// Empty returns true if there is at least one resource diff in the receiving plan.
+func (p *Plan) Empty() bool {
+        return len(p.Resources) == 0
+}
+
+// DiffActionSymbol returns a string that, once passed through a
+// colorstring.Colorize, will produce a result that can be written
+// to a terminal to produce a symbol made of three printable
+// characters, possibly interspersed with VT100 color codes.
+func DiffActionSymbol(action plans.Action) string {
+        switch action {
+        case plans.DeleteThenCreate:
+                return "[red]-[reset]/[green]+[reset]"
+        case plans.CreateThenDelete:
+                return "[green]+[reset]/[red]-[reset]"
+        case plans.Create:
+                return "  [green]+[reset]"
+        case plans.Delete:
+                return "  [red]-[reset]"
+        case plans.Read:
+                return " [cyan]<=[reset]"
+        case plans.Update:
+                return "  [yellow]~[reset]"
+        default:
+                return "  ?"
+        }
+}
+
+// formatPlanInstanceDiff writes the text representation of the given instance diff
+// to the given buffer, using the given colorizer.
+func formatPlanInstanceDiff(buf *bytes.Buffer, r *InstanceDiff, keyLen int, colorizer *colorstring.Colorize) {
+        addrStr := r.Addr.String()
+
+        // Determine the color for the text (green for adding, yellow
+        // for change, red for delete), and symbol, and output the
+        // resource header.
+        color := "yellow"
+        symbol := DiffActionSymbol(r.Action)
+        oldValues := true
+        switch r.Action {
+        case plans.DeleteThenCreate, plans.CreateThenDelete:
+                color = "yellow"
+        case plans.Create:
+                color = "green"
+                oldValues = false
+        case plans.Delete:
+                color = "red"
+        case plans.Read:
+                color = "cyan"
+                oldValues = false
+        }
+
+        var extraStr string
+        if r.Tainted {
+                extraStr = extraStr + " (tainted)"
+        }
+        if r.Deposed {
+                extraStr = extraStr + " (deposed)"
+        }
+        if r.Action.IsReplace() {
+                extraStr = extraStr + colorizer.Color(" [red][bold](new resource required)")
+        }
+
+        buf.WriteString(
+                colorizer.Color(fmt.Sprintf(
+                        "[%s]%s [%s]%s%s\n",
+                        color, symbol, color, addrStr, extraStr,
+                )),
+        )
+
+        for _, attr := range r.Attributes {
+
+                v := attr.NewValue
+                var dispV string
+                switch {
+                case v == "" && attr.NewComputed:
+                        dispV = "<computed>"
+                case attr.Sensitive:
+                        dispV = "<sensitive>"
+                default:
+                        dispV = fmt.Sprintf("%q", v)
+                }
+
+                updateMsg := ""
+                switch {
+                case attr.ForcesNew && r.Action.IsReplace():
+                        updateMsg = colorizer.Color(" [red](forces new resource)")
+                case attr.Sensitive && oldValues:
+                        updateMsg = colorizer.Color(" [yellow](attribute changed)")
+                }
+
+                if oldValues {
+                        u := attr.OldValue
+                        var dispU string
+                        switch {
+                        case attr.Sensitive:
+                                dispU = "<sensitive>"
+                        default:
+                                dispU = fmt.Sprintf("%q", u)
+                        }
+                        buf.WriteString(fmt.Sprintf(
+                                "      %s:%s %s => %s%s\n",
+                                attr.Path,
+                                strings.Repeat(" ", keyLen-len(attr.Path)),
+                                dispU, dispV,
+                                updateMsg,
+                        ))
+                } else {
+                        buf.WriteString(fmt.Sprintf(
+                                "      %s:%s %s%s\n",
+                                attr.Path,
+                                strings.Repeat(" ", keyLen-len(attr.Path)),
+                                dispV,
+                                updateMsg,
+                        ))
+                }
+        }
+
+        // Write the reset color so we don't bleed color into later text
+        buf.WriteString(colorizer.Color("[reset]\n"))
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/state.go b/vendor/github.com/hashicorp/terraform/command/format/state.go
new file mode 100644
index 0000000..f411ef9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/state.go
@@ -0,0 +1,286 @@
+package format
+
+import (
+        "bytes"
+        "fmt"
+        "sort"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+        "github.com/mitchellh/colorstring"
+)
+
+// StateOpts are the options for formatting a state.
+type StateOpts struct {
+        // State is the state to format. This is required.
+        State *states.State
+
+        // Schemas are used to decode attributes. This is required.
+        Schemas *terraform.Schemas
+
+        // Color is the colorizer. This is optional.
+        Color *colorstring.Colorize
+}
+
+// State takes a state and returns a string
+func State(opts *StateOpts) string {
+        if opts.Color == nil {
+                panic("colorize not given")
+        }
+
+        if opts.Schemas == nil {
+                panic("schemas not given")
+        }
+
+        s := opts.State
+        if len(s.Modules) == 0 {
+                return "The state file is empty. No resources are represented."
+        }
+
+        buf := bytes.NewBufferString("[reset]")
+        p := blockBodyDiffPrinter{
+                buf:    buf,
+                color:  opts.Color,
+                action: plans.NoOp,
+        }
+
+        // Format all the modules
+        for _, m := range s.Modules {
+                formatStateModule(p, m, opts.Schemas)
+        }
+
+        // Write the outputs for the root module
+        m := s.RootModule()
+
+        if m.OutputValues != nil {
+                if len(m.OutputValues) > 0 {
+                        p.buf.WriteString("Outputs:\n\n")
+                }
+
+                // Sort the outputs
+                ks := make([]string, 0, len(m.OutputValues))
+                for k := range m.OutputValues {
+                        ks = append(ks, k)
+                }
+                sort.Strings(ks)
+
+                // Output each output k/v pair
+                for _, k := range ks {
+                        v := m.OutputValues[k]
+                        p.buf.WriteString(fmt.Sprintf("%s = ", k))
+                        p.writeValue(v.Value, plans.NoOp, 0)
+                        p.buf.WriteString("\n\n")
+                }
+        }
+
+        return opts.Color.Color(strings.TrimSpace(p.buf.String()))
+
+}
+
+func formatStateModule(p blockBodyDiffPrinter, m *states.Module, schemas *terraform.Schemas) {
+        // First get the names of all the resources so we can show them
+        // in alphabetical order.
+        names := make([]string, 0, len(m.Resources))
+        for name := range m.Resources {
+                names = append(names, name)
+        }
+        sort.Strings(names)
+
+        // Go through each resource and begin building up the output.
+        for _, key := range names {
+                for k, v := range m.Resources[key].Instances {
+                        addr := m.Resources[key].Addr
+
+                        taintStr := ""
+                        if v.Current.Status == 'T' {
+                                taintStr = "(tainted)"
+                        }
+                        p.buf.WriteString(fmt.Sprintf("# %s: %s\n", addr.Absolute(m.Addr).Instance(k), taintStr))
+
+                        var schema *configschema.Block
+                        provider := m.Resources[key].ProviderConfig.ProviderConfig.StringCompact()
+                        if _, exists := schemas.Providers[provider]; !exists {
+                                // This should never happen in normal use because we should've
+                                // loaded all of the schemas and checked things prior to this
+                                // point. We can't return errors here, but since this is UI code
+                                // we will try to do _something_ reasonable.
+                                p.buf.WriteString(fmt.Sprintf("# missing schema for provider %q\n\n", provider))
+                                continue
+                        }
+
+                        switch addr.Mode {
+                        case addrs.ManagedResourceMode:
+                                schema, _ = schemas.ResourceTypeConfig(
+                                        provider,
+                                        addr.Mode,
+                                        addr.Type,
+                                )
+                                if schema == nil {
+                                        p.buf.WriteString(fmt.Sprintf(
+                                                "# missing schema for provider %q resource type %s\n\n", provider, addr.Type))
+                                        continue
+                                }
+
+                                p.buf.WriteString(fmt.Sprintf(
+                                        "resource %q %q {",
+                                        addr.Type,
+                                        addr.Name,
+                                ))
+                        case addrs.DataResourceMode:
+                                schema, _ = schemas.ResourceTypeConfig(
+                                        provider,
+                                        addr.Mode,
+                                        addr.Type,
+                                )
+                                if schema == nil {
+                                        p.buf.WriteString(fmt.Sprintf(
+                                                "# missing schema for provider %q data source %s\n\n", provider, addr.Type))
+                                        continue
+                                }
+
+                                p.buf.WriteString(fmt.Sprintf(
+                                        "data %q %q {",
+                                        addr.Type,
+                                        addr.Name,
+                                ))
+                        default:
+                                // should never happen, since the above is exhaustive
+                                p.buf.WriteString(addr.String())
+                        }
+
+                        val, err := v.Current.Decode(schema.ImpliedType())
+                        if err != nil {
+                                fmt.Println(err.Error())
+                                break
+                        }
+
+                        path := make(cty.Path, 0, 3)
+                        bodyWritten := p.writeBlockBodyDiff(schema, val.Value, val.Value, 2, path)
+                        if bodyWritten {
+                                p.buf.WriteString("\n")
+                        }
+
+                        p.buf.WriteString("}\n\n")
+                }
+        }
+        p.buf.WriteString("[reset]\n")
+}
+
+func formatNestedList(indent string, outputList []interface{}) string {
+        outputBuf := new(bytes.Buffer)
+        outputBuf.WriteString(fmt.Sprintf("%s[", indent))
+
+        lastIdx := len(outputList) - 1
+
+        for i, value := range outputList {
+                outputBuf.WriteString(fmt.Sprintf("\n%s%s%s", indent, "    ", value))
+                if i != lastIdx {
+                        outputBuf.WriteString(",")
+                }
+        }
+
+        outputBuf.WriteString(fmt.Sprintf("\n%s]", indent))
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
+
+func formatListOutput(indent, outputName string, outputList []interface{}) string {
+        keyIndent := ""
+
+        outputBuf := new(bytes.Buffer)
+
+        if outputName != "" {
+                outputBuf.WriteString(fmt.Sprintf("%s%s = [", indent, outputName))
+                keyIndent = "    "
+        }
+
+        lastIdx := len(outputList) - 1
+
+        for i, value := range outputList {
+                switch typedValue := value.(type) {
+                case string:
+                        outputBuf.WriteString(fmt.Sprintf("\n%s%s%s", indent, keyIndent, value))
+                case []interface{}:
+                        outputBuf.WriteString(fmt.Sprintf("\n%s%s", indent,
+                                formatNestedList(indent+keyIndent, typedValue)))
+                case map[string]interface{}:
+                        outputBuf.WriteString(fmt.Sprintf("\n%s%s", indent,
+                                formatNestedMap(indent+keyIndent, typedValue)))
+                }
+
+                if lastIdx != i {
+                        outputBuf.WriteString(",")
+                }
+        }
+
+        if outputName != "" {
+                if len(outputList) > 0 {
+                        outputBuf.WriteString(fmt.Sprintf("\n%s]", indent))
+                } else {
+                        outputBuf.WriteString("]")
+                }
+        }
+
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
+
+func formatNestedMap(indent string, outputMap map[string]interface{}) string {
+        ks := make([]string, 0, len(outputMap))
+        for k, _ := range outputMap {
+                ks = append(ks, k)
+        }
+        sort.Strings(ks)
+
+        outputBuf := new(bytes.Buffer)
+        outputBuf.WriteString(fmt.Sprintf("%s{", indent))
+
+        lastIdx := len(outputMap) - 1
+        for i, k := range ks {
+                v := outputMap[k]
+                outputBuf.WriteString(fmt.Sprintf("\n%s%s = %v", indent+"    ", k, v))
+
+                if lastIdx != i {
+                        outputBuf.WriteString(",")
+                }
+        }
+
+        outputBuf.WriteString(fmt.Sprintf("\n%s}", indent))
+
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
+
+func formatMapOutput(indent, outputName string, outputMap map[string]interface{}) string {
+        ks := make([]string, 0, len(outputMap))
+        for k, _ := range outputMap {
+                ks = append(ks, k)
+        }
+        sort.Strings(ks)
+
+        keyIndent := ""
+
+        outputBuf := new(bytes.Buffer)
+        if outputName != "" {
+                outputBuf.WriteString(fmt.Sprintf("%s%s = {", indent, outputName))
+                keyIndent = "  "
+        }
+
+        for _, k := range ks {
+                v := outputMap[k]
+                outputBuf.WriteString(fmt.Sprintf("\n%s%s%s = %v", indent, keyIndent, k, v))
+        }
+
+        if outputName != "" {
+                if len(outputMap) > 0 {
+                        outputBuf.WriteString(fmt.Sprintf("\n%s}", indent))
+                } else {
+                        outputBuf.WriteString("}")
+                }
+        }
+
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go b/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
deleted file mode 100644
index 2b1b0ca..0000000
--- a/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
+++ /dev/null
@@ -1,97 +0,0 @@
-package configschema
-
-import (
-        "github.com/hashicorp/hcl2/hcldec"
-        "github.com/zclconf/go-cty/cty"
-)
-
-var mapLabelNames = []string{"key"}
-
-// DecoderSpec returns a hcldec.Spec that can be used to decode a HCL Body
-// using the facilities in the hcldec package.
-//
-// The returned specification is guaranteed to return a value of the same type
-// returned by method ImpliedType, but it may contain null or unknown values if
-// any of the block attributes are defined as optional and/or computed
-// respectively.
-func (b *Block) DecoderSpec() hcldec.Spec {
-        ret := hcldec.ObjectSpec{}
-        if b == nil {
-                return ret
-        }
-
-        for name, attrS := range b.Attributes {
-                switch {
-                case attrS.Computed && attrS.Optional:
-                        // In this special case we use an unknown value as a default
-                        // to get the intended behavior that the result is computed
-                        // unless it has been explicitly set in config.
-                        ret[name] = &hcldec.DefaultSpec{
-                                Primary: &hcldec.AttrSpec{
-                                        Name: name,
-                                        Type: attrS.Type,
-                                },
-                                Default: &hcldec.LiteralSpec{
-                                        Value: cty.UnknownVal(attrS.Type),
-                                },
-                        }
-                case attrS.Computed:
-                        ret[name] = &hcldec.LiteralSpec{
-                                Value: cty.UnknownVal(attrS.Type),
-                        }
-                default:
-                        ret[name] = &hcldec.AttrSpec{
-                                Name:     name,
-                                Type:     attrS.Type,
-                                Required: attrS.Required,
-                        }
-                }
-        }
-
-        for name, blockS := range b.BlockTypes {
-                if _, exists := ret[name]; exists {
-                        // This indicates an invalid schema, since it's not valid to
-                        // define both an attribute and a block type of the same name.
-                        // However, we don't raise this here since it's checked by
-                        // InternalValidate.
-                        continue
-                }
-
-                childSpec := blockS.Block.DecoderSpec()
-
-                switch blockS.Nesting {
-                case NestingSingle:
-                        ret[name] = &hcldec.BlockSpec{
-                                TypeName: name,
-                                Nested:   childSpec,
-                                Required: blockS.MinItems == 1 && blockS.MaxItems >= 1,
-                        }
-                case NestingList:
-                        ret[name] = &hcldec.BlockListSpec{
-                                TypeName: name,
-                                Nested:   childSpec,
-                                MinItems: blockS.MinItems,
-                                MaxItems: blockS.MaxItems,
-                        }
-                case NestingSet:
-                        ret[name] = &hcldec.BlockSetSpec{
-                                TypeName: name,
-                                Nested:   childSpec,
-                                MinItems: blockS.MinItems,
-                                MaxItems: blockS.MaxItems,
-                        }
-                case NestingMap:
-                        ret[name] = &hcldec.BlockMapSpec{
-                                TypeName:   name,
-                                Nested:     childSpec,
-                                LabelNames: mapLabelNames,
-                        }
-                default:
-                        // Invalid nesting type is just ignored. It's checked by
-                        // InternalValidate.
-                        continue
-                }
-        }
-
-        return ret
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go b/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
deleted file mode 100644
index 67324eb..0000000
--- a/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package configschema
-
-import (
-        "github.com/hashicorp/hcl2/hcldec"
-        "github.com/zclconf/go-cty/cty"
-)
-
-// ImpliedType returns the cty.Type that would result from decoding a
-// configuration block using the receiving block schema.
-//
-// ImpliedType always returns a result, even if the given schema is
-// inconsistent. Code that creates configschema.Block objects should be
-// tested using the InternalValidate method to detect any inconsistencies
-// that would cause this method to fall back on defaults and assumptions.
-func (b *Block) ImpliedType() cty.Type {
-        if b == nil {
-                return cty.EmptyObject
-        }
-
-        return hcldec.ImpliedType(b.DecoderSpec())
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go b/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
deleted file mode 100644
index 6cb9313..0000000
--- a/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Code generated by "stringer -type=NestingMode"; DO NOT EDIT.
-
-package configschema
-
-import "strconv"
-
-const _NestingMode_name = "nestingModeInvalidNestingSingleNestingListNestingSetNestingMap"
-
-var _NestingMode_index = [...]uint8{0, 18, 31, 42, 52, 62}
-
-func (i NestingMode) String() string {
-        if i < 0 || i >= NestingMode(len(_NestingMode_index)-1) {
-                return "NestingMode(" + strconv.FormatInt(int64(i), 10) + ")"
-        }
-        return _NestingMode_name[_NestingMode_index[i]:_NestingMode_index[i+1]]
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/flatmap.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/flatmap.go
new file mode 100644
index 0000000..bb4228d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/flatmap.go
@@ -0,0 +1,424 @@
+package hcl2shim
+
+import (
+        "fmt"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// FlatmapValueFromHCL2 converts a value from HCL2 (really, from the cty dynamic
+// types library that HCL2 uses) to a map compatible with what would be
+// produced by the "flatmap" package.
+//
+// The type of the given value informs the structure of the resulting map.
+// The value must be of an object type or this function will panic.
+//
+// Flatmap values can only represent maps when they are of primitive types,
+// so the given value must not have any maps of complex types or the result
+// is undefined.
+func FlatmapValueFromHCL2(v cty.Value) map[string]string {
+        if v.IsNull() {
+                return nil
+        }
+
+        if !v.Type().IsObjectType() {
+                panic(fmt.Sprintf("HCL2ValueFromFlatmap called on %#v", v.Type()))
+        }
+
+        m := make(map[string]string)
+        flatmapValueFromHCL2Map(m, "", v)
+        return m
+}
+
+func flatmapValueFromHCL2Value(m map[string]string, key string, val cty.Value) {
+        ty := val.Type()
+        switch {
+        case ty.IsPrimitiveType() || ty == cty.DynamicPseudoType:
+                flatmapValueFromHCL2Primitive(m, key, val)
+        case ty.IsObjectType() || ty.IsMapType():
+                flatmapValueFromHCL2Map(m, key+".", val)
+        case ty.IsTupleType() || ty.IsListType() || ty.IsSetType():
+                flatmapValueFromHCL2Seq(m, key+".", val)
+        default:
+                panic(fmt.Sprintf("cannot encode %s to flatmap", ty.FriendlyName()))
+        }
+}
+
+func flatmapValueFromHCL2Primitive(m map[string]string, key string, val cty.Value) {
+        if !val.IsKnown() {
+                m[key] = UnknownVariableValue
+                return
+        }
+        if val.IsNull() {
+                // Omit entirely
+                return
+        }
+
+        var err error
+        val, err = convert.Convert(val, cty.String)
+        if err != nil {
+                // Should not be possible, since all primitive types can convert to string.
+                panic(fmt.Sprintf("invalid primitive encoding to flatmap: %s", err))
+        }
+        m[key] = val.AsString()
+}
+
+func flatmapValueFromHCL2Map(m map[string]string, prefix string, val cty.Value) {
+        if val.IsNull() {
+                // Omit entirely
+                return
+        }
+        if !val.IsKnown() {
+                switch {
+                case val.Type().IsObjectType():
+                        // Whole objects can't be unknown in flatmap, so instead we'll
+                        // just write all of the attribute values out as unknown.
+                        for name, aty := range val.Type().AttributeTypes() {
+                                flatmapValueFromHCL2Value(m, prefix+name, cty.UnknownVal(aty))
+                        }
+                default:
+                        m[prefix+"%"] = UnknownVariableValue
+                }
+                return
+        }
+
+        len := 0
+        for it := val.ElementIterator(); it.Next(); {
+                ak, av := it.Element()
+                name := ak.AsString()
+                flatmapValueFromHCL2Value(m, prefix+name, av)
+                len++
+        }
+        if !val.Type().IsObjectType() { // objects don't have an explicit count included, since their attribute count is fixed
+                m[prefix+"%"] = strconv.Itoa(len)
+        }
+}
+
+func flatmapValueFromHCL2Seq(m map[string]string, prefix string, val cty.Value) {
+        if val.IsNull() {
+                // Omit entirely
+                return
+        }
+        if !val.IsKnown() {
+                m[prefix+"#"] = UnknownVariableValue
+                return
+        }
+
+        // For sets this won't actually generate exactly what helper/schema would've
+        // generated, because we don't have access to the set key function it
+        // would've used. However, in practice it doesn't actually matter what the
+        // keys are as long as they are unique, so we'll just generate sequential
+        // indexes for them as if it were a list.
+        //
+        // An important implication of this, however, is that the set ordering will
+        // not be consistent across mutations and so different keys may be assigned
+        // to the same value when round-tripping. Since this shim is intended to
+        // be short-lived and not used for round-tripping, we accept this.
+        i := 0
+        for it := val.ElementIterator(); it.Next(); {
+                _, av := it.Element()
+                key := prefix + strconv.Itoa(i)
+                flatmapValueFromHCL2Value(m, key, av)
+                i++
+        }
+        m[prefix+"#"] = strconv.Itoa(i)
+}
+
+// HCL2ValueFromFlatmap converts a map compatible with what would be produced
+// by the "flatmap" package to a HCL2 (really, the cty dynamic types library
+// that HCL2 uses) object type.
+//
+// The intended result type must be provided in order to guide how the
+// map contents are decoded. This must be an object type or this function
+// will panic.
+//
+// Flatmap values can only represent maps when they are of primitive types,
+// so the given type must not have any maps of complex types or the result
+// is undefined.
+//
+// The result may contain null values if the given map does not contain keys
+// for all of the different key paths implied by the given type.
+func HCL2ValueFromFlatmap(m map[string]string, ty cty.Type) (cty.Value, error) {
+        if m == nil {
+                return cty.NullVal(ty), nil
+        }
+        if !ty.IsObjectType() {
+                panic(fmt.Sprintf("HCL2ValueFromFlatmap called on %#v", ty))
+        }
+
+        return hcl2ValueFromFlatmapObject(m, "", ty.AttributeTypes())
+}
+
+func hcl2ValueFromFlatmapValue(m map[string]string, key string, ty cty.Type) (cty.Value, error) {
+        var val cty.Value
+        var err error
+        switch {
+        case ty.IsPrimitiveType():
+                val, err = hcl2ValueFromFlatmapPrimitive(m, key, ty)
+        case ty.IsObjectType():
+                val, err = hcl2ValueFromFlatmapObject(m, key+".", ty.AttributeTypes())
+        case ty.IsTupleType():
+                val, err = hcl2ValueFromFlatmapTuple(m, key+".", ty.TupleElementTypes())
+        case ty.IsMapType():
+                val, err = hcl2ValueFromFlatmapMap(m, key+".", ty)
+        case ty.IsListType():
+                val, err = hcl2ValueFromFlatmapList(m, key+".", ty)
+        case ty.IsSetType():
+                val, err = hcl2ValueFromFlatmapSet(m, key+".", ty)
+        default:
+                err = fmt.Errorf("cannot decode %s from flatmap", ty.FriendlyName())
+        }
+
+        if err != nil {
+                return cty.DynamicVal, err
+        }
+        return val, nil
+}
+
+func hcl2ValueFromFlatmapPrimitive(m map[string]string, key string, ty cty.Type) (cty.Value, error) {
+        rawVal, exists := m[key]
+        if !exists {
+                return cty.NullVal(ty), nil
+        }
+        if rawVal == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        var err error
+        val := cty.StringVal(rawVal)
+        val, err = convert.Convert(val, ty)
+        if err != nil {
+                // This should never happen for _valid_ input, but flatmap data might
+                // be tampered with by the user and become invalid.
+                return cty.DynamicVal, fmt.Errorf("invalid value for %q in state: %s", key, err)
+        }
+
+        return val, nil
+}
+
+func hcl2ValueFromFlatmapObject(m map[string]string, prefix string, atys map[string]cty.Type) (cty.Value, error) {
+        vals := make(map[string]cty.Value)
+        for name, aty := range atys {
+                val, err := hcl2ValueFromFlatmapValue(m, prefix+name, aty)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[name] = val
+        }
+        return cty.ObjectVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapTuple(m map[string]string, prefix string, etys []cty.Type) (cty.Value, error) {
+        var vals []cty.Value
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(cty.Tuple(etys)), nil
+        }
+
+        countStr, exists := m[prefix+"#"]
+        if !exists {
+                return cty.NullVal(cty.Tuple(etys)), nil
+        }
+        if countStr == UnknownVariableValue {
+                return cty.UnknownVal(cty.Tuple(etys)), nil
+        }
+
+        count, err := strconv.Atoi(countStr)
+        if err != nil {
+                return cty.DynamicVal, fmt.Errorf("invalid count value for %q in state: %s", prefix, err)
+        }
+        if count != len(etys) {
+                return cty.DynamicVal, fmt.Errorf("wrong number of values for %q in state: got %d, but need %d", prefix, count, len(etys))
+        }
+
+        vals = make([]cty.Value, len(etys))
+        for i, ety := range etys {
+                key := prefix + strconv.Itoa(i)
+                val, err := hcl2ValueFromFlatmapValue(m, key, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[i] = val
+        }
+        return cty.TupleVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapMap(m map[string]string, prefix string, ty cty.Type) (cty.Value, error) {
+        vals := make(map[string]cty.Value)
+        ety := ty.ElementType()
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        // We actually don't really care about the "count" of a map for our
+        // purposes here, but we do need to check if it _exists_ in order to
+        // recognize the difference between null (not set at all) and empty.
+        if strCount, exists := m[prefix+"%"]; !exists {
+                return cty.NullVal(ty), nil
+        } else if strCount == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        for fullKey := range m {
+                if !strings.HasPrefix(fullKey, prefix) {
+                        continue
+                }
+
+                // The flatmap format doesn't allow us to distinguish between keys
+                // that contain periods and nested objects, so by convention a
+                // map is only ever of primitive type in flatmap, and we just assume
+                // that the remainder of the raw key (dots and all) is the key we
+                // want in the result value.
+                key := fullKey[len(prefix):]
+                if key == "%" {
+                        // Ignore the "count" key
+                        continue
+                }
+
+                val, err := hcl2ValueFromFlatmapValue(m, fullKey, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[key] = val
+        }
+
+        if len(vals) == 0 {
+                return cty.MapValEmpty(ety), nil
+        }
+        return cty.MapVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapList(m map[string]string, prefix string, ty cty.Type) (cty.Value, error) {
+        var vals []cty.Value
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        countStr, exists := m[prefix+"#"]
+        if !exists {
+                return cty.NullVal(ty), nil
+        }
+        if countStr == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        count, err := strconv.Atoi(countStr)
+        if err != nil {
+                return cty.DynamicVal, fmt.Errorf("invalid count value for %q in state: %s", prefix, err)
+        }
+
+        ety := ty.ElementType()
+        if count == 0 {
+                return cty.ListValEmpty(ety), nil
+        }
+
+        vals = make([]cty.Value, count)
+        for i := 0; i < count; i++ {
+                key := prefix + strconv.Itoa(i)
+                val, err := hcl2ValueFromFlatmapValue(m, key, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[i] = val
+        }
+
+        return cty.ListVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapSet(m map[string]string, prefix string, ty cty.Type) (cty.Value, error) {
+        var vals []cty.Value
+        ety := ty.ElementType()
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        strCount, exists := m[prefix+"#"]
+        if !exists {
+                return cty.NullVal(ty), nil
+        } else if strCount == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        // Keep track of keys we've seen, se we don't add the same set value
+        // multiple times. The cty.Set will normally de-duplicate values, but we may
+        // have unknown values that would not show as equivalent.
+        seen := map[string]bool{}
+
+        for fullKey := range m {
+                if !strings.HasPrefix(fullKey, prefix) {
+                        continue
+                }
+                subKey := fullKey[len(prefix):]
+                if subKey == "#" {
+                        // Ignore the "count" key
+                        continue
+                }
+                key := fullKey
+                if dot := strings.IndexByte(subKey, '.'); dot != -1 {
+                        key = fullKey[:dot+len(prefix)]
+                }
+
+                if seen[key] {
+                        continue
+                }
+
+                seen[key] = true
+
+                // The flatmap format doesn't allow us to distinguish between keys
+                // that contain periods and nested objects, so by convention a
+                // map is only ever of primitive type in flatmap, and we just assume
+                // that the remainder of the raw key (dots and all) is the key we
+                // want in the result value.
+
+                val, err := hcl2ValueFromFlatmapValue(m, key, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals = append(vals, val)
+        }
+
+        if len(vals) == 0 && strCount == "1" {
+                // An empty set wouldn't be represented in the flatmap, so this must be
+                // a single empty object since the count is actually 1.
+                // Add an appropriately typed null value to the set.
+                var val cty.Value
+                switch {
+                case ety.IsMapType():
+                        val = cty.MapValEmpty(ety)
+                case ety.IsListType():
+                        val = cty.ListValEmpty(ety)
+                case ety.IsSetType():
+                        val = cty.SetValEmpty(ety)
+                case ety.IsObjectType():
+                        // TODO: cty.ObjectValEmpty
+                        objectMap := map[string]cty.Value{}
+                        for attr, ty := range ety.AttributeTypes() {
+                                objectMap[attr] = cty.NullVal(ty)
+                        }
+                        val = cty.ObjectVal(objectMap)
+                default:
+                        val = cty.NullVal(ety)
+                }
+                vals = append(vals, val)
+
+        } else if len(vals) == 0 {
+                return cty.SetValEmpty(ety), nil
+        }
+
+        return cty.SetVal(vals), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/paths.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/paths.go
new file mode 100644
index 0000000..3403c02
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/paths.go
@@ -0,0 +1,276 @@
+package hcl2shim
+
+import (
+        "fmt"
+        "reflect"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// RequiresReplace takes a list of flatmapped paths from a
+// InstanceDiff.Attributes along with the corresponding cty.Type, and returns
+// the list of the cty.Paths that are flagged as causing the resource
+// replacement (RequiresNew).
+// This will filter out redundant paths, paths that refer to flatmapped indexes
+// (e.g. "#", "%"), and will return any changes within a set as the path to the
+// set itself.
+func RequiresReplace(attrs []string, ty cty.Type) ([]cty.Path, error) {
+        var paths []cty.Path
+
+        for _, attr := range attrs {
+                p, err := requiresReplacePath(attr, ty)
+                if err != nil {
+                        return nil, err
+                }
+
+                paths = append(paths, p)
+        }
+
+        // now trim off any trailing paths that aren't GetAttrSteps, since only an
+        // attribute itself can require replacement
+        paths = trimPaths(paths)
+
+        // There may be redundant paths due to set elements or index attributes
+        // Do some ugly n^2 filtering, but these are always fairly small sets.
+        for i := 0; i < len(paths)-1; i++ {
+                for j := i + 1; j < len(paths); j++ {
+                        if reflect.DeepEqual(paths[i], paths[j]) {
+                                // swap the tail and slice it off
+                                paths[j], paths[len(paths)-1] = paths[len(paths)-1], paths[j]
+                                paths = paths[:len(paths)-1]
+                                j--
+                        }
+                }
+        }
+
+        return paths, nil
+}
+
+// trimPaths removes any trailing steps that aren't of type GetAttrSet, since
+// only an attribute itself can require replacement
+func trimPaths(paths []cty.Path) []cty.Path {
+        var trimmed []cty.Path
+        for _, path := range paths {
+                path = trimPath(path)
+                if len(path) > 0 {
+                        trimmed = append(trimmed, path)
+                }
+        }
+        return trimmed
+}
+
+func trimPath(path cty.Path) cty.Path {
+        for len(path) > 0 {
+                _, isGetAttr := path[len(path)-1].(cty.GetAttrStep)
+                if isGetAttr {
+                        break
+                }
+                path = path[:len(path)-1]
+        }
+        return path
+}
+
+// requiresReplacePath takes a key from a flatmap along with the cty.Type
+// describing the structure, and returns the cty.Path that would be used to
+// reference the nested value in the data structure.
+// This is used specifically to record the RequiresReplace attributes from a
+// ResourceInstanceDiff.
+func requiresReplacePath(k string, ty cty.Type) (cty.Path, error) {
+        if k == "" {
+                return nil, nil
+        }
+        if !ty.IsObjectType() {
+                panic(fmt.Sprintf("requires replace path on non-object type: %#v", ty))
+        }
+
+        path, err := pathFromFlatmapKeyObject(k, ty.AttributeTypes())
+        if err != nil {
+                return path, fmt.Errorf("[%s] %s", k, err)
+        }
+        return path, nil
+}
+
+func pathSplit(p string) (string, string) {
+        parts := strings.SplitN(p, ".", 2)
+        head := parts[0]
+        rest := ""
+        if len(parts) > 1 {
+                rest = parts[1]
+        }
+        return head, rest
+}
+
+func pathFromFlatmapKeyObject(key string, atys map[string]cty.Type) (cty.Path, error) {
+        k, rest := pathSplit(key)
+
+        path := cty.Path{cty.GetAttrStep{Name: k}}
+
+        ty, ok := atys[k]
+        if !ok {
+                return path, fmt.Errorf("attribute %q not found", k)
+        }
+
+        if rest == "" {
+                return path, nil
+        }
+
+        p, err := pathFromFlatmapKeyValue(rest, ty)
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeyValue(key string, ty cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        switch {
+        case ty.IsPrimitiveType():
+                err = fmt.Errorf("invalid step %q with type %#v", key, ty)
+        case ty.IsObjectType():
+                path, err = pathFromFlatmapKeyObject(key, ty.AttributeTypes())
+        case ty.IsTupleType():
+                path, err = pathFromFlatmapKeyTuple(key, ty.TupleElementTypes())
+        case ty.IsMapType():
+                path, err = pathFromFlatmapKeyMap(key, ty)
+        case ty.IsListType():
+                path, err = pathFromFlatmapKeyList(key, ty)
+        case ty.IsSetType():
+                path, err = pathFromFlatmapKeySet(key, ty)
+        default:
+                err = fmt.Errorf("unrecognized type: %s", ty.FriendlyName())
+        }
+
+        if err != nil {
+                return path, err
+        }
+
+        return path, nil
+}
+
+func pathFromFlatmapKeyTuple(key string, etys []cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        k, rest := pathSplit(key)
+
+        // we don't need to convert the index keys to paths
+        if k == "#" {
+                return path, nil
+        }
+
+        idx, err := strconv.Atoi(k)
+        if err != nil {
+                return path, err
+        }
+
+        path = cty.Path{cty.IndexStep{Key: cty.NumberIntVal(int64(idx))}}
+
+        if idx >= len(etys) {
+                return path, fmt.Errorf("index %s out of range in %#v", key, etys)
+        }
+
+        if rest == "" {
+                return path, nil
+        }
+
+        ty := etys[idx]
+
+        p, err := pathFromFlatmapKeyValue(rest, ty.ElementType())
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeyMap(key string, ty cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        k, rest := key, ""
+        if !ty.ElementType().IsPrimitiveType() {
+                k, rest = pathSplit(key)
+        }
+
+        // we don't need to convert the index keys to paths
+        if k == "%" {
+                return path, nil
+        }
+
+        path = cty.Path{cty.IndexStep{Key: cty.StringVal(k)}}
+
+        if rest == "" {
+                return path, nil
+        }
+
+        p, err := pathFromFlatmapKeyValue(rest, ty.ElementType())
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeyList(key string, ty cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        k, rest := pathSplit(key)
+
+        // we don't need to convert the index keys to paths
+        if key == "#" {
+                return path, nil
+        }
+
+        idx, err := strconv.Atoi(k)
+        if err != nil {
+                return path, err
+        }
+
+        path = cty.Path{cty.IndexStep{Key: cty.NumberIntVal(int64(idx))}}
+
+        if rest == "" {
+                return path, nil
+        }
+
+        p, err := pathFromFlatmapKeyValue(rest, ty.ElementType())
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeySet(key string, ty cty.Type) (cty.Path, error) {
+        // once we hit a set, we can't return consistent paths, so just mark the
+        // set as a whole changed.
+        return nil, nil
+}
+
+// FlatmapKeyFromPath returns the flatmap equivalent of the given cty.Path for
+// use in generating legacy style diffs.
+func FlatmapKeyFromPath(path cty.Path) string {
+        var parts []string
+
+        for _, step := range path {
+                switch step := step.(type) {
+                case cty.GetAttrStep:
+                        parts = append(parts, step.Name)
+                case cty.IndexStep:
+                        switch ty := step.Key.Type(); {
+                        case ty == cty.String:
+                                parts = append(parts, step.Key.AsString())
+                        case ty == cty.Number:
+                                i, _ := step.Key.AsBigFloat().Int64()
+                                parts = append(parts, strconv.Itoa(int(i)))
+                        }
+                }
+        }
+
+        return strings.Join(parts, ".")
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
index 0b697a5..daeb0b8 100644
--- a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
@@ -6,6 +6,8 @@ import (
 
         "github.com/hashicorp/hil/ast"
         "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
 )
 
 // UnknownVariableValue is a sentinel value that can be used
@@ -14,6 +16,108 @@ import (
 // unknown keys.
 const UnknownVariableValue = "74D93920-ED26-11E3-AC10-0800200C9A66"
 
+// ConfigValueFromHCL2Block is like ConfigValueFromHCL2 but it works only for
+// known object values and uses the provided block schema to perform some
+// additional normalization to better mimic the shape of value that the old
+// HCL1/HIL-based codepaths would've produced.
+//
+// In particular, it discards the collections that we use to represent nested
+// blocks (other than NestingSingle) if they are empty, which better mimics
+// the HCL1 behavior because HCL1 had no knowledge of the schema and so didn't
+// know that an unspecified block _could_ exist.
+//
+// The given object value must conform to the schema's implied type or this
+// function will panic or produce incorrect results.
+//
+// This is primarily useful for the final transition from new-style values to
+// terraform.ResourceConfig before calling to a legacy provider, since
+// helper/schema (the old provider SDK) is particularly sensitive to these
+// subtle differences within its validation code.
+func ConfigValueFromHCL2Block(v cty.Value, schema *configschema.Block) map[string]interface{} {
+        if v.IsNull() {
+                return nil
+        }
+        if !v.IsKnown() {
+                panic("ConfigValueFromHCL2Block used with unknown value")
+        }
+        if !v.Type().IsObjectType() {
+                panic(fmt.Sprintf("ConfigValueFromHCL2Block used with non-object value %#v", v))
+        }
+
+        atys := v.Type().AttributeTypes()
+        ret := make(map[string]interface{})
+
+        for name := range schema.Attributes {
+                if _, exists := atys[name]; !exists {
+                        continue
+                }
+
+                av := v.GetAttr(name)
+                if av.IsNull() {
+                        // Skip nulls altogether, to better mimic how HCL1 would behave
+                        continue
+                }
+                ret[name] = ConfigValueFromHCL2(av)
+        }
+
+        for name, blockS := range schema.BlockTypes {
+                if _, exists := atys[name]; !exists {
+                        continue
+                }
+                bv := v.GetAttr(name)
+                if !bv.IsKnown() {
+                        ret[name] = UnknownVariableValue
+                        continue
+                }
+                if bv.IsNull() {
+                        continue
+                }
+
+                switch blockS.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        ret[name] = ConfigValueFromHCL2Block(bv, &blockS.Block)
+
+                case configschema.NestingList, configschema.NestingSet:
+                        l := bv.LengthInt()
+                        if l == 0 {
+                                // skip empty collections to better mimic how HCL1 would behave
+                                continue
+                        }
+
+                        elems := make([]interface{}, 0, l)
+                        for it := bv.ElementIterator(); it.Next(); {
+                                _, ev := it.Element()
+                                if !ev.IsKnown() {
+                                        elems = append(elems, UnknownVariableValue)
+                                        continue
+                                }
+                                elems = append(elems, ConfigValueFromHCL2Block(ev, &blockS.Block))
+                        }
+                        ret[name] = elems
+
+                case configschema.NestingMap:
+                        if bv.LengthInt() == 0 {
+                                // skip empty collections to better mimic how HCL1 would behave
+                                continue
+                        }
+
+                        elems := make(map[string]interface{})
+                        for it := bv.ElementIterator(); it.Next(); {
+                                ek, ev := it.Element()
+                                if !ev.IsKnown() {
+                                        elems[ek.AsString()] = UnknownVariableValue
+                                        continue
+                                }
+                                elems[ek.AsString()] = ConfigValueFromHCL2Block(ev, &blockS.Block)
+                        }
+                        ret[name] = elems
+                }
+        }
+
+        return ret
+}
+
 // ConfigValueFromHCL2 converts a value from HCL2 (really, from the cty dynamic
 // types library that HCL2 uses) to a value type that matches what would've
 // been produced from the HCL-based interpolator for an equivalent structure.
@@ -73,7 +177,10 @@ func ConfigValueFromHCL2(v cty.Value) interface{} {
                 it := v.ElementIterator()
                 for it.Next() {
                         ek, ev := it.Element()
-                        l[ek.AsString()] = ConfigValueFromHCL2(ev)
+                        cv := ConfigValueFromHCL2(ev)
+                        if cv != nil {
+                                l[ek.AsString()] = cv
+                        }
                 }
                 return l
         }
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values_equiv.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values_equiv.go
new file mode 100644
index 0000000..92f0213
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values_equiv.go
@@ -0,0 +1,214 @@
+package hcl2shim
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ValuesSDKEquivalent returns true if both of the given values seem equivalent
+// as far as the legacy SDK diffing code would be concerned.
+//
+// Since SDK diffing is a fuzzy, inexact operation, this function is also
+// fuzzy and inexact. It will err on the side of returning false if it
+// encounters an ambiguous situation. Ambiguity is most common in the presence
+// of sets because in practice it is impossible to exactly correlate
+// nonequal-but-equivalent set elements because they have no identity separate
+// from their value.
+//
+// This must be used _only_ for comparing values for equivalence within the
+// SDK planning code. It is only meaningful to compare the "prior state"
+// provided by Terraform Core with the "planned new state" produced by the
+// legacy SDK code via shims. In particular it is not valid to use this
+// function with their the config value or the "proposed new state" value
+// because they contain only the subset of data that Terraform Core itself is
+// able to determine.
+func ValuesSDKEquivalent(a, b cty.Value) bool {
+        if a == cty.NilVal || b == cty.NilVal {
+                // We don't generally expect nils to appear, but we'll allow them
+                // for robustness since the data structures produced by legacy SDK code
+                // can sometimes be non-ideal.
+                return a == b // equivalent if they are _both_ nil
+        }
+        if a.RawEquals(b) {
+                // Easy case. We use RawEquals because we want two unknowns to be
+                // considered equal here, whereas "Equals" would return unknown.
+                return true
+        }
+        if !a.IsKnown() || !b.IsKnown() {
+                // Two unknown values are equivalent regardless of type. A known is
+                // never equivalent to an unknown.
+                return a.IsKnown() == b.IsKnown()
+        }
+        if aZero, bZero := valuesSDKEquivalentIsNullOrZero(a), valuesSDKEquivalentIsNullOrZero(b); aZero || bZero {
+                // Two null/zero values are equivalent regardless of type. A non-zero is
+                // never equivalent to a zero.
+                return aZero == bZero
+        }
+
+        // If we get down here then we are guaranteed that both a and b are known,
+        // non-null values.
+
+        aTy := a.Type()
+        bTy := b.Type()
+        switch {
+        case aTy.IsSetType() && bTy.IsSetType():
+                return valuesSDKEquivalentSets(a, b)
+        case aTy.IsListType() && bTy.IsListType():
+                return valuesSDKEquivalentSequences(a, b)
+        case aTy.IsTupleType() && bTy.IsTupleType():
+                return valuesSDKEquivalentSequences(a, b)
+        case aTy.IsMapType() && bTy.IsMapType():
+                return valuesSDKEquivalentMappings(a, b)
+        case aTy.IsObjectType() && bTy.IsObjectType():
+                return valuesSDKEquivalentMappings(a, b)
+        case aTy == cty.Number && bTy == cty.Number:
+                return valuesSDKEquivalentNumbers(a, b)
+        default:
+                // We've now covered all the interesting cases, so anything that falls
+                // down here cannot be equivalent.
+                return false
+        }
+}
+
+// valuesSDKEquivalentIsNullOrZero returns true if the given value is either
+// null or is the "zero value" (in the SDK/Go sense) for its type.
+func valuesSDKEquivalentIsNullOrZero(v cty.Value) bool {
+        if v == cty.NilVal {
+                return true
+        }
+
+        ty := v.Type()
+        switch {
+        case !v.IsKnown():
+                return false
+        case v.IsNull():
+                return true
+
+        // After this point, v is always known and non-null
+        case ty.IsListType() || ty.IsSetType() || ty.IsMapType() || ty.IsObjectType() || ty.IsTupleType():
+                return v.LengthInt() == 0
+        case ty == cty.String:
+                return v.RawEquals(cty.StringVal(""))
+        case ty == cty.Number:
+                return v.RawEquals(cty.Zero)
+        case ty == cty.Bool:
+                return v.RawEquals(cty.False)
+        default:
+                // The above is exhaustive, but for robustness we'll consider anything
+                // else to _not_ be zero unless it is null.
+                return false
+        }
+}
+
+// valuesSDKEquivalentSets returns true only if each of the elements in a can
+// be correlated with at least one equivalent element in b and vice-versa.
+// This is a fuzzy operation that prefers to signal non-equivalence if it cannot
+// be certain that all elements are accounted for.
+func valuesSDKEquivalentSets(a, b cty.Value) bool {
+        if aLen, bLen := a.LengthInt(), b.LengthInt(); aLen != bLen {
+                return false
+        }
+
+        // Our methodology here is a little tricky, to deal with the fact that
+        // it's impossible to directly correlate two non-equal set elements because
+        // they don't have identities separate from their values.
+        // The approach is to count the number of equivalent elements each element
+        // of a has in b and vice-versa, and then return true only if each element
+        // in both sets has at least one equivalent.
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        aeqs := make([]bool, len(as))
+        beqs := make([]bool, len(bs))
+        for ai, av := range as {
+                for bi, bv := range bs {
+                        if ValuesSDKEquivalent(av, bv) {
+                                aeqs[ai] = true
+                                beqs[bi] = true
+                        }
+                }
+        }
+
+        for _, eq := range aeqs {
+                if !eq {
+                        return false
+                }
+        }
+        for _, eq := range beqs {
+                if !eq {
+                        return false
+                }
+        }
+        return true
+}
+
+// valuesSDKEquivalentSequences decides equivalence for two sequence values
+// (lists or tuples).
+func valuesSDKEquivalentSequences(a, b cty.Value) bool {
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        if len(as) != len(bs) {
+                return false
+        }
+
+        for i := range as {
+                if !ValuesSDKEquivalent(as[i], bs[i]) {
+                        return false
+                }
+        }
+        return true
+}
+
+// valuesSDKEquivalentMappings decides equivalence for two mapping values
+// (maps or objects).
+func valuesSDKEquivalentMappings(a, b cty.Value) bool {
+        as := a.AsValueMap()
+        bs := b.AsValueMap()
+        if len(as) != len(bs) {
+                return false
+        }
+
+        for k, av := range as {
+                bv, ok := bs[k]
+                if !ok {
+                        return false
+                }
+                if !ValuesSDKEquivalent(av, bv) {
+                        return false
+                }
+        }
+        return true
+}
+
+// valuesSDKEquivalentNumbers decides equivalence for two number values based
+// on the fact that the SDK uses int and float64 representations while
+// cty (and thus Terraform Core) uses big.Float, and so we expect to lose
+// precision in the round-trip.
+//
+// This does _not_ attempt to allow for an epsilon difference that may be
+// caused by accumulated innacuracy in a float calculation, under the
+// expectation that providers generally do not actually do compuations on
+// floats and instead just pass string representations of them on verbatim
+// to remote APIs. A remote API _itself_ may introduce inaccuracy, but that's
+// a problem for the provider itself to deal with, based on its knowledge of
+// the remote system, e.g. using DiffSuppressFunc.
+func valuesSDKEquivalentNumbers(a, b cty.Value) bool {
+        if a.RawEquals(b) {
+                return true // easy
+        }
+
+        af := a.AsBigFloat()
+        bf := b.AsBigFloat()
+
+        if af.IsInt() != bf.IsInt() {
+                return false
+        }
+        if af.IsInt() && bf.IsInt() {
+                return false // a.RawEquals(b) test above is good enough for integers
+        }
+
+        // The SDK supports only int and float64, so if it's not an integer
+        // we know that only a float64-level of precision can possibly be
+        // significant.
+        af64, _ := af.Float64()
+        bf64, _ := bf.Float64()
+        return af64 == bf64
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
index 421edb0..6a2050c 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
@@ -47,6 +47,20 @@ func stringSliceToVariableValue(values []string) []ast.Variable {
         return output
 }
 
+// listVariableSliceToVariableValue converts a list of lists into the value
+// required to be returned from interpolation functions which return TypeList.
+func listVariableSliceToVariableValue(values [][]ast.Variable) []ast.Variable {
+        output := make([]ast.Variable, len(values))
+
+        for index, value := range values {
+                output[index] = ast.Variable{
+                        Type:  ast.TypeList,
+                        Value: value,
+                }
+        }
+        return output
+}
+
 func listVariableValueToStringSlice(values []ast.Variable) ([]string, error) {
         output := make([]string, len(values))
         for index, value := range values {
@@ -61,74 +75,69 @@ func listVariableValueToStringSlice(values []ast.Variable) ([]string, error) {
 // Funcs is the mapping of built-in functions for configuration.
 func Funcs() map[string]ast.Function {
         return map[string]ast.Function{
-                "abs":              interpolationFuncAbs(),
-                "basename":         interpolationFuncBasename(),
-                "base64decode":     interpolationFuncBase64Decode(),
-                "base64encode":     interpolationFuncBase64Encode(),
-                "base64gzip":       interpolationFuncBase64Gzip(),
-                "base64sha256":     interpolationFuncBase64Sha256(),
-                "base64sha512":     interpolationFuncBase64Sha512(),
-                "bcrypt":           interpolationFuncBcrypt(),
-                "ceil":             interpolationFuncCeil(),
-                "chomp":            interpolationFuncChomp(),
-                "cidrhost":         interpolationFuncCidrHost(),
-                "cidrnetmask":      interpolationFuncCidrNetmask(),
-                "cidrsubnet":       interpolationFuncCidrSubnet(),
-                "coalesce":         interpolationFuncCoalesce(),
-                "coalescelist":     interpolationFuncCoalesceList(),
-                "compact":          interpolationFuncCompact(),
-                "concat":           interpolationFuncConcat(),
-                "contains":         interpolationFuncContains(),
-                "dirname":          interpolationFuncDirname(),
-                "distinct":         interpolationFuncDistinct(),
-                "element":          interpolationFuncElement(),
-                "chunklist":        interpolationFuncChunklist(),
-                "file":             interpolationFuncFile(),
-                "filebase64sha256": interpolationFuncMakeFileHash(interpolationFuncBase64Sha256()),
-                "filebase64sha512": interpolationFuncMakeFileHash(interpolationFuncBase64Sha512()),
-                "filemd5":          interpolationFuncMakeFileHash(interpolationFuncMd5()),
-                "filesha1":         interpolationFuncMakeFileHash(interpolationFuncSha1()),
-                "filesha256":       interpolationFuncMakeFileHash(interpolationFuncSha256()),
-                "filesha512":       interpolationFuncMakeFileHash(interpolationFuncSha512()),
-                "matchkeys":        interpolationFuncMatchKeys(),
-                "flatten":          interpolationFuncFlatten(),
-                "floor":            interpolationFuncFloor(),
-                "format":           interpolationFuncFormat(),
-                "formatlist":       interpolationFuncFormatList(),
-                "indent":           interpolationFuncIndent(),
-                "index":            interpolationFuncIndex(),
-                "join":             interpolationFuncJoin(),
-                "jsonencode":       interpolationFuncJSONEncode(),
-                "length":           interpolationFuncLength(),
-                "list":             interpolationFuncList(),
-                "log":              interpolationFuncLog(),
-                "lower":            interpolationFuncLower(),
-                "map":              interpolationFuncMap(),
-                "max":              interpolationFuncMax(),
-                "md5":              interpolationFuncMd5(),
-                "merge":            interpolationFuncMerge(),
-                "min":              interpolationFuncMin(),
-                "pathexpand":       interpolationFuncPathExpand(),
-                "pow":              interpolationFuncPow(),
-                "uuid":             interpolationFuncUUID(),
-                "replace":          interpolationFuncReplace(),
-                "rsadecrypt":       interpolationFuncRsaDecrypt(),
-                "sha1":             interpolationFuncSha1(),
-                "sha256":           interpolationFuncSha256(),
-                "sha512":           interpolationFuncSha512(),
-                "signum":           interpolationFuncSignum(),
-                "slice":            interpolationFuncSlice(),
-                "sort":             interpolationFuncSort(),
-                "split":            interpolationFuncSplit(),
-                "substr":           interpolationFuncSubstr(),
-                "timestamp":        interpolationFuncTimestamp(),
-                "timeadd":          interpolationFuncTimeAdd(),
-                "title":            interpolationFuncTitle(),
-                "transpose":        interpolationFuncTranspose(),
-                "trimspace":        interpolationFuncTrimSpace(),
-                "upper":            interpolationFuncUpper(),
-                "urlencode":        interpolationFuncURLEncode(),
-                "zipmap":           interpolationFuncZipMap(),
+                "abs":          interpolationFuncAbs(),
+                "basename":     interpolationFuncBasename(),
+                "base64decode": interpolationFuncBase64Decode(),
+                "base64encode": interpolationFuncBase64Encode(),
+                "base64gzip":   interpolationFuncBase64Gzip(),
+                "base64sha256": interpolationFuncBase64Sha256(),
+                "base64sha512": interpolationFuncBase64Sha512(),
+                "bcrypt":       interpolationFuncBcrypt(),
+                "ceil":         interpolationFuncCeil(),
+                "chomp":        interpolationFuncChomp(),
+                "cidrhost":     interpolationFuncCidrHost(),
+                "cidrnetmask":  interpolationFuncCidrNetmask(),
+                "cidrsubnet":   interpolationFuncCidrSubnet(),
+                "coalesce":     interpolationFuncCoalesce(),
+                "coalescelist": interpolationFuncCoalesceList(),
+                "compact":      interpolationFuncCompact(),
+                "concat":       interpolationFuncConcat(),
+                "contains":     interpolationFuncContains(),
+                "dirname":      interpolationFuncDirname(),
+                "distinct":     interpolationFuncDistinct(),
+                "element":      interpolationFuncElement(),
+                "chunklist":    interpolationFuncChunklist(),
+                "file":         interpolationFuncFile(),
+                "matchkeys":    interpolationFuncMatchKeys(),
+                "flatten":      interpolationFuncFlatten(),
+                "floor":        interpolationFuncFloor(),
+                "format":       interpolationFuncFormat(),
+                "formatlist":   interpolationFuncFormatList(),
+                "indent":       interpolationFuncIndent(),
+                "index":        interpolationFuncIndex(),
+                "join":         interpolationFuncJoin(),
+                "jsonencode":   interpolationFuncJSONEncode(),
+                "length":       interpolationFuncLength(),
+                "list":         interpolationFuncList(),
+                "log":          interpolationFuncLog(),
+                "lower":        interpolationFuncLower(),
+                "map":          interpolationFuncMap(),
+                "max":          interpolationFuncMax(),
+                "md5":          interpolationFuncMd5(),
+                "merge":        interpolationFuncMerge(),
+                "min":          interpolationFuncMin(),
+                "pathexpand":   interpolationFuncPathExpand(),
+                "pow":          interpolationFuncPow(),
+                "uuid":         interpolationFuncUUID(),
+                "replace":      interpolationFuncReplace(),
+                "reverse":      interpolationFuncReverse(),
+                "rsadecrypt":   interpolationFuncRsaDecrypt(),
+                "sha1":         interpolationFuncSha1(),
+                "sha256":       interpolationFuncSha256(),
+                "sha512":       interpolationFuncSha512(),
+                "signum":       interpolationFuncSignum(),
+                "slice":        interpolationFuncSlice(),
+                "sort":         interpolationFuncSort(),
+                "split":        interpolationFuncSplit(),
+                "substr":       interpolationFuncSubstr(),
+                "timestamp":    interpolationFuncTimestamp(),
+                "timeadd":      interpolationFuncTimeAdd(),
+                "title":        interpolationFuncTitle(),
+                "transpose":    interpolationFuncTranspose(),
+                "trimspace":    interpolationFuncTrimSpace(),
+                "upper":        interpolationFuncUpper(),
+                "urlencode":    interpolationFuncURLEncode(),
+                "zipmap":       interpolationFuncZipMap(),
         }
 }
 
@@ -947,6 +956,25 @@ func interpolationFuncReplace() ast.Function {
         }
 }
 
+// interpolationFuncReverse implements the "reverse" function that does list reversal
+func interpolationFuncReverse() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeList},
+                ReturnType: ast.TypeList,
+                Variadic:   false,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        inputList := args[0].([]ast.Variable)
+
+                        reversedList := make([]ast.Variable, len(inputList))
+                        for idx := range inputList {
+                                reversedList[len(inputList)-1-idx] = inputList[idx]
+                        }
+
+                        return reversedList, nil
+                },
+        }
+}
+
 func interpolationFuncLength() ast.Function {
         return ast.Function{
                 ArgTypes:   []ast.Type{ast.TypeAny},
@@ -1731,24 +1759,3 @@ func interpolationFuncRsaDecrypt() ast.Function {
                 },
         }
 }
-
-// interpolationFuncMakeFileHash constructs a function that hashes the contents
-// of a file by combining the implementations of the file(...) function and
-// a given other function that is assumed to take a single string argument and
-// return a hash value.
-func interpolationFuncMakeFileHash(hashFunc ast.Function) ast.Function {
-        fileFunc := interpolationFuncFile()
-
-        return ast.Function{
-                ArgTypes:   []ast.Type{ast.TypeString},
-                ReturnType: ast.TypeString,
-                Callback: func(args []interface{}) (interface{}, error) {
-                        filename := args[0].(string)
-                        contents, err := fileFunc.Callback([]interface{}{filename})
-                        if err != nil {
-                                return nil, err
-                        }
-                        return hashFunc.Callback([]interface{}{contents})
-                },
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/module/storage.go b/vendor/github.com/hashicorp/terraform/config/module/storage.go
index 58e3a10..7734cbc 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/storage.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/storage.go
@@ -7,7 +7,6 @@ import (
         "log"
         "os"
         "path/filepath"
-        "strings"
 
         getter "github.com/hashicorp/go-getter"
         "github.com/hashicorp/terraform/registry"
@@ -101,21 +100,6 @@ func (s Storage) loadManifest() (moduleManifest, error) {
         if err := json.Unmarshal(data, &manifest); err != nil {
                 return manifest, err
         }
-
-        for i, rec := range manifest.Modules {
-                // If the path was recorded before we changed to always using a
-                // slash as separator, we delete the record from the manifest so
-                // it can be discovered again and will be recorded using a slash.
-                if strings.Contains(rec.Dir, "\\") {
-                        manifest.Modules[i] = manifest.Modules[len(manifest.Modules)-1]
-                        manifest.Modules = manifest.Modules[:len(manifest.Modules)-1]
-                        continue
-                }
-
-                // Make sure we use the correct path separator.
-                rec.Dir = filepath.FromSlash(rec.Dir)
-        }
-
         return manifest, nil
 }
 
@@ -146,9 +130,6 @@ func (s Storage) recordModule(rec moduleRecord) error {
                 }
         }
 
-        // Make sure we always use a slash separator.
-        rec.Dir = filepath.ToSlash(rec.Dir)
-
         manifest.Modules = append(manifest.Modules, rec)
 
         js, err := json.Marshal(manifest)
@@ -331,7 +312,7 @@ func (s Storage) findRegistryModule(mSource, constraint string) (moduleRecord, e
         // we need to lookup available versions
         // Only on Get if it's not found, on unconditionally on Update
         if (s.Mode == GetModeGet && !found) || (s.Mode == GetModeUpdate) {
-                resp, err := s.registry.Versions(mod)
+                resp, err := s.registry.ModuleVersions(mod)
                 if err != nil {
                         return rec, err
                 }
@@ -351,7 +332,7 @@ func (s Storage) findRegistryModule(mSource, constraint string) (moduleRecord, e
 
                 rec.Version = match.Version
 
-                rec.url, err = s.registry.Location(mod, rec.Version)
+                rec.url, err = s.registry.ModuleLocation(mod, rec.Version)
                 if err != nil {
                         return rec, err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
index 8a55e06..0105278 100644
--- a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
+++ b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
@@ -4,6 +4,14 @@ package config
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ManagedResourceMode-0]
+        _ = x[DataResourceMode-1]
+}
+
 const _ResourceMode_name = "ManagedResourceModeDataResourceMode"
 
 var _ResourceMode_index = [...]uint8{0, 19, 35}
diff --git a/vendor/github.com/hashicorp/terraform/configs/backend.go b/vendor/github.com/hashicorp/terraform/configs/backend.go
new file mode 100644
index 0000000..6df7ddd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/backend.go
@@ -0,0 +1,55 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Backend represents a "backend" block inside a "terraform" block in a module
+// or file.
+type Backend struct {
+        Type   string
+        Config hcl.Body
+
+        TypeRange hcl.Range
+        DeclRange hcl.Range
+}
+
+func decodeBackendBlock(block *hcl.Block) (*Backend, hcl.Diagnostics) {
+        return &Backend{
+                Type:      block.Labels[0],
+                TypeRange: block.LabelRanges[0],
+                Config:    block.Body,
+                DeclRange: block.DefRange,
+        }, nil
+}
+
+// Hash produces a hash value for the reciever that covers the type and the
+// portions of the config that conform to the given schema.
+//
+// If the config does not conform to the schema then the result is not
+// meaningful for comparison since it will be based on an incomplete result.
+//
+// As an exception, required attributes in the schema are treated as optional
+// for the purpose of hashing, so that an incomplete configuration can still
+// be hashed. Other errors, such as extraneous attributes, have no such special
+// case.
+func (b *Backend) Hash(schema *configschema.Block) int {
+        // Don't fail if required attributes are not set. Instead, we'll just
+        // hash them as nulls.
+        schema = schema.NoneRequired()
+        spec := schema.DecoderSpec()
+        val, _ := hcldec.Decode(b.Config, spec, nil)
+        if val == cty.NilVal {
+                val = cty.UnknownVal(schema.ImpliedType())
+        }
+
+        toHash := cty.TupleVal([]cty.Value{
+                cty.StringVal(b.Type),
+                val,
+        })
+
+        return toHash.Hash()
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/compat_shim.go b/vendor/github.com/hashicorp/terraform/configs/compat_shim.go
new file mode 100644
index 0000000..66037fc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/compat_shim.go
@@ -0,0 +1,116 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// -------------------------------------------------------------------------
+// Functions in this file are compatibility shims intended to ease conversion
+// from the old configuration loader. Any use of these functions that makes
+// a change should generate a deprecation warning explaining to the user how
+// to update their code for new patterns.
+//
+// Shims are particularly important for any patterns that have been widely
+// documented in books, tutorials, etc. Users will still be starting from
+// these examples and we want to help them adopt the latest patterns rather
+// than leave them stranded.
+// -------------------------------------------------------------------------
+
+// shimTraversalInString takes any arbitrary expression and checks if it is
+// a quoted string in the native syntax. If it _is_, then it is parsed as a
+// traversal and re-wrapped into a synthetic traversal expression and a
+// warning is generated. Otherwise, the given expression is just returned
+// verbatim.
+//
+// This function has no effect on expressions from the JSON syntax, since
+// traversals in strings are the required pattern in that syntax.
+//
+// If wantKeyword is set, the generated warning diagnostic will talk about
+// keywords rather than references. The behavior is otherwise unchanged, and
+// the caller remains responsible for checking that the result is indeed
+// a keyword, e.g. using hcl.ExprAsKeyword.
+func shimTraversalInString(expr hcl.Expression, wantKeyword bool) (hcl.Expression, hcl.Diagnostics) {
+        // ObjectConsKeyExpr is a special wrapper type used for keys on object
+        // constructors to deal with the fact that naked identifiers are normally
+        // handled as "bareword" strings rather than as variable references. Since
+        // we know we're interpreting as a traversal anyway (and thus it won't
+        // matter whether it's a string or an identifier) we can safely just unwrap
+        // here and then process whatever we find inside as normal.
+        if ocke, ok := expr.(*hclsyntax.ObjectConsKeyExpr); ok {
+                expr = ocke.Wrapped
+        }
+
+        if !exprIsNativeQuotedString(expr) {
+                return expr, nil
+        }
+
+        strVal, diags := expr.Value(nil)
+        if diags.HasErrors() || strVal.IsNull() || !strVal.IsKnown() {
+                // Since we're not even able to attempt a shim here, we'll discard
+                // the diagnostics we saw so far and let the caller's own error
+                // handling take care of reporting the invalid expression.
+                return expr, nil
+        }
+
+        // The position handling here isn't _quite_ right because it won't
+        // take into account any escape sequences in the literal string, but
+        // it should be close enough for any error reporting to make sense.
+        srcRange := expr.Range()
+        startPos := srcRange.Start // copy
+        startPos.Column++          // skip initial quote
+        startPos.Byte++            // skip initial quote
+
+        traversal, tDiags := hclsyntax.ParseTraversalAbs(
+                []byte(strVal.AsString()),
+                srcRange.Filename,
+                startPos,
+        )
+        diags = append(diags, tDiags...)
+
+        // For initial release our deprecation warnings are disabled to allow
+        // a period where modules can be compatible with both old and new
+        // conventions.
+        // FIXME: Re-enable these deprecation warnings in a release prior to
+        // Terraform 0.13 and then remove the shims altogether for 0.13.
+        /*
+                if wantKeyword {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagWarning,
+                                Summary:  "Quoted keywords are deprecated",
+                                Detail:   "In this context, keywords are expected literally rather than in quotes. Previous versions of Terraform required quotes, but that usage is now deprecated. Remove the quotes surrounding this keyword to silence this warning.",
+                                Subject:  &srcRange,
+                        })
+                } else {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagWarning,
+                                Summary:  "Quoted references are deprecated",
+                                Detail:   "In this context, references are expected literally rather than in quotes. Previous versions of Terraform required quotes, but that usage is now deprecated. Remove the quotes surrounding this reference to silence this warning.",
+                                Subject:  &srcRange,
+                        })
+                }
+        */
+
+        return &hclsyntax.ScopeTraversalExpr{
+                Traversal: traversal,
+                SrcRange:  srcRange,
+        }, diags
+}
+
+// shimIsIgnoreChangesStar returns true if the given expression seems to be
+// a string literal whose value is "*". This is used to support a legacy
+// form of ignore_changes = all .
+//
+// This function does not itself emit any diagnostics, so it's the caller's
+// responsibility to emit a warning diagnostic when this function returns true.
+func shimIsIgnoreChangesStar(expr hcl.Expression) bool {
+        val, valDiags := expr.Value(nil)
+        if valDiags.HasErrors() {
+                return false
+        }
+        if val.Type() != cty.String || val.IsNull() || !val.IsKnown() {
+                return false
+        }
+        return val.AsString() == "*"
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/config.go b/vendor/github.com/hashicorp/terraform/configs/config.go
new file mode 100644
index 0000000..8294312
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/config.go
@@ -0,0 +1,205 @@
+package configs
+
+import (
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// A Config is a node in the tree of modules within a configuration.
+//
+// The module tree is constructed by following ModuleCall instances recursively
+// through the root module transitively into descendent modules.
+//
+// A module tree described in *this* package represents the static tree
+// represented by configuration. During evaluation a static ModuleNode may
+// expand into zero or more module instances depending on the use of count and
+// for_each configuration attributes within each call.
+type Config struct {
+        // RootModule points to the Config for the root module within the same
+        // module tree as this module. If this module _is_ the root module then
+        // this is self-referential.
+        Root *Config
+
+        // ParentModule points to the Config for the module that directly calls
+        // this module. If this is the root module then this field is nil.
+        Parent *Config
+
+        // Path is a sequence of module logical names that traverse from the root
+        // module to this config. Path is empty for the root module.
+        //
+        // This should only be used to display paths to the end-user in rare cases
+        // where we are talking about the static module tree, before module calls
+        // have been resolved. In most cases, an addrs.ModuleInstance describing
+        // a node in the dynamic module tree is better, since it will then include
+        // any keys resulting from evaluating "count" and "for_each" arguments.
+        Path addrs.Module
+
+        // ChildModules points to the Config for each of the direct child modules
+        // called from this module. The keys in this map match the keys in
+        // Module.ModuleCalls.
+        Children map[string]*Config
+
+        // Module points to the object describing the configuration for the
+        // various elements (variables, resources, etc) defined by this module.
+        Module *Module
+
+        // CallRange is the source range for the header of the module block that
+        // requested this module.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        CallRange hcl.Range
+
+        // SourceAddr is the source address that the referenced module was requested
+        // from, as specified in configuration.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        SourceAddr string
+
+        // SourceAddrRange is the location in the configuration source where the
+        // SourceAddr value was set, for use in diagnostic messages.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        SourceAddrRange hcl.Range
+
+        // Version is the specific version that was selected for this module,
+        // based on version constraints given in configuration.
+        //
+        // This field is nil if the module was loaded from a non-registry source,
+        // since versions are not supported for other sources.
+        //
+        // This field is meaningless for the root module, where it will always
+        // be nil.
+        Version *version.Version
+}
+
+// NewEmptyConfig constructs a single-node configuration tree with an empty
+// root module. This is generally a pretty useless thing to do, so most callers
+// should instead use BuildConfig.
+func NewEmptyConfig() *Config {
+        ret := &Config{}
+        ret.Root = ret
+        ret.Children = make(map[string]*Config)
+        ret.Module = &Module{}
+        return ret
+}
+
+// Depth returns the number of "hops" the receiver is from the root of its
+// module tree, with the root module having a depth of zero.
+func (c *Config) Depth() int {
+        ret := 0
+        this := c
+        for this.Parent != nil {
+                ret++
+                this = this.Parent
+        }
+        return ret
+}
+
+// DeepEach calls the given function once for each module in the tree, starting
+// with the receiver.
+//
+// A parent is always called before its children and children of a particular
+// node are visited in lexicographic order by their names.
+func (c *Config) DeepEach(cb func(c *Config)) {
+        cb(c)
+
+        names := make([]string, 0, len(c.Children))
+        for name := range c.Children {
+                names = append(names, name)
+        }
+
+        for _, name := range names {
+                c.Children[name].DeepEach(cb)
+        }
+}
+
+// AllModules returns a slice of all the receiver and all of its descendent
+// nodes in the module tree, in the same order they would be visited by
+// DeepEach.
+func (c *Config) AllModules() []*Config {
+        var ret []*Config
+        c.DeepEach(func(c *Config) {
+                ret = append(ret, c)
+        })
+        return ret
+}
+
+// Descendent returns the descendent config that has the given path beneath
+// the receiver, or nil if there is no such module.
+//
+// The path traverses the static module tree, prior to any expansion to handle
+// count and for_each arguments.
+//
+// An empty path will just return the receiver, and is therefore pointless.
+func (c *Config) Descendent(path addrs.Module) *Config {
+        current := c
+        for _, name := range path {
+                current = current.Children[name]
+                if current == nil {
+                        return nil
+                }
+        }
+        return current
+}
+
+// DescendentForInstance is like Descendent except that it accepts a path
+// to a particular module instance in the dynamic module graph, returning
+// the node from the static module graph that corresponds to it.
+//
+// All instances created by a particular module call share the same
+// configuration, so the keys within the given path are disregarded.
+func (c *Config) DescendentForInstance(path addrs.ModuleInstance) *Config {
+        current := c
+        for _, step := range path {
+                current = current.Children[step.Name]
+                if current == nil {
+                        return nil
+                }
+        }
+        return current
+}
+
+// ProviderTypes returns the names of each distinct provider type referenced
+// in the receiving configuration.
+//
+// This is a helper for easily determining which provider types are required
+// to fully interpret the configuration, though it does not include version
+// information and so callers are expected to have already dealt with
+// provider version selection in an earlier step and have identified suitable
+// versions for each provider.
+func (c *Config) ProviderTypes() []string {
+        m := make(map[string]struct{})
+        c.gatherProviderTypes(m)
+
+        ret := make([]string, 0, len(m))
+        for k := range m {
+                ret = append(ret, k)
+        }
+        sort.Strings(ret)
+        return ret
+}
+func (c *Config) gatherProviderTypes(m map[string]struct{}) {
+        if c == nil {
+                return
+        }
+
+        for _, pc := range c.Module.ProviderConfigs {
+                m[pc.Name] = struct{}{}
+        }
+        for _, rc := range c.Module.ManagedResources {
+                providerAddr := rc.ProviderConfigAddr()
+                m[providerAddr.Type] = struct{}{}
+        }
+        for _, rc := range c.Module.DataResources {
+                providerAddr := rc.ProviderConfigAddr()
+                m[providerAddr.Type] = struct{}{}
+        }
+
+        // Must also visit our child modules, recursively.
+        for _, cc := range c.Children {
+                cc.gatherProviderTypes(m)
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/config_build.go b/vendor/github.com/hashicorp/terraform/configs/config_build.go
new file mode 100644
index 0000000..948b2c8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/config_build.go
@@ -0,0 +1,179 @@
+package configs
+
+import (
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// BuildConfig constructs a Config from a root module by loading all of its
+// descendent modules via the given ModuleWalker.
+//
+// The result is a module tree that has so far only had basic module- and
+// file-level invariants validated. If the returned diagnostics contains errors,
+// the returned module tree may be incomplete but can still be used carefully
+// for static analysis.
+func BuildConfig(root *Module, walker ModuleWalker) (*Config, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        cfg := &Config{
+                Module: root,
+        }
+        cfg.Root = cfg // Root module is self-referential.
+        cfg.Children, diags = buildChildModules(cfg, walker)
+        return cfg, diags
+}
+
+func buildChildModules(parent *Config, walker ModuleWalker) (map[string]*Config, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        ret := map[string]*Config{}
+
+        calls := parent.Module.ModuleCalls
+
+        // We'll sort the calls by their local names so that they'll appear in a
+        // predictable order in any logging that's produced during the walk.
+        callNames := make([]string, 0, len(calls))
+        for k := range calls {
+                callNames = append(callNames, k)
+        }
+        sort.Strings(callNames)
+
+        for _, callName := range callNames {
+                call := calls[callName]
+                path := make([]string, len(parent.Path)+1)
+                copy(path, parent.Path)
+                path[len(path)-1] = call.Name
+
+                req := ModuleRequest{
+                        Name:              call.Name,
+                        Path:              path,
+                        SourceAddr:        call.SourceAddr,
+                        SourceAddrRange:   call.SourceAddrRange,
+                        VersionConstraint: call.Version,
+                        Parent:            parent,
+                        CallRange:         call.DeclRange,
+                }
+
+                mod, ver, modDiags := walker.LoadModule(&req)
+                diags = append(diags, modDiags...)
+                if mod == nil {
+                        // nil can be returned if the source address was invalid and so
+                        // nothing could be loaded whatsoever. LoadModule should've
+                        // returned at least one error diagnostic in that case.
+                        continue
+                }
+
+                child := &Config{
+                        Parent:          parent,
+                        Root:            parent.Root,
+                        Path:            path,
+                        Module:          mod,
+                        CallRange:       call.DeclRange,
+                        SourceAddr:      call.SourceAddr,
+                        SourceAddrRange: call.SourceAddrRange,
+                        Version:         ver,
+                }
+
+                child.Children, modDiags = buildChildModules(child, walker)
+
+                ret[call.Name] = child
+        }
+
+        return ret, diags
+}
+
+// A ModuleWalker knows how to find and load a child module given details about
+// the module to be loaded and a reference to its partially-loaded parent
+// Config.
+type ModuleWalker interface {
+        // LoadModule finds and loads a requested child module.
+        //
+        // If errors are detected during loading, implementations should return them
+        // in the diagnostics object. If the diagnostics object contains any errors
+        // then the caller will tolerate the returned module being nil or incomplete.
+        // If no errors are returned, it should be non-nil and complete.
+        //
+        // Full validation need not have been performed but an implementation should
+        // ensure that the basic file- and module-validations performed by the
+        // LoadConfigDir function (valid syntax, no namespace collisions, etc) have
+        // been performed before returning a module.
+        LoadModule(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics)
+}
+
+// ModuleWalkerFunc is an implementation of ModuleWalker that directly wraps
+// a callback function, for more convenient use of that interface.
+type ModuleWalkerFunc func(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics)
+
+// LoadModule implements ModuleWalker.
+func (f ModuleWalkerFunc) LoadModule(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics) {
+        return f(req)
+}
+
+// ModuleRequest is used with the ModuleWalker interface to describe a child
+// module that must be loaded.
+type ModuleRequest struct {
+        // Name is the "logical name" of the module call within configuration.
+        // This is provided in case the name is used as part of a storage key
+        // for the module, but implementations must otherwise treat it as an
+        // opaque string. It is guaranteed to have already been validated as an
+        // HCL identifier and UTF-8 encoded.
+        Name string
+
+        // Path is a list of logical names that traverse from the root module to
+        // this module. This can be used, for example, to form a lookup key for
+        // each distinct module call in a configuration, allowing for multiple
+        // calls with the same name at different points in the tree.
+        Path addrs.Module
+
+        // SourceAddr is the source address string provided by the user in
+        // configuration.
+        SourceAddr string
+
+        // SourceAddrRange is the source range for the SourceAddr value as it
+        // was provided in configuration. This can and should be used to generate
+        // diagnostics about the source address having invalid syntax, referring
+        // to a non-existent object, etc.
+        SourceAddrRange hcl.Range
+
+        // VersionConstraint is the version constraint applied to the module in
+        // configuration. This data structure includes the source range for
+        // the constraint, which can and should be used to generate diagnostics
+        // about constraint-related issues, such as constraints that eliminate all
+        // available versions of a module whose source is otherwise valid.
+        VersionConstraint VersionConstraint
+
+        // Parent is the partially-constructed module tree node that the loaded
+        // module will be added to. Callers may refer to any field of this
+        // structure except Children, which is still under construction when
+        // ModuleRequest objects are created and thus has undefined content.
+        // The main reason this is provided is so that full module paths can
+        // be constructed for uniqueness.
+        Parent *Config
+
+        // CallRange is the source range for the header of the "module" block
+        // in configuration that prompted this request. This can be used as the
+        // subject of an error diagnostic that relates to the module call itself,
+        // rather than to either its source address or its version number.
+        CallRange hcl.Range
+}
+
+// DisabledModuleWalker is a ModuleWalker that doesn't support
+// child modules at all, and so will return an error if asked to load one.
+//
+// This is provided primarily for testing. There is no good reason to use this
+// in the main application.
+var DisabledModuleWalker ModuleWalker
+
+func init() {
+        DisabledModuleWalker = ModuleWalkerFunc(func(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics) {
+                return nil, nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Child modules are not supported",
+                                Detail:   "Child module calls are not allowed in this context.",
+                                Subject:  &req.CallRange,
+                        },
+                }
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/copy_dir.go b/vendor/github.com/hashicorp/terraform/configs/configload/copy_dir.go
new file mode 100644
index 0000000..ebbeb3b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/copy_dir.go
@@ -0,0 +1,125 @@
+package configload
+
+import (
+        "io"
+        "os"
+        "path/filepath"
+        "strings"
+)
+
+// copyDir copies the src directory contents into dst. Both directories
+// should already exist.
+func copyDir(dst, src string) error {
+        src, err := filepath.EvalSymlinks(src)
+        if err != nil {
+                return err
+        }
+
+        walkFn := func(path string, info os.FileInfo, err error) error {
+                if err != nil {
+                        return err
+                }
+
+                if path == src {
+                        return nil
+                }
+
+                if strings.HasPrefix(filepath.Base(path), ".") {
+                        // Skip any dot files
+                        if info.IsDir() {
+                                return filepath.SkipDir
+                        } else {
+                                return nil
+                        }
+                }
+
+                // The "path" has the src prefixed to it. We need to join our
+                // destination with the path without the src on it.
+                dstPath := filepath.Join(dst, path[len(src):])
+
+                // we don't want to try and copy the same file over itself.
+                if eq, err := sameFile(path, dstPath); eq {
+                        return nil
+                } else if err != nil {
+                        return err
+                }
+
+                // If we have a directory, make that subdirectory, then continue
+                // the walk.
+                if info.IsDir() {
+                        if path == filepath.Join(src, dst) {
+                                // dst is in src; don't walk it.
+                                return nil
+                        }
+
+                        if err := os.MkdirAll(dstPath, 0755); err != nil {
+                                return err
+                        }
+
+                        return nil
+                }
+
+                // If the current path is a symlink, recreate the symlink relative to
+                // the dst directory
+                if info.Mode()&os.ModeSymlink == os.ModeSymlink {
+                        target, err := os.Readlink(path)
+                        if err != nil {
+                                return err
+                        }
+
+                        return os.Symlink(target, dstPath)
+                }
+
+                // If we have a file, copy the contents.
+                srcF, err := os.Open(path)
+                if err != nil {
+                        return err
+                }
+                defer srcF.Close()
+
+                dstF, err := os.Create(dstPath)
+                if err != nil {
+                        return err
+                }
+                defer dstF.Close()
+
+                if _, err := io.Copy(dstF, srcF); err != nil {
+                        return err
+                }
+
+                // Chmod it
+                return os.Chmod(dstPath, info.Mode())
+        }
+
+        return filepath.Walk(src, walkFn)
+}
+
+// sameFile tried to determine if to paths are the same file.
+// If the paths don't match, we lookup the inode on supported systems.
+func sameFile(a, b string) (bool, error) {
+        if a == b {
+                return true, nil
+        }
+
+        aIno, err := inode(a)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        bIno, err := inode(b)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        if aIno > 0 && aIno == bIno {
+                return true, nil
+        }
+
+        return false, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/doc.go b/vendor/github.com/hashicorp/terraform/configs/configload/doc.go
new file mode 100644
index 0000000..8b615f9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/doc.go
@@ -0,0 +1,4 @@
+// Package configload knows how to install modules into the .terraform/modules
+// directory and to load modules from those installed locations. It is used
+// in conjunction with the LoadConfig function in the parent package.
+package configload
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/getter.go b/vendor/github.com/hashicorp/terraform/configs/configload/getter.go
new file mode 100644
index 0000000..4a3dace
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/getter.go
@@ -0,0 +1,150 @@
+package configload
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        getter "github.com/hashicorp/go-getter"
+)
+
+// We configure our own go-getter detector and getter sets here, because
+// the set of sources we support is part of Terraform's documentation and
+// so we don't want any new sources introduced in go-getter to sneak in here
+// and work even though they aren't documented. This also insulates us from
+// any meddling that might be done by other go-getter callers linked into our
+// executable.
+
+var goGetterDetectors = []getter.Detector{
+        new(getter.GitHubDetector),
+        new(getter.BitBucketDetector),
+        new(getter.S3Detector),
+        new(getter.FileDetector),
+}
+
+var goGetterNoDetectors = []getter.Detector{}
+
+var goGetterDecompressors = map[string]getter.Decompressor{
+        "bz2": new(getter.Bzip2Decompressor),
+        "gz":  new(getter.GzipDecompressor),
+        "xz":  new(getter.XzDecompressor),
+        "zip": new(getter.ZipDecompressor),
+
+        "tar.bz2":  new(getter.TarBzip2Decompressor),
+        "tar.tbz2": new(getter.TarBzip2Decompressor),
+
+        "tar.gz": new(getter.TarGzipDecompressor),
+        "tgz":    new(getter.TarGzipDecompressor),
+
+        "tar.xz": new(getter.TarXzDecompressor),
+        "txz":    new(getter.TarXzDecompressor),
+}
+
+var goGetterGetters = map[string]getter.Getter{
+        "file":  new(getter.FileGetter),
+        "git":   new(getter.GitGetter),
+        "hg":    new(getter.HgGetter),
+        "s3":    new(getter.S3Getter),
+        "http":  getterHTTPGetter,
+        "https": getterHTTPGetter,
+}
+
+var getterHTTPClient = cleanhttp.DefaultClient()
+
+var getterHTTPGetter = &getter.HttpGetter{
+        Client: getterHTTPClient,
+        Netrc:  true,
+}
+
+// A reusingGetter is a helper for the module installer that remembers
+// the final resolved addresses of all of the sources it has already been
+// asked to install, and will copy from a prior installation directory if
+// it has the same resolved source address.
+//
+// The keys in a reusingGetter are resolved and trimmed source addresses
+// (with a scheme always present, and without any "subdir" component),
+// and the values are the paths where each source was previously installed.
+type reusingGetter map[string]string
+
+// getWithGoGetter retrieves the package referenced in the given address
+// into the installation path and then returns the full path to any subdir
+// indicated in the address.
+//
+// The errors returned by this function are those surfaced by the underlying
+// go-getter library, which have very inconsistent quality as
+// end-user-actionable error messages. At this time we do not have any
+// reasonable way to improve these error messages at this layer because
+// the underlying errors are not separatelyr recognizable.
+func (g reusingGetter) getWithGoGetter(instPath, addr string) (string, error) {
+        packageAddr, subDir := splitAddrSubdir(addr)
+
+        log.Printf("[DEBUG] will download %q to %s", packageAddr, instPath)
+
+        realAddr, err := getter.Detect(packageAddr, instPath, getter.Detectors)
+        if err != nil {
+                return "", err
+        }
+
+        var realSubDir string
+        realAddr, realSubDir = splitAddrSubdir(realAddr)
+        if realSubDir != "" {
+                subDir = filepath.Join(realSubDir, subDir)
+        }
+
+        if realAddr != packageAddr {
+                log.Printf("[TRACE] go-getter detectors rewrote %q to %q", packageAddr, realAddr)
+        }
+
+        if prevDir, exists := g[realAddr]; exists {
+                log.Printf("[TRACE] copying previous install %s to %s", prevDir, instPath)
+                err := os.Mkdir(instPath, os.ModePerm)
+                if err != nil {
+                        return "", fmt.Errorf("failed to create directory %s: %s", instPath, err)
+                }
+                err = copyDir(instPath, prevDir)
+                if err != nil {
+                        return "", fmt.Errorf("failed to copy from %s to %s: %s", prevDir, instPath, err)
+                }
+        } else {
+                log.Printf("[TRACE] fetching %q to %q", realAddr, instPath)
+                client := getter.Client{
+                        Src: realAddr,
+                        Dst: instPath,
+                        Pwd: instPath,
+
+                        Mode: getter.ClientModeDir,
+
+                        Detectors:     goGetterNoDetectors, // we already did detection above
+                        Decompressors: goGetterDecompressors,
+                        Getters:       goGetterGetters,
+                }
+                err = client.Get()
+                if err != nil {
+                        return "", err
+                }
+                // Remember where we installed this so we might reuse this directory
+                // on subsequent calls to avoid re-downloading.
+                g[realAddr] = instPath
+        }
+
+        // Our subDir string can contain wildcards until this point, so that
+        // e.g. a subDir of * can expand to one top-level directory in a .tar.gz
+        // archive. Now that we've expanded the archive successfully we must
+        // resolve that into a concrete path.
+        var finalDir string
+        if subDir != "" {
+                finalDir, err = getter.SubdirGlob(instPath, subDir)
+                log.Printf("[TRACE] expanded %q to %q", subDir, finalDir)
+                if err != nil {
+                        return "", err
+                }
+        } else {
+                finalDir = instPath
+        }
+
+        // If we got this far then we have apparently succeeded in downloading
+        // the requested object!
+        return filepath.Clean(finalDir), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/inode.go b/vendor/github.com/hashicorp/terraform/configs/configload/inode.go
new file mode 100644
index 0000000..57df041
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/inode.go
@@ -0,0 +1,21 @@
+// +build linux darwin openbsd netbsd solaris dragonfly
+
+package configload
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return st.Ino, nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/inode_freebsd.go b/vendor/github.com/hashicorp/terraform/configs/configload/inode_freebsd.go
new file mode 100644
index 0000000..4dc28ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/inode_freebsd.go
@@ -0,0 +1,21 @@
+// +build freebsd
+
+package configload
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return uint64(st.Ino), nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/inode_windows.go b/vendor/github.com/hashicorp/terraform/configs/configload/inode_windows.go
new file mode 100644
index 0000000..0d22e67
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/inode_windows.go
@@ -0,0 +1,8 @@
+// +build windows
+
+package configload
+
+// no syscall.Stat_t on windows, return 0 for inodes
+func inode(path string) (uint64, error) {
+        return 0, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/loader.go b/vendor/github.com/hashicorp/terraform/configs/configload/loader.go
new file mode 100644
index 0000000..416b48f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/loader.go
@@ -0,0 +1,150 @@
+package configload
+
+import (
+        "fmt"
+        "path/filepath"
+
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/spf13/afero"
+)
+
+// A Loader instance is the main entry-point for loading configurations via
+// this package.
+//
+// It extends the general config-loading functionality in the parent package
+// "configs" to support installation of modules from remote sources and
+// loading full configurations using modules that were previously installed.
+type Loader struct {
+        // parser is used to read configuration
+        parser *configs.Parser
+
+        // modules is used to install and locate descendent modules that are
+        // referenced (directly or indirectly) from the root module.
+        modules moduleMgr
+}
+
+// Config is used with NewLoader to specify configuration arguments for the
+// loader.
+type Config struct {
+        // ModulesDir is a path to a directory where descendent modules are
+        // (or should be) installed. (This is usually the
+        // .terraform/modules directory, in the common case where this package
+        // is being loaded from the main Terraform CLI package.)
+        ModulesDir string
+
+        // Services is the service discovery client to use when locating remote
+        // module registry endpoints. If this is nil then registry sources are
+        // not supported, which should be true only in specialized circumstances
+        // such as in tests.
+        Services *disco.Disco
+}
+
+// NewLoader creates and returns a loader that reads configuration from the
+// real OS filesystem.
+//
+// The loader has some internal state about the modules that are currently
+// installed, which is read from disk as part of this function. If that
+// manifest cannot be read then an error will be returned.
+func NewLoader(config *Config) (*Loader, error) {
+        fs := afero.NewOsFs()
+        parser := configs.NewParser(fs)
+        reg := registry.NewClient(config.Services, nil)
+
+        ret := &Loader{
+                parser: parser,
+                modules: moduleMgr{
+                        FS:         afero.Afero{Fs: fs},
+                        CanInstall: true,
+                        Dir:        config.ModulesDir,
+                        Services:   config.Services,
+                        Registry:   reg,
+                },
+        }
+
+        err := ret.modules.readModuleManifestSnapshot()
+        if err != nil {
+                return nil, fmt.Errorf("failed to read module manifest: %s", err)
+        }
+
+        return ret, nil
+}
+
+// ModulesDir returns the path to the directory where the loader will look for
+// the local cache of remote module packages.
+func (l *Loader) ModulesDir() string {
+        return l.modules.Dir
+}
+
+// RefreshModules updates the in-memory cache of the module manifest from the
+// module manifest file on disk. This is not necessary in normal use because
+// module installation and configuration loading are separate steps, but it
+// can be useful in tests where module installation is done as a part of
+// configuration loading by a helper function.
+//
+// Call this function after any module installation where an existing loader
+// is already alive and may be used again later.
+//
+// An error is returned if the manifest file cannot be read.
+func (l *Loader) RefreshModules() error {
+        if l == nil {
+                // Nothing to do, then.
+                return nil
+        }
+        return l.modules.readModuleManifestSnapshot()
+}
+
+// Parser returns the underlying parser for this loader.
+//
+// This is useful for loading other sorts of files than the module directories
+// that a loader deals with, since then they will share the source code cache
+// for this loader and can thus be shown as snippets in diagnostic messages.
+func (l *Loader) Parser() *configs.Parser {
+        return l.parser
+}
+
+// Sources returns the source code cache for the underlying parser of this
+// loader. This is a shorthand for l.Parser().Sources().
+func (l *Loader) Sources() map[string][]byte {
+        return l.parser.Sources()
+}
+
+// IsConfigDir returns true if and only if the given directory contains at
+// least one Terraform configuration file. This is a wrapper around calling
+// the same method name on the loader's parser.
+func (l *Loader) IsConfigDir(path string) bool {
+        return l.parser.IsConfigDir(path)
+}
+
+// ImportSources writes into the receiver's source code the given source
+// code buffers.
+//
+// This is useful in the situation where an ancillary loader is created for
+// some reason (e.g. loading config from a plan file) but the cached source
+// code from that loader must be imported into the "main" loader in order
+// to return source code snapshots in diagnostic messages.
+//
+//     loader.ImportSources(otherLoader.Sources())
+func (l *Loader) ImportSources(sources map[string][]byte) {
+        p := l.Parser()
+        for name, src := range sources {
+                p.ForceFileSource(name, src)
+        }
+}
+
+// ImportSourcesFromSnapshot writes into the receiver's source code the
+// source files from the given snapshot.
+//
+// This is similar to ImportSources but knows how to unpack and flatten a
+// snapshot data structure to get the corresponding flat source file map.
+func (l *Loader) ImportSourcesFromSnapshot(snap *Snapshot) {
+        p := l.Parser()
+        for _, m := range snap.Modules {
+                baseDir := m.Dir
+                for fn, src := range m.Files {
+                        fullPath := filepath.Join(baseDir, fn)
+                        p.ForceFileSource(fullPath, src)
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/loader_load.go b/vendor/github.com/hashicorp/terraform/configs/configload/loader_load.go
new file mode 100644
index 0000000..93a9420
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/loader_load.go
@@ -0,0 +1,97 @@
+package configload
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
+)
+
+// LoadConfig reads the Terraform module in the given directory and uses it as the
+// root module to build the static module tree that represents a configuration,
+// assuming that all required descendent modules have already been installed.
+//
+// If error diagnostics are returned, the returned configuration may be either
+// nil or incomplete. In the latter case, cautious static analysis is possible
+// in spite of the errors.
+//
+// LoadConfig performs the basic syntax and uniqueness validations that are
+// required to process the individual modules, and also detects
+func (l *Loader) LoadConfig(rootDir string) (*configs.Config, hcl.Diagnostics) {
+        rootMod, diags := l.parser.LoadConfigDir(rootDir)
+        if rootMod == nil {
+                return nil, diags
+        }
+
+        cfg, cDiags := configs.BuildConfig(rootMod, configs.ModuleWalkerFunc(l.moduleWalkerLoad))
+        diags = append(diags, cDiags...)
+
+        return cfg, diags
+}
+
+// moduleWalkerLoad is a configs.ModuleWalkerFunc for loading modules that
+// are presumed to have already been installed. A different function
+// (moduleWalkerInstall) is used for installation.
+func (l *Loader) moduleWalkerLoad(req *configs.ModuleRequest) (*configs.Module, *version.Version, hcl.Diagnostics) {
+        // Since we're just loading here, we expect that all referenced modules
+        // will be already installed and described in our manifest. However, we
+        // do verify that the manifest and the configuration are in agreement
+        // so that we can prompt the user to run "terraform init" if not.
+
+        key := l.modules.manifest.ModuleKey(req.Path)
+        record, exists := l.modules.manifest[key]
+
+        if !exists {
+                return nil, nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Module not installed",
+                                Detail:   "This module is not yet installed. Run \"terraform init\" to install all modules required by this configuration.",
+                                Subject:  &req.CallRange,
+                        },
+                }
+        }
+
+        var diags hcl.Diagnostics
+
+        // Check for inconsistencies between manifest and config
+        if req.SourceAddr != record.SourceAddr {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Module source has changed",
+                        Detail:   "The source address was changed since this module was installed. Run \"terraform init\" to install all modules required by this configuration.",
+                        Subject:  &req.SourceAddrRange,
+                })
+        }
+        if !req.VersionConstraint.Required.Check(record.Version) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Module version requirements have changed",
+                        Detail: fmt.Sprintf(
+                                "The version requirements have changed since this module was installed and the installed version (%s) is no longer acceptable. Run \"terraform init\" to install all modules required by this configuration.",
+                                record.Version,
+                        ),
+                        Subject: &req.SourceAddrRange,
+                })
+        }
+
+        mod, mDiags := l.parser.LoadConfigDir(record.Dir)
+        diags = append(diags, mDiags...)
+        if mod == nil {
+                // nil specifically indicates that the directory does not exist or
+                // cannot be read, so in this case we'll discard any generic diagnostics
+                // returned from LoadConfigDir and produce our own context-sensitive
+                // error message.
+                return nil, nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Module not installed",
+                                Detail:   fmt.Sprintf("This module's local cache directory %s could not be read. Run \"terraform init\" to install all modules required by this configuration.", record.Dir),
+                                Subject:  &req.CallRange,
+                        },
+                }
+        }
+
+        return mod, record.Version, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/loader_snapshot.go b/vendor/github.com/hashicorp/terraform/configs/configload/loader_snapshot.go
new file mode 100644
index 0000000..44c6439
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/loader_snapshot.go
@@ -0,0 +1,504 @@
+package configload
+
+import (
+        "fmt"
+        "io"
+        "os"
+        "path/filepath"
+        "sort"
+        "time"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/spf13/afero"
+)
+
+// LoadConfigWithSnapshot is a variant of LoadConfig that also simultaneously
+// creates an in-memory snapshot of the configuration files used, which can
+// be later used to create a loader that may read only from this snapshot.
+func (l *Loader) LoadConfigWithSnapshot(rootDir string) (*configs.Config, *Snapshot, hcl.Diagnostics) {
+        rootMod, diags := l.parser.LoadConfigDir(rootDir)
+        if rootMod == nil {
+                return nil, nil, diags
+        }
+
+        snap := &Snapshot{
+                Modules: map[string]*SnapshotModule{},
+        }
+        walker := l.makeModuleWalkerSnapshot(snap)
+        cfg, cDiags := configs.BuildConfig(rootMod, walker)
+        diags = append(diags, cDiags...)
+
+        addDiags := l.addModuleToSnapshot(snap, "", rootDir, "", nil)
+        diags = append(diags, addDiags...)
+
+        return cfg, snap, diags
+}
+
+// NewLoaderFromSnapshot creates a Loader that reads files only from the
+// given snapshot.
+//
+// A snapshot-based loader cannot install modules, so calling InstallModules
+// on the return value will cause a panic.
+//
+// A snapshot-based loader also has access only to configuration files. Its
+// underlying parser does not have access to other files in the native
+// filesystem, such as values files. For those, either use a normal loader
+// (created by NewLoader) or use the configs.Parser API directly.
+func NewLoaderFromSnapshot(snap *Snapshot) *Loader {
+        fs := snapshotFS{snap}
+        parser := configs.NewParser(fs)
+
+        ret := &Loader{
+                parser: parser,
+                modules: moduleMgr{
+                        FS:         afero.Afero{Fs: fs},
+                        CanInstall: false,
+                        manifest:   snap.moduleManifest(),
+                },
+        }
+
+        return ret
+}
+
+// Snapshot is an in-memory representation of the source files from a
+// configuration, which can be used as an alternative configurations source
+// for a loader with NewLoaderFromSnapshot.
+//
+// The primary purpose of a Snapshot is to build the configuration portion
+// of a plan file (see ../../plans/planfile) so that it can later be reloaded
+// and used to recover the exact configuration that the plan was built from.
+type Snapshot struct {
+        // Modules is a map from opaque module keys (suitable for use as directory
+        // names on all supported operating systems) to the snapshot information
+        // about each module.
+        Modules map[string]*SnapshotModule
+}
+
+// NewEmptySnapshot constructs and returns a snapshot containing only an empty
+// root module. This is not useful for anything except placeholders in tests.
+func NewEmptySnapshot() *Snapshot {
+        return &Snapshot{
+                Modules: map[string]*SnapshotModule{
+                        "": &SnapshotModule{
+                                Files: map[string][]byte{},
+                        },
+                },
+        }
+}
+
+// SnapshotModule represents a single module within a Snapshot.
+type SnapshotModule struct {
+        // Dir is the path, relative to the root directory given when the
+        // snapshot was created, where the module appears in the snapshot's
+        // virtual filesystem.
+        Dir string
+
+        // Files is a map from each configuration file filename for the
+        // module to a raw byte representation of the source file contents.
+        Files map[string][]byte
+
+        // SourceAddr is the source address given for this module in configuration.
+        SourceAddr string `json:"Source"`
+
+        // Version is the version of the module that is installed, or nil if
+        // the module is installed from a source that does not support versions.
+        Version *version.Version `json:"-"`
+}
+
+// moduleManifest constructs a module manifest based on the contents of
+// the receiving snapshot.
+func (s *Snapshot) moduleManifest() modsdir.Manifest {
+        ret := make(modsdir.Manifest)
+
+        for k, modSnap := range s.Modules {
+                ret[k] = modsdir.Record{
+                        Key:        k,
+                        Dir:        modSnap.Dir,
+                        SourceAddr: modSnap.SourceAddr,
+                        Version:    modSnap.Version,
+                }
+        }
+
+        return ret
+}
+
+// makeModuleWalkerSnapshot creates a configs.ModuleWalker that will exhibit
+// the same lookup behaviors as l.moduleWalkerLoad but will additionally write
+// source files from the referenced modules into the given snapshot.
+func (l *Loader) makeModuleWalkerSnapshot(snap *Snapshot) configs.ModuleWalker {
+        return configs.ModuleWalkerFunc(
+                func(req *configs.ModuleRequest) (*configs.Module, *version.Version, hcl.Diagnostics) {
+                        mod, v, diags := l.moduleWalkerLoad(req)
+                        if diags.HasErrors() {
+                                return mod, v, diags
+                        }
+
+                        key := l.modules.manifest.ModuleKey(req.Path)
+                        record, exists := l.modules.manifest[key]
+
+                        if !exists {
+                                // Should never happen, since otherwise moduleWalkerLoader would've
+                                // returned an error and we would've returned already.
+                                panic(fmt.Sprintf("module %s is not present in manifest", key))
+                        }
+
+                        addDiags := l.addModuleToSnapshot(snap, key, record.Dir, record.SourceAddr, record.Version)
+                        diags = append(diags, addDiags...)
+
+                        return mod, v, diags
+                },
+        )
+}
+
+func (l *Loader) addModuleToSnapshot(snap *Snapshot, key string, dir string, sourceAddr string, v *version.Version) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        primaryFiles, overrideFiles, moreDiags := l.parser.ConfigDirFiles(dir)
+        if moreDiags.HasErrors() {
+                // Any diagnostics we get here should be already present
+                // in diags, so it's weird if we get here but we'll allow it
+                // and return a general error message in that case.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Failed to read directory for module",
+                        Detail:   fmt.Sprintf("The source directory %s could not be read", dir),
+                })
+                return diags
+        }
+
+        snapMod := &SnapshotModule{
+                Dir:        dir,
+                Files:      map[string][]byte{},
+                SourceAddr: sourceAddr,
+                Version:    v,
+        }
+
+        files := make([]string, 0, len(primaryFiles)+len(overrideFiles))
+        files = append(files, primaryFiles...)
+        files = append(files, overrideFiles...)
+        sources := l.Sources() // should be populated with all the files we need by now
+        for _, filePath := range files {
+                filename := filepath.Base(filePath)
+                src, exists := sources[filePath]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing source file for snapshot",
+                                Detail:   fmt.Sprintf("The source code for file %s could not be found to produce a configuration snapshot.", filePath),
+                        })
+                        continue
+                }
+                snapMod.Files[filepath.Clean(filename)] = src
+        }
+
+        snap.Modules[key] = snapMod
+
+        return diags
+}
+
+// snapshotFS is an implementation of afero.Fs that reads from a snapshot.
+//
+// This is not intended as a general-purpose filesystem implementation. Instead,
+// it just supports the minimal functionality required to support the
+// configuration loader and parser as an implementation detail of creating
+// a loader from a snapshot.
+type snapshotFS struct {
+        snap *Snapshot
+}
+
+var _ afero.Fs = snapshotFS{}
+
+func (fs snapshotFS) Create(name string) (afero.File, error) {
+        return nil, fmt.Errorf("cannot create file inside configuration snapshot")
+}
+
+func (fs snapshotFS) Mkdir(name string, perm os.FileMode) error {
+        return fmt.Errorf("cannot create directory inside configuration snapshot")
+}
+
+func (fs snapshotFS) MkdirAll(name string, perm os.FileMode) error {
+        return fmt.Errorf("cannot create directories inside configuration snapshot")
+}
+
+func (fs snapshotFS) Open(name string) (afero.File, error) {
+
+        // Our "filesystem" is sparsely populated only with the directories
+        // mentioned by modules in our snapshot, so the high-level process
+        // for opening a file is:
+        // - Find the module snapshot corresponding to the containing directory
+        // - Find the file within that snapshot
+        // - Wrap the resulting byte slice in a snapshotFile to return
+        //
+        // The other possibility handled here is if the given name is for the
+        // module directory itself, in which case we'll return a snapshotDir
+        // instead.
+        //
+        // This function doesn't try to be incredibly robust in supporting
+        // different permutations of paths, etc because in practice we only
+        // need to support the path forms that our own loader and parser will
+        // generate.
+
+        dir := filepath.Dir(name)
+        fn := filepath.Base(name)
+        directDir := filepath.Clean(name)
+
+        // First we'll check to see if this is an exact path for a module directory.
+        // We need to do this first (rather than as part of the next loop below)
+        // because a module in a child directory of another module can otherwise
+        // appear to be a file in that parent directory.
+        for _, candidate := range fs.snap.Modules {
+                modDir := filepath.Clean(candidate.Dir)
+                if modDir == directDir {
+                        // We've matched the module directory itself
+                        filenames := make([]string, 0, len(candidate.Files))
+                        for n := range candidate.Files {
+                                filenames = append(filenames, n)
+                        }
+                        sort.Strings(filenames)
+                        return snapshotDir{
+                                filenames: filenames,
+                        }, nil
+                }
+        }
+
+        // If we get here then the given path isn't a module directory exactly, so
+        // we'll treat it as a file path and try to find a module directory it
+        // could be located in.
+        var modSnap *SnapshotModule
+        for _, candidate := range fs.snap.Modules {
+                modDir := filepath.Clean(candidate.Dir)
+                if modDir == dir {
+                        modSnap = candidate
+                        break
+                }
+        }
+        if modSnap == nil {
+                return nil, os.ErrNotExist
+        }
+
+        src, exists := modSnap.Files[fn]
+        if !exists {
+                return nil, os.ErrNotExist
+        }
+
+        return &snapshotFile{
+                src: src,
+        }, nil
+}
+
+func (fs snapshotFS) OpenFile(name string, flag int, perm os.FileMode) (afero.File, error) {
+        return fs.Open(name)
+}
+
+func (fs snapshotFS) Remove(name string) error {
+        return fmt.Errorf("cannot remove file inside configuration snapshot")
+}
+
+func (fs snapshotFS) RemoveAll(path string) error {
+        return fmt.Errorf("cannot remove files inside configuration snapshot")
+}
+
+func (fs snapshotFS) Rename(old, new string) error {
+        return fmt.Errorf("cannot rename file inside configuration snapshot")
+}
+
+func (fs snapshotFS) Stat(name string) (os.FileInfo, error) {
+        f, err := fs.Open(name)
+        if err != nil {
+                return nil, err
+        }
+        _, isDir := f.(snapshotDir)
+        return snapshotFileInfo{
+                name:  filepath.Base(name),
+                isDir: isDir,
+        }, nil
+}
+
+func (fs snapshotFS) Name() string {
+        return "ConfigSnapshotFS"
+}
+
+func (fs snapshotFS) Chmod(name string, mode os.FileMode) error {
+        return fmt.Errorf("cannot set file mode inside configuration snapshot")
+}
+
+func (fs snapshotFS) Chtimes(name string, atime, mtime time.Time) error {
+        return fmt.Errorf("cannot set file times inside configuration snapshot")
+}
+
+type snapshotFile struct {
+        snapshotFileStub
+        src []byte
+        at  int64
+}
+
+var _ afero.File = (*snapshotFile)(nil)
+
+func (f *snapshotFile) Read(p []byte) (n int, err error) {
+        if len(p) > 0 && f.at == int64(len(f.src)) {
+                return 0, io.EOF
+        }
+        if f.at > int64(len(f.src)) {
+                return 0, io.ErrUnexpectedEOF
+        }
+        if int64(len(f.src))-f.at >= int64(len(p)) {
+                n = len(p)
+        } else {
+                n = int(int64(len(f.src)) - f.at)
+        }
+        copy(p, f.src[f.at:f.at+int64(n)])
+        f.at += int64(n)
+        return
+}
+
+func (f *snapshotFile) ReadAt(p []byte, off int64) (n int, err error) {
+        f.at = off
+        return f.Read(p)
+}
+
+func (f *snapshotFile) Seek(offset int64, whence int) (int64, error) {
+        switch whence {
+        case 0:
+                f.at = offset
+        case 1:
+                f.at += offset
+        case 2:
+                f.at = int64(len(f.src)) + offset
+        }
+        return f.at, nil
+}
+
+type snapshotDir struct {
+        snapshotFileStub
+        filenames []string
+        at        int
+}
+
+var _ afero.File = snapshotDir{}
+
+func (f snapshotDir) Readdir(count int) ([]os.FileInfo, error) {
+        names, err := f.Readdirnames(count)
+        if err != nil {
+                return nil, err
+        }
+        ret := make([]os.FileInfo, len(names))
+        for i, name := range names {
+                ret[i] = snapshotFileInfo{
+                        name:  name,
+                        isDir: false,
+                }
+        }
+        return ret, nil
+}
+
+func (f snapshotDir) Readdirnames(count int) ([]string, error) {
+        var outLen int
+        names := f.filenames[f.at:]
+        if count > 0 {
+                if len(names) < count {
+                        outLen = len(names)
+                } else {
+                        outLen = count
+                }
+                if len(names) == 0 {
+                        return nil, io.EOF
+                }
+        } else {
+                outLen = len(names)
+        }
+        f.at += outLen
+
+        return names[:outLen], nil
+}
+
+// snapshotFileInfo is a minimal implementation of os.FileInfo to support our
+// virtual filesystem from snapshots.
+type snapshotFileInfo struct {
+        name  string
+        isDir bool
+}
+
+var _ os.FileInfo = snapshotFileInfo{}
+
+func (fi snapshotFileInfo) Name() string {
+        return fi.name
+}
+
+func (fi snapshotFileInfo) Size() int64 {
+        // In practice, our parser and loader never call Size
+        return -1
+}
+
+func (fi snapshotFileInfo) Mode() os.FileMode {
+        return os.ModePerm
+}
+
+func (fi snapshotFileInfo) ModTime() time.Time {
+        return time.Now()
+}
+
+func (fi snapshotFileInfo) IsDir() bool {
+        return fi.isDir
+}
+
+func (fi snapshotFileInfo) Sys() interface{} {
+        return nil
+}
+
+type snapshotFileStub struct{}
+
+func (f snapshotFileStub) Close() error {
+        return nil
+}
+
+func (f snapshotFileStub) Read(p []byte) (n int, err error) {
+        return 0, fmt.Errorf("cannot read")
+}
+
+func (f snapshotFileStub) ReadAt(p []byte, off int64) (n int, err error) {
+        return 0, fmt.Errorf("cannot read")
+}
+
+func (f snapshotFileStub) Seek(offset int64, whence int) (int64, error) {
+        return 0, fmt.Errorf("cannot seek")
+}
+
+func (f snapshotFileStub) Write(p []byte) (n int, err error) {
+        return f.WriteAt(p, 0)
+}
+
+func (f snapshotFileStub) WriteAt(p []byte, off int64) (n int, err error) {
+        return 0, fmt.Errorf("cannot write to file in snapshot")
+}
+
+func (f snapshotFileStub) WriteString(s string) (n int, err error) {
+        return 0, fmt.Errorf("cannot write to file in snapshot")
+}
+
+func (f snapshotFileStub) Name() string {
+        // in practice, the loader and parser never use this
+        return "<unimplemented>"
+}
+
+func (f snapshotFileStub) Readdir(count int) ([]os.FileInfo, error) {
+        return nil, fmt.Errorf("cannot use Readdir on a file")
+}
+
+func (f snapshotFileStub) Readdirnames(count int) ([]string, error) {
+        return nil, fmt.Errorf("cannot use Readdir on a file")
+}
+
+func (f snapshotFileStub) Stat() (os.FileInfo, error) {
+        return nil, fmt.Errorf("cannot stat")
+}
+
+func (f snapshotFileStub) Sync() error {
+        return nil
+}
+
+func (f snapshotFileStub) Truncate(size int64) error {
+        return fmt.Errorf("cannot write to file in snapshot")
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/module_mgr.go b/vendor/github.com/hashicorp/terraform/configs/configload/module_mgr.go
new file mode 100644
index 0000000..3c410ee
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/module_mgr.go
@@ -0,0 +1,76 @@
+package configload
+
+import (
+        "os"
+        "path/filepath"
+
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/spf13/afero"
+)
+
+type moduleMgr struct {
+        FS afero.Afero
+
+        // CanInstall is true for a module manager that can support installation.
+        //
+        // This must be set only if FS is an afero.OsFs, because the installer
+        // (which uses go-getter) is not aware of the virtual filesystem
+        // abstraction and will always write into the "real" filesystem.
+        CanInstall bool
+
+        // Dir is the path where descendent modules are (or will be) installed.
+        Dir string
+
+        // Services is a service discovery client that will be used to find
+        // remote module registry endpoints. This object may be pre-loaded with
+        // cached discovery information.
+        Services *disco.Disco
+
+        // Registry is a client for the module registry protocol, which is used
+        // when a module is requested from a registry source.
+        Registry *registry.Client
+
+        // manifest tracks the currently-installed modules for this manager.
+        //
+        // The loader may read this. Only the installer may write to it, and
+        // after a set of updates are completed the installer must call
+        // writeModuleManifestSnapshot to persist a snapshot of the manifest
+        // to disk for use on subsequent runs.
+        manifest modsdir.Manifest
+}
+
+func (m *moduleMgr) manifestSnapshotPath() string {
+        return filepath.Join(m.Dir, modsdir.ManifestSnapshotFilename)
+}
+
+// readModuleManifestSnapshot loads a manifest snapshot from the filesystem.
+func (m *moduleMgr) readModuleManifestSnapshot() error {
+        r, err := m.FS.Open(m.manifestSnapshotPath())
+        if err != nil {
+                if os.IsNotExist(err) {
+                        // We'll treat a missing file as an empty manifest
+                        m.manifest = make(modsdir.Manifest)
+                        return nil
+                }
+                return err
+        }
+
+        m.manifest, err = modsdir.ReadManifestSnapshot(r)
+        return err
+}
+
+// writeModuleManifestSnapshot writes a snapshot of the current manifest
+// to the filesystem.
+//
+// The caller must guarantee no concurrent modifications of the manifest for
+// the duration of a call to this function, or the behavior is undefined.
+func (m *moduleMgr) writeModuleManifestSnapshot() error {
+        w, err := m.FS.Create(m.manifestSnapshotPath())
+        if err != nil {
+                return err
+        }
+
+        return m.manifest.WriteSnapshot(w)
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/source_addr.go b/vendor/github.com/hashicorp/terraform/configs/configload/source_addr.go
new file mode 100644
index 0000000..594cf64
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/source_addr.go
@@ -0,0 +1,45 @@
+package configload
+
+import (
+        "strings"
+
+        "github.com/hashicorp/go-getter"
+
+        "github.com/hashicorp/terraform/registry/regsrc"
+)
+
+var localSourcePrefixes = []string{
+        "./",
+        "../",
+        ".\\",
+        "..\\",
+}
+
+func isLocalSourceAddr(addr string) bool {
+        for _, prefix := range localSourcePrefixes {
+                if strings.HasPrefix(addr, prefix) {
+                        return true
+                }
+        }
+        return false
+}
+
+func isRegistrySourceAddr(addr string) bool {
+        _, err := regsrc.ParseModuleSource(addr)
+        return err == nil
+}
+
+// splitAddrSubdir splits the given address (which is assumed to be a
+// registry address or go-getter-style address) into a package portion
+// and a sub-directory portion.
+//
+// The package portion defines what should be downloaded and then the
+// sub-directory portion, if present, specifies a sub-directory within
+// the downloaded object (an archive, VCS repository, etc) that contains
+// the module's configuration files.
+//
+// The subDir portion will be returned as empty if no subdir separator
+// ("//") is present in the address.
+func splitAddrSubdir(addr string) (packageAddr, subDir string) {
+        return getter.SourceDirSubdir(addr)
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/testing.go b/vendor/github.com/hashicorp/terraform/configs/configload/testing.go
new file mode 100644
index 0000000..86ca9d1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/testing.go
@@ -0,0 +1,43 @@
+package configload
+
+import (
+        "io/ioutil"
+        "os"
+        "testing"
+)
+
+// NewLoaderForTests is a variant of NewLoader that is intended to be more
+// convenient for unit tests.
+//
+// The loader's modules directory is a separate temporary directory created
+// for each call. Along with the created loader, this function returns a
+// cleanup function that should be called before the test completes in order
+// to remove that temporary directory.
+//
+// In the case of any errors, t.Fatal (or similar) will be called to halt
+// execution of the test, so the calling test does not need to handle errors
+// itself.
+func NewLoaderForTests(t *testing.T) (*Loader, func()) {
+        t.Helper()
+
+        modulesDir, err := ioutil.TempDir("", "tf-configs")
+        if err != nil {
+                t.Fatalf("failed to create temporary modules dir: %s", err)
+                return nil, func() {}
+        }
+
+        cleanup := func() {
+                os.RemoveAll(modulesDir)
+        }
+
+        loader, err := NewLoader(&Config{
+                ModulesDir: modulesDir,
+        })
+        if err != nil {
+                cleanup()
+                t.Fatalf("failed to create config loader: %s", err)
+                return nil, func() {}
+        }
+
+        return loader, cleanup
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/coerce_value.go b/vendor/github.com/hashicorp/terraform/configs/configschema/coerce_value.go
new file mode 100644
index 0000000..e59f58d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/coerce_value.go
@@ -0,0 +1,274 @@
+package configschema
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// CoerceValue attempts to force the given value to conform to the type
+// implied by the receiever, while also applying the same validation and
+// transformation rules that would be applied by the decoder specification
+// returned by method DecoderSpec.
+//
+// This is useful in situations where a configuration must be derived from
+// an already-decoded value. It is always better to decode directly from
+// configuration where possible since then source location information is
+// still available to produce diagnostics, but in special situations this
+// function allows a compatible result to be obtained even if the
+// configuration objects are not available.
+//
+// If the given value cannot be converted to conform to the receiving schema
+// then an error is returned describing one of possibly many problems. This
+// error may be a cty.PathError indicating a position within the nested
+// data structure where the problem applies.
+func (b *Block) CoerceValue(in cty.Value) (cty.Value, error) {
+        var path cty.Path
+        return b.coerceValue(in, path)
+}
+
+func (b *Block) coerceValue(in cty.Value, path cty.Path) (cty.Value, error) {
+        switch {
+        case in.IsNull():
+                return cty.NullVal(b.ImpliedType()), nil
+        case !in.IsKnown():
+                return cty.UnknownVal(b.ImpliedType()), nil
+        }
+
+        ty := in.Type()
+        if !ty.IsObjectType() {
+                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("an object is required")
+        }
+
+        for name := range ty.AttributeTypes() {
+                if _, defined := b.Attributes[name]; defined {
+                        continue
+                }
+                if _, defined := b.BlockTypes[name]; defined {
+                        continue
+                }
+                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("unexpected attribute %q", name)
+        }
+
+        attrs := make(map[string]cty.Value)
+
+        for name, attrS := range b.Attributes {
+                var val cty.Value
+                switch {
+                case ty.HasAttribute(name):
+                        val = in.GetAttr(name)
+                case attrS.Computed || attrS.Optional:
+                        val = cty.NullVal(attrS.Type)
+                default:
+                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", name)
+                }
+
+                val, err := attrS.coerceValue(val, append(path, cty.GetAttrStep{Name: name}))
+                if err != nil {
+                        return cty.UnknownVal(b.ImpliedType()), err
+                }
+
+                attrs[name] = val
+        }
+        for typeName, blockS := range b.BlockTypes {
+                switch blockS.Nesting {
+
+                case NestingSingle, NestingGroup:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                var err error
+                                val := in.GetAttr(typeName)
+                                attrs[typeName], err = blockS.coerceValue(val, append(path, cty.GetAttrStep{Name: typeName}))
+                                if err != nil {
+                                        return cty.UnknownVal(b.ImpliedType()), err
+                                }
+                        case blockS.MinItems != 1 && blockS.MaxItems != 1:
+                                if blockS.Nesting == NestingGroup {
+                                        attrs[typeName] = blockS.EmptyValue()
+                                } else {
+                                        attrs[typeName] = cty.NullVal(blockS.ImpliedType())
+                                }
+                        default:
+                                // We use the word "attribute" here because we're talking about
+                                // the cty sense of that word rather than the HCL sense.
+                                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", typeName)
+                        }
+
+                case NestingList:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                coll := in.GetAttr(typeName)
+
+                                switch {
+                                case coll.IsNull():
+                                        attrs[typeName] = cty.NullVal(cty.List(blockS.ImpliedType()))
+                                        continue
+                                case !coll.IsKnown():
+                                        attrs[typeName] = cty.UnknownVal(cty.List(blockS.ImpliedType()))
+                                        continue
+                                }
+
+                                if !coll.CanIterateElements() {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a list")
+                                }
+                                l := coll.LengthInt()
+                                if l < blockS.MinItems {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("insufficient items for attribute %q; must have at least %d", typeName, blockS.MinItems)
+                                }
+                                if l > blockS.MaxItems && blockS.MaxItems > 0 {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("too many items for attribute %q; cannot have more than %d", typeName, blockS.MaxItems)
+                                }
+                                if l == 0 {
+                                        attrs[typeName] = cty.ListValEmpty(blockS.ImpliedType())
+                                        continue
+                                }
+                                elems := make([]cty.Value, 0, l)
+                                {
+                                        path = append(path, cty.GetAttrStep{Name: typeName})
+                                        for it := coll.ElementIterator(); it.Next(); {
+                                                var err error
+                                                idx, val := it.Element()
+                                                val, err = blockS.coerceValue(val, append(path, cty.IndexStep{Key: idx}))
+                                                if err != nil {
+                                                        return cty.UnknownVal(b.ImpliedType()), err
+                                                }
+                                                elems = append(elems, val)
+                                        }
+                                }
+                                attrs[typeName] = cty.ListVal(elems)
+                        case blockS.MinItems == 0:
+                                attrs[typeName] = cty.ListValEmpty(blockS.ImpliedType())
+                        default:
+                                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", typeName)
+                        }
+
+                case NestingSet:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                coll := in.GetAttr(typeName)
+
+                                switch {
+                                case coll.IsNull():
+                                        attrs[typeName] = cty.NullVal(cty.Set(blockS.ImpliedType()))
+                                        continue
+                                case !coll.IsKnown():
+                                        attrs[typeName] = cty.UnknownVal(cty.Set(blockS.ImpliedType()))
+                                        continue
+                                }
+
+                                if !coll.CanIterateElements() {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a set")
+                                }
+                                l := coll.LengthInt()
+                                if l < blockS.MinItems {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("insufficient items for attribute %q; must have at least %d", typeName, blockS.MinItems)
+                                }
+                                if l > blockS.MaxItems && blockS.MaxItems > 0 {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("too many items for attribute %q; cannot have more than %d", typeName, blockS.MaxItems)
+                                }
+                                if l == 0 {
+                                        attrs[typeName] = cty.SetValEmpty(blockS.ImpliedType())
+                                        continue
+                                }
+                                elems := make([]cty.Value, 0, l)
+                                {
+                                        path = append(path, cty.GetAttrStep{Name: typeName})
+                                        for it := coll.ElementIterator(); it.Next(); {
+                                                var err error
+                                                idx, val := it.Element()
+                                                val, err = blockS.coerceValue(val, append(path, cty.IndexStep{Key: idx}))
+                                                if err != nil {
+                                                        return cty.UnknownVal(b.ImpliedType()), err
+                                                }
+                                                elems = append(elems, val)
+                                        }
+                                }
+                                attrs[typeName] = cty.SetVal(elems)
+                        case blockS.MinItems == 0:
+                                attrs[typeName] = cty.SetValEmpty(blockS.ImpliedType())
+                        default:
+                                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", typeName)
+                        }
+
+                case NestingMap:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                coll := in.GetAttr(typeName)
+
+                                switch {
+                                case coll.IsNull():
+                                        attrs[typeName] = cty.NullVal(cty.Map(blockS.ImpliedType()))
+                                        continue
+                                case !coll.IsKnown():
+                                        attrs[typeName] = cty.UnknownVal(cty.Map(blockS.ImpliedType()))
+                                        continue
+                                }
+
+                                if !coll.CanIterateElements() {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a map")
+                                }
+                                l := coll.LengthInt()
+                                if l == 0 {
+                                        attrs[typeName] = cty.MapValEmpty(blockS.ImpliedType())
+                                        continue
+                                }
+                                elems := make(map[string]cty.Value)
+                                {
+                                        path = append(path, cty.GetAttrStep{Name: typeName})
+                                        for it := coll.ElementIterator(); it.Next(); {
+                                                var err error
+                                                key, val := it.Element()
+                                                if key.Type() != cty.String || key.IsNull() || !key.IsKnown() {
+                                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a map")
+                                                }
+                                                val, err = blockS.coerceValue(val, append(path, cty.IndexStep{Key: key}))
+                                                if err != nil {
+                                                        return cty.UnknownVal(b.ImpliedType()), err
+                                                }
+                                                elems[key.AsString()] = val
+                                        }
+                                }
+
+                                // If the attribute values here contain any DynamicPseudoTypes,
+                                // the concrete type must be an object.
+                                useObject := false
+                                switch {
+                                case coll.Type().IsObjectType():
+                                        useObject = true
+                                default:
+                                        // It's possible that we were given a map, and need to coerce it to an object
+                                        ety := coll.Type().ElementType()
+                                        for _, v := range elems {
+                                                if !v.Type().Equals(ety) {
+                                                        useObject = true
+                                                        break
+                                                }
+                                        }
+                                }
+
+                                if useObject {
+                                        attrs[typeName] = cty.ObjectVal(elems)
+                                } else {
+                                        attrs[typeName] = cty.MapVal(elems)
+                                }
+                        default:
+                                attrs[typeName] = cty.MapValEmpty(blockS.ImpliedType())
+                        }
+
+                default:
+                        // should never happen because above is exhaustive
+                        panic(fmt.Errorf("unsupported nesting mode %#v", blockS.Nesting))
+                }
+        }
+
+        return cty.ObjectVal(attrs), nil
+}
+
+func (a *Attribute) coerceValue(in cty.Value, path cty.Path) (cty.Value, error) {
+        val, err := convert.Convert(in, a.Type)
+        if err != nil {
+                return cty.UnknownVal(a.Type), path.NewError(err)
+        }
+        return val, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/decoder_spec.go b/vendor/github.com/hashicorp/terraform/configs/configschema/decoder_spec.go
new file mode 100644
index 0000000..d8f41ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/decoder_spec.go
@@ -0,0 +1,117 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+)
+
+var mapLabelNames = []string{"key"}
+
+// DecoderSpec returns a hcldec.Spec that can be used to decode a HCL Body
+// using the facilities in the hcldec package.
+//
+// The returned specification is guaranteed to return a value of the same type
+// returned by method ImpliedType, but it may contain null values if any of the
+// block attributes are defined as optional and/or computed respectively.
+func (b *Block) DecoderSpec() hcldec.Spec {
+        ret := hcldec.ObjectSpec{}
+        if b == nil {
+                return ret
+        }
+
+        for name, attrS := range b.Attributes {
+                ret[name] = attrS.decoderSpec(name)
+        }
+
+        for name, blockS := range b.BlockTypes {
+                if _, exists := ret[name]; exists {
+                        // This indicates an invalid schema, since it's not valid to
+                        // define both an attribute and a block type of the same name.
+                        // However, we don't raise this here since it's checked by
+                        // InternalValidate.
+                        continue
+                }
+
+                childSpec := blockS.Block.DecoderSpec()
+
+                switch blockS.Nesting {
+                case NestingSingle, NestingGroup:
+                        ret[name] = &hcldec.BlockSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                Required: blockS.MinItems == 1 && blockS.MaxItems >= 1,
+                        }
+                        if blockS.Nesting == NestingGroup {
+                                ret[name] = &hcldec.DefaultSpec{
+                                        Primary: ret[name],
+                                        Default: &hcldec.LiteralSpec{
+                                                Value: blockS.EmptyValue(),
+                                        },
+                                }
+                        }
+                case NestingList:
+                        // We prefer to use a list where possible, since it makes our
+                        // implied type more complete, but if there are any
+                        // dynamically-typed attributes inside we must use a tuple
+                        // instead, at the expense of our type then not being predictable.
+                        if blockS.Block.ImpliedType().HasDynamicTypes() {
+                                ret[name] = &hcldec.BlockTupleSpec{
+                                        TypeName: name,
+                                        Nested:   childSpec,
+                                        MinItems: blockS.MinItems,
+                                        MaxItems: blockS.MaxItems,
+                                }
+                        } else {
+                                ret[name] = &hcldec.BlockListSpec{
+                                        TypeName: name,
+                                        Nested:   childSpec,
+                                        MinItems: blockS.MinItems,
+                                        MaxItems: blockS.MaxItems,
+                                }
+                        }
+                case NestingSet:
+                        // We forbid dynamically-typed attributes inside NestingSet in
+                        // InternalValidate, so we don't do anything special to handle
+                        // that here. (There is no set analog to tuple and object types,
+                        // because cty's set implementation depends on knowing the static
+                        // type in order to properly compute its internal hashes.)
+                        ret[name] = &hcldec.BlockSetSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                MinItems: blockS.MinItems,
+                                MaxItems: blockS.MaxItems,
+                        }
+                case NestingMap:
+                        // We prefer to use a list where possible, since it makes our
+                        // implied type more complete, but if there are any
+                        // dynamically-typed attributes inside we must use a tuple
+                        // instead, at the expense of our type then not being predictable.
+                        if blockS.Block.ImpliedType().HasDynamicTypes() {
+                                ret[name] = &hcldec.BlockObjectSpec{
+                                        TypeName:   name,
+                                        Nested:     childSpec,
+                                        LabelNames: mapLabelNames,
+                                }
+                        } else {
+                                ret[name] = &hcldec.BlockMapSpec{
+                                        TypeName:   name,
+                                        Nested:     childSpec,
+                                        LabelNames: mapLabelNames,
+                                }
+                        }
+                default:
+                        // Invalid nesting type is just ignored. It's checked by
+                        // InternalValidate.
+                        continue
+                }
+        }
+
+        return ret
+}
+
+func (a *Attribute) decoderSpec(name string) hcldec.Spec {
+        return &hcldec.AttrSpec{
+                Name:     name,
+                Type:     a.Type,
+                Required: a.Required,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/doc.go b/vendor/github.com/hashicorp/terraform/configs/configschema/doc.go
index caf8d73..caf8d73 100644
--- a/vendor/github.com/hashicorp/terraform/config/configschema/doc.go
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/doc.go
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/empty_value.go b/vendor/github.com/hashicorp/terraform/configs/configschema/empty_value.go
new file mode 100644
index 0000000..005da56
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/empty_value.go
@@ -0,0 +1,59 @@
+package configschema
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// EmptyValue returns the "empty value" for the recieving block, which for
+// a block type is a non-null object where all of the attribute values are
+// the empty values of the block's attributes and nested block types.
+//
+// In other words, it returns the value that would be returned if an empty
+// block were decoded against the recieving schema, assuming that no required
+// attribute or block constraints were honored.
+func (b *Block) EmptyValue() cty.Value {
+        vals := make(map[string]cty.Value)
+        for name, attrS := range b.Attributes {
+                vals[name] = attrS.EmptyValue()
+        }
+        for name, blockS := range b.BlockTypes {
+                vals[name] = blockS.EmptyValue()
+        }
+        return cty.ObjectVal(vals)
+}
+
+// EmptyValue returns the "empty value" for the receiving attribute, which is
+// the value that would be returned if there were no definition of the attribute
+// at all, ignoring any required constraint.
+func (a *Attribute) EmptyValue() cty.Value {
+        return cty.NullVal(a.Type)
+}
+
+// EmptyValue returns the "empty value" for when there are zero nested blocks
+// present of the receiving type.
+func (b *NestedBlock) EmptyValue() cty.Value {
+        switch b.Nesting {
+        case NestingSingle:
+                return cty.NullVal(b.Block.ImpliedType())
+        case NestingGroup:
+                return b.Block.EmptyValue()
+        case NestingList:
+                if ty := b.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        return cty.EmptyTupleVal
+                } else {
+                        return cty.ListValEmpty(ty)
+                }
+        case NestingMap:
+                if ty := b.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        return cty.EmptyObjectVal
+                } else {
+                        return cty.MapValEmpty(ty)
+                }
+        case NestingSet:
+                return cty.SetValEmpty(b.Block.ImpliedType())
+        default:
+                // Should never get here because the above is intended to be exhaustive,
+                // but we'll be robust and return a result nonetheless.
+                return cty.NullVal(cty.DynamicPseudoType)
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/implied_type.go b/vendor/github.com/hashicorp/terraform/configs/configschema/implied_type.go
new file mode 100644
index 0000000..c0ee841
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/implied_type.go
@@ -0,0 +1,42 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ImpliedType returns the cty.Type that would result from decoding a
+// configuration block using the receiving block schema.
+//
+// ImpliedType always returns a result, even if the given schema is
+// inconsistent. Code that creates configschema.Block objects should be
+// tested using the InternalValidate method to detect any inconsistencies
+// that would cause this method to fall back on defaults and assumptions.
+func (b *Block) ImpliedType() cty.Type {
+        if b == nil {
+                return cty.EmptyObject
+        }
+
+        return hcldec.ImpliedType(b.DecoderSpec())
+}
+
+// ContainsSensitive returns true if any of the attributes of the receiving
+// block or any of its descendent blocks are marked as sensitive.
+//
+// Blocks themselves cannot be sensitive as a whole -- sensitivity is a
+// per-attribute idea -- but sometimes we want to include a whole object
+// decoded from a block in some UI output, and that is safe to do only if
+// none of the contained attributes are sensitive.
+func (b *Block) ContainsSensitive() bool {
+        for _, attrS := range b.Attributes {
+                if attrS.Sensitive {
+                        return true
+                }
+        }
+        for _, blockS := range b.BlockTypes {
+                if blockS.ContainsSensitive() {
+                        return true
+                }
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go b/vendor/github.com/hashicorp/terraform/configs/configschema/internal_validate.go
index 33cbe88..ebf1abb 100644
--- a/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/internal_validate.go
@@ -72,10 +72,23 @@ func (b *Block) internalValidate(prefix string, err error) error {
                         case blockS.MinItems < 0 || blockS.MinItems > 1:
                                 err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must be set to either 0 or 1 in NestingSingle mode", prefix, name))
                         }
+                case NestingGroup:
+                        if blockS.MinItems != 0 || blockS.MaxItems != 0 {
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems cannot be used in NestingGroup mode", prefix, name))
+                        }
                 case NestingList, NestingSet:
                         if blockS.MinItems > blockS.MaxItems && blockS.MaxItems != 0 {
                                 err = multierror.Append(err, fmt.Errorf("%s%s: MinItems must be less than or equal to MaxItems in %s mode", prefix, name, blockS.Nesting))
                         }
+                        if blockS.Nesting == NestingSet {
+                                ety := blockS.Block.ImpliedType()
+                                if ety.HasDynamicTypes() {
+                                        // This is not permitted because the HCL (cty) set implementation
+                                        // needs to know the exact type of set elements in order to
+                                        // properly hash them, and so can't support mixed types.
+                                        err = multierror.Append(err, fmt.Errorf("%s%s: NestingSet blocks may not contain attributes of cty.DynamicPseudoType", prefix, name))
+                                }
+                        }
                 case NestingMap:
                         if blockS.MinItems != 0 || blockS.MaxItems != 0 {
                                 err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must both be 0 in NestingMap mode", prefix, name))
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/nestingmode_string.go b/vendor/github.com/hashicorp/terraform/configs/configschema/nestingmode_string.go
new file mode 100644
index 0000000..febe743
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/nestingmode_string.go
@@ -0,0 +1,28 @@
+// Code generated by "stringer -type=NestingMode"; DO NOT EDIT.
+
+package configschema
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[nestingModeInvalid-0]
+        _ = x[NestingSingle-1]
+        _ = x[NestingGroup-2]
+        _ = x[NestingList-3]
+        _ = x[NestingSet-4]
+        _ = x[NestingMap-5]
+}
+
+const _NestingMode_name = "nestingModeInvalidNestingSingleNestingGroupNestingListNestingSetNestingMap"
+
+var _NestingMode_index = [...]uint8{0, 18, 31, 43, 54, 64, 74}
+
+func (i NestingMode) String() string {
+        if i < 0 || i >= NestingMode(len(_NestingMode_index)-1) {
+                return "NestingMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _NestingMode_name[_NestingMode_index[i]:_NestingMode_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/none_required.go b/vendor/github.com/hashicorp/terraform/configs/configschema/none_required.go
new file mode 100644
index 0000000..0be3b8f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/none_required.go
@@ -0,0 +1,38 @@
+package configschema
+
+// NoneRequired returns a deep copy of the receiver with any required
+// attributes translated to optional.
+func (b *Block) NoneRequired() *Block {
+        ret := &Block{}
+
+        if b.Attributes != nil {
+                ret.Attributes = make(map[string]*Attribute, len(b.Attributes))
+        }
+        for name, attrS := range b.Attributes {
+                ret.Attributes[name] = attrS.forceOptional()
+        }
+
+        if b.BlockTypes != nil {
+                ret.BlockTypes = make(map[string]*NestedBlock, len(b.BlockTypes))
+        }
+        for name, blockS := range b.BlockTypes {
+                ret.BlockTypes[name] = blockS.noneRequired()
+        }
+
+        return ret
+}
+
+func (b *NestedBlock) noneRequired() *NestedBlock {
+        ret := *b
+        ret.Block = *(ret.Block.NoneRequired())
+        ret.MinItems = 0
+        ret.MaxItems = 0
+        return &ret
+}
+
+func (a *Attribute) forceOptional() *Attribute {
+        ret := *a
+        ret.Optional = true
+        ret.Required = false
+        return &ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/schema.go b/vendor/github.com/hashicorp/terraform/configs/configschema/schema.go
index 9a8ee55..5a67334 100644
--- a/vendor/github.com/hashicorp/terraform/config/configschema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/schema.go
@@ -28,6 +28,12 @@ type Attribute struct {
         // Type is a type specification that the attribute's value must conform to.
         Type cty.Type
 
+        // Description is an English-language description of the purpose and
+        // usage of the attribute. A description should be concise and use only
+        // one or two sentences, leaving full definition to longer-form
+        // documentation defined elsewhere.
+        Description string
+
         // Required, if set to true, specifies that an omitted or null value is
         // not permitted.
         Required bool
@@ -87,6 +93,23 @@ const (
         // provided directly as an object value.
         NestingSingle
 
+        // NestingGroup is similar to NestingSingle in that it calls for only a
+        // single instance of a given block type with no labels, but it additonally
+        // guarantees that its result will never be null, even if the block is
+        // absent, and instead the nested attributes and blocks will be treated
+        // as absent in that case. (Any required attributes or blocks within the
+        // nested block are not enforced unless the block is explicitly present
+        // in the configuration, so they are all effectively optional when the
+        // block is not present.)
+        //
+        // This is useful for the situation where a remote API has a feature that
+        // is always enabled but has a group of settings related to that feature
+        // that themselves have default values. By using NestingGroup instead of
+        // NestingSingle in that case, generated plans will show the block as
+        // present even when not present in configuration, thus allowing any
+        // default values within to be displayed to the user.
+        NestingGroup
+
         // NestingList indicates that multiple blocks of the given type are
         // permitted, with no labels, and that their corresponding objects should
         // be provided in a list.
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/validate_traversal.go b/vendor/github.com/hashicorp/terraform/configs/configschema/validate_traversal.go
new file mode 100644
index 0000000..a41e930
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/validate_traversal.go
@@ -0,0 +1,173 @@
+package configschema
+
+import (
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/helper/didyoumean"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// StaticValidateTraversal checks whether the given traversal (which must be
+// relative) refers to a construct in the receiving schema, returning error
+// diagnostics if any problems are found.
+//
+// This method is "optimistic" in that it will not return errors for possible
+// problems that cannot be detected statically. It is possible that an
+// traversal which passed static validation will still fail when evaluated.
+func (b *Block) StaticValidateTraversal(traversal hcl.Traversal) tfdiags.Diagnostics {
+        if !traversal.IsRelative() {
+                panic("StaticValidateTraversal on absolute traversal")
+        }
+        if len(traversal) == 0 {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+
+        next := traversal[0]
+        after := traversal[1:]
+
+        var name string
+        switch step := next.(type) {
+        case hcl.TraverseAttr:
+                name = step.Name
+        case hcl.TraverseIndex:
+                // No other traversal step types are allowed directly at a block.
+                // If it looks like the user was trying to use index syntax to
+                // access an attribute then we'll produce a specialized message.
+                key := step.Key
+                if key.Type() == cty.String && key.IsKnown() && !key.IsNull() {
+                        maybeName := key.AsString()
+                        if hclsyntax.ValidIdentifier(maybeName) {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  `Invalid index operation`,
+                                        Detail:   fmt.Sprintf(`Only attribute access is allowed here. Did you mean to access attribute %q using the dot operator?`, maybeName),
+                                        Subject:  &step.SrcRange,
+                                })
+                                return diags
+                        }
+                }
+                // If it looks like some other kind of index then we'll use a generic error.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid index operation`,
+                        Detail:   `Only attribute access is allowed here, using the dot operator.`,
+                        Subject:  &step.SrcRange,
+                })
+                return diags
+        default:
+                // No other traversal types should appear in a normal valid traversal,
+                // but we'll handle this with a generic error anyway to be robust.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid operation`,
+                        Detail:   `Only attribute access is allowed here, using the dot operator.`,
+                        Subject:  next.SourceRange().Ptr(),
+                })
+                return diags
+        }
+
+        if attrS, exists := b.Attributes[name]; exists {
+                // For attribute validation we will just apply the rest of the
+                // traversal to an unknown value of the attribute type and pass
+                // through HCL's own errors, since we don't want to replicate all of
+                // HCL's type checking rules here.
+                val := cty.UnknownVal(attrS.Type)
+                _, hclDiags := after.TraverseRel(val)
+                diags = diags.Append(hclDiags)
+                return diags
+        }
+
+        if blockS, exists := b.BlockTypes[name]; exists {
+                moreDiags := blockS.staticValidateTraversal(name, after)
+                diags = diags.Append(moreDiags)
+                return diags
+        }
+
+        // If we get here then the name isn't valid at all. We'll collect up
+        // all of the names that _are_ valid to use as suggestions.
+        var suggestions []string
+        for name := range b.Attributes {
+                suggestions = append(suggestions, name)
+        }
+        for name := range b.BlockTypes {
+                suggestions = append(suggestions, name)
+        }
+        sort.Strings(suggestions)
+        suggestion := didyoumean.NameSuggestion(name, suggestions)
+        if suggestion != "" {
+                suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+        }
+        diags = diags.Append(&hcl.Diagnostic{
+                Severity: hcl.DiagError,
+                Summary:  `Unsupported attribute`,
+                Detail:   fmt.Sprintf(`This object has no argument, nested block, or exported attribute named %q.%s`, name, suggestion),
+                Subject:  next.SourceRange().Ptr(),
+        })
+
+        return diags
+}
+
+func (b *NestedBlock) staticValidateTraversal(typeName string, traversal hcl.Traversal) tfdiags.Diagnostics {
+        if b.Nesting == NestingSingle || b.Nesting == NestingGroup {
+                // Single blocks are easy: just pass right through.
+                return b.Block.StaticValidateTraversal(traversal)
+        }
+
+        if len(traversal) == 0 {
+                // It's always valid to access a nested block's attribute directly.
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+        next := traversal[0]
+        after := traversal[1:]
+
+        switch b.Nesting {
+
+        case NestingSet:
+                // Can't traverse into a set at all, since it does not have any keys
+                // to index with.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Cannot index a set value`,
+                        Detail:   fmt.Sprintf(`Block type %q is represented by a set of objects, and set elements do not have addressable keys. To find elements matching specific criteria, use a "for" expression with an "if" clause.`, typeName),
+                        Subject:  next.SourceRange().Ptr(),
+                })
+                return diags
+
+        case NestingList:
+                if _, ok := next.(hcl.TraverseIndex); ok {
+                        moreDiags := b.Block.StaticValidateTraversal(after)
+                        diags = diags.Append(moreDiags)
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Invalid operation`,
+                                Detail:   fmt.Sprintf(`Block type %q is represented by a list of objects, so it must be indexed using a numeric key, like .%s[0].`, typeName, typeName),
+                                Subject:  next.SourceRange().Ptr(),
+                        })
+                }
+                return diags
+
+        case NestingMap:
+                // Both attribute and index steps are valid for maps, so we'll just
+                // pass through here and let normal evaluation catch an
+                // incorrectly-typed index key later, if present.
+                moreDiags := b.Block.StaticValidateTraversal(after)
+                diags = diags.Append(moreDiags)
+                return diags
+
+        default:
+                // Invalid nesting type is just ignored. It's checked by
+                // InternalValidate. (Note that we handled NestingSingle separately
+                // back at the start of this function.)
+                return nil
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/depends_on.go b/vendor/github.com/hashicorp/terraform/configs/depends_on.go
new file mode 100644
index 0000000..b198476
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/depends_on.go
@@ -0,0 +1,23 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+func decodeDependsOn(attr *hcl.Attribute) ([]hcl.Traversal, hcl.Diagnostics) {
+        var ret []hcl.Traversal
+        exprs, diags := hcl.ExprList(attr.Expr)
+
+        for _, expr := range exprs {
+                expr, shimDiags := shimTraversalInString(expr, false)
+                diags = append(diags, shimDiags...)
+
+                traversal, travDiags := hcl.AbsTraversalForExpr(expr)
+                diags = append(diags, travDiags...)
+                if len(traversal) != 0 {
+                        ret = append(ret, traversal)
+                }
+        }
+
+        return ret, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/doc.go b/vendor/github.com/hashicorp/terraform/configs/doc.go
new file mode 100644
index 0000000..f01eb79
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/doc.go
@@ -0,0 +1,19 @@
+// Package configs contains types that represent Terraform configurations and
+// the different elements thereof.
+//
+// The functionality in this package can be used for some static analyses of
+// Terraform configurations, but this package generally exposes representations
+// of the configuration source code rather than the result of evaluating these
+// objects. The sibling package "lang" deals with evaluation of structures
+// and expressions in the configuration.
+//
+// Due to its close relationship with HCL, this package makes frequent use
+// of types from the HCL API, including raw HCL diagnostic messages. Such
+// diagnostics can be converted into Terraform-flavored diagnostics, if needed,
+// using functions in the sibling package tfdiags.
+//
+// The Parser type is the main entry-point into this package. The LoadConfigDir
+// method can be used to load a single module directory, and then a full
+// configuration (including any descendent modules) can be produced using
+// the top-level BuildConfig method.
+package configs
diff --git a/vendor/github.com/hashicorp/terraform/configs/module.go b/vendor/github.com/hashicorp/terraform/configs/module.go
new file mode 100644
index 0000000..250f9d3
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module.go
@@ -0,0 +1,404 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Module is a container for a set of configuration constructs that are
+// evaluated within a common namespace.
+type Module struct {
+        // SourceDir is the filesystem directory that the module was loaded from.
+        //
+        // This is populated automatically only for configurations loaded with
+        // LoadConfigDir. If the parser is using a virtual filesystem then the
+        // path here will be in terms of that virtual filesystem.
+
+        // Any other caller that constructs a module directly with NewModule may
+        // assign a suitable value to this attribute before using it for other
+        // purposes. It should be treated as immutable by all consumers of Module
+        // values.
+        SourceDir string
+
+        CoreVersionConstraints []VersionConstraint
+
+        Backend              *Backend
+        ProviderConfigs      map[string]*Provider
+        ProviderRequirements map[string][]VersionConstraint
+
+        Variables map[string]*Variable
+        Locals    map[string]*Local
+        Outputs   map[string]*Output
+
+        ModuleCalls map[string]*ModuleCall
+
+        ManagedResources map[string]*Resource
+        DataResources    map[string]*Resource
+}
+
+// File describes the contents of a single configuration file.
+//
+// Individual files are not usually used alone, but rather combined together
+// with other files (conventionally, those in the same directory) to produce
+// a *Module, using NewModule.
+//
+// At the level of an individual file we represent directly the structural
+// elements present in the file, without any attempt to detect conflicting
+// declarations. A File object can therefore be used for some basic static
+// analysis of individual elements, but must be built into a Module to detect
+// duplicate declarations.
+type File struct {
+        CoreVersionConstraints []VersionConstraint
+
+        Backends             []*Backend
+        ProviderConfigs      []*Provider
+        ProviderRequirements []*ProviderRequirement
+
+        Variables []*Variable
+        Locals    []*Local
+        Outputs   []*Output
+
+        ModuleCalls []*ModuleCall
+
+        ManagedResources []*Resource
+        DataResources    []*Resource
+}
+
+// NewModule takes a list of primary files and a list of override files and
+// produces a *Module by combining the files together.
+//
+// If there are any conflicting declarations in the given files -- for example,
+// if the same variable name is defined twice -- then the resulting module
+// will be incomplete and error diagnostics will be returned. Careful static
+// analysis of the returned Module is still possible in this case, but the
+// module will probably not be semantically valid.
+func NewModule(primaryFiles, overrideFiles []*File) (*Module, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        mod := &Module{
+                ProviderConfigs:      map[string]*Provider{},
+                ProviderRequirements: map[string][]VersionConstraint{},
+                Variables:            map[string]*Variable{},
+                Locals:               map[string]*Local{},
+                Outputs:              map[string]*Output{},
+                ModuleCalls:          map[string]*ModuleCall{},
+                ManagedResources:     map[string]*Resource{},
+                DataResources:        map[string]*Resource{},
+        }
+
+        for _, file := range primaryFiles {
+                fileDiags := mod.appendFile(file)
+                diags = append(diags, fileDiags...)
+        }
+
+        for _, file := range overrideFiles {
+                fileDiags := mod.mergeFile(file)
+                diags = append(diags, fileDiags...)
+        }
+
+        return mod, diags
+}
+
+// ResourceByAddr returns the configuration for the resource with the given
+// address, or nil if there is no such resource.
+func (m *Module) ResourceByAddr(addr addrs.Resource) *Resource {
+        key := addr.String()
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                return m.ManagedResources[key]
+        case addrs.DataResourceMode:
+                return m.DataResources[key]
+        default:
+                return nil
+        }
+}
+
+func (m *Module) appendFile(file *File) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        for _, constraint := range file.CoreVersionConstraints {
+                // If there are any conflicting requirements then we'll catch them
+                // when we actually check these constraints.
+                m.CoreVersionConstraints = append(m.CoreVersionConstraints, constraint)
+        }
+
+        for _, b := range file.Backends {
+                if m.Backend != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate backend configuration",
+                                Detail:   fmt.Sprintf("A module may have only one backend configuration. The backend was previously configured at %s.", m.Backend.DeclRange),
+                                Subject:  &b.DeclRange,
+                        })
+                        continue
+                }
+                m.Backend = b
+        }
+
+        for _, pc := range file.ProviderConfigs {
+                key := pc.moduleUniqueKey()
+                if existing, exists := m.ProviderConfigs[key]; exists {
+                        if existing.Alias == "" {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate provider configuration",
+                                        Detail:   fmt.Sprintf("A default (non-aliased) provider configuration for %q was already given at %s. If multiple configurations are required, set the \"alias\" argument for alternative configurations.", existing.Name, existing.DeclRange),
+                                        Subject:  &pc.DeclRange,
+                                })
+                        } else {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate provider configuration",
+                                        Detail:   fmt.Sprintf("A provider configuration for %q with alias %q was already given at %s. Each configuration for the same provider must have a distinct alias.", existing.Name, existing.Alias, existing.DeclRange),
+                                        Subject:  &pc.DeclRange,
+                                })
+                        }
+                        continue
+                }
+                m.ProviderConfigs[key] = pc
+        }
+
+        for _, reqd := range file.ProviderRequirements {
+                m.ProviderRequirements[reqd.Name] = append(m.ProviderRequirements[reqd.Name], reqd.Requirement)
+        }
+
+        for _, v := range file.Variables {
+                if existing, exists := m.Variables[v.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate variable declaration",
+                                Detail:   fmt.Sprintf("A variable named %q was already declared at %s. Variable names must be unique within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &v.DeclRange,
+                        })
+                }
+                m.Variables[v.Name] = v
+        }
+
+        for _, l := range file.Locals {
+                if existing, exists := m.Locals[l.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate local value definition",
+                                Detail:   fmt.Sprintf("A local value named %q was already defined at %s. Local value names must be unique within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &l.DeclRange,
+                        })
+                }
+                m.Locals[l.Name] = l
+        }
+
+        for _, o := range file.Outputs {
+                if existing, exists := m.Outputs[o.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate output definition",
+                                Detail:   fmt.Sprintf("An output named %q was already defined at %s. Output names must be unique within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &o.DeclRange,
+                        })
+                }
+                m.Outputs[o.Name] = o
+        }
+
+        for _, mc := range file.ModuleCalls {
+                if existing, exists := m.ModuleCalls[mc.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate module call",
+                                Detail:   fmt.Sprintf("An module call named %q was already defined at %s. Module calls must have unique names within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &mc.DeclRange,
+                        })
+                }
+                m.ModuleCalls[mc.Name] = mc
+        }
+
+        for _, r := range file.ManagedResources {
+                key := r.moduleUniqueKey()
+                if existing, exists := m.ManagedResources[key]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate resource %q configuration", existing.Type),
+                                Detail:   fmt.Sprintf("A %s resource named %q was already declared at %s. Resource names must be unique per type in each module.", existing.Type, existing.Name, existing.DeclRange),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                m.ManagedResources[key] = r
+        }
+
+        for _, r := range file.DataResources {
+                key := r.moduleUniqueKey()
+                if existing, exists := m.DataResources[key]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate data %q configuration", existing.Type),
+                                Detail:   fmt.Sprintf("A %s data resource named %q was already declared at %s. Resource names must be unique per type in each module.", existing.Type, existing.Name, existing.DeclRange),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                m.DataResources[key] = r
+        }
+
+        return diags
+}
+
+func (m *Module) mergeFile(file *File) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if len(file.CoreVersionConstraints) != 0 {
+                // This is a bit of a strange case for overriding since we normally
+                // would union together across multiple files anyway, but we'll
+                // allow it and have each override file clobber any existing list.
+                m.CoreVersionConstraints = nil
+                for _, constraint := range file.CoreVersionConstraints {
+                        m.CoreVersionConstraints = append(m.CoreVersionConstraints, constraint)
+                }
+        }
+
+        if len(file.Backends) != 0 {
+                switch len(file.Backends) {
+                case 1:
+                        m.Backend = file.Backends[0]
+                default:
+                        // An override file with multiple backends is still invalid, even
+                        // though it can override backends from _other_ files.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate backend configuration",
+                                Detail:   fmt.Sprintf("Each override file may have only one backend configuration. A backend was previously configured at %s.", file.Backends[0].DeclRange),
+                                Subject:  &file.Backends[1].DeclRange,
+                        })
+                }
+        }
+
+        for _, pc := range file.ProviderConfigs {
+                key := pc.moduleUniqueKey()
+                existing, exists := m.ProviderConfigs[key]
+                if pc.Alias == "" {
+                        // We allow overriding a non-existing _default_ provider configuration
+                        // because the user model is that an absent provider configuration
+                        // implies an empty provider configuration, which is what the user
+                        // is therefore overriding here.
+                        if exists {
+                                mergeDiags := existing.merge(pc)
+                                diags = append(diags, mergeDiags...)
+                        } else {
+                                m.ProviderConfigs[key] = pc
+                        }
+                } else {
+                        // For aliased providers, there must be a base configuration to
+                        // override. This allows us to detect and report alias typos
+                        // that might otherwise cause the override to not apply.
+                        if !exists {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing base provider configuration for override",
+                                        Detail:   fmt.Sprintf("There is no %s provider configuration with the alias %q. An override file can only override an aliased provider configuration that was already defined in a primary configuration file.", pc.Name, pc.Alias),
+                                        Subject:  &pc.DeclRange,
+                                })
+                                continue
+                        }
+                        mergeDiags := existing.merge(pc)
+                        diags = append(diags, mergeDiags...)
+                }
+        }
+
+        if len(file.ProviderRequirements) != 0 {
+                mergeProviderVersionConstraints(m.ProviderRequirements, file.ProviderRequirements)
+        }
+
+        for _, v := range file.Variables {
+                existing, exists := m.Variables[v.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing base variable declaration to override",
+                                Detail:   fmt.Sprintf("There is no variable named %q. An override file can only override a variable that was already declared in a primary configuration file.", v.Name),
+                                Subject:  &v.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(v)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, l := range file.Locals {
+                existing, exists := m.Locals[l.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing base local value definition to override",
+                                Detail:   fmt.Sprintf("There is no local value named %q. An override file can only override a local value that was already defined in a primary configuration file.", l.Name),
+                                Subject:  &l.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(l)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, o := range file.Outputs {
+                existing, exists := m.Outputs[o.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing base output definition to override",
+                                Detail:   fmt.Sprintf("There is no output named %q. An override file can only override an output that was already defined in a primary configuration file.", o.Name),
+                                Subject:  &o.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(o)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, mc := range file.ModuleCalls {
+                existing, exists := m.ModuleCalls[mc.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing module call to override",
+                                Detail:   fmt.Sprintf("There is no module call named %q. An override file can only override a module call that was defined in a primary configuration file.", mc.Name),
+                                Subject:  &mc.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(mc)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, r := range file.ManagedResources {
+                key := r.moduleUniqueKey()
+                existing, exists := m.ManagedResources[key]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing resource to override",
+                                Detail:   fmt.Sprintf("There is no %s resource named %q. An override file can only override a resource block defined in a primary configuration file.", r.Type, r.Name),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(r)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, r := range file.DataResources {
+                key := r.moduleUniqueKey()
+                existing, exists := m.DataResources[key]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing data resource to override",
+                                Detail:   fmt.Sprintf("There is no %s data resource named %q. An override file can only override a data block defined in a primary configuration file.", r.Type, r.Name),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(r)
+                diags = append(diags, mergeDiags...)
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/module_call.go b/vendor/github.com/hashicorp/terraform/configs/module_call.go
new file mode 100644
index 0000000..8c3ba67
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module_call.go
@@ -0,0 +1,188 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// ModuleCall represents a "module" block in a module or file.
+type ModuleCall struct {
+        Name string
+
+        SourceAddr      string
+        SourceAddrRange hcl.Range
+        SourceSet       bool
+
+        Config hcl.Body
+
+        Version VersionConstraint
+
+        Count   hcl.Expression
+        ForEach hcl.Expression
+
+        Providers []PassedProviderConfig
+
+        DependsOn []hcl.Traversal
+
+        DeclRange hcl.Range
+}
+
+func decodeModuleBlock(block *hcl.Block, override bool) (*ModuleCall, hcl.Diagnostics) {
+        mc := &ModuleCall{
+                Name:      block.Labels[0],
+                DeclRange: block.DefRange,
+        }
+
+        schema := moduleBlockSchema
+        if override {
+                schema = schemaForOverrides(schema)
+        }
+
+        content, remain, diags := block.Body.PartialContent(schema)
+        mc.Config = remain
+
+        if !hclsyntax.ValidIdentifier(mc.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid module instance name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+
+        if attr, exists := content.Attributes["source"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &mc.SourceAddr)
+                diags = append(diags, valDiags...)
+                mc.SourceAddrRange = attr.Expr.Range()
+                mc.SourceSet = true
+        }
+
+        if attr, exists := content.Attributes["version"]; exists {
+                var versionDiags hcl.Diagnostics
+                mc.Version, versionDiags = decodeVersionConstraint(attr)
+                diags = append(diags, versionDiags...)
+        }
+
+        if attr, exists := content.Attributes["count"]; exists {
+                mc.Count = attr.Expr
+
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["for_each"]; exists {
+                mc.ForEach = attr.Expr
+
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                mc.DependsOn = append(mc.DependsOn, deps...)
+
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["providers"]; exists {
+                seen := make(map[string]hcl.Range)
+                pairs, pDiags := hcl.ExprMap(attr.Expr)
+                diags = append(diags, pDiags...)
+                for _, pair := range pairs {
+                        key, keyDiags := decodeProviderConfigRef(pair.Key, "providers")
+                        diags = append(diags, keyDiags...)
+                        value, valueDiags := decodeProviderConfigRef(pair.Value, "providers")
+                        diags = append(diags, valueDiags...)
+                        if keyDiags.HasErrors() || valueDiags.HasErrors() {
+                                continue
+                        }
+
+                        matchKey := key.String()
+                        if prev, exists := seen[matchKey]; exists {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate provider address",
+                                        Detail:   fmt.Sprintf("A provider configuration was already passed to %s at %s. Each child provider configuration can be assigned only once.", matchKey, prev),
+                                        Subject:  pair.Value.Range().Ptr(),
+                                })
+                                continue
+                        }
+
+                        rng := hcl.RangeBetween(pair.Key.Range(), pair.Value.Range())
+                        seen[matchKey] = rng
+                        mc.Providers = append(mc.Providers, PassedProviderConfig{
+                                InChild:  key,
+                                InParent: value,
+                        })
+                }
+        }
+
+        // Reserved block types (all of them)
+        for _, block := range content.Blocks {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved block type name in module block",
+                        Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                        Subject:  &block.TypeRange,
+                })
+        }
+
+        return mc, diags
+}
+
+// PassedProviderConfig represents a provider config explicitly passed down to
+// a child module, possibly giving it a new local address in the process.
+type PassedProviderConfig struct {
+        InChild  *ProviderConfigRef
+        InParent *ProviderConfigRef
+}
+
+var moduleBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name:     "source",
+                        Required: true,
+                },
+                {
+                        Name: "version",
+                },
+                {
+                        Name: "count",
+                },
+                {
+                        Name: "for_each",
+                },
+                {
+                        Name: "depends_on",
+                },
+                {
+                        Name: "providers",
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                // These are all reserved for future use.
+                {Type: "lifecycle"},
+                {Type: "locals"},
+                {Type: "provider", LabelNames: []string{"type"}},
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/module_merge.go b/vendor/github.com/hashicorp/terraform/configs/module_merge.go
new file mode 100644
index 0000000..12614c1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module_merge.go
@@ -0,0 +1,247 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// The methods in this file are used by Module.mergeFile to apply overrides
+// to our different configuration elements. These methods all follow the
+// pattern of mutating the receiver to incorporate settings from the parameter,
+// returning error diagnostics if any aspect of the parameter cannot be merged
+// into the receiver for some reason.
+//
+// User expectation is that anything _explicitly_ set in the given object
+// should take precedence over the corresponding settings in the receiver,
+// but that anything omitted in the given object should be left unchanged.
+// In some cases it may be reasonable to do a "deep merge" of certain nested
+// features, if it is possible to unambiguously correlate the nested elements
+// and their behaviors are orthogonal to each other.
+
+func (p *Provider) merge(op *Provider) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if op.Version.Required != nil {
+                p.Version = op.Version
+        }
+
+        p.Config = MergeBodies(p.Config, op.Config)
+
+        return diags
+}
+
+func mergeProviderVersionConstraints(recv map[string][]VersionConstraint, ovrd []*ProviderRequirement) {
+        // Any provider name that's mentioned in the override gets nilled out in
+        // our map so that we'll rebuild it below. Any provider not mentioned is
+        // left unchanged.
+        for _, reqd := range ovrd {
+                delete(recv, reqd.Name)
+        }
+        for _, reqd := range ovrd {
+                recv[reqd.Name] = append(recv[reqd.Name], reqd.Requirement)
+        }
+}
+
+func (v *Variable) merge(ov *Variable) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if ov.DescriptionSet {
+                v.Description = ov.Description
+                v.DescriptionSet = ov.DescriptionSet
+        }
+        if ov.Default != cty.NilVal {
+                v.Default = ov.Default
+        }
+        if ov.Type != cty.NilType {
+                v.Type = ov.Type
+        }
+        if ov.ParsingMode != 0 {
+                v.ParsingMode = ov.ParsingMode
+        }
+
+        // If the override file overrode type without default or vice-versa then
+        // it may have created an invalid situation, which we'll catch now by
+        // attempting to re-convert the value.
+        //
+        // Note that here we may be re-converting an already-converted base value
+        // from the base config. This will be a no-op if the type was not changed,
+        // but in particular might be user-observable in the edge case where the
+        // literal value in config could've been converted to the overridden type
+        // constraint but the converted value cannot. In practice, this situation
+        // should be rare since most of our conversions are interchangable.
+        if v.Default != cty.NilVal {
+                val, err := convert.Convert(v.Default, v.Type)
+                if err != nil {
+                        // What exactly we'll say in the error message here depends on whether
+                        // it was Default or Type that was overridden here.
+                        switch {
+                        case ov.Type != cty.NilType && ov.Default == cty.NilVal:
+                                // If only the type was overridden
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("Overriding this variable's type constraint has made its default value invalid: %s.", err),
+                                        Subject:  &ov.DeclRange,
+                                })
+                        case ov.Type == cty.NilType && ov.Default != cty.NilVal:
+                                // Only the default was overridden
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("The overridden default value for this variable is not compatible with the variable's type constraint: %s.", err),
+                                        Subject:  &ov.DeclRange,
+                                })
+                        default:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("This variable's default value is not compatible with its type constraint: %s.", err),
+                                        Subject:  &ov.DeclRange,
+                                })
+                        }
+                } else {
+                        v.Default = val
+                }
+        }
+
+        return diags
+}
+
+func (l *Local) merge(ol *Local) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        // Since a local is just a single expression in configuration, the
+        // override definition entirely replaces the base definition, including
+        // the source range so that we'll send the user to the right place if
+        // there is an error.
+        l.Expr = ol.Expr
+        l.DeclRange = ol.DeclRange
+
+        return diags
+}
+
+func (o *Output) merge(oo *Output) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if oo.Description != "" {
+                o.Description = oo.Description
+        }
+        if oo.Expr != nil {
+                o.Expr = oo.Expr
+        }
+        if oo.SensitiveSet {
+                o.Sensitive = oo.Sensitive
+                o.SensitiveSet = oo.SensitiveSet
+        }
+
+        // We don't allow depends_on to be overridden because that is likely to
+        // cause confusing misbehavior.
+        if len(oo.DependsOn) != 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported override",
+                        Detail:   "The depends_on argument may not be overridden.",
+                        Subject:  oo.DependsOn[0].SourceRange().Ptr(), // the first item is the closest range we have
+                })
+        }
+
+        return diags
+}
+
+func (mc *ModuleCall) merge(omc *ModuleCall) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if omc.SourceSet {
+                mc.SourceAddr = omc.SourceAddr
+                mc.SourceAddrRange = omc.SourceAddrRange
+                mc.SourceSet = omc.SourceSet
+        }
+
+        if omc.Count != nil {
+                mc.Count = omc.Count
+        }
+
+        if omc.ForEach != nil {
+                mc.ForEach = omc.ForEach
+        }
+
+        if len(omc.Version.Required) != 0 {
+                mc.Version = omc.Version
+        }
+
+        mc.Config = MergeBodies(mc.Config, omc.Config)
+
+        // We don't allow depends_on to be overridden because that is likely to
+        // cause confusing misbehavior.
+        if len(mc.DependsOn) != 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported override",
+                        Detail:   "The depends_on argument may not be overridden.",
+                        Subject:  mc.DependsOn[0].SourceRange().Ptr(), // the first item is the closest range we have
+                })
+        }
+
+        return diags
+}
+
+func (r *Resource) merge(or *Resource) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if r.Mode != or.Mode {
+                // This is always a programming error, since managed and data resources
+                // are kept in separate maps in the configuration structures.
+                panic(fmt.Errorf("can't merge %s into %s", or.Mode, r.Mode))
+        }
+
+        if or.Count != nil {
+                r.Count = or.Count
+        }
+        if or.ForEach != nil {
+                r.ForEach = or.ForEach
+        }
+        if or.ProviderConfigRef != nil {
+                r.ProviderConfigRef = or.ProviderConfigRef
+        }
+        if r.Mode == addrs.ManagedResourceMode {
+                // or.Managed is always non-nil for managed resource mode
+
+                if or.Managed.Connection != nil {
+                        r.Managed.Connection = or.Managed.Connection
+                }
+                if or.Managed.CreateBeforeDestroySet {
+                        r.Managed.CreateBeforeDestroy = or.Managed.CreateBeforeDestroy
+                        r.Managed.CreateBeforeDestroySet = or.Managed.CreateBeforeDestroySet
+                }
+                if len(or.Managed.IgnoreChanges) != 0 {
+                        r.Managed.IgnoreChanges = or.Managed.IgnoreChanges
+                }
+                if or.Managed.PreventDestroySet {
+                        r.Managed.PreventDestroy = or.Managed.PreventDestroy
+                        r.Managed.PreventDestroySet = or.Managed.PreventDestroySet
+                }
+                if len(or.Managed.Provisioners) != 0 {
+                        r.Managed.Provisioners = or.Managed.Provisioners
+                }
+        }
+
+        r.Config = MergeBodies(r.Config, or.Config)
+
+        // We don't allow depends_on to be overridden because that is likely to
+        // cause confusing misbehavior.
+        if len(or.DependsOn) != 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported override",
+                        Detail:   "The depends_on argument may not be overridden.",
+                        Subject:  or.DependsOn[0].SourceRange().Ptr(), // the first item is the closest range we have
+                })
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/module_merge_body.go b/vendor/github.com/hashicorp/terraform/configs/module_merge_body.go
new file mode 100644
index 0000000..0ed561e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module_merge_body.go
@@ -0,0 +1,143 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// MergeBodies creates a new HCL body that contains a combination of the
+// given base and override bodies. Attributes and blocks defined in the
+// override body take precedence over those of the same name defined in
+// the base body.
+//
+// If any block of a particular type appears in "override" then it will
+// replace _all_ of the blocks of the same type in "base" in the new
+// body.
+func MergeBodies(base, override hcl.Body) hcl.Body {
+        return mergeBody{
+                Base:     base,
+                Override: override,
+        }
+}
+
+// mergeBody is a hcl.Body implementation that wraps a pair of other bodies
+// and allows attributes and blocks within the override to take precedence
+// over those defined in the base body.
+//
+// This is used to deal with dynamically-processed bodies in Module.mergeFile.
+// It uses a shallow-only merging strategy where direct attributes defined
+// in Override will override attributes of the same name in Base, while any
+// blocks defined in Override will hide all blocks of the same type in Base.
+//
+// This cannot possibly "do the right thing" in all cases, because we don't
+// have enough information about user intent. However, this behavior is intended
+// to be reasonable for simple overriding use-cases.
+type mergeBody struct {
+        Base     hcl.Body
+        Override hcl.Body
+}
+
+var _ hcl.Body = mergeBody{}
+
+func (b mergeBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        baseSchema := schemaWithDynamic(schema)
+        overrideSchema := schemaWithDynamic(schemaForOverrides(schema))
+
+        baseContent, _, cDiags := b.Base.PartialContent(baseSchema)
+        diags = append(diags, cDiags...)
+        overrideContent, _, cDiags := b.Override.PartialContent(overrideSchema)
+        diags = append(diags, cDiags...)
+
+        content := b.prepareContent(baseContent, overrideContent)
+
+        return content, diags
+}
+
+func (b mergeBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        baseSchema := schemaWithDynamic(schema)
+        overrideSchema := schemaWithDynamic(schemaForOverrides(schema))
+
+        baseContent, baseRemain, cDiags := b.Base.PartialContent(baseSchema)
+        diags = append(diags, cDiags...)
+        overrideContent, overrideRemain, cDiags := b.Override.PartialContent(overrideSchema)
+        diags = append(diags, cDiags...)
+
+        content := b.prepareContent(baseContent, overrideContent)
+
+        remain := MergeBodies(baseRemain, overrideRemain)
+
+        return content, remain, diags
+}
+
+func (b mergeBody) prepareContent(base *hcl.BodyContent, override *hcl.BodyContent) *hcl.BodyContent {
+        content := &hcl.BodyContent{
+                Attributes: make(hcl.Attributes),
+        }
+
+        // For attributes we just assign from each map in turn and let the override
+        // map clobber any matching entries from base.
+        for k, a := range base.Attributes {
+                content.Attributes[k] = a
+        }
+        for k, a := range override.Attributes {
+                content.Attributes[k] = a
+        }
+
+        // Things are a little more interesting for blocks because they arrive
+        // as a flat list. Our merging semantics call for us to suppress blocks
+        // from base if at least one block of the same type appears in override.
+        // We explicitly do not try to correlate and deeply merge nested blocks,
+        // since we don't have enough context here to infer user intent.
+
+        overriddenBlockTypes := make(map[string]bool)
+        for _, block := range override.Blocks {
+                if block.Type == "dynamic" {
+                        overriddenBlockTypes[block.Labels[0]] = true
+                        continue
+                }
+                overriddenBlockTypes[block.Type] = true
+        }
+        for _, block := range base.Blocks {
+                // We skip over dynamic blocks whose type label is an overridden type
+                // but note that below we do still leave them as dynamic blocks in
+                // the result because expanding the dynamic blocks that are left is
+                // done much later during the core graph walks, where we can safely
+                // evaluate the expressions.
+                if block.Type == "dynamic" && overriddenBlockTypes[block.Labels[0]] {
+                        continue
+                }
+                if overriddenBlockTypes[block.Type] {
+                        continue
+                }
+                content.Blocks = append(content.Blocks, block)
+        }
+        for _, block := range override.Blocks {
+                content.Blocks = append(content.Blocks, block)
+        }
+
+        return content
+}
+
+func (b mergeBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        ret := make(hcl.Attributes)
+
+        baseAttrs, aDiags := b.Base.JustAttributes()
+        diags = append(diags, aDiags...)
+        overrideAttrs, aDiags := b.Override.JustAttributes()
+        diags = append(diags, aDiags...)
+
+        for k, a := range baseAttrs {
+                ret[k] = a
+        }
+        for k, a := range overrideAttrs {
+                ret[k] = a
+        }
+
+        return ret, diags
+}
+
+func (b mergeBody) MissingItemRange() hcl.Range {
+        return b.Base.MissingItemRange()
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/named_values.go b/vendor/github.com/hashicorp/terraform/configs/named_values.go
new file mode 100644
index 0000000..6f6b469
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/named_values.go
@@ -0,0 +1,364 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/ext/typeexpr"
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// A consistent detail message for all "not a valid identifier" diagnostics.
+const badIdentifierDetail = "A name must start with a letter and may contain only letters, digits, underscores, and dashes."
+
+// Variable represents a "variable" block in a module or file.
+type Variable struct {
+        Name        string
+        Description string
+        Default     cty.Value
+        Type        cty.Type
+        ParsingMode VariableParsingMode
+
+        DescriptionSet bool
+
+        DeclRange hcl.Range
+}
+
+func decodeVariableBlock(block *hcl.Block, override bool) (*Variable, hcl.Diagnostics) {
+        v := &Variable{
+                Name:      block.Labels[0],
+                DeclRange: block.DefRange,
+        }
+
+        // Unless we're building an override, we'll set some defaults
+        // which we might override with attributes below. We leave these
+        // as zero-value in the override case so we can recognize whether
+        // or not they are set when we merge.
+        if !override {
+                v.Type = cty.DynamicPseudoType
+                v.ParsingMode = VariableParseLiteral
+        }
+
+        content, diags := block.Body.Content(variableBlockSchema)
+
+        if !hclsyntax.ValidIdentifier(v.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid variable name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+
+        // Don't allow declaration of variables that would conflict with the
+        // reserved attribute and block type names in a "module" block, since
+        // these won't be usable for child modules.
+        for _, attr := range moduleBlockSchema.Attributes {
+                if attr.Name == v.Name {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid variable name",
+                                Detail:   fmt.Sprintf("The variable name %q is reserved due to its special meaning inside module blocks.", attr.Name),
+                                Subject:  &block.LabelRanges[0],
+                        })
+                }
+        }
+        for _, blockS := range moduleBlockSchema.Blocks {
+                if blockS.Type == v.Name {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid variable name",
+                                Detail:   fmt.Sprintf("The variable name %q is reserved due to its special meaning inside module blocks.", blockS.Type),
+                                Subject:  &block.LabelRanges[0],
+                        })
+                }
+        }
+
+        if attr, exists := content.Attributes["description"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &v.Description)
+                diags = append(diags, valDiags...)
+                v.DescriptionSet = true
+        }
+
+        if attr, exists := content.Attributes["type"]; exists {
+                ty, parseMode, tyDiags := decodeVariableType(attr.Expr)
+                diags = append(diags, tyDiags...)
+                v.Type = ty
+                v.ParsingMode = parseMode
+        }
+
+        if attr, exists := content.Attributes["default"]; exists {
+                val, valDiags := attr.Expr.Value(nil)
+                diags = append(diags, valDiags...)
+
+                // Convert the default to the expected type so we can catch invalid
+                // defaults early and allow later code to assume validity.
+                // Note that this depends on us having already processed any "type"
+                // attribute above.
+                // However, we can't do this if we're in an override file where
+                // the type might not be set; we'll catch that during merge.
+                if v.Type != cty.NilType {
+                        var err error
+                        val, err = convert.Convert(val, v.Type)
+                        if err != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("This default value is not compatible with the variable's type constraint: %s.", err),
+                                        Subject:  attr.Expr.Range().Ptr(),
+                                })
+                                val = cty.DynamicVal
+                        }
+                }
+
+                v.Default = val
+        }
+
+        return v, diags
+}
+
+func decodeVariableType(expr hcl.Expression) (cty.Type, VariableParsingMode, hcl.Diagnostics) {
+        if exprIsNativeQuotedString(expr) {
+                // Here we're accepting the pre-0.12 form of variable type argument where
+                // the string values "string", "list" and "map" are accepted has a hint
+                // about the type used primarily for deciding how to parse values
+                // given on the command line and in environment variables.
+                // Only the native syntax ends up in this codepath; we handle the
+                // JSON syntax (which is, of course, quoted even in the new format)
+                // in the normal codepath below.
+                val, diags := expr.Value(nil)
+                if diags.HasErrors() {
+                        return cty.DynamicPseudoType, VariableParseHCL, diags
+                }
+                str := val.AsString()
+                switch str {
+                case "string":
+                        return cty.String, VariableParseLiteral, diags
+                case "list":
+                        return cty.List(cty.DynamicPseudoType), VariableParseHCL, diags
+                case "map":
+                        return cty.Map(cty.DynamicPseudoType), VariableParseHCL, diags
+                default:
+                        return cty.DynamicPseudoType, VariableParseHCL, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid legacy variable type hint",
+                                Detail:   `The legacy variable type hint form, using a quoted string, allows only the values "string", "list", and "map". To provide a full type expression, remove the surrounding quotes and give the type expression directly.`,
+                                Subject:  expr.Range().Ptr(),
+                        }}
+                }
+        }
+
+        // First we'll deal with some shorthand forms that the HCL-level type
+        // expression parser doesn't include. These both emulate pre-0.12 behavior
+        // of allowing a list or map of any element type as long as all of the
+        // elements are consistent. This is the same as list(any) or map(any).
+        switch hcl.ExprAsKeyword(expr) {
+        case "list":
+                return cty.List(cty.DynamicPseudoType), VariableParseHCL, nil
+        case "map":
+                return cty.Map(cty.DynamicPseudoType), VariableParseHCL, nil
+        }
+
+        ty, diags := typeexpr.TypeConstraint(expr)
+        if diags.HasErrors() {
+                return cty.DynamicPseudoType, VariableParseHCL, diags
+        }
+
+        switch {
+        case ty.IsPrimitiveType():
+                // Primitive types use literal parsing.
+                return ty, VariableParseLiteral, diags
+        default:
+                // Everything else uses HCL parsing
+                return ty, VariableParseHCL, diags
+        }
+}
+
+// VariableParsingMode defines how values of a particular variable given by
+// text-only mechanisms (command line arguments and environment variables)
+// should be parsed to produce the final value.
+type VariableParsingMode rune
+
+// VariableParseLiteral is a variable parsing mode that just takes the given
+// string directly as a cty.String value.
+const VariableParseLiteral VariableParsingMode = 'L'
+
+// VariableParseHCL is a variable parsing mode that attempts to parse the given
+// string as an HCL expression and returns the result.
+const VariableParseHCL VariableParsingMode = 'H'
+
+// Parse uses the receiving parsing mode to process the given variable value
+// string, returning the result along with any diagnostics.
+//
+// A VariableParsingMode does not know the expected type of the corresponding
+// variable, so it's the caller's responsibility to attempt to convert the
+// result to the appropriate type and return to the user any diagnostics that
+// conversion may produce.
+//
+// The given name is used to create a synthetic filename in case any diagnostics
+// must be generated about the given string value. This should be the name
+// of the root module variable whose value will be populated from the given
+// string.
+//
+// If the returned diagnostics has errors, the returned value may not be
+// valid.
+func (m VariableParsingMode) Parse(name, value string) (cty.Value, hcl.Diagnostics) {
+        switch m {
+        case VariableParseLiteral:
+                return cty.StringVal(value), nil
+        case VariableParseHCL:
+                fakeFilename := fmt.Sprintf("<value for var.%s>", name)
+                expr, diags := hclsyntax.ParseExpression([]byte(value), fakeFilename, hcl.Pos{Line: 1, Column: 1})
+                if diags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+                val, valDiags := expr.Value(nil)
+                diags = append(diags, valDiags...)
+                return val, diags
+        default:
+                // Should never happen
+                panic(fmt.Errorf("Parse called on invalid VariableParsingMode %#v", m))
+        }
+}
+
+// Output represents an "output" block in a module or file.
+type Output struct {
+        Name        string
+        Description string
+        Expr        hcl.Expression
+        DependsOn   []hcl.Traversal
+        Sensitive   bool
+
+        DescriptionSet bool
+        SensitiveSet   bool
+
+        DeclRange hcl.Range
+}
+
+func decodeOutputBlock(block *hcl.Block, override bool) (*Output, hcl.Diagnostics) {
+        o := &Output{
+                Name:      block.Labels[0],
+                DeclRange: block.DefRange,
+        }
+
+        schema := outputBlockSchema
+        if override {
+                schema = schemaForOverrides(schema)
+        }
+
+        content, diags := block.Body.Content(schema)
+
+        if !hclsyntax.ValidIdentifier(o.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid output name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+
+        if attr, exists := content.Attributes["description"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &o.Description)
+                diags = append(diags, valDiags...)
+                o.DescriptionSet = true
+        }
+
+        if attr, exists := content.Attributes["value"]; exists {
+                o.Expr = attr.Expr
+        }
+
+        if attr, exists := content.Attributes["sensitive"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &o.Sensitive)
+                diags = append(diags, valDiags...)
+                o.SensitiveSet = true
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                o.DependsOn = append(o.DependsOn, deps...)
+        }
+
+        return o, diags
+}
+
+// Local represents a single entry from a "locals" block in a module or file.
+// The "locals" block itself is not represented, because it serves only to
+// provide context for us to interpret its contents.
+type Local struct {
+        Name string
+        Expr hcl.Expression
+
+        DeclRange hcl.Range
+}
+
+func decodeLocalsBlock(block *hcl.Block) ([]*Local, hcl.Diagnostics) {
+        attrs, diags := block.Body.JustAttributes()
+        if len(attrs) == 0 {
+                return nil, diags
+        }
+
+        locals := make([]*Local, 0, len(attrs))
+        for name, attr := range attrs {
+                if !hclsyntax.ValidIdentifier(name) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid local value name",
+                                Detail:   badIdentifierDetail,
+                                Subject:  &attr.NameRange,
+                        })
+                }
+
+                locals = append(locals, &Local{
+                        Name:      name,
+                        Expr:      attr.Expr,
+                        DeclRange: attr.Range,
+                })
+        }
+        return locals, diags
+}
+
+// Addr returns the address of the local value declared by the receiver,
+// relative to its containing module.
+func (l *Local) Addr() addrs.LocalValue {
+        return addrs.LocalValue{
+                Name: l.Name,
+        }
+}
+
+var variableBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "description",
+                },
+                {
+                        Name: "default",
+                },
+                {
+                        Name: "type",
+                },
+        },
+}
+
+var outputBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "description",
+                },
+                {
+                        Name:     "value",
+                        Required: true,
+                },
+                {
+                        Name: "depends_on",
+                },
+                {
+                        Name: "sensitive",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser.go b/vendor/github.com/hashicorp/terraform/configs/parser.go
new file mode 100644
index 0000000..8176fa1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser.go
@@ -0,0 +1,100 @@
+package configs
+
+import (
+        "fmt"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hclparse"
+        "github.com/spf13/afero"
+)
+
+// Parser is the main interface to read configuration files and other related
+// files from disk.
+//
+// It retains a cache of all files that are loaded so that they can be used
+// to create source code snippets in diagnostics, etc.
+type Parser struct {
+        fs afero.Afero
+        p  *hclparse.Parser
+}
+
+// NewParser creates and returns a new Parser that reads files from the given
+// filesystem. If a nil filesystem is passed then the system's "real" filesystem
+// will be used, via afero.OsFs.
+func NewParser(fs afero.Fs) *Parser {
+        if fs == nil {
+                fs = afero.OsFs{}
+        }
+
+        return &Parser{
+                fs: afero.Afero{Fs: fs},
+                p:  hclparse.NewParser(),
+        }
+}
+
+// LoadHCLFile is a low-level method that reads the file at the given path,
+// parses it, and returns the hcl.Body representing its root. In many cases
+// it is better to use one of the other Load*File methods on this type,
+// which additionally decode the root body in some way and return a higher-level
+// construct.
+//
+// If the file cannot be read at all -- e.g. because it does not exist -- then
+// this method will return a nil body and error diagnostics. In this case
+// callers may wish to ignore the provided error diagnostics and produce
+// a more context-sensitive error instead.
+//
+// The file will be parsed using the HCL native syntax unless the filename
+// ends with ".json", in which case the HCL JSON syntax will be used.
+func (p *Parser) LoadHCLFile(path string) (hcl.Body, hcl.Diagnostics) {
+        src, err := p.fs.ReadFile(path)
+
+        if err != nil {
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Failed to read file",
+                                Detail:   fmt.Sprintf("The file %q could not be read.", path),
+                        },
+                }
+        }
+
+        var file *hcl.File
+        var diags hcl.Diagnostics
+        switch {
+        case strings.HasSuffix(path, ".json"):
+                file, diags = p.p.ParseJSON(src, path)
+        default:
+                file, diags = p.p.ParseHCL(src, path)
+        }
+
+        // If the returned file or body is nil, then we'll return a non-nil empty
+        // body so we'll meet our contract that nil means an error reading the file.
+        if file == nil || file.Body == nil {
+                return hcl.EmptyBody(), diags
+        }
+
+        return file.Body, diags
+}
+
+// Sources returns a map of the cached source buffers for all files that
+// have been loaded through this parser, with source filenames (as requested
+// when each file was opened) as the keys.
+func (p *Parser) Sources() map[string][]byte {
+        return p.p.Sources()
+}
+
+// ForceFileSource artificially adds source code to the cache of file sources,
+// as if it had been loaded from the given filename.
+//
+// This should be used only in special situations where configuration is loaded
+// some other way. Most callers should load configuration via methods of
+// Parser, which will update the sources cache automatically.
+func (p *Parser) ForceFileSource(filename string, src []byte) {
+        // We'll make a synthetic hcl.File here just so we can reuse the
+        // existing cache.
+        p.p.AddFile(filename, &hcl.File{
+                Body:  hcl.EmptyBody(),
+                Bytes: src,
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser_config.go b/vendor/github.com/hashicorp/terraform/configs/parser_config.go
new file mode 100644
index 0000000..7f2ff27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser_config.go
@@ -0,0 +1,247 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// LoadConfigFile reads the file at the given path and parses it as a config
+// file.
+//
+// If the file cannot be read -- for example, if it does not exist -- then
+// a nil *File will be returned along with error diagnostics. Callers may wish
+// to disregard the returned diagnostics in this case and instead generate
+// their own error message(s) with additional context.
+//
+// If the returned diagnostics has errors when a non-nil map is returned
+// then the map may be incomplete but should be valid enough for careful
+// static analysis.
+//
+// This method wraps LoadHCLFile, and so it inherits the syntax selection
+// behaviors documented for that method.
+func (p *Parser) LoadConfigFile(path string) (*File, hcl.Diagnostics) {
+        return p.loadConfigFile(path, false)
+}
+
+// LoadConfigFileOverride is the same as LoadConfigFile except that it relaxes
+// certain required attribute constraints in order to interpret the given
+// file as an overrides file.
+func (p *Parser) LoadConfigFileOverride(path string) (*File, hcl.Diagnostics) {
+        return p.loadConfigFile(path, true)
+}
+
+func (p *Parser) loadConfigFile(path string, override bool) (*File, hcl.Diagnostics) {
+
+        body, diags := p.LoadHCLFile(path)
+        if body == nil {
+                return nil, diags
+        }
+
+        file := &File{}
+
+        var reqDiags hcl.Diagnostics
+        file.CoreVersionConstraints, reqDiags = sniffCoreVersionRequirements(body)
+        diags = append(diags, reqDiags...)
+
+        content, contentDiags := body.Content(configFileSchema)
+        diags = append(diags, contentDiags...)
+
+        for _, block := range content.Blocks {
+                switch block.Type {
+
+                case "terraform":
+                        content, contentDiags := block.Body.Content(terraformBlockSchema)
+                        diags = append(diags, contentDiags...)
+
+                        // We ignore the "terraform_version" attribute here because
+                        // sniffCoreVersionRequirements already dealt with that above.
+
+                        for _, innerBlock := range content.Blocks {
+                                switch innerBlock.Type {
+
+                                case "backend":
+                                        backendCfg, cfgDiags := decodeBackendBlock(innerBlock)
+                                        diags = append(diags, cfgDiags...)
+                                        if backendCfg != nil {
+                                                file.Backends = append(file.Backends, backendCfg)
+                                        }
+
+                                case "required_providers":
+                                        reqs, reqsDiags := decodeRequiredProvidersBlock(innerBlock)
+                                        diags = append(diags, reqsDiags...)
+                                        file.ProviderRequirements = append(file.ProviderRequirements, reqs...)
+
+                                default:
+                                        // Should never happen because the above cases should be exhaustive
+                                        // for all block type names in our schema.
+                                        continue
+
+                                }
+                        }
+
+                case "provider":
+                        cfg, cfgDiags := decodeProviderBlock(block)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.ProviderConfigs = append(file.ProviderConfigs, cfg)
+                        }
+
+                case "variable":
+                        cfg, cfgDiags := decodeVariableBlock(block, override)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.Variables = append(file.Variables, cfg)
+                        }
+
+                case "locals":
+                        defs, defsDiags := decodeLocalsBlock(block)
+                        diags = append(diags, defsDiags...)
+                        file.Locals = append(file.Locals, defs...)
+
+                case "output":
+                        cfg, cfgDiags := decodeOutputBlock(block, override)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.Outputs = append(file.Outputs, cfg)
+                        }
+
+                case "module":
+                        cfg, cfgDiags := decodeModuleBlock(block, override)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.ModuleCalls = append(file.ModuleCalls, cfg)
+                        }
+
+                case "resource":
+                        cfg, cfgDiags := decodeResourceBlock(block)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.ManagedResources = append(file.ManagedResources, cfg)
+                        }
+
+                case "data":
+                        cfg, cfgDiags := decodeDataBlock(block)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.DataResources = append(file.DataResources, cfg)
+                        }
+
+                default:
+                        // Should never happen because the above cases should be exhaustive
+                        // for all block type names in our schema.
+                        continue
+
+                }
+        }
+
+        return file, diags
+}
+
+// sniffCoreVersionRequirements does minimal parsing of the given body for
+// "terraform" blocks with "required_version" attributes, returning the
+// requirements found.
+//
+// This is intended to maximize the chance that we'll be able to read the
+// requirements (syntax errors notwithstanding) even if the config file contains
+// constructs that might've been added in future Terraform versions
+//
+// This is a "best effort" sort of method which will return constraints it is
+// able to find, but may return no constraints at all if the given body is
+// so invalid that it cannot be decoded at all.
+func sniffCoreVersionRequirements(body hcl.Body) ([]VersionConstraint, hcl.Diagnostics) {
+        rootContent, _, diags := body.PartialContent(configFileVersionSniffRootSchema)
+
+        var constraints []VersionConstraint
+
+        for _, block := range rootContent.Blocks {
+                content, _, blockDiags := block.Body.PartialContent(configFileVersionSniffBlockSchema)
+                diags = append(diags, blockDiags...)
+
+                attr, exists := content.Attributes["required_version"]
+                if !exists {
+                        continue
+                }
+
+                constraint, constraintDiags := decodeVersionConstraint(attr)
+                diags = append(diags, constraintDiags...)
+                if !constraintDiags.HasErrors() {
+                        constraints = append(constraints, constraint)
+                }
+        }
+
+        return constraints, diags
+}
+
+// configFileSchema is the schema for the top-level of a config file. We use
+// the low-level HCL API for this level so we can easily deal with each
+// block type separately with its own decoding logic.
+var configFileSchema = &hcl.BodySchema{
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "terraform",
+                },
+                {
+                        Type:       "provider",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "variable",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type: "locals",
+                },
+                {
+                        Type:       "output",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "module",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "resource",
+                        LabelNames: []string{"type", "name"},
+                },
+                {
+                        Type:       "data",
+                        LabelNames: []string{"type", "name"},
+                },
+        },
+}
+
+// terraformBlockSchema is the schema for a top-level "terraform" block in
+// a configuration file.
+var terraformBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "required_version",
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type:       "backend",
+                        LabelNames: []string{"type"},
+                },
+                {
+                        Type: "required_providers",
+                },
+        },
+}
+
+// configFileVersionSniffRootSchema is a schema for sniffCoreVersionRequirements
+var configFileVersionSniffRootSchema = &hcl.BodySchema{
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "terraform",
+                },
+        },
+}
+
+// configFileVersionSniffBlockSchema is a schema for sniffCoreVersionRequirements
+var configFileVersionSniffBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "required_version",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser_config_dir.go b/vendor/github.com/hashicorp/terraform/configs/parser_config_dir.go
new file mode 100644
index 0000000..3014cb4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser_config_dir.go
@@ -0,0 +1,142 @@
+package configs
+
+import (
+        "fmt"
+        "path/filepath"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// LoadConfigDir reads the .tf and .tf.json files in the given directory
+// as config files (using LoadConfigFile) and then combines these files into
+// a single Module.
+//
+// If this method returns nil, that indicates that the given directory does not
+// exist at all or could not be opened for some reason. Callers may wish to
+// detect this case and ignore the returned diagnostics so that they can
+// produce a more context-aware error message in that case.
+//
+// If this method returns a non-nil module while error diagnostics are returned
+// then the module may be incomplete but can be used carefully for static
+// analysis.
+//
+// This file does not consider a directory with no files to be an error, and
+// will simply return an empty module in that case. Callers should first call
+// Parser.IsConfigDir if they wish to recognize that situation.
+//
+// .tf files are parsed using the HCL native syntax while .tf.json files are
+// parsed using the HCL JSON syntax.
+func (p *Parser) LoadConfigDir(path string) (*Module, hcl.Diagnostics) {
+        primaryPaths, overridePaths, diags := p.dirFiles(path)
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        primary, fDiags := p.loadFiles(primaryPaths, false)
+        diags = append(diags, fDiags...)
+        override, fDiags := p.loadFiles(overridePaths, true)
+        diags = append(diags, fDiags...)
+
+        mod, modDiags := NewModule(primary, override)
+        diags = append(diags, modDiags...)
+
+        mod.SourceDir = path
+
+        return mod, diags
+}
+
+// ConfigDirFiles returns lists of the primary and override files configuration
+// files in the given directory.
+//
+// If the given directory does not exist or cannot be read, error diagnostics
+// are returned. If errors are returned, the resulting lists may be incomplete.
+func (p Parser) ConfigDirFiles(dir string) (primary, override []string, diags hcl.Diagnostics) {
+        return p.dirFiles(dir)
+}
+
+// IsConfigDir determines whether the given path refers to a directory that
+// exists and contains at least one Terraform config file (with a .tf or
+// .tf.json extension.)
+func (p *Parser) IsConfigDir(path string) bool {
+        primaryPaths, overridePaths, _ := p.dirFiles(path)
+        return (len(primaryPaths) + len(overridePaths)) > 0
+}
+
+func (p *Parser) loadFiles(paths []string, override bool) ([]*File, hcl.Diagnostics) {
+        var files []*File
+        var diags hcl.Diagnostics
+
+        for _, path := range paths {
+                var f *File
+                var fDiags hcl.Diagnostics
+                if override {
+                        f, fDiags = p.LoadConfigFileOverride(path)
+                } else {
+                        f, fDiags = p.LoadConfigFile(path)
+                }
+                diags = append(diags, fDiags...)
+                if f != nil {
+                        files = append(files, f)
+                }
+        }
+
+        return files, diags
+}
+
+func (p *Parser) dirFiles(dir string) (primary, override []string, diags hcl.Diagnostics) {
+        infos, err := p.fs.ReadDir(dir)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Failed to read module directory",
+                        Detail:   fmt.Sprintf("Module directory %s does not exist or cannot be read.", dir),
+                })
+                return
+        }
+
+        for _, info := range infos {
+                if info.IsDir() {
+                        // We only care about files
+                        continue
+                }
+
+                name := info.Name()
+                ext := fileExt(name)
+                if ext == "" || IsIgnoredFile(name) {
+                        continue
+                }
+
+                baseName := name[:len(name)-len(ext)] // strip extension
+                isOverride := baseName == "override" || strings.HasSuffix(baseName, "_override")
+
+                fullPath := filepath.Join(dir, name)
+                if isOverride {
+                        override = append(override, fullPath)
+                } else {
+                        primary = append(primary, fullPath)
+                }
+        }
+
+        return
+}
+
+// fileExt returns the Terraform configuration extension of the given
+// path, or a blank string if it is not a recognized extension.
+func fileExt(path string) string {
+        if strings.HasSuffix(path, ".tf") {
+                return ".tf"
+        } else if strings.HasSuffix(path, ".tf.json") {
+                return ".tf.json"
+        } else {
+                return ""
+        }
+}
+
+// IsIgnoredFile returns true if the given filename (which must not have a
+// directory path ahead of it) should be ignored as e.g. an editor swap file.
+func IsIgnoredFile(name string) bool {
+        return strings.HasPrefix(name, ".") || // Unix-like hidden files
+                strings.HasSuffix(name, "~") || // vim
+                strings.HasPrefix(name, "#") && strings.HasSuffix(name, "#") // emacs
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser_values.go b/vendor/github.com/hashicorp/terraform/configs/parser_values.go
new file mode 100644
index 0000000..b7f1c1c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser_values.go
@@ -0,0 +1,43 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// LoadValuesFile reads the file at the given path and parses it as a "values
+// file", which is an HCL config file whose top-level attributes are treated
+// as arbitrary key.value pairs.
+//
+// If the file cannot be read -- for example, if it does not exist -- then
+// a nil map will be returned along with error diagnostics. Callers may wish
+// to disregard the returned diagnostics in this case and instead generate
+// their own error message(s) with additional context.
+//
+// If the returned diagnostics has errors when a non-nil map is returned
+// then the map may be incomplete but should be valid enough for careful
+// static analysis.
+//
+// This method wraps LoadHCLFile, and so it inherits the syntax selection
+// behaviors documented for that method.
+func (p *Parser) LoadValuesFile(path string) (map[string]cty.Value, hcl.Diagnostics) {
+        body, diags := p.LoadHCLFile(path)
+        if body == nil {
+                return nil, diags
+        }
+
+        vals := make(map[string]cty.Value)
+        attrs, attrDiags := body.JustAttributes()
+        diags = append(diags, attrDiags...)
+        if attrs == nil {
+                return vals, diags
+        }
+
+        for name, attr := range attrs {
+                val, valDiags := attr.Expr.Value(nil)
+                diags = append(diags, valDiags...)
+                vals[name] = val
+        }
+
+        return vals, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provider.go b/vendor/github.com/hashicorp/terraform/configs/provider.go
new file mode 100644
index 0000000..d01d5cf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provider.go
@@ -0,0 +1,144 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Provider represents a "provider" block in a module or file. A provider
+// block is a provider configuration, and there can be zero or more
+// configurations for each actual provider.
+type Provider struct {
+        Name       string
+        NameRange  hcl.Range
+        Alias      string
+        AliasRange *hcl.Range // nil if no alias set
+
+        Version VersionConstraint
+
+        Config hcl.Body
+
+        DeclRange hcl.Range
+}
+
+func decodeProviderBlock(block *hcl.Block) (*Provider, hcl.Diagnostics) {
+        content, config, diags := block.Body.PartialContent(providerBlockSchema)
+
+        provider := &Provider{
+                Name:      block.Labels[0],
+                NameRange: block.LabelRanges[0],
+                Config:    config,
+                DeclRange: block.DefRange,
+        }
+
+        if attr, exists := content.Attributes["alias"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &provider.Alias)
+                diags = append(diags, valDiags...)
+                provider.AliasRange = attr.Expr.Range().Ptr()
+
+                if !hclsyntax.ValidIdentifier(provider.Alias) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration alias",
+                                Detail:   fmt.Sprintf("An alias must be a valid name. %s", badIdentifierDetail),
+                        })
+                }
+        }
+
+        if attr, exists := content.Attributes["version"]; exists {
+                var versionDiags hcl.Diagnostics
+                provider.Version, versionDiags = decodeVersionConstraint(attr)
+                diags = append(diags, versionDiags...)
+        }
+
+        // Reserved attribute names
+        for _, name := range []string{"count", "depends_on", "for_each", "source"} {
+                if attr, exists := content.Attributes[name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved argument name in provider block",
+                                Detail:   fmt.Sprintf("The provider argument name %q is reserved for use by Terraform in a future version.", name),
+                                Subject:  &attr.NameRange,
+                        })
+                }
+        }
+
+        // Reserved block types (all of them)
+        for _, block := range content.Blocks {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved block type name in provider block",
+                        Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                        Subject:  &block.TypeRange,
+                })
+        }
+
+        return provider, diags
+}
+
+// Addr returns the address of the receiving provider configuration, relative
+// to its containing module.
+func (p *Provider) Addr() addrs.ProviderConfig {
+        return addrs.ProviderConfig{
+                Type:  p.Name,
+                Alias: p.Alias,
+        }
+}
+
+func (p *Provider) moduleUniqueKey() string {
+        if p.Alias != "" {
+                return fmt.Sprintf("%s.%s", p.Name, p.Alias)
+        }
+        return p.Name
+}
+
+// ProviderRequirement represents a declaration of a dependency on a particular
+// provider version without actually configuring that provider. This is used in
+// child modules that expect a provider to be passed in from their parent.
+type ProviderRequirement struct {
+        Name        string
+        Requirement VersionConstraint
+}
+
+func decodeRequiredProvidersBlock(block *hcl.Block) ([]*ProviderRequirement, hcl.Diagnostics) {
+        attrs, diags := block.Body.JustAttributes()
+        var reqs []*ProviderRequirement
+        for name, attr := range attrs {
+                req, reqDiags := decodeVersionConstraint(attr)
+                diags = append(diags, reqDiags...)
+                if !diags.HasErrors() {
+                        reqs = append(reqs, &ProviderRequirement{
+                                Name:        name,
+                                Requirement: req,
+                        })
+                }
+        }
+        return reqs, diags
+}
+
+var providerBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "alias",
+                },
+                {
+                        Name: "version",
+                },
+
+                // Attribute names reserved for future expansion.
+                {Name: "count"},
+                {Name: "depends_on"},
+                {Name: "for_each"},
+                {Name: "source"},
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                // _All_ of these are reserved for future expansion.
+                {Type: "lifecycle"},
+                {Type: "locals"},
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provisioner.go b/vendor/github.com/hashicorp/terraform/configs/provisioner.go
new file mode 100644
index 0000000..b031dd0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provisioner.go
@@ -0,0 +1,150 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Provisioner represents a "provisioner" block when used within a
+// "resource" block in a module or file.
+type Provisioner struct {
+        Type       string
+        Config     hcl.Body
+        Connection *Connection
+        When       ProvisionerWhen
+        OnFailure  ProvisionerOnFailure
+
+        DeclRange hcl.Range
+        TypeRange hcl.Range
+}
+
+func decodeProvisionerBlock(block *hcl.Block) (*Provisioner, hcl.Diagnostics) {
+        pv := &Provisioner{
+                Type:      block.Labels[0],
+                TypeRange: block.LabelRanges[0],
+                DeclRange: block.DefRange,
+                When:      ProvisionerWhenCreate,
+                OnFailure: ProvisionerOnFailureFail,
+        }
+
+        content, config, diags := block.Body.PartialContent(provisionerBlockSchema)
+        pv.Config = config
+
+        if attr, exists := content.Attributes["when"]; exists {
+                expr, shimDiags := shimTraversalInString(attr.Expr, true)
+                diags = append(diags, shimDiags...)
+
+                switch hcl.ExprAsKeyword(expr) {
+                case "create":
+                        pv.When = ProvisionerWhenCreate
+                case "destroy":
+                        pv.When = ProvisionerWhenDestroy
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid \"when\" keyword",
+                                Detail:   "The \"when\" argument requires one of the following keywords: create or destroy.",
+                                Subject:  expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        if attr, exists := content.Attributes["on_failure"]; exists {
+                expr, shimDiags := shimTraversalInString(attr.Expr, true)
+                diags = append(diags, shimDiags...)
+
+                switch hcl.ExprAsKeyword(expr) {
+                case "continue":
+                        pv.OnFailure = ProvisionerOnFailureContinue
+                case "fail":
+                        pv.OnFailure = ProvisionerOnFailureFail
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid \"on_failure\" keyword",
+                                Detail:   "The \"on_failure\" argument requires one of the following keywords: continue or fail.",
+                                Subject:  attr.Expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        var seenConnection *hcl.Block
+        for _, block := range content.Blocks {
+                switch block.Type {
+
+                case "connection":
+                        if seenConnection != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate connection block",
+                                        Detail:   fmt.Sprintf("This provisioner already has a connection block at %s.", seenConnection.DefRange),
+                                        Subject:  &block.DefRange,
+                                })
+                                continue
+                        }
+                        seenConnection = block
+
+                        //conn, connDiags := decodeConnectionBlock(block)
+                        //diags = append(diags, connDiags...)
+                        pv.Connection = &Connection{
+                                Config:    block.Body,
+                                DeclRange: block.DefRange,
+                        }
+
+                default:
+                        // Any other block types are ones we've reserved for future use,
+                        // so they get a generic message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved block type name in provisioner block",
+                                Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return pv, diags
+}
+
+// Connection represents a "connection" block when used within either a
+// "resource" or "provisioner" block in a module or file.
+type Connection struct {
+        Config hcl.Body
+
+        DeclRange hcl.Range
+}
+
+// ProvisionerWhen is an enum for valid values for when to run provisioners.
+type ProvisionerWhen int
+
+//go:generate stringer -type ProvisionerWhen
+
+const (
+        ProvisionerWhenInvalid ProvisionerWhen = iota
+        ProvisionerWhenCreate
+        ProvisionerWhenDestroy
+)
+
+// ProvisionerOnFailure is an enum for valid values for on_failure options
+// for provisioners.
+type ProvisionerOnFailure int
+
+//go:generate stringer -type ProvisionerOnFailure
+
+const (
+        ProvisionerOnFailureInvalid ProvisionerOnFailure = iota
+        ProvisionerOnFailureContinue
+        ProvisionerOnFailureFail
+)
+
+var provisionerBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {Name: "when"},
+                {Name: "on_failure"},
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {Type: "connection"},
+                {Type: "lifecycle"}, // reserved for future use
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provisioneronfailure_string.go b/vendor/github.com/hashicorp/terraform/configs/provisioneronfailure_string.go
new file mode 100644
index 0000000..7ff5a6e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provisioneronfailure_string.go
@@ -0,0 +1,25 @@
+// Code generated by "stringer -type ProvisionerOnFailure"; DO NOT EDIT.
+
+package configs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ProvisionerOnFailureInvalid-0]
+        _ = x[ProvisionerOnFailureContinue-1]
+        _ = x[ProvisionerOnFailureFail-2]
+}
+
+const _ProvisionerOnFailure_name = "ProvisionerOnFailureInvalidProvisionerOnFailureContinueProvisionerOnFailureFail"
+
+var _ProvisionerOnFailure_index = [...]uint8{0, 27, 55, 79}
+
+func (i ProvisionerOnFailure) String() string {
+        if i < 0 || i >= ProvisionerOnFailure(len(_ProvisionerOnFailure_index)-1) {
+                return "ProvisionerOnFailure(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _ProvisionerOnFailure_name[_ProvisionerOnFailure_index[i]:_ProvisionerOnFailure_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provisionerwhen_string.go b/vendor/github.com/hashicorp/terraform/configs/provisionerwhen_string.go
new file mode 100644
index 0000000..9f21b3a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provisionerwhen_string.go
@@ -0,0 +1,25 @@
+// Code generated by "stringer -type ProvisionerWhen"; DO NOT EDIT.
+
+package configs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ProvisionerWhenInvalid-0]
+        _ = x[ProvisionerWhenCreate-1]
+        _ = x[ProvisionerWhenDestroy-2]
+}
+
+const _ProvisionerWhen_name = "ProvisionerWhenInvalidProvisionerWhenCreateProvisionerWhenDestroy"
+
+var _ProvisionerWhen_index = [...]uint8{0, 22, 43, 65}
+
+func (i ProvisionerWhen) String() string {
+        if i < 0 || i >= ProvisionerWhen(len(_ProvisionerWhen_index)-1) {
+                return "ProvisionerWhen(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _ProvisionerWhen_name[_ProvisionerWhen_index[i]:_ProvisionerWhen_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/resource.go b/vendor/github.com/hashicorp/terraform/configs/resource.go
new file mode 100644
index 0000000..de1a343
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/resource.go
@@ -0,0 +1,486 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Resource represents a "resource" or "data" block in a module or file.
+type Resource struct {
+        Mode    addrs.ResourceMode
+        Name    string
+        Type    string
+        Config  hcl.Body
+        Count   hcl.Expression
+        ForEach hcl.Expression
+
+        ProviderConfigRef *ProviderConfigRef
+
+        DependsOn []hcl.Traversal
+
+        // Managed is populated only for Mode = addrs.ManagedResourceMode,
+        // containing the additional fields that apply to managed resources.
+        // For all other resource modes, this field is nil.
+        Managed *ManagedResource
+
+        DeclRange hcl.Range
+        TypeRange hcl.Range
+}
+
+// ManagedResource represents a "resource" block in a module or file.
+type ManagedResource struct {
+        Connection   *Connection
+        Provisioners []*Provisioner
+
+        CreateBeforeDestroy bool
+        PreventDestroy      bool
+        IgnoreChanges       []hcl.Traversal
+        IgnoreAllChanges    bool
+
+        CreateBeforeDestroySet bool
+        PreventDestroySet      bool
+}
+
+func (r *Resource) moduleUniqueKey() string {
+        return r.Addr().String()
+}
+
+// Addr returns a resource address for the receiver that is relative to the
+// resource's containing module.
+func (r *Resource) Addr() addrs.Resource {
+        return addrs.Resource{
+                Mode: r.Mode,
+                Type: r.Type,
+                Name: r.Name,
+        }
+}
+
+// ProviderConfigAddr returns the address for the provider configuration
+// that should be used for this resource. This function implements the
+// default behavior of extracting the type from the resource type name if
+// an explicit "provider" argument was not provided.
+func (r *Resource) ProviderConfigAddr() addrs.ProviderConfig {
+        if r.ProviderConfigRef == nil {
+                return r.Addr().DefaultProviderConfig()
+        }
+
+        return addrs.ProviderConfig{
+                Type:  r.ProviderConfigRef.Name,
+                Alias: r.ProviderConfigRef.Alias,
+        }
+}
+
+func decodeResourceBlock(block *hcl.Block) (*Resource, hcl.Diagnostics) {
+        r := &Resource{
+                Mode:      addrs.ManagedResourceMode,
+                Type:      block.Labels[0],
+                Name:      block.Labels[1],
+                DeclRange: block.DefRange,
+                TypeRange: block.LabelRanges[0],
+                Managed:   &ManagedResource{},
+        }
+
+        content, remain, diags := block.Body.PartialContent(resourceBlockSchema)
+        r.Config = remain
+
+        if !hclsyntax.ValidIdentifier(r.Type) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid resource type name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+        if !hclsyntax.ValidIdentifier(r.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid resource name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[1],
+                })
+        }
+
+        if attr, exists := content.Attributes["count"]; exists {
+                r.Count = attr.Expr
+        }
+
+        if attr, exists := content.Attributes["for_each"]; exists {
+                r.ForEach = attr.Expr
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in resource block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["provider"]; exists {
+                var providerDiags hcl.Diagnostics
+                r.ProviderConfigRef, providerDiags = decodeProviderConfigRef(attr.Expr, "provider")
+                diags = append(diags, providerDiags...)
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                r.DependsOn = append(r.DependsOn, deps...)
+        }
+
+        var seenLifecycle *hcl.Block
+        var seenConnection *hcl.Block
+        for _, block := range content.Blocks {
+                switch block.Type {
+                case "lifecycle":
+                        if seenLifecycle != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate lifecycle block",
+                                        Detail:   fmt.Sprintf("This resource already has a lifecycle block at %s.", seenLifecycle.DefRange),
+                                        Subject:  &block.DefRange,
+                                })
+                                continue
+                        }
+                        seenLifecycle = block
+
+                        lcContent, lcDiags := block.Body.Content(resourceLifecycleBlockSchema)
+                        diags = append(diags, lcDiags...)
+
+                        if attr, exists := lcContent.Attributes["create_before_destroy"]; exists {
+                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &r.Managed.CreateBeforeDestroy)
+                                diags = append(diags, valDiags...)
+                                r.Managed.CreateBeforeDestroySet = true
+                        }
+
+                        if attr, exists := lcContent.Attributes["prevent_destroy"]; exists {
+                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &r.Managed.PreventDestroy)
+                                diags = append(diags, valDiags...)
+                                r.Managed.PreventDestroySet = true
+                        }
+
+                        if attr, exists := lcContent.Attributes["ignore_changes"]; exists {
+
+                                // ignore_changes can either be a list of relative traversals
+                                // or it can be just the keyword "all" to ignore changes to this
+                                // resource entirely.
+                                //   ignore_changes = [ami, instance_type]
+                                //   ignore_changes = all
+                                // We also allow two legacy forms for compatibility with earlier
+                                // versions:
+                                //   ignore_changes = ["ami", "instance_type"]
+                                //   ignore_changes = ["*"]
+
+                                kw := hcl.ExprAsKeyword(attr.Expr)
+
+                                switch {
+                                case kw == "all":
+                                        r.Managed.IgnoreAllChanges = true
+                                default:
+                                        exprs, listDiags := hcl.ExprList(attr.Expr)
+                                        diags = append(diags, listDiags...)
+
+                                        var ignoreAllRange hcl.Range
+
+                                        for _, expr := range exprs {
+
+                                                // our expr might be the literal string "*", which
+                                                // we accept as a deprecated way of saying "all".
+                                                if shimIsIgnoreChangesStar(expr) {
+                                                        r.Managed.IgnoreAllChanges = true
+                                                        ignoreAllRange = expr.Range()
+                                                        diags = append(diags, &hcl.Diagnostic{
+                                                                Severity: hcl.DiagWarning,
+                                                                Summary:  "Deprecated ignore_changes wildcard",
+                                                                Detail:   "The [\"*\"] form of ignore_changes wildcard is deprecated. Use \"ignore_changes = all\" to ignore changes to all attributes.",
+                                                                Subject:  attr.Expr.Range().Ptr(),
+                                                        })
+                                                        continue
+                                                }
+
+                                                expr, shimDiags := shimTraversalInString(expr, false)
+                                                diags = append(diags, shimDiags...)
+
+                                                traversal, travDiags := hcl.RelTraversalForExpr(expr)
+                                                diags = append(diags, travDiags...)
+                                                if len(traversal) != 0 {
+                                                        r.Managed.IgnoreChanges = append(r.Managed.IgnoreChanges, traversal)
+                                                }
+                                        }
+
+                                        if r.Managed.IgnoreAllChanges && len(r.Managed.IgnoreChanges) != 0 {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid ignore_changes ruleset",
+                                                        Detail:   "Cannot mix wildcard string \"*\" with non-wildcard references.",
+                                                        Subject:  &ignoreAllRange,
+                                                        Context:  attr.Expr.Range().Ptr(),
+                                                })
+                                        }
+
+                                }
+
+                        }
+
+                case "connection":
+                        if seenConnection != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate connection block",
+                                        Detail:   fmt.Sprintf("This resource already has a connection block at %s.", seenConnection.DefRange),
+                                        Subject:  &block.DefRange,
+                                })
+                                continue
+                        }
+                        seenConnection = block
+
+                        r.Managed.Connection = &Connection{
+                                Config:    block.Body,
+                                DeclRange: block.DefRange,
+                        }
+
+                case "provisioner":
+                        pv, pvDiags := decodeProvisionerBlock(block)
+                        diags = append(diags, pvDiags...)
+                        if pv != nil {
+                                r.Managed.Provisioners = append(r.Managed.Provisioners, pv)
+                        }
+
+                default:
+                        // Any other block types are ones we've reserved for future use,
+                        // so they get a generic message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved block type name in resource block",
+                                Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return r, diags
+}
+
+func decodeDataBlock(block *hcl.Block) (*Resource, hcl.Diagnostics) {
+        r := &Resource{
+                Mode:      addrs.DataResourceMode,
+                Type:      block.Labels[0],
+                Name:      block.Labels[1],
+                DeclRange: block.DefRange,
+                TypeRange: block.LabelRanges[0],
+        }
+
+        content, remain, diags := block.Body.PartialContent(dataBlockSchema)
+        r.Config = remain
+
+        if !hclsyntax.ValidIdentifier(r.Type) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid data source name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+        if !hclsyntax.ValidIdentifier(r.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid data resource name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[1],
+                })
+        }
+
+        if attr, exists := content.Attributes["count"]; exists {
+                r.Count = attr.Expr
+        }
+
+        if attr, exists := content.Attributes["for_each"]; exists {
+                r.ForEach = attr.Expr
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["provider"]; exists {
+                var providerDiags hcl.Diagnostics
+                r.ProviderConfigRef, providerDiags = decodeProviderConfigRef(attr.Expr, "provider")
+                diags = append(diags, providerDiags...)
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                r.DependsOn = append(r.DependsOn, deps...)
+        }
+
+        for _, block := range content.Blocks {
+                // All of the block types we accept are just reserved for future use, but some get a specialized error message.
+                switch block.Type {
+                case "lifecycle":
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unsupported lifecycle block",
+                                Detail:   "Data resources do not have lifecycle settings, so a lifecycle block is not allowed.",
+                                Subject:  &block.DefRange,
+                        })
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved block type name in data block",
+                                Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return r, diags
+}
+
+type ProviderConfigRef struct {
+        Name       string
+        NameRange  hcl.Range
+        Alias      string
+        AliasRange *hcl.Range // nil if alias not set
+}
+
+func decodeProviderConfigRef(expr hcl.Expression, argName string) (*ProviderConfigRef, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        var shimDiags hcl.Diagnostics
+        expr, shimDiags = shimTraversalInString(expr, false)
+        diags = append(diags, shimDiags...)
+
+        traversal, travDiags := hcl.AbsTraversalForExpr(expr)
+
+        // AbsTraversalForExpr produces only generic errors, so we'll discard
+        // the errors given and produce our own with extra context. If we didn't
+        // get any errors then we might still have warnings, though.
+        if !travDiags.HasErrors() {
+                diags = append(diags, travDiags...)
+        }
+
+        if len(traversal) < 1 || len(traversal) > 2 {
+                // A provider reference was given as a string literal in the legacy
+                // configuration language and there are lots of examples out there
+                // showing that usage, so we'll sniff for that situation here and
+                // produce a specialized error message for it to help users find
+                // the new correct form.
+                if exprIsNativeQuotedString(expr) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration reference",
+                                Detail:   "A provider configuration reference must not be given in quotes.",
+                                Subject:  expr.Range().Ptr(),
+                        })
+                        return nil, diags
+                }
+
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration reference",
+                        Detail:   fmt.Sprintf("The %s argument requires a provider type name, optionally followed by a period and then a configuration alias.", argName),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return nil, diags
+        }
+
+        ret := &ProviderConfigRef{
+                Name:      traversal.RootName(),
+                NameRange: traversal[0].SourceRange(),
+        }
+
+        if len(traversal) > 1 {
+                aliasStep, ok := traversal[1].(hcl.TraverseAttr)
+                if !ok {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration reference",
+                                Detail:   "Provider name must either stand alone or be followed by a period and then a configuration alias.",
+                                Subject:  traversal[1].SourceRange().Ptr(),
+                        })
+                        return ret, diags
+                }
+
+                ret.Alias = aliasStep.Name
+                ret.AliasRange = aliasStep.SourceRange().Ptr()
+        }
+
+        return ret, diags
+}
+
+// Addr returns the provider config address corresponding to the receiving
+// config reference.
+//
+// This is a trivial conversion, essentially just discarding the source
+// location information and keeping just the addressing information.
+func (r *ProviderConfigRef) Addr() addrs.ProviderConfig {
+        return addrs.ProviderConfig{
+                Type:  r.Name,
+                Alias: r.Alias,
+        }
+}
+
+func (r *ProviderConfigRef) String() string {
+        if r == nil {
+                return "<nil>"
+        }
+        if r.Alias != "" {
+                return fmt.Sprintf("%s.%s", r.Name, r.Alias)
+        }
+        return r.Name
+}
+
+var commonResourceAttributes = []hcl.AttributeSchema{
+        {
+                Name: "count",
+        },
+        {
+                Name: "for_each",
+        },
+        {
+                Name: "provider",
+        },
+        {
+                Name: "depends_on",
+        },
+}
+
+var resourceBlockSchema = &hcl.BodySchema{
+        Attributes: commonResourceAttributes,
+        Blocks: []hcl.BlockHeaderSchema{
+                {Type: "locals"}, // reserved for future use
+                {Type: "lifecycle"},
+                {Type: "connection"},
+                {Type: "provisioner", LabelNames: []string{"type"}},
+        },
+}
+
+var dataBlockSchema = &hcl.BodySchema{
+        Attributes: commonResourceAttributes,
+        Blocks: []hcl.BlockHeaderSchema{
+                {Type: "lifecycle"}, // reserved for future use
+                {Type: "locals"},    // reserved for future use
+        },
+}
+
+var resourceLifecycleBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "create_before_destroy",
+                },
+                {
+                        Name: "prevent_destroy",
+                },
+                {
+                        Name: "ignore_changes",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/synth_body.go b/vendor/github.com/hashicorp/terraform/configs/synth_body.go
new file mode 100644
index 0000000..3ae1bff
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/synth_body.go
@@ -0,0 +1,118 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SynthBody produces a synthetic hcl.Body that behaves as if it had attributes
+// corresponding to the elements given in the values map.
+//
+// This is useful in situations where, for example, values provided on the
+// command line can override values given in configuration, using MergeBodies.
+//
+// The given filename is used in case any diagnostics are returned. Since
+// the created body is synthetic, it is likely that this will not be a "real"
+// filename. For example, if from a command line argument it could be
+// a representation of that argument's name, such as "-var=...".
+func SynthBody(filename string, values map[string]cty.Value) hcl.Body {
+        return synthBody{
+                Filename: filename,
+                Values:   values,
+        }
+}
+
+type synthBody struct {
+        Filename string
+        Values   map[string]cty.Value
+}
+
+func (b synthBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        content, remain, diags := b.PartialContent(schema)
+        remainS := remain.(synthBody)
+        for name := range remainS.Values {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported attribute",
+                        Detail:   fmt.Sprintf("An attribute named %q is not expected here.", name),
+                        Subject:  b.synthRange().Ptr(),
+                })
+        }
+        return content, diags
+}
+
+func (b synthBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        content := &hcl.BodyContent{
+                Attributes:       make(hcl.Attributes),
+                MissingItemRange: b.synthRange(),
+        }
+
+        remainValues := make(map[string]cty.Value)
+        for attrName, val := range b.Values {
+                remainValues[attrName] = val
+        }
+
+        for _, attrS := range schema.Attributes {
+                delete(remainValues, attrS.Name)
+                val, defined := b.Values[attrS.Name]
+                if !defined {
+                        if attrS.Required {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing required attribute",
+                                        Detail:   fmt.Sprintf("The attribute %q is required, but no definition was found.", attrS.Name),
+                                        Subject:  b.synthRange().Ptr(),
+                                })
+                        }
+                        continue
+                }
+                content.Attributes[attrS.Name] = b.synthAttribute(attrS.Name, val)
+        }
+
+        // We just ignore blocks altogether, because this body type never has
+        // nested blocks.
+
+        remain := synthBody{
+                Filename: b.Filename,
+                Values:   remainValues,
+        }
+
+        return content, remain, diags
+}
+
+func (b synthBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        ret := make(hcl.Attributes)
+        for name, val := range b.Values {
+                ret[name] = b.synthAttribute(name, val)
+        }
+        return ret, nil
+}
+
+func (b synthBody) MissingItemRange() hcl.Range {
+        return b.synthRange()
+}
+
+func (b synthBody) synthAttribute(name string, val cty.Value) *hcl.Attribute {
+        rng := b.synthRange()
+        return &hcl.Attribute{
+                Name: name,
+                Expr: &hclsyntax.LiteralValueExpr{
+                        Val:      val,
+                        SrcRange: rng,
+                },
+                NameRange: rng,
+                Range:     rng,
+        }
+}
+
+func (b synthBody) synthRange() hcl.Range {
+        return hcl.Range{
+                Filename: b.Filename,
+                Start:    hcl.Pos{Line: 1, Column: 1},
+                End:      hcl.Pos{Line: 1, Column: 1},
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/util.go b/vendor/github.com/hashicorp/terraform/configs/util.go
new file mode 100644
index 0000000..5fbde43
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/util.go
@@ -0,0 +1,63 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// exprIsNativeQuotedString determines whether the given expression looks like
+// it's a quoted string in the HCL native syntax.
+//
+// This should be used sparingly only for situations where our legacy HCL
+// decoding would've expected a keyword or reference in quotes but our new
+// decoding expects the keyword or reference to be provided directly as
+// an identifier-based expression.
+func exprIsNativeQuotedString(expr hcl.Expression) bool {
+        _, ok := expr.(*hclsyntax.TemplateExpr)
+        return ok
+}
+
+// schemaForOverrides takes a *hcl.BodySchema and produces a new one that is
+// equivalent except that any required attributes are forced to not be required.
+//
+// This is useful for dealing with "override" config files, which are allowed
+// to omit things that they don't wish to override from the main configuration.
+//
+// The returned schema may have some pointers in common with the given schema,
+// so neither the given schema nor the returned schema should be modified after
+// using this function in order to avoid confusion.
+//
+// Overrides are rarely used, so it's recommended to just create the override
+// schema on the fly only when it's needed, rather than storing it in a global
+// variable as we tend to do for a primary schema.
+func schemaForOverrides(schema *hcl.BodySchema) *hcl.BodySchema {
+        ret := &hcl.BodySchema{
+                Attributes: make([]hcl.AttributeSchema, len(schema.Attributes)),
+                Blocks:     schema.Blocks,
+        }
+
+        for i, attrS := range schema.Attributes {
+                ret.Attributes[i] = attrS
+                ret.Attributes[i].Required = false
+        }
+
+        return ret
+}
+
+// schemaWithDynamic takes a *hcl.BodySchema and produces a new one that
+// is equivalent except that it accepts an additional block type "dynamic" with
+// a single label, used to recognize usage of the HCL dynamic block extension.
+func schemaWithDynamic(schema *hcl.BodySchema) *hcl.BodySchema {
+        ret := &hcl.BodySchema{
+                Attributes: schema.Attributes,
+                Blocks:     make([]hcl.BlockHeaderSchema, len(schema.Blocks), len(schema.Blocks)+1),
+        }
+
+        copy(ret.Blocks, schema.Blocks)
+        ret.Blocks = append(ret.Blocks, hcl.BlockHeaderSchema{
+                Type:       "dynamic",
+                LabelNames: []string{"type"},
+        })
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/variable_type_hint.go b/vendor/github.com/hashicorp/terraform/configs/variable_type_hint.go
new file mode 100644
index 0000000..204efd1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/variable_type_hint.go
@@ -0,0 +1,45 @@
+package configs
+
+// VariableTypeHint is an enumeration used for the Variable.TypeHint field,
+// which is an incompletely-specified type for the variable which is used
+// as a hint for whether a value provided in an ambiguous context (on the
+// command line or in an environment variable) should be taken literally as a
+// string or parsed as an HCL expression to produce a data structure.
+//
+// The type hint is applied to runtime values as well, but since it does not
+// accurately describe a precise type it is not fully-sufficient to infer
+// the dynamic type of a value passed through a variable.
+//
+// These hints use inaccurate terminology for historical reasons. Full details
+// are in the documentation for each constant in this enumeration, but in
+// summary:
+//
+//     TypeHintString requires a primitive type
+//     TypeHintList requires a type that could be converted to a tuple
+//     TypeHintMap requires a type that could be converted to an object
+type VariableTypeHint rune
+
+//go:generate stringer -type VariableTypeHint
+
+// TypeHintNone indicates the absense of a type hint. Values specified in
+// ambiguous contexts will be treated as literal strings, as if TypeHintString
+// were selected, but no runtime value checks will be applied. This is reasonable
+// type hint for a module that is never intended to be used at the top-level
+// of a configuration, since descendent modules never recieve values from
+// ambiguous contexts.
+const TypeHintNone VariableTypeHint = 0
+
+// TypeHintString spec indicates that a value provided in an ambiguous context
+// should be treated as a literal string, and additionally requires that the
+// runtime value for the variable is of a primitive type (string, number, bool).
+const TypeHintString VariableTypeHint = 'S'
+
+// TypeHintList indicates that a value provided in an ambiguous context should
+// be treated as an HCL expression, and additionally requires that the
+// runtime value for the variable is of an tuple, list, or set type.
+const TypeHintList VariableTypeHint = 'L'
+
+// TypeHintMap indicates that a value provided in an ambiguous context should
+// be treated as an HCL expression, and additionally requires that the
+// runtime value for the variable is of an object or map type.
+const TypeHintMap VariableTypeHint = 'M'
diff --git a/vendor/github.com/hashicorp/terraform/configs/variabletypehint_string.go b/vendor/github.com/hashicorp/terraform/configs/variabletypehint_string.go
new file mode 100644
index 0000000..2b50428
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/variabletypehint_string.go
@@ -0,0 +1,39 @@
+// Code generated by "stringer -type VariableTypeHint"; DO NOT EDIT.
+
+package configs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeHintNone-0]
+        _ = x[TypeHintString-83]
+        _ = x[TypeHintList-76]
+        _ = x[TypeHintMap-77]
+}
+
+const (
+        _VariableTypeHint_name_0 = "TypeHintNone"
+        _VariableTypeHint_name_1 = "TypeHintListTypeHintMap"
+        _VariableTypeHint_name_2 = "TypeHintString"
+)
+
+var (
+        _VariableTypeHint_index_1 = [...]uint8{0, 12, 23}
+)
+
+func (i VariableTypeHint) String() string {
+        switch {
+        case i == 0:
+                return _VariableTypeHint_name_0
+        case 76 <= i && i <= 77:
+                i -= 76
+                return _VariableTypeHint_name_1[_VariableTypeHint_index_1[i]:_VariableTypeHint_index_1[i+1]]
+        case i == 83:
+                return _VariableTypeHint_name_2
+        default:
+                return "VariableTypeHint(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/version_constraint.go b/vendor/github.com/hashicorp/terraform/configs/version_constraint.go
new file mode 100644
index 0000000..7aa19ef
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/version_constraint.go
@@ -0,0 +1,64 @@
+package configs
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// VersionConstraint represents a version constraint on some resource
+// (e.g. Terraform Core, a provider, a module, ...) that carries with it
+// a source range so that a helpful diagnostic can be printed in the event
+// that a particular constraint does not match.
+type VersionConstraint struct {
+        Required  version.Constraints
+        DeclRange hcl.Range
+}
+
+func decodeVersionConstraint(attr *hcl.Attribute) (VersionConstraint, hcl.Diagnostics) {
+        ret := VersionConstraint{
+                DeclRange: attr.Range,
+        }
+
+        val, diags := attr.Expr.Value(nil)
+        if diags.HasErrors() {
+                return ret, diags
+        }
+        var err error
+        val, err = convert.Convert(val, cty.String)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid version constraint",
+                        Detail:   fmt.Sprintf("A string value is required for %s.", attr.Name),
+                        Subject:  attr.Expr.Range().Ptr(),
+                })
+                return ret, diags
+        }
+
+        if val.IsNull() {
+                // A null version constraint is strange, but we'll just treat it
+                // like an empty constraint set.
+                return ret, diags
+        }
+
+        constraintStr := val.AsString()
+        constraints, err := version.NewConstraint(constraintStr)
+        if err != nil {
+                // NewConstraint doesn't return user-friendly errors, so we'll just
+                // ignore the provided error and produce our own generic one.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid version constraint",
+                        Detail:   "This string does not use correct version constraint syntax.", // Not very actionable :(
+                        Subject:  attr.Expr.Range().Ptr(),
+                })
+                return ret, diags
+        }
+
+        ret.Required = constraints
+        return ret, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/dag/dag.go b/vendor/github.com/hashicorp/terraform/dag/dag.go
index b7eb10c..77c67ef 100644
--- a/vendor/github.com/hashicorp/terraform/dag/dag.go
+++ b/vendor/github.com/hashicorp/terraform/dag/dag.go
@@ -5,6 +5,8 @@ import (
         "sort"
         "strings"
 
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/go-multierror"
 )
 
@@ -15,7 +17,7 @@ type AcyclicGraph struct {
 }
 
 // WalkFunc is the callback used for walking the graph.
-type WalkFunc func(Vertex) error
+type WalkFunc func(Vertex) tfdiags.Diagnostics
 
 // DepthWalkFunc is a walk function that also receives the current depth of the
 // walk as an argument
@@ -161,9 +163,9 @@ func (g *AcyclicGraph) Cycles() [][]Vertex {
 }
 
 // Walk walks the graph, calling your callback as each node is visited.
-// This will walk nodes in parallel if it can. Because the walk is done
-// in parallel, the error returned will be a multierror.
-func (g *AcyclicGraph) Walk(cb WalkFunc) error {
+// This will walk nodes in parallel if it can. The resulting diagnostics
+// contains problems from all graphs visited, in no particular order.
+func (g *AcyclicGraph) Walk(cb WalkFunc) tfdiags.Diagnostics {
         defer g.debug.BeginOperation(typeWalk, "").End("")
 
         w := &Walker{Callback: cb, Reverse: true}
diff --git a/vendor/github.com/hashicorp/terraform/dag/walk.go b/vendor/github.com/hashicorp/terraform/dag/walk.go
index f03b100..1c926c2 100644
--- a/vendor/github.com/hashicorp/terraform/dag/walk.go
+++ b/vendor/github.com/hashicorp/terraform/dag/walk.go
@@ -2,12 +2,11 @@ package dag
 
 import (
         "errors"
-        "fmt"
         "log"
         "sync"
         "time"
 
-        "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // Walker is used to walk every vertex of a graph in parallel.
@@ -54,10 +53,15 @@ type Walker struct {
         // if new vertices are added.
         wait sync.WaitGroup
 
-        // errMap contains the errors recorded so far for execution. Reading
-        // and writing should hold errLock.
-        errMap  map[Vertex]error
-        errLock sync.Mutex
+        // diagsMap contains the diagnostics recorded so far for execution,
+        // and upstreamFailed contains all the vertices whose problems were
+        // caused by upstream failures, and thus whose diagnostics should be
+        // excluded from the final set.
+        //
+        // Readers and writers of either map must hold diagsLock.
+        diagsMap       map[Vertex]tfdiags.Diagnostics
+        upstreamFailed map[Vertex]struct{}
+        diagsLock      sync.Mutex
 }
 
 type walkerVertex struct {
@@ -98,31 +102,30 @@ type walkerVertex struct {
 // user-returned error.
 var errWalkUpstream = errors.New("upstream dependency failed")
 
-// Wait waits for the completion of the walk and returns any errors (
-// in the form of a multierror) that occurred. Update should be called
-// to populate the walk with vertices and edges prior to calling this.
+// Wait waits for the completion of the walk and returns diagnostics describing
+// any problems that arose. Update should be called to populate the walk with
+// vertices and edges prior to calling this.
 //
 // Wait will return as soon as all currently known vertices are complete.
 // If you plan on calling Update with more vertices in the future, you
 // should not call Wait until after this is done.
-func (w *Walker) Wait() error {
+func (w *Walker) Wait() tfdiags.Diagnostics {
         // Wait for completion
         w.wait.Wait()
 
-        // Grab the error lock
-        w.errLock.Lock()
-        defer w.errLock.Unlock()
-
-        // Build the error
-        var result error
-        for v, err := range w.errMap {
-                if err != nil && err != errWalkUpstream {
-                        result = multierror.Append(result, fmt.Errorf(
-                                "%s: %s", VertexName(v), err))
+        var diags tfdiags.Diagnostics
+        w.diagsLock.Lock()
+        for v, vDiags := range w.diagsMap {
+                if _, upstream := w.upstreamFailed[v]; upstream {
+                        // Ignore diagnostics for nodes that had failed upstreams, since
+                        // the downstream diagnostics are likely to be redundant.
+                        continue
                 }
+                diags = diags.Append(vDiags)
         }
+        w.diagsLock.Unlock()
 
-        return result
+        return diags
 }
 
 // Update updates the currently executing walk with the given graph.
@@ -136,6 +139,7 @@ func (w *Walker) Wait() error {
 // Multiple Updates can be called in parallel. Update can be called at any
 // time during a walk.
 func (w *Walker) Update(g *AcyclicGraph) {
+        log.Print("[TRACE] dag/walk: updating graph")
         var v, e *Set
         if g != nil {
                 v, e = g.vertices, g.edges
@@ -381,25 +385,34 @@ func (w *Walker) walkVertex(v Vertex, info *walkerVertex) {
         }
 
         // Run our callback or note that our upstream failed
-        var err error
+        var diags tfdiags.Diagnostics
+        var upstreamFailed bool
         if depsSuccess {
-                log.Printf("[TRACE] dag/walk: walking %q", VertexName(v))
-                err = w.Callback(v)
+                log.Printf("[TRACE] dag/walk: visiting %q", VertexName(v))
+                diags = w.Callback(v)
         } else {
-                log.Printf("[TRACE] dag/walk: upstream errored, not walking %q", VertexName(v))
-                err = errWalkUpstream
+                log.Printf("[TRACE] dag/walk: upstream of %q errored, so skipping", VertexName(v))
+                // This won't be displayed to the user because we'll set upstreamFailed,
+                // but we need to ensure there's at least one error in here so that
+                // the failures will cascade downstream.
+                diags = diags.Append(errors.New("upstream dependencies failed"))
+                upstreamFailed = true
         }
 
-        // Record the error
-        if err != nil {
-                w.errLock.Lock()
-                defer w.errLock.Unlock()
-
-                if w.errMap == nil {
-                        w.errMap = make(map[Vertex]error)
-                }
-                w.errMap[v] = err
+        // Record the result (we must do this after execution because we mustn't
+        // hold diagsLock while visiting a vertex.)
+        w.diagsLock.Lock()
+        if w.diagsMap == nil {
+                w.diagsMap = make(map[Vertex]tfdiags.Diagnostics)
+        }
+        w.diagsMap[v] = diags
+        if w.upstreamFailed == nil {
+                w.upstreamFailed = make(map[Vertex]struct{})
         }
+        if upstreamFailed {
+                w.upstreamFailed[v] = struct{}{}
+        }
+        w.diagsLock.Unlock()
 }
 
 func (w *Walker) waitDeps(
@@ -407,6 +420,7 @@ func (w *Walker) waitDeps(
         deps map[Vertex]<-chan struct{},
         doneCh chan<- bool,
         cancelCh <-chan struct{}) {
+
         // For each dependency given to us, wait for it to complete
         for dep, depCh := range deps {
         DepSatisfied:
@@ -423,17 +437,17 @@ func (w *Walker) waitDeps(
                                 return
 
                         case <-time.After(time.Second * 5):
-                                log.Printf("[TRACE] dag/walk: vertex %q, waiting for: %q",
+                                log.Printf("[TRACE] dag/walk: vertex %q is waiting for %q",
                                         VertexName(v), VertexName(dep))
                         }
                 }
         }
 
         // Dependencies satisfied! We need to check if any errored
-        w.errLock.Lock()
-        defer w.errLock.Unlock()
-        for dep, _ := range deps {
-                if w.errMap[dep] != nil {
+        w.diagsLock.Lock()
+        defer w.diagsLock.Unlock()
+        for dep := range deps {
+                if w.diagsMap[dep].HasErrors() {
                         // One of our dependencies failed, so return false
                         doneCh <- false
                         return
diff --git a/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go b/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go
new file mode 100644
index 0000000..54899bc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go
@@ -0,0 +1,24 @@
+package didyoumean
+
+import (
+        "github.com/agext/levenshtein"
+)
+
+// NameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func NameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go b/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go
new file mode 100644
index 0000000..82b5937
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go
@@ -0,0 +1,6 @@
+// Package plugin contains types and functions to help Terraform plugins
+// implement the plugin rpc interface.
+// The primary Provider type will be responsible for converting from the grpc
+// wire protocol to the types and methods known to the provider
+// implementations.
+package plugin
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
new file mode 100644
index 0000000..510f47f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
@@ -0,0 +1,1338 @@
+package plugin
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "log"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        context "golang.org/x/net/context"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/helper/schema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+const newExtraKey = "_new_extra_shim"
+
+// NewGRPCProviderServerShim wraps a terraform.ResourceProvider in a
+// proto.ProviderServer implementation. If the provided provider is not a
+// *schema.Provider, this will return nil,
+func NewGRPCProviderServerShim(p terraform.ResourceProvider) *GRPCProviderServer {
+        sp, ok := p.(*schema.Provider)
+        if !ok {
+                return nil
+        }
+
+        return &GRPCProviderServer{
+                provider: sp,
+        }
+}
+
+// GRPCProviderServer handles the server, or plugin side of the rpc connection.
+type GRPCProviderServer struct {
+        provider *schema.Provider
+}
+
+func (s *GRPCProviderServer) GetSchema(_ context.Context, req *proto.GetProviderSchema_Request) (*proto.GetProviderSchema_Response, error) {
+        // Here we are certain that the provider is being called through grpc, so
+        // make sure the feature flag for helper/schema is set
+        schema.SetProto5()
+
+        resp := &proto.GetProviderSchema_Response{
+                ResourceSchemas:   make(map[string]*proto.Schema),
+                DataSourceSchemas: make(map[string]*proto.Schema),
+        }
+
+        resp.Provider = &proto.Schema{
+                Block: convert.ConfigSchemaToProto(s.getProviderSchemaBlock()),
+        }
+
+        for typ, res := range s.provider.ResourcesMap {
+                resp.ResourceSchemas[typ] = &proto.Schema{
+                        Version: int64(res.SchemaVersion),
+                        Block:   convert.ConfigSchemaToProto(res.CoreConfigSchema()),
+                }
+        }
+
+        for typ, dat := range s.provider.DataSourcesMap {
+                resp.DataSourceSchemas[typ] = &proto.Schema{
+                        Version: int64(dat.SchemaVersion),
+                        Block:   convert.ConfigSchemaToProto(dat.CoreConfigSchema()),
+                }
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) getProviderSchemaBlock() *configschema.Block {
+        return schema.InternalMap(s.provider.Schema).CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) getResourceSchemaBlock(name string) *configschema.Block {
+        res := s.provider.ResourcesMap[name]
+        return res.CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) getDatasourceSchemaBlock(name string) *configschema.Block {
+        dat := s.provider.DataSourcesMap[name]
+        return dat.CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) PrepareProviderConfig(_ context.Context, req *proto.PrepareProviderConfig_Request) (*proto.PrepareProviderConfig_Response, error) {
+        resp := &proto.PrepareProviderConfig_Response{}
+
+        schemaBlock := s.getProviderSchemaBlock()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // lookup any required, top-level attributes that are Null, and see if we
+        // have a Default value available.
+        configVal, err = cty.Transform(configVal, func(path cty.Path, val cty.Value) (cty.Value, error) {
+                // we're only looking for top-level attributes
+                if len(path) != 1 {
+                        return val, nil
+                }
+
+                // nothing to do if we already have a value
+                if !val.IsNull() {
+                        return val, nil
+                }
+
+                // get the Schema definition for this attribute
+                getAttr, ok := path[0].(cty.GetAttrStep)
+                // these should all exist, but just ignore anything strange
+                if !ok {
+                        return val, nil
+                }
+
+                attrSchema := s.provider.Schema[getAttr.Name]
+                // continue to ignore anything that doesn't match
+                if attrSchema == nil {
+                        return val, nil
+                }
+
+                // this is deprecated, so don't set it
+                if attrSchema.Deprecated != "" || attrSchema.Removed != "" {
+                        return val, nil
+                }
+
+                // find a default value if it exists
+                def, err := attrSchema.DefaultValue()
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, fmt.Errorf("error getting default for %q: %s", getAttr.Name, err))
+                        return val, err
+                }
+
+                // no default
+                if def == nil {
+                        return val, nil
+                }
+
+                // create a cty.Value and make sure it's the correct type
+                tmpVal := hcl2shim.HCL2ValueFromConfigValue(def)
+
+                // helper/schema used to allow setting "" to a bool
+                if val.Type() == cty.Bool && tmpVal.RawEquals(cty.StringVal("")) {
+                        // return a warning about the conversion
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, "provider set empty string as default value for bool "+getAttr.Name)
+                        tmpVal = cty.False
+                }
+
+                val, err = ctyconvert.Convert(tmpVal, val.Type())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, fmt.Errorf("error setting default for %q: %s", getAttr.Name, err))
+                }
+
+                return val, err
+        })
+        if err != nil {
+                // any error here was already added to the diagnostics
+                return resp, nil
+        }
+
+        configVal, err = schemaBlock.CoerceValue(configVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.Validate(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        preparedConfigMP, err := msgpack.Marshal(configVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.PreparedConfig = &proto.DynamicValue{Msgpack: preparedConfigMP}
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ValidateResourceTypeConfig(_ context.Context, req *proto.ValidateResourceTypeConfig_Request) (*proto.ValidateResourceTypeConfig_Response, error) {
+        resp := &proto.ValidateResourceTypeConfig_Response{}
+
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.ValidateResource(req.TypeName, config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ValidateDataSourceConfig(_ context.Context, req *proto.ValidateDataSourceConfig_Request) (*proto.ValidateDataSourceConfig_Response, error) {
+        resp := &proto.ValidateDataSourceConfig_Response{}
+
+        schemaBlock := s.getDatasourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.ValidateDataSource(req.TypeName, config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) UpgradeResourceState(_ context.Context, req *proto.UpgradeResourceState_Request) (*proto.UpgradeResourceState_Response, error) {
+        resp := &proto.UpgradeResourceState_Response{}
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        version := int(req.Version)
+
+        jsonMap := map[string]interface{}{}
+        var err error
+
+        switch {
+        // We first need to upgrade a flatmap state if it exists.
+        // There should never be both a JSON and Flatmap state in the request.
+        case len(req.RawState.Flatmap) > 0:
+                jsonMap, version, err = s.upgradeFlatmapState(version, req.RawState.Flatmap, res)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        // if there's a JSON state, we need to decode it.
+        case len(req.RawState.Json) > 0:
+                err = json.Unmarshal(req.RawState.Json, &jsonMap)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        default:
+                log.Println("[DEBUG] no state provided to upgrade")
+                return resp, nil
+        }
+
+        // complete the upgrade of the JSON states
+        jsonMap, err = s.upgradeJSONState(version, jsonMap, res)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // The provider isn't required to clean out removed fields
+        s.removeAttributes(jsonMap, schemaBlock.ImpliedType())
+
+        // now we need to turn the state into the default json representation, so
+        // that it can be re-decoded using the actual schema.
+        val, err := schema.JSONMapToStateValue(jsonMap, schemaBlock)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // encode the final state to the expected msgpack format
+        newStateMP, err := msgpack.Marshal(val, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.UpgradedState = &proto.DynamicValue{Msgpack: newStateMP}
+        return resp, nil
+}
+
+// upgradeFlatmapState takes a legacy flatmap state, upgrades it using Migrate
+// state if necessary, and converts it to the new JSON state format decoded as a
+// map[string]interface{}.
+// upgradeFlatmapState returns the json map along with the corresponding schema
+// version.
+func (s *GRPCProviderServer) upgradeFlatmapState(version int, m map[string]string, res *schema.Resource) (map[string]interface{}, int, error) {
+        // this will be the version we've upgraded so, defaulting to the given
+        // version in case no migration was called.
+        upgradedVersion := version
+
+        // first determine if we need to call the legacy MigrateState func
+        requiresMigrate := version < res.SchemaVersion
+
+        schemaType := res.CoreConfigSchema().ImpliedType()
+
+        // if there are any StateUpgraders, then we need to only compare
+        // against the first version there
+        if len(res.StateUpgraders) > 0 {
+                requiresMigrate = version < res.StateUpgraders[0].Version
+        }
+
+        if requiresMigrate {
+                if res.MigrateState == nil {
+                        return nil, 0, errors.New("cannot upgrade state, missing MigrateState function")
+                }
+
+                is := &terraform.InstanceState{
+                        ID:         m["id"],
+                        Attributes: m,
+                        Meta: map[string]interface{}{
+                                "schema_version": strconv.Itoa(version),
+                        },
+                }
+
+                is, err := res.MigrateState(version, is, s.provider.Meta())
+                if err != nil {
+                        return nil, 0, err
+                }
+
+                // re-assign the map in case there was a copy made, making sure to keep
+                // the ID
+                m := is.Attributes
+                m["id"] = is.ID
+
+                // if there are further upgraders, then we've only updated that far
+                if len(res.StateUpgraders) > 0 {
+                        schemaType = res.StateUpgraders[0].Type
+                        upgradedVersion = res.StateUpgraders[0].Version
+                }
+        } else {
+                // the schema version may be newer than the MigrateState functions
+                // handled and older than the current, but still stored in the flatmap
+                // form. If that's the case, we need to find the correct schema type to
+                // convert the state.
+                for _, upgrader := range res.StateUpgraders {
+                        if upgrader.Version == version {
+                                schemaType = upgrader.Type
+                                break
+                        }
+                }
+        }
+
+        // now we know the state is up to the latest version that handled the
+        // flatmap format state. Now we can upgrade the format and continue from
+        // there.
+        newConfigVal, err := hcl2shim.HCL2ValueFromFlatmap(m, schemaType)
+        if err != nil {
+                return nil, 0, err
+        }
+
+        jsonMap, err := schema.StateValueToJSONMap(newConfigVal, schemaType)
+        return jsonMap, upgradedVersion, err
+}
+
+func (s *GRPCProviderServer) upgradeJSONState(version int, m map[string]interface{}, res *schema.Resource) (map[string]interface{}, error) {
+        var err error
+
+        for _, upgrader := range res.StateUpgraders {
+                if version != upgrader.Version {
+                        continue
+                }
+
+                m, err = upgrader.Upgrade(m, s.provider.Meta())
+                if err != nil {
+                        return nil, err
+                }
+                version++
+        }
+
+        return m, nil
+}
+
+// Remove any attributes no longer present in the schema, so that the json can
+// be correctly decoded.
+func (s *GRPCProviderServer) removeAttributes(v interface{}, ty cty.Type) {
+        // we're only concerned with finding maps that corespond to object
+        // attributes
+        switch v := v.(type) {
+        case []interface{}:
+                // If these aren't blocks the next call will be a noop
+                if ty.IsListType() || ty.IsSetType() {
+                        eTy := ty.ElementType()
+                        for _, eV := range v {
+                                s.removeAttributes(eV, eTy)
+                        }
+                }
+                return
+        case map[string]interface{}:
+                // map blocks aren't yet supported, but handle this just in case
+                if ty.IsMapType() {
+                        eTy := ty.ElementType()
+                        for _, eV := range v {
+                                s.removeAttributes(eV, eTy)
+                        }
+                        return
+                }
+
+                if ty == cty.DynamicPseudoType {
+                        log.Printf("[DEBUG] ignoring dynamic block: %#v\n", v)
+                        return
+                }
+
+                if !ty.IsObjectType() {
+                        // This shouldn't happen, and will fail to decode further on, so
+                        // there's no need to handle it here.
+                        log.Printf("[WARN] unexpected type %#v for map in json state", ty)
+                        return
+                }
+
+                attrTypes := ty.AttributeTypes()
+                for attr, attrV := range v {
+                        attrTy, ok := attrTypes[attr]
+                        if !ok {
+                                log.Printf("[DEBUG] attribute %q no longer present in schema", attr)
+                                delete(v, attr)
+                                continue
+                        }
+
+                        s.removeAttributes(attrV, attrTy)
+                }
+        }
+}
+
+func (s *GRPCProviderServer) Stop(_ context.Context, _ *proto.Stop_Request) (*proto.Stop_Response, error) {
+        resp := &proto.Stop_Response{}
+
+        err := s.provider.Stop()
+        if err != nil {
+                resp.Error = err.Error()
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) Configure(_ context.Context, req *proto.Configure_Request) (*proto.Configure_Response, error) {
+        resp := &proto.Configure_Response{}
+
+        schemaBlock := s.getProviderSchemaBlock()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        s.provider.TerraformVersion = req.TerraformVersion
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+        err = s.provider.Configure(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ReadResource(_ context.Context, req *proto.ReadResource_Request) (*proto.ReadResource_Response, error) {
+        resp := &proto.ReadResource_Response{}
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        stateVal, err := msgpack.Unmarshal(req.CurrentState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        instanceState, err := res.ShimInstanceStateFromValue(stateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newInstanceState, err := res.RefreshWithoutUpgrade(instanceState, s.provider.Meta())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        if newInstanceState == nil || newInstanceState.ID == "" {
+                // The old provider API used an empty id to signal that the remote
+                // object appears to have been deleted, but our new protocol expects
+                // to see a null value (in the cty sense) in that case.
+                newStateMP, err := msgpack.Marshal(cty.NullVal(schemaBlock.ImpliedType()), schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                }
+                resp.NewState = &proto.DynamicValue{
+                        Msgpack: newStateMP,
+                }
+                return resp, nil
+        }
+
+        // helper/schema should always copy the ID over, but do it again just to be safe
+        newInstanceState.Attributes["id"] = newInstanceState.ID
+
+        newStateVal, err := hcl2shim.HCL2ValueFromFlatmap(newInstanceState.Attributes, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = normalizeNullValues(newStateVal, stateVal, false)
+        newStateVal = copyTimeoutValues(newStateVal, stateVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.NewState = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) PlanResourceChange(_ context.Context, req *proto.PlanResourceChange_Request) (*proto.PlanResourceChange_Response, error) {
+        resp := &proto.PlanResourceChange_Response{}
+
+        // This is a signal to Terraform Core that we're doing the best we can to
+        // shim the legacy type system of the SDK onto the Terraform type system
+        // but we need it to cut us some slack. This setting should not be taken
+        // forward to any new SDK implementations, since setting it prevents us
+        // from catching certain classes of provider bug that can lead to
+        // confusing downstream errors.
+        resp.LegacyTypeSystem = true
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        priorStateVal, err := msgpack.Unmarshal(req.PriorState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        create := priorStateVal.IsNull()
+
+        proposedNewStateVal, err := msgpack.Unmarshal(req.ProposedNewState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // We don't usually plan destroys, but this can return early in any case.
+        if proposedNewStateVal.IsNull() {
+                resp.PlannedState = req.ProposedNewState
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        priorState, err := res.ShimInstanceStateFromValue(priorStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        priorPrivate := make(map[string]interface{})
+        if len(req.PriorPrivate) > 0 {
+                if err := json.Unmarshal(req.PriorPrivate, &priorPrivate); err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        priorState.Meta = priorPrivate
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(proposedNewStateVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // turn the proposed state into a legacy configuration
+        cfg := terraform.NewResourceConfigShimmed(proposedNewStateVal, schemaBlock)
+
+        diff, err := s.provider.SimpleDiff(info, priorState, cfg)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // if this is a new instance, we need to make sure ID is going to be computed
+        if create {
+                if diff == nil {
+                        diff = terraform.NewInstanceDiff()
+                }
+
+                diff.Attributes["id"] = &terraform.ResourceAttrDiff{
+                        NewComputed: true,
+                }
+        }
+
+        if diff == nil || len(diff.Attributes) == 0 {
+                // schema.Provider.Diff returns nil if it ends up making a diff with no
+                // changes, but our new interface wants us to return an actual change
+                // description that _shows_ there are no changes. This is always the
+                // prior state, because we force a diff above if this is a new instance.
+                resp.PlannedState = req.PriorState
+                return resp, nil
+        }
+
+        if priorState == nil {
+                priorState = &terraform.InstanceState{}
+        }
+
+        // now we need to apply the diff to the prior state, so get the planned state
+        plannedAttrs, err := diff.Apply(priorState.Attributes, schemaBlock)
+
+        plannedStateVal, err := hcl2shim.HCL2ValueFromFlatmap(plannedAttrs, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal, err = schemaBlock.CoerceValue(plannedStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal = normalizeNullValues(plannedStateVal, proposedNewStateVal, false)
+
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal = copyTimeoutValues(plannedStateVal, proposedNewStateVal)
+
+        // The old SDK code has some imprecisions that cause it to sometimes
+        // generate differences that the SDK itself does not consider significant
+        // but Terraform Core would. To avoid producing weird do-nothing diffs
+        // in that case, we'll check if the provider as produced something we
+        // think is "equivalent" to the prior state and just return the prior state
+        // itself if so, thus ensuring that Terraform Core will treat this as
+        // a no-op. See the docs for ValuesSDKEquivalent for some caveats on its
+        // accuracy.
+        forceNoChanges := false
+        if hcl2shim.ValuesSDKEquivalent(priorStateVal, plannedStateVal) {
+                plannedStateVal = priorStateVal
+                forceNoChanges = true
+        }
+
+        // if this was creating the resource, we need to set any remaining computed
+        // fields
+        if create {
+                plannedStateVal = SetUnknowns(plannedStateVal, schemaBlock)
+        }
+
+        plannedMP, err := msgpack.Marshal(plannedStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.PlannedState = &proto.DynamicValue{
+                Msgpack: plannedMP,
+        }
+
+        // Now we need to store any NewExtra values, which are where any actual
+        // StateFunc modified config fields are hidden.
+        privateMap := diff.Meta
+        if privateMap == nil {
+                privateMap = map[string]interface{}{}
+        }
+
+        newExtra := map[string]interface{}{}
+
+        for k, v := range diff.Attributes {
+                if v.NewExtra != nil {
+                        newExtra[k] = v.NewExtra
+                }
+        }
+        privateMap[newExtraKey] = newExtra
+
+        // the Meta field gets encoded into PlannedPrivate
+        plannedPrivate, err := json.Marshal(privateMap)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.PlannedPrivate = plannedPrivate
+
+        // collect the attributes that require instance replacement, and convert
+        // them to cty.Paths.
+        var requiresNew []string
+        if !forceNoChanges {
+                for attr, d := range diff.Attributes {
+                        if d.RequiresNew {
+                                requiresNew = append(requiresNew, attr)
+                        }
+                }
+        }
+
+        // If anything requires a new resource already, or the "id" field indicates
+        // that we will be creating a new resource, then we need to add that to
+        // RequiresReplace so that core can tell if the instance is being replaced
+        // even if changes are being suppressed via "ignore_changes".
+        id := plannedStateVal.GetAttr("id")
+        if len(requiresNew) > 0 || id.IsNull() || !id.IsKnown() {
+                requiresNew = append(requiresNew, "id")
+        }
+
+        requiresReplace, err := hcl2shim.RequiresReplace(requiresNew, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // convert these to the protocol structures
+        for _, p := range requiresReplace {
+                resp.RequiresReplace = append(resp.RequiresReplace, pathToAttributePath(p))
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ApplyResourceChange(_ context.Context, req *proto.ApplyResourceChange_Request) (*proto.ApplyResourceChange_Response, error) {
+        resp := &proto.ApplyResourceChange_Response{
+                // Start with the existing state as a fallback
+                NewState: req.PriorState,
+        }
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        priorStateVal, err := msgpack.Unmarshal(req.PriorState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal, err := msgpack.Unmarshal(req.PlannedState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        priorState, err := res.ShimInstanceStateFromValue(priorStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        private := make(map[string]interface{})
+        if len(req.PlannedPrivate) > 0 {
+                if err := json.Unmarshal(req.PlannedPrivate, &private); err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        var diff *terraform.InstanceDiff
+        destroy := false
+
+        // a null state means we are destroying the instance
+        if plannedStateVal.IsNull() {
+                destroy = true
+                diff = &terraform.InstanceDiff{
+                        Attributes: make(map[string]*terraform.ResourceAttrDiff),
+                        Meta:       make(map[string]interface{}),
+                        Destroy:    true,
+                }
+        } else {
+                diff, err = schema.DiffFromValues(priorStateVal, plannedStateVal, stripResourceModifiers(res))
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        if diff == nil {
+                diff = &terraform.InstanceDiff{
+                        Attributes: make(map[string]*terraform.ResourceAttrDiff),
+                        Meta:       make(map[string]interface{}),
+                }
+        }
+
+        // add NewExtra Fields that may have been stored in the private data
+        if newExtra := private[newExtraKey]; newExtra != nil {
+                for k, v := range newExtra.(map[string]interface{}) {
+                        d := diff.Attributes[k]
+
+                        if d == nil {
+                                d = &terraform.ResourceAttrDiff{}
+                        }
+
+                        d.NewExtra = v
+                        diff.Attributes[k] = d
+                }
+        }
+
+        if private != nil {
+                diff.Meta = private
+        }
+
+        for k, d := range diff.Attributes {
+                // We need to turn off any RequiresNew. There could be attributes
+                // without changes in here inserted by helper/schema, but if they have
+                // RequiresNew then the state will be dropped from the ResourceData.
+                d.RequiresNew = false
+
+                // Check that any "removed" attributes that don't actually exist in the
+                // prior state, or helper/schema will confuse itself
+                if d.NewRemoved {
+                        if _, ok := priorState.Attributes[k]; !ok {
+                                delete(diff.Attributes, k)
+                        }
+                }
+        }
+
+        newInstanceState, err := s.provider.Apply(info, priorState, diff)
+        // we record the error here, but continue processing any returned state.
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+        }
+        newStateVal := cty.NullVal(schemaBlock.ImpliedType())
+
+        // Always return a null value for destroy.
+        // While this is usually indicated by a nil state, check for missing ID or
+        // attributes in the case of a provider failure.
+        if destroy || newInstanceState == nil || newInstanceState.Attributes == nil || newInstanceState.ID == "" {
+                newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+                resp.NewState = &proto.DynamicValue{
+                        Msgpack: newStateMP,
+                }
+                return resp, nil
+        }
+
+        // We keep the null val if we destroyed the resource, otherwise build the
+        // entire object, even if the new state was nil.
+        newStateVal, err = schema.StateValueFromInstanceState(newInstanceState, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = normalizeNullValues(newStateVal, plannedStateVal, true)
+
+        newStateVal = copyTimeoutValues(newStateVal, plannedStateVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.NewState = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+
+        meta, err := json.Marshal(newInstanceState.Meta)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.Private = meta
+
+        // This is a signal to Terraform Core that we're doing the best we can to
+        // shim the legacy type system of the SDK onto the Terraform type system
+        // but we need it to cut us some slack. This setting should not be taken
+        // forward to any new SDK implementations, since setting it prevents us
+        // from catching certain classes of provider bug that can lead to
+        // confusing downstream errors.
+        resp.LegacyTypeSystem = true
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ImportResourceState(_ context.Context, req *proto.ImportResourceState_Request) (*proto.ImportResourceState_Response, error) {
+        resp := &proto.ImportResourceState_Response{}
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        newInstanceStates, err := s.provider.ImportState(info, req.Id)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        for _, is := range newInstanceStates {
+                // copy the ID again just to be sure it wasn't missed
+                is.Attributes["id"] = is.ID
+
+                resourceType := is.Ephemeral.Type
+                if resourceType == "" {
+                        resourceType = req.TypeName
+                }
+
+                schemaBlock := s.getResourceSchemaBlock(resourceType)
+                newStateVal, err := hcl2shim.HCL2ValueFromFlatmap(is.Attributes, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                meta, err := json.Marshal(is.Meta)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                importedResource := &proto.ImportResourceState_ImportedResource{
+                        TypeName: resourceType,
+                        State: &proto.DynamicValue{
+                                Msgpack: newStateMP,
+                        },
+                        Private: meta,
+                }
+
+                resp.ImportedResources = append(resp.ImportedResources, importedResource)
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ReadDataSource(_ context.Context, req *proto.ReadDataSource_Request) (*proto.ReadDataSource_Response, error) {
+        resp := &proto.ReadDataSource_Response{}
+
+        schemaBlock := s.getDatasourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        // we need to still build the diff separately with the Read method to match
+        // the old behavior
+        diff, err := s.provider.ReadDataDiff(info, config)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // now we can get the new complete data source
+        newInstanceState, err := s.provider.ReadDataApply(info, diff)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal, err := schema.StateValueFromInstanceState(newInstanceState, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = copyTimeoutValues(newStateVal, configVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.State = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+        return resp, nil
+}
+
+func pathToAttributePath(path cty.Path) *proto.AttributePath {
+        var steps []*proto.AttributePath_Step
+
+        for _, step := range path {
+                switch s := step.(type) {
+                case cty.GetAttrStep:
+                        steps = append(steps, &proto.AttributePath_Step{
+                                Selector: &proto.AttributePath_Step_AttributeName{
+                                        AttributeName: s.Name,
+                                },
+                        })
+                case cty.IndexStep:
+                        ty := s.Key.Type()
+                        switch ty {
+                        case cty.Number:
+                                i, _ := s.Key.AsBigFloat().Int64()
+                                steps = append(steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyInt{
+                                                ElementKeyInt: i,
+                                        },
+                                })
+                        case cty.String:
+                                steps = append(steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyString{
+                                                ElementKeyString: s.Key.AsString(),
+                                        },
+                                })
+                        }
+                }
+        }
+
+        return &proto.AttributePath{Steps: steps}
+}
+
+// helper/schema throws away timeout values from the config and stores them in
+// the Private/Meta fields. we need to copy those values into the planned state
+// so that core doesn't see a perpetual diff with the timeout block.
+func copyTimeoutValues(to cty.Value, from cty.Value) cty.Value {
+        // if `to` is null we are planning to remove it altogether.
+        if to.IsNull() {
+                return to
+        }
+        toAttrs := to.AsValueMap()
+        // We need to remove the key since the hcl2shims will add a non-null block
+        // because we can't determine if a single block was null from the flatmapped
+        // values. This needs to conform to the correct schema for marshaling, so
+        // change the value to null rather than deleting it from the object map.
+        timeouts, ok := toAttrs[schema.TimeoutsConfigKey]
+        if ok {
+                toAttrs[schema.TimeoutsConfigKey] = cty.NullVal(timeouts.Type())
+        }
+
+        // if from is null then there are no timeouts to copy
+        if from.IsNull() {
+                return cty.ObjectVal(toAttrs)
+        }
+
+        fromAttrs := from.AsValueMap()
+        timeouts, ok = fromAttrs[schema.TimeoutsConfigKey]
+
+        // timeouts shouldn't be unknown, but don't copy possibly invalid values either
+        if !ok || timeouts.IsNull() || !timeouts.IsWhollyKnown() {
+                // no timeouts block to copy
+                return cty.ObjectVal(toAttrs)
+        }
+
+        toAttrs[schema.TimeoutsConfigKey] = timeouts
+
+        return cty.ObjectVal(toAttrs)
+}
+
+// stripResourceModifiers takes a *schema.Resource and returns a deep copy with all
+// StateFuncs and CustomizeDiffs removed. This will be used during apply to
+// create a diff from a planned state where the diff modifications have already
+// been applied.
+func stripResourceModifiers(r *schema.Resource) *schema.Resource {
+        if r == nil {
+                return nil
+        }
+        // start with a shallow copy
+        newResource := new(schema.Resource)
+        *newResource = *r
+
+        newResource.CustomizeDiff = nil
+        newResource.Schema = map[string]*schema.Schema{}
+
+        for k, s := range r.Schema {
+                newResource.Schema[k] = stripSchema(s)
+        }
+
+        return newResource
+}
+
+func stripSchema(s *schema.Schema) *schema.Schema {
+        if s == nil {
+                return nil
+        }
+        // start with a shallow copy
+        newSchema := new(schema.Schema)
+        *newSchema = *s
+
+        newSchema.StateFunc = nil
+
+        switch e := newSchema.Elem.(type) {
+        case *schema.Schema:
+                newSchema.Elem = stripSchema(e)
+        case *schema.Resource:
+                newSchema.Elem = stripResourceModifiers(e)
+        }
+
+        return newSchema
+}
+
+// Zero values and empty containers may be interchanged by the apply process.
+// When there is a discrepency between src and dst value being null or empty,
+// prefer the src value. This takes a little more liberty with set types, since
+// we can't correlate modified set values. In the case of sets, if the src set
+// was wholly known we assume the value was correctly applied and copy that
+// entirely to the new value.
+// While apply prefers the src value, during plan we prefer dst whenever there
+// is an unknown or a set is involved, since the plan can alter the value
+// however it sees fit. This however means that a CustomizeDiffFunction may not
+// be able to change a null to an empty value or vice versa, but that should be
+// very uncommon nor was it reliable before 0.12 either.
+func normalizeNullValues(dst, src cty.Value, apply bool) cty.Value {
+        ty := dst.Type()
+        if !src.IsNull() && !src.IsKnown() {
+                // Return src during plan to retain unknown interpolated placeholders,
+                // which could be lost if we're only updating a resource. If this is a
+                // read scenario, then there shouldn't be any unknowns at all.
+                if dst.IsNull() && !apply {
+                        return src
+                }
+                return dst
+        }
+
+        // Handle null/empty changes for collections during apply.
+        // A change between null and empty values prefers src to make sure the state
+        // is consistent between plan and apply.
+        if ty.IsCollectionType() && apply {
+                dstEmpty := !dst.IsNull() && dst.IsKnown() && dst.LengthInt() == 0
+                srcEmpty := !src.IsNull() && src.IsKnown() && src.LengthInt() == 0
+
+                if (src.IsNull() && dstEmpty) || (srcEmpty && dst.IsNull()) {
+                        return src
+                }
+        }
+
+        if src.IsNull() || !src.IsKnown() || !dst.IsKnown() {
+                return dst
+        }
+
+        switch {
+        case ty.IsMapType(), ty.IsObjectType():
+                var dstMap map[string]cty.Value
+                if !dst.IsNull() {
+                        dstMap = dst.AsValueMap()
+                }
+                if dstMap == nil {
+                        dstMap = map[string]cty.Value{}
+                }
+
+                srcMap := src.AsValueMap()
+                for key, v := range srcMap {
+                        dstVal, ok := dstMap[key]
+                        if !ok && apply && ty.IsMapType() {
+                                // don't transfer old map values to dst during apply
+                                continue
+                        }
+
+                        if dstVal == cty.NilVal {
+                                if !apply && ty.IsMapType() {
+                                        // let plan shape this map however it wants
+                                        continue
+                                }
+                                dstVal = cty.NullVal(v.Type())
+                        }
+
+                        dstMap[key] = normalizeNullValues(dstVal, v, apply)
+                }
+
+                // you can't call MapVal/ObjectVal with empty maps, but nothing was
+                // copied in anyway. If the dst is nil, and the src is known, assume the
+                // src is correct.
+                if len(dstMap) == 0 {
+                        if dst.IsNull() && src.IsWhollyKnown() && apply {
+                                return src
+                        }
+                        return dst
+                }
+
+                if ty.IsMapType() {
+                        // helper/schema will populate an optional+computed map with
+                        // unknowns which we have to fixup here.
+                        // It would be preferable to simply prevent any known value from
+                        // becoming unknown, but concessions have to be made to retain the
+                        // broken legacy behavior when possible.
+                        for k, srcVal := range srcMap {
+                                if !srcVal.IsNull() && srcVal.IsKnown() {
+                                        dstVal, ok := dstMap[k]
+                                        if !ok {
+                                                continue
+                                        }
+
+                                        if !dstVal.IsNull() && !dstVal.IsKnown() {
+                                                dstMap[k] = srcVal
+                                        }
+                                }
+                        }
+
+                        return cty.MapVal(dstMap)
+                }
+
+                return cty.ObjectVal(dstMap)
+
+        case ty.IsSetType():
+                // If the original was wholly known, then we expect that is what the
+                // provider applied. The apply process loses too much information to
+                // reliably re-create the set.
+                if src.IsWhollyKnown() && apply {
+                        return src
+                }
+
+        case ty.IsListType(), ty.IsTupleType():
+                // If the dst is null, and the src is known, then we lost an empty value
+                // so take the original.
+                if dst.IsNull() {
+                        if src.IsWhollyKnown() && src.LengthInt() == 0 && apply {
+                                return src
+                        }
+
+                        // if dst is null and src only contains unknown values, then we lost
+                        // those during a read or plan.
+                        if !apply && !src.IsNull() {
+                                allUnknown := true
+                                for _, v := range src.AsValueSlice() {
+                                        if v.IsKnown() {
+                                                allUnknown = false
+                                                break
+                                        }
+                                }
+                                if allUnknown {
+                                        return src
+                                }
+                        }
+
+                        return dst
+                }
+
+                // if the lengths are identical, then iterate over each element in succession.
+                srcLen := src.LengthInt()
+                dstLen := dst.LengthInt()
+                if srcLen == dstLen && srcLen > 0 {
+                        srcs := src.AsValueSlice()
+                        dsts := dst.AsValueSlice()
+
+                        for i := 0; i < srcLen; i++ {
+                                dsts[i] = normalizeNullValues(dsts[i], srcs[i], apply)
+                        }
+
+                        if ty.IsTupleType() {
+                                return cty.TupleVal(dsts)
+                        }
+                        return cty.ListVal(dsts)
+                }
+
+        case ty.IsPrimitiveType():
+                if dst.IsNull() && src.IsWhollyKnown() && apply {
+                        return src
+                }
+        }
+
+        return dst
+}
+
+// validateConfigNulls checks a config value for unsupported nulls before
+// attempting to shim the value. While null values can mostly be ignored in the
+// configuration, since they're not supported in HCL1, the case where a null
+// appears in a list-like attribute (list, set, tuple) will present a nil value
+// to helper/schema which can panic. Return an error to the user in this case,
+// indicating the attribute with the null value.
+func validateConfigNulls(v cty.Value, path cty.Path) []*proto.Diagnostic {
+        var diags []*proto.Diagnostic
+        if v.IsNull() || !v.IsKnown() {
+                return diags
+        }
+
+        switch {
+        case v.Type().IsListType() || v.Type().IsSetType() || v.Type().IsTupleType():
+                it := v.ElementIterator()
+                for it.Next() {
+                        kv, ev := it.Element()
+                        if ev.IsNull() {
+                                diags = append(diags, &proto.Diagnostic{
+                                        Severity:  proto.Diagnostic_ERROR,
+                                        Summary:   "Null value found in list",
+                                        Detail:    "Null values are not allowed for this attribute value.",
+                                        Attribute: convert.PathToAttributePath(append(path, cty.IndexStep{Key: kv})),
+                                })
+                                continue
+                        }
+
+                        d := validateConfigNulls(ev, append(path, cty.IndexStep{Key: kv}))
+                        diags = convert.AppendProtoDiag(diags, d)
+                }
+
+        case v.Type().IsMapType() || v.Type().IsObjectType():
+                it := v.ElementIterator()
+                for it.Next() {
+                        kv, ev := it.Element()
+                        var step cty.PathStep
+                        switch {
+                        case v.Type().IsMapType():
+                                step = cty.IndexStep{Key: kv}
+                        case v.Type().IsObjectType():
+                                step = cty.GetAttrStep{Name: kv.AsString()}
+                        }
+                        d := validateConfigNulls(ev, append(path, step))
+                        diags = convert.AppendProtoDiag(diags, d)
+                }
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go
new file mode 100644
index 0000000..14494e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go
@@ -0,0 +1,147 @@
+package plugin
+
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/helper/schema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/terraform"
+        "github.com/zclconf/go-cty/cty"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        context "golang.org/x/net/context"
+)
+
+// NewGRPCProvisionerServerShim wraps a terraform.ResourceProvisioner in a
+// proto.ProvisionerServer implementation. If the provided provisioner is not a
+// *schema.Provisioner, this will return nil,
+func NewGRPCProvisionerServerShim(p terraform.ResourceProvisioner) *GRPCProvisionerServer {
+        sp, ok := p.(*schema.Provisioner)
+        if !ok {
+                return nil
+        }
+        return &GRPCProvisionerServer{
+                provisioner: sp,
+        }
+}
+
+type GRPCProvisionerServer struct {
+        provisioner *schema.Provisioner
+}
+
+func (s *GRPCProvisionerServer) GetSchema(_ context.Context, req *proto.GetProvisionerSchema_Request) (*proto.GetProvisionerSchema_Response, error) {
+        resp := &proto.GetProvisionerSchema_Response{}
+
+        resp.Provisioner = &proto.Schema{
+                Block: convert.ConfigSchemaToProto(schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()),
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProvisionerServer) ValidateProvisionerConfig(_ context.Context, req *proto.ValidateProvisionerConfig_Request) (*proto.ValidateProvisionerConfig_Response, error) {
+        resp := &proto.ValidateProvisionerConfig_Response{}
+
+        cfgSchema := schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, cfgSchema.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, cfgSchema)
+
+        warns, errs := s.provisioner.Validate(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+// stringMapFromValue converts a cty.Value to a map[stirng]string.
+// This will panic if the val is not a cty.Map(cty.String).
+func stringMapFromValue(val cty.Value) map[string]string {
+        m := map[string]string{}
+        if val.IsNull() || !val.IsKnown() {
+                return m
+        }
+
+        for it := val.ElementIterator(); it.Next(); {
+                ak, av := it.Element()
+                name := ak.AsString()
+
+                if !av.IsKnown() || av.IsNull() {
+                        continue
+                }
+
+                av, _ = ctyconvert.Convert(av, cty.String)
+                m[name] = av.AsString()
+        }
+
+        return m
+}
+
+// uiOutput implements the terraform.UIOutput interface to adapt the grpc
+// stream to the legacy Provisioner.Apply method.
+type uiOutput struct {
+        srv proto.Provisioner_ProvisionResourceServer
+}
+
+func (o uiOutput) Output(s string) {
+        err := o.srv.Send(&proto.ProvisionResource_Response{
+                Output: s,
+        })
+        if err != nil {
+                log.Printf("[ERROR] %s", err)
+        }
+}
+
+func (s *GRPCProvisionerServer) ProvisionResource(req *proto.ProvisionResource_Request, srv proto.Provisioner_ProvisionResourceServer) error {
+        // We send back a diagnostics over the stream if there was a
+        // provisioner-side problem.
+        srvResp := &proto.ProvisionResource_Response{}
+
+        cfgSchema := schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()
+        cfgVal, err := msgpack.Unmarshal(req.Config.Msgpack, cfgSchema.ImpliedType())
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+                return nil
+        }
+        resourceConfig := terraform.NewResourceConfigShimmed(cfgVal, cfgSchema)
+
+        connVal, err := msgpack.Unmarshal(req.Connection.Msgpack, cty.Map(cty.String))
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+                return nil
+        }
+
+        conn := stringMapFromValue(connVal)
+
+        instanceState := &terraform.InstanceState{
+                Ephemeral: terraform.EphemeralState{
+                        ConnInfo: conn,
+                },
+                Meta: make(map[string]interface{}),
+        }
+
+        err = s.provisioner.Apply(uiOutput{srv}, instanceState, resourceConfig)
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+        }
+        return nil
+}
+
+func (s *GRPCProvisionerServer) Stop(_ context.Context, req *proto.Stop_Request) (*proto.Stop_Response, error) {
+        resp := &proto.Stop_Response{}
+
+        err := s.provisioner.Stop()
+        if err != nil {
+                resp.Error = err.Error()
+        }
+
+        return resp, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go b/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go
new file mode 100644
index 0000000..64a6784
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go
@@ -0,0 +1,131 @@
+package plugin
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SetUnknowns takes a cty.Value, and compares it to the schema setting any null
+// values which are computed to unknown.
+func SetUnknowns(val cty.Value, schema *configschema.Block) cty.Value {
+        if !val.IsKnown() {
+                return val
+        }
+
+        // If the object was null, we still need to handle the top level attributes
+        // which might be computed, but we don't need to expand the blocks.
+        if val.IsNull() {
+                objMap := map[string]cty.Value{}
+                allNull := true
+                for name, attr := range schema.Attributes {
+                        switch {
+                        case attr.Computed:
+                                objMap[name] = cty.UnknownVal(attr.Type)
+                                allNull = false
+                        default:
+                                objMap[name] = cty.NullVal(attr.Type)
+                        }
+                }
+
+                // If this object has no unknown attributes, then we can leave it null.
+                if allNull {
+                        return val
+                }
+
+                return cty.ObjectVal(objMap)
+        }
+
+        valMap := val.AsValueMap()
+        newVals := make(map[string]cty.Value)
+
+        for name, attr := range schema.Attributes {
+                v := valMap[name]
+
+                if attr.Computed && v.IsNull() {
+                        newVals[name] = cty.UnknownVal(attr.Type)
+                        continue
+                }
+
+                newVals[name] = v
+        }
+
+        for name, blockS := range schema.BlockTypes {
+                blockVal := valMap[name]
+                if blockVal.IsNull() || !blockVal.IsKnown() {
+                        newVals[name] = blockVal
+                        continue
+                }
+
+                blockValType := blockVal.Type()
+                blockElementType := blockS.Block.ImpliedType()
+
+                // This switches on the value type here, so we can correctly switch
+                // between Tuples/Lists and Maps/Objects.
+                switch {
+                case blockS.Nesting == configschema.NestingSingle || blockS.Nesting == configschema.NestingGroup:
+                        // NestingSingle is the only exception here, where we treat the
+                        // block directly as an object
+                        newVals[name] = SetUnknowns(blockVal, &blockS.Block)
+
+                case blockValType.IsSetType(), blockValType.IsListType(), blockValType.IsTupleType():
+                        listVals := blockVal.AsValueSlice()
+                        newListVals := make([]cty.Value, 0, len(listVals))
+
+                        for _, v := range listVals {
+                                newListVals = append(newListVals, SetUnknowns(v, &blockS.Block))
+                        }
+
+                        switch {
+                        case blockValType.IsSetType():
+                                switch len(newListVals) {
+                                case 0:
+                                        newVals[name] = cty.SetValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.SetVal(newListVals)
+                                }
+                        case blockValType.IsListType():
+                                switch len(newListVals) {
+                                case 0:
+                                        newVals[name] = cty.ListValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.ListVal(newListVals)
+                                }
+                        case blockValType.IsTupleType():
+                                newVals[name] = cty.TupleVal(newListVals)
+                        }
+
+                case blockValType.IsMapType(), blockValType.IsObjectType():
+                        mapVals := blockVal.AsValueMap()
+                        newMapVals := make(map[string]cty.Value)
+
+                        for k, v := range mapVals {
+                                newMapVals[k] = SetUnknowns(v, &blockS.Block)
+                        }
+
+                        switch {
+                        case blockValType.IsMapType():
+                                switch len(newMapVals) {
+                                case 0:
+                                        newVals[name] = cty.MapValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.MapVal(newMapVals)
+                                }
+                        case blockValType.IsObjectType():
+                                if len(newMapVals) == 0 {
+                                        // We need to populate empty values to make a valid object.
+                                        for attr, ty := range blockElementType.AttributeTypes() {
+                                                newMapVals[attr] = cty.NullVal(ty)
+                                        }
+                                }
+                                newVals[name] = cty.ObjectVal(newMapVals)
+                        }
+
+                default:
+                        panic(fmt.Sprintf("failed to set unknown values for nested block %q:%#v", name, blockValType))
+                }
+        }
+
+        return cty.ObjectVal(newVals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
new file mode 100644
index 0000000..0742e99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
@@ -0,0 +1,43 @@
+package resource
+
+import (
+        "context"
+        "net"
+        "time"
+
+        "github.com/hashicorp/terraform/helper/plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        tfplugin "github.com/hashicorp/terraform/plugin"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/terraform"
+        "google.golang.org/grpc"
+        "google.golang.org/grpc/test/bufconn"
+)
+
+// GRPCTestProvider takes a legacy ResourceProvider, wraps it in the new GRPC
+// shim and starts it in a grpc server using an inmem connection. It returns a
+// GRPCClient for this new server to test the shimmed resource provider.
+func GRPCTestProvider(rp terraform.ResourceProvider) providers.Interface {
+        listener := bufconn.Listen(256 * 1024)
+        grpcServer := grpc.NewServer()
+
+        p := plugin.NewGRPCProviderServerShim(rp)
+        proto.RegisterProviderServer(grpcServer, p)
+
+        go grpcServer.Serve(listener)
+
+        conn, err := grpc.Dial("", grpc.WithDialer(func(string, time.Duration) (net.Conn, error) {
+                return listener.Dial()
+        }), grpc.WithInsecure())
+        if err != nil {
+                panic(err)
+        }
+
+        var pp tfplugin.GRPCProviderPlugin
+        client, _ := pp.GRPCClient(context.Background(), nil, conn)
+
+        grpcClient := client.(*tfplugin.GRPCProvider)
+        grpcClient.TestServer = grpcServer
+
+        return grpcClient
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state.go b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
index c34e21b..88a8396 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
@@ -38,7 +38,7 @@ type StateChangeConf struct {
 // specified in the configuration using the specified Refresh() func,
 // waiting the number of seconds specified in the timeout configuration.
 //
-// If the Refresh function returns a error, exit immediately with that error.
+// If the Refresh function returns an error, exit immediately with that error.
 //
 // If the Refresh function returns a state other than the Target state or one
 // listed in Pending, return immediately with an error.
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
new file mode 100644
index 0000000..b2aff99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
@@ -0,0 +1,163 @@
+package resource
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/helper/schema"
+
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// shimState takes a new *states.State and reverts it to a legacy state for the provider ACC tests
+func shimNewState(newState *states.State, providers map[string]terraform.ResourceProvider) (*terraform.State, error) {
+        state := terraform.NewState()
+
+        // in the odd case of a nil state, let the helper packages handle it
+        if newState == nil {
+                return nil, nil
+        }
+
+        for _, newMod := range newState.Modules {
+                mod := state.AddModule(newMod.Addr)
+
+                for name, out := range newMod.OutputValues {
+                        outputType := ""
+                        val := hcl2shim.ConfigValueFromHCL2(out.Value)
+                        ty := out.Value.Type()
+                        switch {
+                        case ty == cty.String:
+                                outputType = "string"
+                        case ty.IsTupleType() || ty.IsListType():
+                                outputType = "list"
+                        case ty.IsMapType():
+                                outputType = "map"
+                        }
+
+                        mod.Outputs[name] = &terraform.OutputState{
+                                Type:      outputType,
+                                Value:     val,
+                                Sensitive: out.Sensitive,
+                        }
+                }
+
+                for _, res := range newMod.Resources {
+                        resType := res.Addr.Type
+                        providerType := res.ProviderConfig.ProviderConfig.Type
+
+                        resource := getResource(providers, providerType, res.Addr)
+
+                        for key, i := range res.Instances {
+                                flatmap, err := shimmedAttributes(i.Current, resource)
+                                if err != nil {
+                                        return nil, fmt.Errorf("error decoding state for %q: %s", resType, err)
+                                }
+
+                                resState := &terraform.ResourceState{
+                                        Type: resType,
+                                        Primary: &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    i.Current.Status == states.ObjectTainted,
+                                        },
+                                        Provider: res.ProviderConfig.String(),
+                                }
+                                if i.Current.SchemaVersion != 0 {
+                                        resState.Primary.Meta = map[string]interface{}{
+                                                "schema_version": i.Current.SchemaVersion,
+                                        }
+                                }
+
+                                for _, dep := range i.Current.Dependencies {
+                                        resState.Dependencies = append(resState.Dependencies, dep.String())
+                                }
+
+                                // convert the indexes to the old style flapmap indexes
+                                idx := ""
+                                switch key.(type) {
+                                case addrs.IntKey:
+                                        // don't add numeric index values to resources with a count of 0
+                                        if len(res.Instances) > 1 {
+                                                idx = fmt.Sprintf(".%d", key)
+                                        }
+                                case addrs.StringKey:
+                                        idx = "." + key.String()
+                                }
+
+                                mod.Resources[res.Addr.String()+idx] = resState
+
+                                // add any deposed instances
+                                for _, dep := range i.Deposed {
+                                        flatmap, err := shimmedAttributes(dep, resource)
+                                        if err != nil {
+                                                return nil, fmt.Errorf("error decoding deposed state for %q: %s", resType, err)
+                                        }
+
+                                        deposed := &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    dep.Status == states.ObjectTainted,
+                                        }
+                                        if dep.SchemaVersion != 0 {
+                                                deposed.Meta = map[string]interface{}{
+                                                        "schema_version": dep.SchemaVersion,
+                                                }
+                                        }
+
+                                        resState.Deposed = append(resState.Deposed, deposed)
+                                }
+                        }
+                }
+        }
+
+        return state, nil
+}
+
+func getResource(providers map[string]terraform.ResourceProvider, providerName string, addr addrs.Resource) *schema.Resource {
+        p := providers[providerName]
+        if p == nil {
+                panic(fmt.Sprintf("provider %q not found in test step", providerName))
+        }
+
+        // this is only for tests, so should only see schema.Providers
+        provider := p.(*schema.Provider)
+
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                resource := provider.ResourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        case addrs.DataResourceMode:
+                resource := provider.DataSourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        }
+
+        panic(fmt.Sprintf("resource %s not found in test step", addr.Type))
+}
+
+func shimmedAttributes(instance *states.ResourceInstanceObjectSrc, res *schema.Resource) (map[string]string, error) {
+        flatmap := instance.AttrsFlat
+        if flatmap != nil {
+                return flatmap, nil
+        }
+
+        // if we have json attrs, they need to be decoded
+        rio, err := instance.Decode(res.CoreConfigSchema().ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        instanceState, err := res.ShimInstanceStateFromValue(rio.Value)
+        if err != nil {
+                return nil, err
+        }
+
+        return instanceState.Attributes, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index b97673f..aa7454d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -1,6 +1,7 @@
 package resource
 
 import (
+        "bytes"
         "flag"
         "fmt"
         "io"
@@ -18,9 +19,18 @@ import (
         "github.com/hashicorp/errwrap"
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/logutils"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/mitchellh/colorstring"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/command/format"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configload"
         "github.com/hashicorp/terraform/helper/logging"
+        "github.com/hashicorp/terraform/internal/initwd"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // flagSweep is a flag available when running tests on the command line. It
@@ -373,6 +383,10 @@ type TestStep struct {
         // be refreshed and don't matter.
         ImportStateVerify       bool
         ImportStateVerifyIgnore []string
+
+        // provider s is used internally to maintain a reference to the
+        // underlying providers during the tests
+        providers map[string]terraform.ResourceProvider
 }
 
 // Set to a file mask in sprintf format where %s is test name
@@ -467,10 +481,22 @@ func Test(t TestT, c TestCase) {
                 c.PreCheck()
         }
 
+        // get instances of all providers, so we can use the individual
+        // resources to shim the state during the tests.
+        providers := make(map[string]terraform.ResourceProvider)
+        for name, pf := range testProviderFactories(c) {
+                p, err := pf()
+                if err != nil {
+                        t.Fatal(err)
+                }
+                providers[name] = p
+        }
+
         providerResolver, err := testProviderResolver(c)
         if err != nil {
                 t.Fatal(err)
         }
+
         opts := terraform.ContextOpts{ProviderResolver: providerResolver}
 
         // A single state variable to track the lifecycle, starting with no state
@@ -481,6 +507,10 @@ func Test(t TestT, c TestCase) {
         idRefresh := c.IDRefreshName != ""
         errored := false
         for i, step := range c.Steps {
+                // insert the providers into the step so we can get the resources for
+                // shimming the state
+                step.providers = providers
+
                 var err error
                 log.Printf("[DEBUG] Test: Executing step %d", i)
 
@@ -535,8 +565,7 @@ func Test(t TestT, c TestCase) {
                                 }
                         } else {
                                 errored = true
-                                t.Error(fmt.Sprintf(
-                                        "Step %d error: %s", i, err))
+                                t.Error(fmt.Sprintf("Step %d error: %s", i, detailedErrorMessage(err)))
                                 break
                         }
                 }
@@ -591,6 +620,7 @@ func Test(t TestT, c TestCase) {
                         Destroy:                   true,
                         PreventDiskCleanup:        lastStep.PreventDiskCleanup,
                         PreventPostDestroyRefresh: c.PreventPostDestroyRefresh,
+                        providers:                 providers,
                 }
 
                 log.Printf("[WARN] Test: Executing destroy step")
@@ -620,39 +650,50 @@ func testProviderConfig(c TestCase) string {
         return strings.Join(lines, "")
 }
 
-// testProviderResolver is a helper to build a ResourceProviderResolver
-// with pre instantiated ResourceProviders, so that we can reset them for the
-// test, while only calling the factory function once.
-// Any errors are stored so that they can be returned by the factory in
-// terraform to match non-test behavior.
-func testProviderResolver(c TestCase) (terraform.ResourceProviderResolver, error) {
-        ctxProviders := c.ProviderFactories
-        if ctxProviders == nil {
-                ctxProviders = make(map[string]terraform.ResourceProviderFactory)
+// testProviderFactories combines the fixed Providers and
+// ResourceProviderFactory functions into a single map of
+// ResourceProviderFactory functions.
+func testProviderFactories(c TestCase) map[string]terraform.ResourceProviderFactory {
+        ctxProviders := make(map[string]terraform.ResourceProviderFactory)
+        for k, pf := range c.ProviderFactories {
+                ctxProviders[k] = pf
         }
 
         // add any fixed providers
         for k, p := range c.Providers {
                 ctxProviders[k] = terraform.ResourceProviderFactoryFixed(p)
         }
+        return ctxProviders
+}
+
+// testProviderResolver is a helper to build a ResourceProviderResolver
+// with pre instantiated ResourceProviders, so that we can reset them for the
+// test, while only calling the factory function once.
+// Any errors are stored so that they can be returned by the factory in
+// terraform to match non-test behavior.
+func testProviderResolver(c TestCase) (providers.Resolver, error) {
+        ctxProviders := testProviderFactories(c)
+
+        // wrap the old provider factories in the test grpc server so they can be
+        // called from terraform.
+        newProviders := make(map[string]providers.Factory)
 
-        // reset the providers if needed
         for k, pf := range ctxProviders {
-                // we can ignore any errors here, if we don't have a provider to reset
-                // the error will be handled later
-                p, err := pf()
-                if err != nil {
-                        return nil, err
-                }
-                if p, ok := p.(TestProvider); ok {
-                        err := p.TestReset()
+                factory := pf // must copy to ensure each closure sees its own value
+                newProviders[k] = func() (providers.Interface, error) {
+                        p, err := factory()
                         if err != nil {
-                                return nil, fmt.Errorf("[ERROR] failed to reset provider %q: %s", k, err)
+                                return nil, err
                         }
+
+                        // The provider is wrapped in a GRPCTestProvider so that it can be
+                        // passed back to terraform core as a providers.Interface, rather
+                        // than the legacy ResourceProvider.
+                        return GRPCTestProvider(p), nil
                 }
         }
 
-        return terraform.ResourceProviderResolverFixed(ctxProviders), nil
+        return providers.ResolverFixed(newProviders), nil
 }
 
 // UnitTest is a helper to force the acceptance testing harness to run in the
@@ -670,33 +711,40 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
                 return nil
         }
 
-        name := fmt.Sprintf("%s.foo", r.Type)
+        addr := addrs.Resource{
+                Mode: addrs.ManagedResourceMode,
+                Type: r.Type,
+                Name: "foo",
+        }.Instance(addrs.NoKey)
+        absAddr := addr.Absolute(addrs.RootModuleInstance)
 
         // Build the state. The state is just the resource with an ID. There
         // are no attributes. We only set what is needed to perform a refresh.
-        state := terraform.NewState()
-        state.RootModule().Resources[name] = &terraform.ResourceState{
-                Type: r.Type,
-                Primary: &terraform.InstanceState{
-                        ID: r.Primary.ID,
+        state := states.NewState()
+        state.RootModule().SetResourceInstanceCurrent(
+                addr,
+                &states.ResourceInstanceObjectSrc{
+                        AttrsFlat: r.Primary.Attributes,
+                        Status:    states.ObjectReady,
                 },
-        }
+                addrs.ProviderConfig{Type: "placeholder"}.Absolute(addrs.RootModuleInstance),
+        )
 
         // Create the config module. We use the full config because Refresh
         // doesn't have access to it and we may need things like provider
         // configurations. The initial implementation of id-only checks used
         // an empty config module, but that caused the aforementioned problems.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return err
         }
 
         // Initialize the context
-        opts.Module = mod
+        opts.Config = cfg
         opts.State = state
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return err
+        ctx, ctxDiags := terraform.NewContext(&opts)
+        if ctxDiags.HasErrors() {
+                return ctxDiags.Err()
         }
         if diags := ctx.Validate(); len(diags) > 0 {
                 if diags.HasErrors() {
@@ -707,20 +755,20 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
-        if err != nil {
-                return fmt.Errorf("Error refreshing: %s", err)
+        state, refreshDiags := ctx.Refresh()
+        if refreshDiags.HasErrors() {
+                return refreshDiags.Err()
         }
 
         // Verify attribute equivalence.
-        actualR := state.RootModule().Resources[name]
+        actualR := state.ResourceInstance(absAddr)
         if actualR == nil {
                 return fmt.Errorf("Resource gone!")
         }
-        if actualR.Primary == nil {
+        if actualR.Current == nil {
                 return fmt.Errorf("Resource has no primary instance")
         }
-        actual := actualR.Primary.Attributes
+        actual := actualR.Current.AttrsFlat
         expected := r.Primary.Attributes
         // Remove fields we're ignoring
         for _, v := range c.IDRefreshIgnore {
@@ -756,15 +804,14 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         return nil
 }
 
-func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error) {
+func testConfig(opts terraform.ContextOpts, step TestStep) (*configs.Config, error) {
         if step.PreConfig != nil {
                 step.PreConfig()
         }
 
         cfgPath, err := ioutil.TempDir("", "tf-test")
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary directory for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary directory for config: %s", err)
         }
 
         if step.PreventDiskCleanup {
@@ -773,38 +820,38 @@ func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error)
                 defer os.RemoveAll(cfgPath)
         }
 
-        // Write the configuration
-        cfgF, err := os.Create(filepath.Join(cfgPath, "main.tf"))
+        // Write the main configuration file
+        err = ioutil.WriteFile(filepath.Join(cfgPath, "main.tf"), []byte(step.Config), os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary file for config: %s", err)
         }
 
-        _, err = io.Copy(cfgF, strings.NewReader(step.Config))
-        cfgF.Close()
+        // Create directory for our child modules, if any.
+        modulesDir := filepath.Join(cfgPath, ".modules")
+        err = os.Mkdir(modulesDir, os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating child modules directory: %s", err)
         }
 
-        // Parse the configuration
-        mod, err := module.NewTreeModule("", cfgPath)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "Error loading configuration: %s", err)
+        inst := initwd.NewModuleInstaller(modulesDir, nil)
+        _, installDiags := inst.InstallModules(cfgPath, true, initwd.ModuleInstallHooksImpl{})
+        if installDiags.HasErrors() {
+                return nil, installDiags.Err()
         }
 
-        // Load the modules
-        modStorage := &module.Storage{
-                StorageDir: filepath.Join(cfgPath, ".tfmodules"),
-                Mode:       module.GetModeGet,
-        }
-        err = mod.Load(modStorage)
+        loader, err := configload.NewLoader(&configload.Config{
+                ModulesDir: modulesDir,
+        })
         if err != nil {
-                return nil, fmt.Errorf("Error downloading modules: %s", err)
+                return nil, fmt.Errorf("failed to create config loader: %s", err)
+        }
+
+        config, configDiags := loader.LoadConfig(cfgPath)
+        if configDiags.HasErrors() {
+                return nil, configDiags
         }
 
-        return mod, nil
+        return config, nil
 }
 
 func testResource(c TestStep, state *terraform.State) (*terraform.ResourceState, error) {
@@ -881,8 +928,9 @@ func TestCheckResourceAttrSet(name, key string) TestCheckFunc {
 // TestCheckModuleResourceAttrSet - as per TestCheckResourceAttrSet but with
 // support for non-root modules
 func TestCheckModuleResourceAttrSet(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -915,8 +963,9 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
 // TestCheckModuleResourceAttr - as per TestCheckResourceAttr but with
 // support for non-root modules
 func TestCheckModuleResourceAttr(mp []string, name string, key string, value string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -926,7 +975,19 @@ func TestCheckModuleResourceAttr(mp []string, name string, key string, value str
 }
 
 func testCheckResourceAttr(is *terraform.InstanceState, name string, key string, value string) error {
+        // Empty containers may be elided from the state.
+        // If the intent here is to check for an empty container, allow the key to
+        // also be non-existent.
+        emptyCheck := false
+        if value == "0" && (strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%")) {
+                emptyCheck = true
+        }
+
         if v, ok := is.Attributes[key]; !ok || v != value {
+                if emptyCheck && !ok {
+                        return nil
+                }
+
                 if !ok {
                         return fmt.Errorf("%s: Attribute '%s' not found", name, key)
                 }
@@ -957,8 +1018,9 @@ func TestCheckNoResourceAttr(name, key string) TestCheckFunc {
 // TestCheckModuleNoResourceAttr - as per TestCheckNoResourceAttr but with
 // support for non-root modules
 func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -968,7 +1030,20 @@ func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestChe
 }
 
 func testCheckNoResourceAttr(is *terraform.InstanceState, name string, key string) error {
-        if _, ok := is.Attributes[key]; ok {
+        // Empty containers may sometimes be included in the state.
+        // If the intent here is to check for an empty container, allow the value to
+        // also be "0".
+        emptyCheck := false
+        if strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%") {
+                emptyCheck = true
+        }
+
+        val, exists := is.Attributes[key]
+        if emptyCheck && val == "0" {
+                return nil
+        }
+
+        if exists {
                 return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
         }
 
@@ -991,8 +1066,9 @@ func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
 // TestModuleMatchResourceAttr - as per TestMatchResourceAttr but with
 // support for non-root modules
 func TestModuleMatchResourceAttr(mp []string, name string, key string, r *regexp.Regexp) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -1052,13 +1128,15 @@ func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string
 // TestCheckModuleResourceAttrPair - as per TestCheckResourceAttrPair but with
 // support for non-root modules
 func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirst string, mpSecond []string, nameSecond string, keySecond string) TestCheckFunc {
+        mptFirst := addrs.Module(mpFirst).UnkeyedInstanceShim()
+        mptSecond := addrs.Module(mpSecond).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                isFirst, err := modulePathPrimaryInstanceState(s, mpFirst, nameFirst)
+                isFirst, err := modulePathPrimaryInstanceState(s, mptFirst, nameFirst)
                 if err != nil {
                         return err
                 }
 
-                isSecond, err := modulePathPrimaryInstanceState(s, mpSecond, nameSecond)
+                isSecond, err := modulePathPrimaryInstanceState(s, mptSecond, nameSecond)
                 if err != nil {
                         return err
                 }
@@ -1068,14 +1146,32 @@ func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirs
 }
 
 func testCheckResourceAttrPair(isFirst *terraform.InstanceState, nameFirst string, keyFirst string, isSecond *terraform.InstanceState, nameSecond string, keySecond string) error {
-        vFirst, ok := isFirst.Attributes[keyFirst]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
+        vFirst, okFirst := isFirst.Attributes[keyFirst]
+        vSecond, okSecond := isSecond.Attributes[keySecond]
+
+        // Container count values of 0 should not be relied upon, and not reliably
+        // maintained by helper/schema. For the purpose of tests, consider unset and
+        // 0 to be equal.
+        if len(keyFirst) > 2 && len(keySecond) > 2 && keyFirst[len(keyFirst)-2:] == keySecond[len(keySecond)-2:] &&
+                (strings.HasSuffix(keyFirst, ".#") || strings.HasSuffix(keyFirst, ".%")) {
+                // they have the same suffix, and it is a collection count key.
+                if vFirst == "0" || vFirst == "" {
+                        okFirst = false
+                }
+                if vSecond == "0" || vSecond == "" {
+                        okSecond = false
+                }
         }
 
-        vSecond, ok := isSecond.Attributes[keySecond]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+        if okFirst != okSecond {
+                if !okFirst {
+                        return fmt.Errorf("%s: Attribute %q not set, but %q is set in %s as %q", nameFirst, keyFirst, keySecond, nameSecond, vSecond)
+                }
+                return fmt.Errorf("%s: Attribute %q is %q, but %q is not set in %s", nameFirst, keyFirst, vFirst, keySecond, nameSecond)
+        }
+        if !(okFirst || okSecond) {
+                // If they both don't exist then they are equally unset, so that's okay.
+                return nil
         }
 
         if vFirst != vSecond {
@@ -1163,7 +1259,7 @@ func modulePrimaryInstanceState(s *terraform.State, ms *terraform.ModuleState, n
 
 // modulePathPrimaryInstanceState returns the primary instance state for the
 // given resource name in a given module path.
-func modulePathPrimaryInstanceState(s *terraform.State, mp []string, name string) (*terraform.InstanceState, error) {
+func modulePathPrimaryInstanceState(s *terraform.State, mp addrs.ModuleInstance, name string) (*terraform.InstanceState, error) {
         ms := s.ModuleByPath(mp)
         if ms == nil {
                 return nil, fmt.Errorf("No module found at: %s", mp)
@@ -1178,3 +1274,47 @@ func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceS
         ms := s.RootModule()
         return modulePrimaryInstanceState(s, ms, name)
 }
+
+// operationError is a specialized implementation of error used to describe
+// failures during one of the several operations performed for a particular
+// test case.
+type operationError struct {
+        OpName string
+        Diags  tfdiags.Diagnostics
+}
+
+func newOperationError(opName string, diags tfdiags.Diagnostics) error {
+        return operationError{opName, diags}
+}
+
+// Error returns a terse error string containing just the basic diagnostic
+// messages, for situations where normal Go error behavior is appropriate.
+func (err operationError) Error() string {
+        return fmt.Sprintf("errors during %s: %s", err.OpName, err.Diags.Err().Error())
+}
+
+// ErrorDetail is like Error except it includes verbosely-rendered diagnostics
+// similar to what would come from a normal Terraform run, which include
+// additional context not included in Error().
+func (err operationError) ErrorDetail() string {
+        var buf bytes.Buffer
+        fmt.Fprintf(&buf, "errors during %s:", err.OpName)
+        clr := &colorstring.Colorize{Disable: true, Colors: colorstring.DefaultColors}
+        for _, diag := range err.Diags {
+                diagStr := format.Diagnostic(diag, nil, clr, 78)
+                buf.WriteByte('\n')
+                buf.WriteString(diagStr)
+        }
+        return buf.String()
+}
+
+// detailedErrorMessage is a helper for calling ErrorDetail on an error if
+// it is an operationError or just taking Error otherwise.
+func detailedErrorMessage(err error) string {
+        switch tErr := err.(type) {
+        case operationError:
+                return tErr.ErrorDetail()
+        default:
+                return err.Error()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 033f126..311fdb6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -1,13 +1,23 @@
 package resource
 
 import (
+        "bufio"
+        "bytes"
         "errors"
         "fmt"
         "log"
+        "sort"
         "strings"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/states"
+
         "github.com/hashicorp/errwrap"
+        "github.com/hashicorp/terraform/plans"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // testStepConfig runs a config-mode test step
@@ -18,69 +28,79 @@ func testStepConfig(
         return testStep(opts, state, step)
 }
 
-func testStep(
-        opts terraform.ContextOpts,
-        state *terraform.State,
-        step TestStep) (*terraform.State, error) {
-        // Pre-taint any resources that have been defined in Taint, as long as this
-        // is not a destroy step.
+func testStep(opts terraform.ContextOpts, state *terraform.State, step TestStep) (*terraform.State, error) {
         if !step.Destroy {
                 if err := testStepTaint(state, step); err != nil {
                         return state, err
                 }
         }
 
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
+        var stepDiags tfdiags.Diagnostics
+
         // Build the context
-        opts.Module = mod
-        opts.State = state
-        opts.Destroy = step.Destroy
-        ctx, err := terraform.NewContext(&opts)
+        opts.Config = cfg
+        opts.State, err = terraform.ShimLegacyState(state)
         if err != nil {
-                return state, fmt.Errorf("Error initializing context: %s", err)
+                return nil, err
+        }
+
+        opts.Destroy = step.Destroy
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, fmt.Errorf("Error initializing context: %s", stepDiags.Err())
         }
-        if diags := ctx.Validate(); len(diags) > 0 {
-                if diags.HasErrors() {
-                        return nil, errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
+        if stepDiags := ctx.Validate(); len(stepDiags) > 0 {
+                if stepDiags.HasErrors() {
+                        return state, errwrap.Wrapf("config is invalid: {{err}}", stepDiags.Err())
                 }
 
-                log.Printf("[WARN] Config warnings:\n%s", diags)
+                log.Printf("[WARN] Config warnings:\n%s", stepDiags)
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
+        newState, stepDiags := ctx.Refresh()
+        // shim the state first so the test can check the state on errors
+
+        state, err = shimNewState(newState, step.providers)
         if err != nil {
-                return state, fmt.Errorf(
-                        "Error refreshing: %s", err)
+                return nil, err
+        }
+        if stepDiags.HasErrors() {
+                return state, newOperationError("refresh", stepDiags)
         }
 
         // If this step is a PlanOnly step, skip over this first Plan and subsequent
         // Apply, and use the follow up Plan that checks for perpetual diffs
         if !step.PlanOnly {
                 // Plan!
-                if p, err := ctx.Plan(); err != nil {
-                        return state, fmt.Errorf(
-                                "Error planning: %s", err)
+                if p, stepDiags := ctx.Plan(); stepDiags.HasErrors() {
+                        return state, newOperationError("plan", stepDiags)
                 } else {
-                        log.Printf("[WARN] Test: Step plan: %s", p)
+                        log.Printf("[WARN] Test: Step plan: %s", legacyPlanComparisonString(newState, p.Changes))
                 }
 
                 // We need to keep a copy of the state prior to destroying
-                // such that destroy steps can verify their behaviour in the check
+                // such that destroy steps can verify their behavior in the check
                 // function
                 stateBeforeApplication := state.DeepCopy()
 
-                // Apply!
-                state, err = ctx.Apply()
+                // Apply the diff, creating real resources.
+                newState, stepDiags = ctx.Apply()
+                // shim the state first so the test can check the state on errors
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf("Error applying: %s", err)
+                        return nil, err
+                }
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("apply", stepDiags)
                 }
 
-                // Check! Excitement!
+                // Run any configured checks
                 if step.Check != nil {
                         if step.Destroy {
                                 if err := step.Check(stateBeforeApplication); err != nil {
@@ -96,31 +116,35 @@ func testStep(
 
         // Now, verify that Plan is now empty and we don't have a perpetual diff issue
         // We do this with TWO plans. One without a refresh.
-        var p *terraform.Plan
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on follow-up plan: %s", err)
+        var p *plans.Plan
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("follow-up plan", stepDiags)
         }
-        if p.Diff != nil && !p.Diff.Empty() {
+        if !p.Changes.Empty() {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
-                                "After applying this step, the plan was not empty:\n\n%s", p)
+                                "After applying this step, the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // And another after a Refresh.
         if !step.Destroy || (step.Destroy && !step.PreventPostDestroyRefresh) {
-                state, err = ctx.Refresh()
+                newState, stepDiags = ctx.Refresh()
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("follow-up refresh", stepDiags)
+                }
+
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf(
-                                "Error on follow-up refresh: %s", err)
+                        return nil, err
                 }
         }
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on second follow-up plan: %s", err)
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("second follow-up refresh", stepDiags)
         }
-        empty := p.Diff == nil || p.Diff.Empty()
+        empty := p.Changes.Empty()
 
         // Data resources are tricky because they legitimately get instantiated
         // during refresh so that they will be already populated during the
@@ -128,35 +152,28 @@ func testStep(
         // config we'll end up wanting to destroy them again here. This is
         // acceptable and expected, and we'll treat it as "empty" for the
         // sake of this testing.
-        if step.Destroy {
+        if step.Destroy && !empty {
                 empty = true
-
-                for _, moduleDiff := range p.Diff.Modules {
-                        for k, instanceDiff := range moduleDiff.Resources {
-                                if !strings.HasPrefix(k, "data.") {
-                                        empty = false
-                                        break
-                                }
-
-                                if !instanceDiff.Destroy {
-                                        empty = false
-                                }
+                for _, change := range p.Changes.Resources {
+                        if change.Addr.Resource.Resource.Mode != addrs.DataResourceMode {
+                                empty = false
+                                break
                         }
                 }
         }
 
         if !empty {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
                                 "After applying this step and refreshing, "+
-                                        "the plan was not empty:\n\n%s", p)
+                                        "the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // Made it here, but expected a non-empty plan, fail!
-        if step.ExpectNonEmptyPlan && (p.Diff == nil || p.Diff.Empty()) {
+        if step.ExpectNonEmptyPlan && empty {
                 return state, fmt.Errorf("Expected a non-empty plan, but got an empty plan!")
         }
 
@@ -164,6 +181,213 @@ func testStep(
         return state, nil
 }
 
+// legacyPlanComparisonString produces a string representation of the changes
+// from a plan and a given state togther, as was formerly produced by the
+// String method of terraform.Plan.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan and state types, and should not be used in new tests. Instead, use
+// a library like "cmp" to do a deep equality  and diff on the two
+// data structures.
+func legacyPlanComparisonString(state *states.State, changes *plans.Changes) string {
+        return fmt.Sprintf(
+                "DIFF:\n\n%s\n\nSTATE:\n\n%s",
+                legacyDiffComparisonString(changes),
+                state.String(),
+        )
+}
+
+// legacyDiffComparisonString produces a string representation of the changes
+// from a planned changes object, as was formerly produced by the String method
+// of terraform.Diff.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan types, and should not be used in new tests. Instead, use a library
+// like "cmp" to do a deep equality check and diff on the two data structures.
+func legacyDiffComparisonString(changes *plans.Changes) string {
+        // The old string representation of a plan was grouped by module, but
+        // our new plan structure is not grouped in that way and so we'll need
+        // to preprocess it in order to produce that grouping.
+        type ResourceChanges struct {
+                Current *plans.ResourceInstanceChangeSrc
+                Deposed map[states.DeposedKey]*plans.ResourceInstanceChangeSrc
+        }
+        byModule := map[string]map[string]*ResourceChanges{}
+        resourceKeys := map[string][]string{}
+        requiresReplace := map[string][]string{}
+        var moduleKeys []string
+        for _, rc := range changes.Resources {
+                if rc.Action == plans.NoOp {
+                        // We won't mention no-op changes here at all, since the old plan
+                        // model we are emulating here didn't have such a concept.
+                        continue
+                }
+                moduleKey := rc.Addr.Module.String()
+                if _, exists := byModule[moduleKey]; !exists {
+                        moduleKeys = append(moduleKeys, moduleKey)
+                        byModule[moduleKey] = make(map[string]*ResourceChanges)
+                }
+                resourceKey := rc.Addr.Resource.String()
+                if _, exists := byModule[moduleKey][resourceKey]; !exists {
+                        resourceKeys[moduleKey] = append(resourceKeys[moduleKey], resourceKey)
+                        byModule[moduleKey][resourceKey] = &ResourceChanges{
+                                Deposed: make(map[states.DeposedKey]*plans.ResourceInstanceChangeSrc),
+                        }
+                }
+
+                if rc.DeposedKey == states.NotDeposed {
+                        byModule[moduleKey][resourceKey].Current = rc
+                } else {
+                        byModule[moduleKey][resourceKey].Deposed[rc.DeposedKey] = rc
+                }
+
+                rr := []string{}
+                for _, p := range rc.RequiredReplace.List() {
+                        rr = append(rr, hcl2shim.FlatmapKeyFromPath(p))
+                }
+                requiresReplace[resourceKey] = rr
+        }
+        sort.Strings(moduleKeys)
+        for _, ks := range resourceKeys {
+                sort.Strings(ks)
+        }
+
+        var buf bytes.Buffer
+
+        for _, moduleKey := range moduleKeys {
+                rcs := byModule[moduleKey]
+                var mBuf bytes.Buffer
+
+                for _, resourceKey := range resourceKeys[moduleKey] {
+                        rc := rcs[resourceKey]
+
+                        forceNewAttrs := requiresReplace[resourceKey]
+
+                        crud := "UPDATE"
+                        if rc.Current != nil {
+                                switch rc.Current.Action {
+                                case plans.DeleteThenCreate:
+                                        crud = "DESTROY/CREATE"
+                                case plans.CreateThenDelete:
+                                        crud = "CREATE/DESTROY"
+                                case plans.Delete:
+                                        crud = "DESTROY"
+                                case plans.Create:
+                                        crud = "CREATE"
+                                }
+                        } else {
+                                // We must be working on a deposed object then, in which
+                                // case destroying is the only possible action.
+                                crud = "DESTROY"
+                        }
+
+                        extra := ""
+                        if rc.Current == nil && len(rc.Deposed) > 0 {
+                                extra = " (deposed only)"
+                        }
+
+                        fmt.Fprintf(
+                                &mBuf, "%s: %s%s\n",
+                                crud, resourceKey, extra,
+                        )
+
+                        attrNames := map[string]bool{}
+                        var oldAttrs map[string]string
+                        var newAttrs map[string]string
+                        if rc.Current != nil {
+                                if before := rc.Current.Before; before != nil {
+                                        ty, err := before.ImpliedType()
+                                        if err == nil {
+                                                val, err := before.Decode(ty)
+                                                if err == nil {
+                                                        oldAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range oldAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                                if after := rc.Current.After; after != nil {
+                                        ty, err := after.ImpliedType()
+                                        if err == nil {
+                                                val, err := after.Decode(ty)
+                                                if err == nil {
+                                                        newAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range newAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                        }
+                        if oldAttrs == nil {
+                                oldAttrs = make(map[string]string)
+                        }
+                        if newAttrs == nil {
+                                newAttrs = make(map[string]string)
+                        }
+
+                        attrNamesOrder := make([]string, 0, len(attrNames))
+                        keyLen := 0
+                        for n := range attrNames {
+                                attrNamesOrder = append(attrNamesOrder, n)
+                                if len(n) > keyLen {
+                                        keyLen = len(n)
+                                }
+                        }
+                        sort.Strings(attrNamesOrder)
+
+                        for _, attrK := range attrNamesOrder {
+                                v := newAttrs[attrK]
+                                u := oldAttrs[attrK]
+
+                                if v == config.UnknownVariableValue {
+                                        v = "<computed>"
+                                }
+                                // NOTE: we don't support <sensitive> here because we would
+                                // need schema to do that. Excluding sensitive values
+                                // is now done at the UI layer, and so should not be tested
+                                // at the core layer.
+
+                                updateMsg := ""
+
+                                // This may not be as precise as in the old diff, as it matches
+                                // everything under the attribute that was originally marked as
+                                // ForceNew, but should help make it easier to determine what
+                                // caused replacement here.
+                                for _, k := range forceNewAttrs {
+                                        if strings.HasPrefix(attrK, k) {
+                                                updateMsg = " (forces new resource)"
+                                                break
+                                        }
+                                }
+
+                                fmt.Fprintf(
+                                        &mBuf, "  %s:%s %#v => %#v%s\n",
+                                        attrK,
+                                        strings.Repeat(" ", keyLen-len(attrK)),
+                                        u, v,
+                                        updateMsg,
+                                )
+                        }
+                }
+
+                if moduleKey == "" { // root module
+                        buf.Write(mBuf.Bytes())
+                        buf.WriteByte('\n')
+                        continue
+                }
+
+                fmt.Fprintf(&buf, "%s:\n", moduleKey)
+                s := bufio.NewScanner(&mBuf)
+                for s.Scan() {
+                        buf.WriteString(fmt.Sprintf("  %s\n", s.Text()))
+                }
+        }
+
+        return buf.String()
+}
+
 func testStepTaint(state *terraform.State, step TestStep) error {
         for _, p := range step.Taint {
                 m := state.RootModule()
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
index 94fef3c..e1b7aea 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
@@ -7,6 +7,12 @@ import (
         "strings"
 
         "github.com/davecgh/go-spew/spew"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/helper/schema"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -15,6 +21,7 @@ func testStepImportState(
         opts terraform.ContextOpts,
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
+
         // Determine the ID to import
         var importId string
         switch {
@@ -41,33 +48,53 @@ func testStepImportState(
 
         // Setup the context. We initialize with an empty state. We use the
         // full config for provider configurations.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
-        opts.Module = mod
-        opts.State = terraform.NewState()
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return state, err
+        opts.Config = cfg
+
+        // import tests start with empty state
+        opts.State = states.NewState()
+
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, stepDiags.Err()
         }
 
-        // Do the import!
-        newState, err := ctx.Import(&terraform.ImportOpts{
+        // The test step provides the resource address as a string, so we need
+        // to parse it to get an addrs.AbsResourceAddress to pass in to the
+        // import method.
+        traversal, hclDiags := hclsyntax.ParseTraversalAbs([]byte(step.ResourceName), "", hcl.Pos{})
+        if hclDiags.HasErrors() {
+                return nil, hclDiags
+        }
+        importAddr, stepDiags := addrs.ParseAbsResourceInstance(traversal)
+        if stepDiags.HasErrors() {
+                return nil, stepDiags.Err()
+        }
+
+        // Do the import
+        importedState, stepDiags := ctx.Import(&terraform.ImportOpts{
                 // Set the module so that any provider config is loaded
-                Module: mod,
+                Config: cfg,
 
                 Targets: []*terraform.ImportTarget{
                         &terraform.ImportTarget{
-                                Addr: step.ResourceName,
+                                Addr: importAddr,
                                 ID:   importId,
                         },
                 },
         })
+        if stepDiags.HasErrors() {
+                log.Printf("[ERROR] Test: ImportState failure: %s", stepDiags.Err())
+                return state, stepDiags.Err()
+        }
+
+        newState, err := shimNewState(importedState, step.providers)
         if err != nil {
-                log.Printf("[ERROR] Test: ImportState failure: %s", err)
-                return state, err
+                return nil, err
         }
 
         // Go through the new state and verify
@@ -75,7 +102,9 @@ func testStepImportState(
                 var states []*terraform.InstanceState
                 for _, r := range newState.RootModule().Resources {
                         if r.Primary != nil {
-                                states = append(states, r.Primary)
+                                is := r.Primary.DeepCopy()
+                                is.Ephemeral.Type = r.Type // otherwise the check function cannot see the type
+                                states = append(states, is)
                         }
                 }
                 if err := step.ImportStateCheck(states); err != nil {
@@ -102,30 +131,84 @@ func testStepImportState(
                                         r.Primary.ID)
                         }
 
+                        // We'll try our best to find the schema for this resource type
+                        // so we can ignore Removed fields during validation. If we fail
+                        // to find the schema then we won't ignore them and so the test
+                        // will need to rely on explicit ImportStateVerifyIgnore, though
+                        // this shouldn't happen in any reasonable case.
+                        var rsrcSchema *schema.Resource
+                        if providerAddr, diags := addrs.ParseAbsProviderConfigStr(r.Provider); !diags.HasErrors() {
+                                providerType := providerAddr.ProviderConfig.Type
+                                if provider, ok := step.providers[providerType]; ok {
+                                        if provider, ok := provider.(*schema.Provider); ok {
+                                                rsrcSchema = provider.ResourcesMap[r.Type]
+                                        }
+                                }
+                        }
+
+                        // don't add empty flatmapped containers, so we can more easily
+                        // compare the attributes
+                        skipEmpty := func(k, v string) bool {
+                                if strings.HasSuffix(k, ".#") || strings.HasSuffix(k, ".%") {
+                                        if v == "0" {
+                                                return true
+                                        }
+                                }
+                                return false
+                        }
+
                         // Compare their attributes
                         actual := make(map[string]string)
                         for k, v := range r.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 actual[k] = v
                         }
+
                         expected := make(map[string]string)
                         for k, v := range oldR.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 expected[k] = v
                         }
 
                         // Remove fields we're ignoring
                         for _, v := range step.ImportStateVerifyIgnore {
-                                for k, _ := range actual {
+                                for k := range actual {
                                         if strings.HasPrefix(k, v) {
                                                 delete(actual, k)
                                         }
                                 }
-                                for k, _ := range expected {
+                                for k := range expected {
                                         if strings.HasPrefix(k, v) {
                                                 delete(expected, k)
                                         }
                                 }
                         }
 
+                        // Also remove any attributes that are marked as "Removed" in the
+                        // schema, if we have a schema to check that against.
+                        if rsrcSchema != nil {
+                                for k := range actual {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(actual, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                                for k := range expected {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(expected, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                        }
+
                         if !reflect.DeepEqual(actual, expected) {
                                 // Determine only the different attributes
                                 for k, v := range expected {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
index 57fbba7..c8d8ae2 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
@@ -2,8 +2,15 @@ package schema
 
 import (
         "context"
+        "fmt"
 
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
 )
 
 // Backend represents a partial backend.Backend implementation and simplifies
@@ -38,41 +45,123 @@ func FromContextBackendConfig(ctx context.Context) *ResourceData {
         return ctx.Value(backendConfigKey).(*ResourceData)
 }
 
-func (b *Backend) Input(
-        input terraform.UIInput,
-        c *terraform.ResourceConfig) (*terraform.ResourceConfig, error) {
+func (b *Backend) ConfigSchema() *configschema.Block {
+        // This is an alias of CoreConfigSchema just to implement the
+        // backend.Backend interface.
+        return b.CoreConfigSchema()
+}
+
+func (b *Backend) PrepareConfig(configVal cty.Value) (cty.Value, tfdiags.Diagnostics) {
         if b == nil {
-                return c, nil
+                return configVal, nil
         }
+        var diags tfdiags.Diagnostics
+        var err error
 
-        return schemaMap(b.Schema).Input(input, c)
-}
+        // In order to use Transform below, this needs to be filled out completely
+        // according the schema.
+        configVal, err = b.CoreConfigSchema().CoerceValue(configVal)
+        if err != nil {
+                return configVal, diags.Append(err)
+        }
 
-func (b *Backend) Validate(c *terraform.ResourceConfig) ([]string, []error) {
-        if b == nil {
-                return nil, nil
+        // lookup any required, top-level attributes that are Null, and see if we
+        // have a Default value available.
+        configVal, err = cty.Transform(configVal, func(path cty.Path, val cty.Value) (cty.Value, error) {
+                // we're only looking for top-level attributes
+                if len(path) != 1 {
+                        return val, nil
+                }
+
+                // nothing to do if we already have a value
+                if !val.IsNull() {
+                        return val, nil
+                }
+
+                // get the Schema definition for this attribute
+                getAttr, ok := path[0].(cty.GetAttrStep)
+                // these should all exist, but just ignore anything strange
+                if !ok {
+                        return val, nil
+                }
+
+                attrSchema := b.Schema[getAttr.Name]
+                // continue to ignore anything that doesn't match
+                if attrSchema == nil {
+                        return val, nil
+                }
+
+                // this is deprecated, so don't set it
+                if attrSchema.Deprecated != "" || attrSchema.Removed != "" {
+                        return val, nil
+                }
+
+                // find a default value if it exists
+                def, err := attrSchema.DefaultValue()
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error getting default for %q: %s", getAttr.Name, err))
+                        return val, err
+                }
+
+                // no default
+                if def == nil {
+                        return val, nil
+                }
+
+                // create a cty.Value and make sure it's the correct type
+                tmpVal := hcl2shim.HCL2ValueFromConfigValue(def)
+
+                // helper/schema used to allow setting "" to a bool
+                if val.Type() == cty.Bool && tmpVal.RawEquals(cty.StringVal("")) {
+                        // return a warning about the conversion
+                        diags = diags.Append("provider set empty string as default value for bool " + getAttr.Name)
+                        tmpVal = cty.False
+                }
+
+                val, err = ctyconvert.Convert(tmpVal, val.Type())
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error setting default for %q: %s", getAttr.Name, err))
+                }
+
+                return val, err
+        })
+        if err != nil {
+                // any error here was already added to the diagnostics
+                return configVal, diags
         }
 
-        return schemaMap(b.Schema).Validate(c)
+        shimRC := b.shimConfig(configVal)
+        warns, errs := schemaMap(b.Schema).Validate(shimRC)
+        for _, warn := range warns {
+                diags = diags.Append(tfdiags.SimpleWarning(warn))
+        }
+        for _, err := range errs {
+                diags = diags.Append(err)
+        }
+        return configVal, diags
 }
 
-func (b *Backend) Configure(c *terraform.ResourceConfig) error {
+func (b *Backend) Configure(obj cty.Value) tfdiags.Diagnostics {
         if b == nil {
                 return nil
         }
 
+        var diags tfdiags.Diagnostics
         sm := schemaMap(b.Schema)
+        shimRC := b.shimConfig(obj)
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, nil)
+        diff, err := sm.Diff(nil, shimRC, nil, nil, true)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
 
         data, err := sm.Data(nil, diff)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
         b.config = data
 
@@ -80,11 +169,28 @@ func (b *Backend) Configure(c *terraform.ResourceConfig) error {
                 err = b.ConfigureFunc(context.WithValue(
                         context.Background(), backendConfigKey, data))
                 if err != nil {
-                        return err
+                        diags = diags.Append(err)
+                        return diags
                 }
         }
 
-        return nil
+        return diags
+}
+
+// shimConfig turns a new-style cty.Value configuration (which must be of
+// an object type) into a minimal old-style *terraform.ResourceConfig object
+// that should be populated enough to appease the not-yet-updated functionality
+// in this package. This should be removed once everything is updated.
+func (b *Backend) shimConfig(obj cty.Value) *terraform.ResourceConfig {
+        shimMap, ok := hcl2shim.ConfigValueFromHCL2(obj).(map[string]interface{})
+        if !ok {
+                // If the configVal was nil, we still want a non-nil map here.
+                shimMap = map[string]interface{}{}
+        }
+        return &terraform.ResourceConfig{
+                Config: shimMap,
+                Raw:    shimMap,
+        }
 }
 
 // Config returns the configuration. This is available after Configure is
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
index bf952f6..875677e 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
@@ -3,7 +3,7 @@ package schema
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/zclconf/go-cty/cty"
 )
 
@@ -39,14 +39,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
                         continue
                 }
-                switch schema.Elem.(type) {
-                case *Schema:
+                if schema.Type == TypeMap {
+                        // For TypeMap in particular, it isn't valid for Elem to be a
+                        // *Resource (since that would be ambiguous in flatmap) and
+                        // so Elem is treated as a TypeString schema if so. This matches
+                        // how the field readers treat this situation, for compatibility
+                        // with configurations targeting Terraform 0.11 and earlier.
+                        if _, isResource := schema.Elem.(*Resource); isResource {
+                                sch := *schema // shallow copy
+                                sch.Elem = &Schema{
+                                        Type: TypeString,
+                                }
+                                ret.Attributes[name] = sch.coreConfigSchemaAttribute()
+                                continue
+                        }
+                }
+                switch schema.ConfigMode {
+                case SchemaConfigModeAttr:
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
-                case *Resource:
+                case SchemaConfigModeBlock:
                         ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
-                default:
-                        // Should never happen for a valid schema
-                        panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                default: // SchemaConfigModeAuto, or any other invalid value
+                        if schema.Computed && !schema.Optional {
+                                // Computed-only schemas are always handled as attributes,
+                                // because they never appear in configuration.
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                                continue
+                        }
+                        switch schema.Elem.(type) {
+                        case *Schema, ValueType:
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                        case *Resource:
+                                ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
+                        default:
+                                // Should never happen for a valid schema
+                                panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                        }
                 }
         }
 
@@ -58,12 +86,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
 // Elem is an instance of Schema. Use coreConfigSchemaBlock for collections
 // whose elem is a whole resource.
 func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
+        // The Schema.DefaultFunc capability adds some extra weirdness here since
+        // it can be combined with "Required: true" to create a sitution where
+        // required-ness is conditional. Terraform Core doesn't share this concept,
+        // so we must sniff for this possibility here and conditionally turn
+        // off the "Required" flag if it looks like the DefaultFunc is going
+        // to provide a value.
+        // This is not 100% true to the original interface of DefaultFunc but
+        // works well enough for the EnvDefaultFunc and MultiEnvDefaultFunc
+        // situations, which are the main cases we care about.
+        //
+        // Note that this also has a consequence for commands that return schema
+        // information for documentation purposes: running those for certain
+        // providers will produce different results depending on which environment
+        // variables are set. We accept that weirdness in order to keep this
+        // interface to core otherwise simple.
+        reqd := s.Required
+        opt := s.Optional
+        if reqd && s.DefaultFunc != nil {
+                v, err := s.DefaultFunc()
+                // We can't report errors from here, so we'll instead just force
+                // "Required" to false and let the provider try calling its
+                // DefaultFunc again during the validate step, where it can then
+                // return the error.
+                if err != nil || (err == nil && v != nil) {
+                        reqd = false
+                        opt = true
+                }
+        }
+
         return &configschema.Attribute{
-                Type:      s.coreConfigSchemaType(),
-                Optional:  s.Optional,
-                Required:  s.Required,
-                Computed:  s.Computed,
-                Sensitive: s.Sensitive,
+                Type:        s.coreConfigSchemaType(),
+                Optional:    opt,
+                Required:    reqd,
+                Computed:    s.Computed,
+                Sensitive:   s.Sensitive,
+                Description: s.Description,
         }
 }
 
@@ -72,7 +130,7 @@ func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
 // of Resource, and will panic otherwise.
 func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
         ret := &configschema.NestedBlock{}
-        if nested := s.Elem.(*Resource).CoreConfigSchema(); nested != nil {
+        if nested := s.Elem.(*Resource).coreConfigSchema(); nested != nil {
                 ret.Block = *nested
         }
         switch s.Type {
@@ -95,6 +153,20 @@ func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
                 // blocks, but we can fake it by requiring at least one item.
                 ret.MinItems = 1
         }
+        if s.Optional && s.MinItems > 0 {
+                // Historically helper/schema would ignore MinItems if Optional were
+                // set, so we must mimic this behavior here to ensure that providers
+                // relying on that undocumented behavior can continue to operate as
+                // they did before.
+                ret.MinItems = 0
+        }
+        if s.Computed && !s.Optional {
+                // MinItems/MaxItems are meaningless for computed nested blocks, since
+                // they are never set by the user anyway. This ensures that we'll never
+                // generate weird errors about them.
+                ret.MinItems = 0
+                ret.MaxItems = 0
+        }
 
         return ret
 }
@@ -117,11 +189,16 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
                 switch set := s.Elem.(type) {
                 case *Schema:
                         elemType = set.coreConfigSchemaType()
+                case ValueType:
+                        // This represents a mistake in the provider code, but it's a
+                        // common one so we'll just shim it.
+                        elemType = (&Schema{Type: set}).coreConfigSchemaType()
                 case *Resource:
-                        // In practice we don't actually use this for normal schema
-                        // construction because we construct a NestedBlock in that
-                        // case instead. See schemaMap.CoreConfigSchema.
-                        elemType = set.CoreConfigSchema().ImpliedType()
+                        // By default we construct a NestedBlock in this case, but this
+                        // behavior is selected either for computed-only schemas or
+                        // when ConfigMode is explicitly SchemaConfigModeBlock.
+                        // See schemaMap.CoreConfigSchema for the exact rules.
+                        elemType = set.coreConfigSchema().ImpliedType()
                 default:
                         if set != nil {
                                 // Should never happen for a valid schema
@@ -148,8 +225,85 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
         }
 }
 
-// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
-// on the resource's schema.
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema on
+// the resource's schema. CoreConfigSchema adds the implicitly required "id"
+// attribute for top level resources if it doesn't exist.
 func (r *Resource) CoreConfigSchema() *configschema.Block {
+        block := r.coreConfigSchema()
+
+        if block.Attributes == nil {
+                block.Attributes = map[string]*configschema.Attribute{}
+        }
+
+        // Add the implicitly required "id" field if it doesn't exist
+        if block.Attributes["id"] == nil {
+                block.Attributes["id"] = &configschema.Attribute{
+                        Type:     cty.String,
+                        Optional: true,
+                        Computed: true,
+                }
+        }
+
+        _, timeoutsAttr := block.Attributes[TimeoutsConfigKey]
+        _, timeoutsBlock := block.BlockTypes[TimeoutsConfigKey]
+
+        // Insert configured timeout values into the schema, as long as the schema
+        // didn't define anything else by that name.
+        if r.Timeouts != nil && !timeoutsAttr && !timeoutsBlock {
+                timeouts := configschema.Block{
+                        Attributes: map[string]*configschema.Attribute{},
+                }
+
+                if r.Timeouts.Create != nil {
+                        timeouts.Attributes[TimeoutCreate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Read != nil {
+                        timeouts.Attributes[TimeoutRead] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Update != nil {
+                        timeouts.Attributes[TimeoutUpdate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Delete != nil {
+                        timeouts.Attributes[TimeoutDelete] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Default != nil {
+                        timeouts.Attributes[TimeoutDefault] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                block.BlockTypes[TimeoutsConfigKey] = &configschema.NestedBlock{
+                        Nesting: configschema.NestingSingle,
+                        Block:   timeouts,
+                }
+        }
+
+        return block
+}
+
+func (r *Resource) coreConfigSchema() *configschema.Block {
+        return schemaMap(r.Schema).CoreConfigSchema()
+}
+
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
+// on the backends's schema.
+func (r *Backend) CoreConfigSchema() *configschema.Block {
         return schemaMap(r.Schema).CoreConfigSchema()
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
index b80b223..2a66a06 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
@@ -3,6 +3,7 @@ package schema
 import (
         "fmt"
         "strconv"
+        "strings"
 )
 
 // FieldReaders are responsible for decoding fields out of data into
@@ -41,6 +42,13 @@ func (r *FieldReadResult) ValueOrZero(s *Schema) interface{} {
         return s.ZeroValue()
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through.
+func SchemasForFlatmapPath(path string, schemaMap map[string]*Schema) []*Schema {
+        parts := strings.Split(path, ".")
+        return addrToSchema(parts, schemaMap)
+}
+
 // addrToSchema finds the final element schema for the given address
 // and the given schema. It returns all the schemas that led to the final
 // schema. These are in order of the address (out to in).
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index 55a301d..808375c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -2,6 +2,7 @@ package schema
 
 import (
         "fmt"
+        "log"
         "strconv"
         "strings"
         "sync"
@@ -93,6 +94,22 @@ func (r *ConfigFieldReader) readField(
                 }
         }
 
+        if protoVersion5 {
+                switch schema.Type {
+                case TypeList, TypeSet, TypeMap, typeObject:
+                        // Check if the value itself is unknown.
+                        // The new protocol shims will add unknown values to this list of
+                        // ComputedKeys. This is the only way we have to indicate that a
+                        // collection is unknown in the config
+                        for _, unknown := range r.Config.ComputedKeys {
+                                if k == unknown {
+                                        log.Printf("[DEBUG] setting computed for %q from ComputedKeys", k)
+                                        return FieldReadResult{Computed: true, Exists: true}, nil
+                                }
+                        }
+                }
+        }
+
         switch schema.Type {
         case TypeBool, TypeFloat, TypeInt, TypeString:
                 return r.readPrimitive(k, schema)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index d558a5b..ae35b4a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -174,6 +174,9 @@ func (r *DiffFieldReader) readPrimitive(
 
 func (r *DiffFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         prefix := strings.Join(address, ".") + "."
 
         // Create the set that will be our result
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
index 054efe0..53f73b7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
@@ -98,6 +98,9 @@ func (r *MapFieldReader) readPrimitive(
 
 func (r *MapFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         // Get the number of elements in the list
         countRaw, err := r.readPrimitive(
                 append(address, "#"), &Schema{Type: TypeInt})
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
index 814c7ba..c09358b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
@@ -297,13 +297,14 @@ func (w *MapFieldWriter) setSet(
         // we get the proper order back based on the hash code.
         if v := reflect.ValueOf(value); v.Kind() == reflect.Slice {
                 // Build a temp *ResourceData to use for the conversion
+                tempAddr := addr[len(addr)-1:]
                 tempSchema := *schema
                 tempSchema.Type = TypeList
-                tempSchemaMap := map[string]*Schema{addr[0]: &tempSchema}
+                tempSchemaMap := map[string]*Schema{tempAddr[0]: &tempSchema}
                 tempW := &MapFieldWriter{Schema: tempSchemaMap}
 
                 // Set the entire list, this lets us get sane values out of it
-                if err := tempW.WriteField(addr, value); err != nil {
+                if err := tempW.WriteField(tempAddr, value); err != nil {
                         return err
                 }
 
@@ -319,7 +320,7 @@ func (w *MapFieldWriter) setSet(
                 }
                 for i := 0; i < v.Len(); i++ {
                         is := strconv.FormatInt(int64(i), 10)
-                        result, err := tempR.ReadField(append(addrCopy, is))
+                        result, err := tempR.ReadField(append(tempAddr, is))
                         if err != nil {
                                 return err
                         }
@@ -340,6 +341,11 @@ func (w *MapFieldWriter) setSet(
         // problems when the old data isn't wiped first.
         w.clearTree(addr)
 
+        if value.(*Set) == nil {
+                w.result[k+".#"] = "0"
+                return nil
+        }
+
         for code, elem := range value.(*Set).m {
                 if err := w.set(append(addrCopy, code), elem); err != nil {
                         return err
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
index 38cd8c7..0184d7b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
@@ -4,6 +4,18 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[getSourceState-1]
+        _ = x[getSourceConfig-2]
+        _ = x[getSourceDiff-4]
+        _ = x[getSourceSet-8]
+        _ = x[getSourceExact-16]
+        _ = x[getSourceLevelMask-15]
+}
+
 const (
         _getSource_name_0 = "getSourceStategetSourceConfig"
         _getSource_name_1 = "getSourceDiff"
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index 6cd325d..9702447 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -9,7 +9,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -64,6 +64,8 @@ type Provider struct {
         stopCtx       context.Context
         stopCtxCancel context.CancelFunc
         stopOnce      sync.Once
+
+        TerraformVersion string
 }
 
 // ConfigureFunc is the function used to configure a Provider.
@@ -251,7 +253,7 @@ func (p *Provider) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, p.meta)
+        diff, err := sm.Diff(nil, c, nil, p.meta, true)
         if err != nil {
                 return err
         }
@@ -296,6 +298,20 @@ func (p *Provider) Diff(
         return r.Diff(s, c, p.meta)
 }
 
+// SimpleDiff is used by the new protocol wrappers to get a diff that doesn't
+// attempt to calculate ignore_changes.
+func (p *Provider) SimpleDiff(
+        info *terraform.InstanceInfo,
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        r, ok := p.ResourcesMap[info.Type]
+        if !ok {
+                return nil, fmt.Errorf("unknown resource type: %s", info.Type)
+        }
+
+        return r.simpleDiff(s, c, p.meta)
+}
+
 // Refresh implementation of terraform.ResourceProvider interface.
 func (p *Provider) Refresh(
         info *terraform.InstanceInfo,
@@ -311,7 +327,7 @@ func (p *Provider) Refresh(
 // Resources implementation of terraform.ResourceProvider interface.
 func (p *Provider) Resources() []terraform.ResourceType {
         keys := make([]string, 0, len(p.ResourcesMap))
-        for k, _ := range p.ResourcesMap {
+        for k := range p.ResourcesMap {
                 keys = append(keys, k)
         }
         sort.Strings(keys)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index a8d42db..637e221 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -121,6 +122,11 @@ func (p *Provisioner) Stop() error {
         return nil
 }
 
+// GetConfigSchema implementation of terraform.ResourceProvisioner interface.
+func (p *Provisioner) GetConfigSchema() (*configschema.Block, error) {
+        return schemaMap(p.Schema).CoreConfigSchema(), nil
+}
+
 // Apply implementation of terraform.ResourceProvisioner interface.
 func (p *Provisioner) Apply(
         o terraform.UIOutput,
@@ -146,7 +152,7 @@ func (p *Provisioner) Apply(
                 }
 
                 sm := schemaMap(p.ConnSchema)
-                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
                 if err != nil {
                         return err
                 }
@@ -160,7 +166,7 @@ func (p *Provisioner) Apply(
                 // Build the configuration data. Doing this requires making a "diff"
                 // even though that's never used. We use that just to get the correct types.
                 configMap := schemaMap(p.Schema)
-                diff, err := configMap.Diff(nil, c, nil, nil)
+                diff, err := configMap.Diff(nil, c, nil, nil, true)
                 if err != nil {
                         return err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index d3be2d6..b5e3065 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // Resource represents a thing in Terraform that has a set of configurable
@@ -44,6 +45,12 @@ type Resource struct {
         // their Versioning at any integer >= 1
         SchemaVersion int
 
+        // MigrateState is deprecated and any new changes to a resource's schema
+        // should be handled by StateUpgraders. Existing MigrateState implementations
+        // should remain for compatibility with existing state. MigrateState will
+        // still be called if the stored SchemaVersion is less than the
+        // first version of the StateUpgraders.
+        //
         // MigrateState is responsible for updating an InstanceState with an old
         // version to the format expected by the current version of the Schema.
         //
@@ -56,6 +63,18 @@ type Resource struct {
         // needs to make any remote API calls.
         MigrateState StateMigrateFunc
 
+        // StateUpgraders contains the functions responsible for upgrading an
+        // existing state with an old schema version to a newer schema. It is
+        // called specifically by Terraform when the stored schema version is less
+        // than the current SchemaVersion of the Resource.
+        //
+        // StateUpgraders map specific schema versions to a StateUpgrader
+        // function. The registered versions are expected to be ordered,
+        // consecutive values. The initial value may be greater than 0 to account
+        // for legacy schemas that weren't recorded and can be handled by
+        // MigrateState.
+        StateUpgraders []StateUpgrader
+
         // The functions below are the CRUD operations for this resource.
         //
         // The only optional operation is Update. If Update is not implemented,
@@ -136,6 +155,27 @@ type Resource struct {
         Timeouts *ResourceTimeout
 }
 
+// ShimInstanceStateFromValue converts a cty.Value to a
+// terraform.InstanceState.
+func (r *Resource) ShimInstanceStateFromValue(state cty.Value) (*terraform.InstanceState, error) {
+        // Get the raw shimmed value. While this is correct, the set hashes don't
+        // match those from the Schema.
+        s := terraform.NewInstanceStateShimmedFromValue(state, r.SchemaVersion)
+
+        // We now rebuild the state through the ResourceData, so that the set indexes
+        // match what helper/schema expects.
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        if err != nil {
+                return nil, err
+        }
+
+        s = data.State()
+        if s == nil {
+                s = &terraform.InstanceState{}
+        }
+        return s, nil
+}
+
 // See Resource documentation.
 type CreateFunc func(*ResourceData, interface{}) error
 
@@ -155,6 +195,27 @@ type ExistsFunc func(*ResourceData, interface{}) (bool, error)
 type StateMigrateFunc func(
         int, *terraform.InstanceState, interface{}) (*terraform.InstanceState, error)
 
+type StateUpgrader struct {
+        // Version is the version schema that this Upgrader will handle, converting
+        // it to Version+1.
+        Version int
+
+        // Type describes the schema that this function can upgrade. Type is
+        // required to decode the schema if the state was stored in a legacy
+        // flatmap format.
+        Type cty.Type
+
+        // Upgrade takes the JSON encoded state and the provider meta value, and
+        // upgrades the state one single schema version. The provided state is
+        // deocded into the default json types using a map[string]interface{}. It
+        // is up to the StateUpgradeFunc to ensure that the returned value can be
+        // encoded using the new schema.
+        Upgrade StateUpgradeFunc
+}
+
+// See StateUpgrader
+type StateUpgradeFunc func(rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error)
+
 // See Resource documentation.
 type CustomizeDiffFunc func(*ResourceDiff, interface{}) error
 
@@ -247,7 +308,7 @@ func (r *Resource) Diff(
                 return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
         }
 
-        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta)
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, true)
         if err != nil {
                 return instanceDiff, err
         }
@@ -263,6 +324,45 @@ func (r *Resource) Diff(
         return instanceDiff, err
 }
 
+func (r *Resource) simpleDiff(
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig,
+        meta interface{}) (*terraform.InstanceDiff, error) {
+
+        t := &ResourceTimeout{}
+        err := t.ConfigDecode(r, c)
+
+        if err != nil {
+                return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
+        }
+
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, false)
+        if err != nil {
+                return instanceDiff, err
+        }
+
+        if instanceDiff == nil {
+                log.Printf("[DEBUG] Instance Diff is nil in SimpleDiff()")
+                return nil, err
+        }
+
+        // Make sure the old value is set in each of the instance diffs.
+        // This was done by the RequiresNew logic in the full legacy Diff.
+        for k, attr := range instanceDiff.Attributes {
+                if attr == nil {
+                        continue
+                }
+                if s != nil {
+                        attr.Old = s.Attributes[k]
+                }
+        }
+
+        if err := t.DiffEncode(instanceDiff); err != nil {
+                log.Printf("[ERR] Error encoding timeout to instance diff: %s", err)
+        }
+        return instanceDiff, err
+}
+
 // Validate validates the resource configuration against the schema.
 func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         warns, errs := schemaMap(r.Schema).Validate(c)
@@ -300,8 +400,11 @@ func (r *Resource) ReadDataApply(
         return r.recordCurrentSchemaVersion(state), err
 }
 
-// Refresh refreshes the state of the resource.
-func (r *Resource) Refresh(
+// RefreshWithoutUpgrade reads the instance state, but does not call
+// MigrateState or the StateUpgraders, since those are now invoked in a
+// separate API call.
+// RefreshWithoutUpgrade is part of the new plugin shims.
+func (r *Resource) RefreshWithoutUpgrade(
         s *terraform.InstanceState,
         meta interface{}) (*terraform.InstanceState, error) {
         // If the ID is already somehow blank, it doesn't exist
@@ -335,12 +438,60 @@ func (r *Resource) Refresh(
                 }
         }
 
-        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
-        if needsMigration && r.MigrateState != nil {
-                s, err := r.MigrateState(stateSchemaVersion, s, meta)
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        data.timeouts = &rt
+        if err != nil {
+                return s, err
+        }
+
+        err = r.Read(data, meta)
+        state := data.State()
+        if state != nil && state.ID == "" {
+                state = nil
+        }
+
+        return r.recordCurrentSchemaVersion(state), err
+}
+
+// Refresh refreshes the state of the resource.
+func (r *Resource) Refresh(
+        s *terraform.InstanceState,
+        meta interface{}) (*terraform.InstanceState, error) {
+        // If the ID is already somehow blank, it doesn't exist
+        if s.ID == "" {
+                return nil, nil
+        }
+
+        rt := ResourceTimeout{}
+        if _, ok := s.Meta[TimeoutKey]; ok {
+                if err := rt.StateDecode(s); err != nil {
+                        log.Printf("[ERR] Error decoding ResourceTimeout: %s", err)
+                }
+        }
+
+        if r.Exists != nil {
+                // Make a copy of data so that if it is modified it doesn't
+                // affect our Read later.
+                data, err := schemaMap(r.Schema).Data(s, nil)
+                data.timeouts = &rt
+
                 if err != nil {
                         return s, err
                 }
+
+                exists, err := r.Exists(data, meta)
+                if err != nil {
+                        return s, err
+                }
+                if !exists {
+                        return nil, nil
+                }
+        }
+
+        // there may be new StateUpgraders that need to be run
+        s, err := r.upgradeState(s, meta)
+        if err != nil {
+                return s, err
         }
 
         data, err := schemaMap(r.Schema).Data(s, nil)
@@ -358,6 +509,71 @@ func (r *Resource) Refresh(
         return r.recordCurrentSchemaVersion(state), err
 }
 
+func (r *Resource) upgradeState(s *terraform.InstanceState, meta interface{}) (*terraform.InstanceState, error) {
+        var err error
+
+        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
+        migrate := needsMigration && r.MigrateState != nil
+
+        if migrate {
+                s, err = r.MigrateState(stateSchemaVersion, s, meta)
+                if err != nil {
+                        return s, err
+                }
+        }
+
+        if len(r.StateUpgraders) == 0 {
+                return s, nil
+        }
+
+        // If we ran MigrateState, then the stateSchemaVersion value is no longer
+        // correct. We can expect the first upgrade function to be the correct
+        // schema type version.
+        if migrate {
+                stateSchemaVersion = r.StateUpgraders[0].Version
+        }
+
+        schemaType := r.CoreConfigSchema().ImpliedType()
+        // find the expected type to convert the state
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion == upgrader.Version {
+                        schemaType = upgrader.Type
+                }
+        }
+
+        // StateUpgraders only operate on the new JSON format state, so the state
+        // need to be converted.
+        stateVal, err := StateValueFromInstanceState(s, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        jsonState, err := StateValueToJSONMap(stateVal, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion != upgrader.Version {
+                        continue
+                }
+
+                jsonState, err = upgrader.Upgrade(jsonState, meta)
+                if err != nil {
+                        return nil, err
+                }
+                stateSchemaVersion++
+        }
+
+        // now we need to re-flatmap the new state
+        stateVal, err = JSONMapToStateValue(jsonState, r.CoreConfigSchema())
+        if err != nil {
+                return nil, err
+        }
+
+        return r.ShimInstanceStateFromValue(stateVal)
+}
+
 // InternalValidate should be called to validate the structure
 // of the resource.
 //
@@ -437,6 +653,31 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                 }
         }
 
+        lastVersion := -1
+        for _, u := range r.StateUpgraders {
+                if lastVersion >= 0 && u.Version-lastVersion > 1 {
+                        return fmt.Errorf("missing schema version between %d and %d", lastVersion, u.Version)
+                }
+
+                if u.Version >= r.SchemaVersion {
+                        return fmt.Errorf("StateUpgrader version %d is >= current version %d", u.Version, r.SchemaVersion)
+                }
+
+                if !u.Type.IsObjectType() {
+                        return fmt.Errorf("StateUpgrader %d type is not cty.Object", u.Version)
+                }
+
+                if u.Upgrade == nil {
+                        return fmt.Errorf("StateUpgrader %d missing StateUpgradeFunc", u.Version)
+                }
+
+                lastVersion = u.Version
+        }
+
+        if lastVersion >= 0 && lastVersion != r.SchemaVersion-1 {
+                return fmt.Errorf("missing StateUpgrader between %d and %d", lastVersion, r.SchemaVersion)
+        }
+
         // Data source
         if r.isTopLevel() && !writable {
                 tsm = schemaMap(r.Schema)
@@ -513,6 +754,13 @@ func (r *Resource) TestResourceData() *ResourceData {
         }
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through in the schema
+// of the receiving Resource.
+func (r *Resource) SchemasForFlatmapPath(path string) []*Schema {
+        return SchemasForFlatmapPath(path, r.Schema)
+}
+
 // Returns true if the resource is "top level" i.e. not a sub-resource.
 func (r *Resource) isTopLevel() bool {
         // TODO: This is a heuristic; replace with a definitive attribute?
@@ -538,7 +786,15 @@ func (r *Resource) checkSchemaVersion(is *terraform.InstanceState) (bool, int) {
         }
 
         stateSchemaVersion, _ := strconv.Atoi(rawString)
-        return stateSchemaVersion < r.SchemaVersion, stateSchemaVersion
+
+        // Don't run MigrateState if the version is handled by a StateUpgrader,
+        // since StateMigrateFuncs are not required to handle unknown versions
+        maxVersion := r.SchemaVersion
+        if len(r.StateUpgraders) > 0 {
+                maxVersion = r.StateUpgraders[0].Version
+        }
+
+        return stateSchemaVersion < maxVersion, stateSchemaVersion
 }
 
 func (r *Resource) recordCurrentSchemaVersion(
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
index 6cc01ee..1c39070 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
@@ -52,6 +52,8 @@ type getResult struct {
 // UnsafeSetFieldRaw allows setting arbitrary values in state to arbitrary
 // values, bypassing schema. This MUST NOT be used in normal circumstances -
 // it exists only to support the remote_state data source.
+//
+// Deprecated: Fully define schema attributes and use Set() instead.
 func (d *ResourceData) UnsafeSetFieldRaw(key string, value string) {
         d.once.Do(d.init)
 
@@ -219,10 +221,16 @@ func (d *ResourceData) Id() string {
 
         if d.state != nil {
                 result = d.state.ID
+                if result == "" {
+                        result = d.state.Attributes["id"]
+                }
         }
 
         if d.newState != nil {
                 result = d.newState.ID
+                if result == "" {
+                        result = d.newState.Attributes["id"]
+                }
         }
 
         return result
@@ -246,6 +254,18 @@ func (d *ResourceData) ConnInfo() map[string]string {
 func (d *ResourceData) SetId(v string) {
         d.once.Do(d.init)
         d.newState.ID = v
+
+        // once we transition away from the legacy state types, "id" will no longer
+        // be a special field, and will become a normal attribute.
+        // set the attribute normally
+        d.setWriter.unsafeWriteField("id", v)
+
+        // Make sure the newState is also set, otherwise the old value
+        // may get precedence.
+        if d.newState.Attributes == nil {
+                d.newState.Attributes = map[string]string{}
+        }
+        d.newState.Attributes["id"] = v
 }
 
 // SetConnInfo sets the connection info for a resource.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
index 7db3dec..47b5481 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
@@ -367,7 +367,7 @@ func (d *ResourceDiff) Get(key string) interface{} {
 }
 
 // GetChange gets the change between the state and diff, checking first to see
-// if a overridden diff exists.
+// if an overridden diff exists.
 //
 // This implementation differs from ResourceData's in the way that we first get
 // results from the exact levels for the new diff, then from state and diff as
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
index 445819f..9e422c1 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
@@ -5,6 +5,7 @@ import (
         "log"
         "time"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
 )
@@ -62,55 +63,70 @@ func (t *ResourceTimeout) ConfigDecode(s *Resource, c *terraform.ResourceConfig)
         }
 
         if raw, ok := c.Config[TimeoutsConfigKey]; ok {
-                if configTimeouts, ok := raw.([]map[string]interface{}); ok {
-                        for _, timeoutValues := range configTimeouts {
-                                // loop through each Timeout given in the configuration and validate they
-                                // the Timeout defined in the resource
-                                for timeKey, timeValue := range timeoutValues {
-                                        // validate that we're dealing with the normal CRUD actions
-                                        var found bool
-                                        for _, key := range timeoutKeys() {
-                                                if timeKey == key {
-                                                        found = true
-                                                        break
-                                                }
-                                        }
+                var rawTimeouts []map[string]interface{}
+                switch raw := raw.(type) {
+                case map[string]interface{}:
+                        rawTimeouts = append(rawTimeouts, raw)
+                case []map[string]interface{}:
+                        rawTimeouts = raw
+                case string:
+                        if raw == config.UnknownVariableValue {
+                                // Timeout is not defined in the config
+                                // Defaults will be used instead
+                                return nil
+                        } else {
+                                log.Printf("[ERROR] Invalid timeout value: %q", raw)
+                                return fmt.Errorf("Invalid Timeout value found")
+                        }
+                default:
+                        log.Printf("[ERROR] Invalid timeout structure: %#v", raw)
+                        return fmt.Errorf("Invalid Timeout structure found")
+                }
 
-                                        if !found {
-                                                return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                for _, timeoutValues := range rawTimeouts {
+                        for timeKey, timeValue := range timeoutValues {
+                                // validate that we're dealing with the normal CRUD actions
+                                var found bool
+                                for _, key := range timeoutKeys() {
+                                        if timeKey == key {
+                                                found = true
+                                                break
                                         }
+                                }
 
-                                        // Get timeout
-                                        rt, err := time.ParseDuration(timeValue.(string))
-                                        if err != nil {
-                                                return fmt.Errorf("Error parsing Timeout for (%s): %s", timeKey, err)
-                                        }
+                                if !found {
+                                        return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                                }
 
-                                        var timeout *time.Duration
-                                        switch timeKey {
-                                        case TimeoutCreate:
-                                                timeout = t.Create
-                                        case TimeoutUpdate:
-                                                timeout = t.Update
-                                        case TimeoutRead:
-                                                timeout = t.Read
-                                        case TimeoutDelete:
-                                                timeout = t.Delete
-                                        case TimeoutDefault:
-                                                timeout = t.Default
-                                        }
+                                // Get timeout
+                                rt, err := time.ParseDuration(timeValue.(string))
+                                if err != nil {
+                                        return fmt.Errorf("Error parsing %q timeout: %s", timeKey, err)
+                                }
 
-                                        // If the resource has not delcared this in the definition, then error
-                                        // with an unsupported message
-                                        if timeout == nil {
-                                                return unsupportedTimeoutKeyError(timeKey)
-                                        }
+                                var timeout *time.Duration
+                                switch timeKey {
+                                case TimeoutCreate:
+                                        timeout = t.Create
+                                case TimeoutUpdate:
+                                        timeout = t.Update
+                                case TimeoutRead:
+                                        timeout = t.Read
+                                case TimeoutDelete:
+                                        timeout = t.Delete
+                                case TimeoutDefault:
+                                        timeout = t.Default
+                                }
 
-                                        *timeout = rt
+                                // If the resource has not delcared this in the definition, then error
+                                // with an unsupported message
+                                if timeout == nil {
+                                        return unsupportedTimeoutKeyError(timeKey)
                                 }
+
+                                *timeout = rt
                         }
-                } else {
-                        log.Printf("[WARN] Invalid Timeout structure found, skipping timeouts")
+                        return nil
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index 0ea5aad..6a3c15a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -12,6 +12,7 @@
 package schema
 
 import (
+        "context"
         "fmt"
         "os"
         "reflect"
@@ -19,7 +20,9 @@ import (
         "sort"
         "strconv"
         "strings"
+        "sync"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
         "github.com/mitchellh/mapstructure"
@@ -31,6 +34,27 @@ const PanicOnErr = "TF_SCHEMA_PANIC_ON_ERROR"
 // type used for schema package context keys
 type contextKey string
 
+var (
+        protoVersionMu sync.Mutex
+        protoVersion5  = false
+)
+
+func isProto5() bool {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        return protoVersion5
+
+}
+
+// SetProto5 enables a feature flag for any internal changes required required
+// to work with the new plugin protocol.  This should not be called by
+// provider.
+func SetProto5() {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        protoVersion5 = true
+}
+
 // Schema is used to describe the structure of a value.
 //
 // Read the documentation of the struct elements for important details.
@@ -51,6 +75,26 @@ type Schema struct {
         //
         Type ValueType
 
+        // ConfigMode allows for overriding the default behaviors for mapping
+        // schema entries onto configuration constructs.
+        //
+        // By default, the Elem field is used to choose whether a particular
+        // schema is represented in configuration as an attribute or as a nested
+        // block; if Elem is a *schema.Resource then it's a block and it's an
+        // attribute otherwise.
+        //
+        // If Elem is *schema.Resource then setting ConfigMode to
+        // SchemaConfigModeAttr will force it to be represented in configuration
+        // as an attribute, which means that the Computed flag can be used to
+        // provide default elements when the argument isn't set at all, while still
+        // allowing the user to force zero elements by explicitly assigning an
+        // empty list.
+        //
+        // When Computed is set without Optional, the attribute is not settable
+        // in configuration at all and so SchemaConfigModeAttr is the automatic
+        // behavior, and SchemaConfigModeBlock is not permitted.
+        ConfigMode SchemaConfigMode
+
         // If one of these is set, then this item can come from the configuration.
         // Both cannot be set. If Optional is set, the value is optional. If
         // Required is set, the value is required.
@@ -123,7 +167,8 @@ type Schema struct {
         // The following fields are only set for a TypeList, TypeSet, or TypeMap.
         //
         // Elem represents the element type. For a TypeMap, it must be a *Schema
-        // with a Type of TypeString, otherwise it may be either a *Schema or a
+        // with a Type that is one of the primitives: TypeString, TypeBool,
+        // TypeInt, or TypeFloat. Otherwise it may be either a *Schema or a
         // *Resource. If it is *Schema, the element type is just a simple value.
         // If it is *Resource, the element type is a complex structure,
         // potentially with its own lifecycle.
@@ -141,13 +186,17 @@ type Schema struct {
         // used to wrap a complex structure, however less than one instance would
         // cause instability.
         //
-        // PromoteSingle, if true, will allow single elements to be standalone
-        // and promote them to a list. For example "foo" would be promoted to
-        // ["foo"] automatically. This is primarily for legacy reasons and the
-        // ambiguity is not recommended for new usage. Promotion is only allowed
-        // for primitive element types.
-        MaxItems      int
-        MinItems      int
+        // If the field Optional is set to true then MinItems is ignored and thus
+        // effectively zero.
+        MaxItems int
+        MinItems int
+
+        // PromoteSingle originally allowed for a single element to be assigned
+        // where a primitive list was expected, but this no longer works from
+        // Terraform v0.12 onwards (Terraform Core will require a list to be set
+        // regardless of what this is set to) and so only applies to Terraform v0.11
+        // and earlier, and so should be used only to retain this functionality
+        // for those still using v0.11 with a provider that formerly used this.
         PromoteSingle bool
 
         // The following fields are only valid for a TypeSet type.
@@ -189,7 +238,8 @@ type Schema struct {
         // guaranteed to be of the proper Schema type, and it can yield warnings or
         // errors based on inspection of that value.
         //
-        // ValidateFunc currently only works for primitive types.
+        // ValidateFunc is honored only when the schema's Type is set to TypeInt,
+        // TypeFloat, TypeString, TypeBool, or TypeMap. It is ignored for all other types.
         ValidateFunc SchemaValidateFunc
 
         // Sensitive ensures that the attribute's value does not get displayed in
@@ -199,6 +249,17 @@ type Schema struct {
         Sensitive bool
 }
 
+// SchemaConfigMode is used to influence how a schema item is mapped into a
+// corresponding configuration construct, using the ConfigMode field of
+// Schema.
+type SchemaConfigMode int
+
+const (
+        SchemaConfigModeAuto SchemaConfigMode = iota
+        SchemaConfigModeAttr
+        SchemaConfigModeBlock
+)
+
 // SchemaDiffSuppressFunc is a function which can be used to determine
 // whether a detected diff on a schema element is "valid" or not, and
 // suppress it from the plan if necessary.
@@ -364,6 +425,11 @@ func (s *Schema) finalizeDiff(d *terraform.ResourceAttrDiff, customized bool) *t
         return d
 }
 
+// InternalMap is used to aid in the transition to the new schema types and
+// protocol. The name is not meant to convey any usefulness, as this is not to
+// be used directly by any providers.
+type InternalMap = schemaMap
+
 // schemaMap is a wrapper that adds nice functions on top of schemas.
 type schemaMap map[string]*Schema
 
@@ -404,7 +470,8 @@ func (m schemaMap) Diff(
         s *terraform.InstanceState,
         c *terraform.ResourceConfig,
         customizeDiff CustomizeDiffFunc,
-        meta interface{}) (*terraform.InstanceDiff, error) {
+        meta interface{},
+        handleRequiresNew bool) (*terraform.InstanceDiff, error) {
         result := new(terraform.InstanceDiff)
         result.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
@@ -450,82 +517,85 @@ func (m schemaMap) Diff(
                 }
         }
 
-        // If the diff requires a new resource, then we recompute the diff
-        // so we have the complete new resource diff, and preserve the
-        // RequiresNew fields where necessary so the user knows exactly what
-        // caused that.
-        if result.RequiresNew() {
-                // Create the new diff
-                result2 := new(terraform.InstanceDiff)
-                result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
-
-                // Preserve the DestroyTainted flag
-                result2.DestroyTainted = result.DestroyTainted
+        if handleRequiresNew {
+                // If the diff requires a new resource, then we recompute the diff
+                // so we have the complete new resource diff, and preserve the
+                // RequiresNew fields where necessary so the user knows exactly what
+                // caused that.
+                if result.RequiresNew() {
+                        // Create the new diff
+                        result2 := new(terraform.InstanceDiff)
+                        result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
-                // Reset the data to not contain state. We have to call init()
-                // again in order to reset the FieldReaders.
-                d.state = nil
-                d.init()
+                        // Preserve the DestroyTainted flag
+                        result2.DestroyTainted = result.DestroyTainted
 
-                // Perform the diff again
-                for k, schema := range m {
-                        err := m.diff(k, schema, result2, d, false)
-                        if err != nil {
-                                return nil, err
-                        }
-                }
+                        // Reset the data to not contain state. We have to call init()
+                        // again in order to reset the FieldReaders.
+                        d.state = nil
+                        d.init()
 
-                // Re-run customization
-                if !result2.DestroyTainted && customizeDiff != nil {
-                        mc := m.DeepCopy()
-                        rd := newResourceDiff(mc, c, d.state, result2)
-                        if err := customizeDiff(rd, meta); err != nil {
-                                return nil, err
-                        }
-                        for _, k := range rd.UpdatedKeys() {
-                                err := m.diff(k, mc[k], result2, rd, false)
+                        // Perform the diff again
+                        for k, schema := range m {
+                                err := m.diff(k, schema, result2, d, false)
                                 if err != nil {
                                         return nil, err
                                 }
                         }
-                }
 
-                // Force all the fields to not force a new since we know what we
-                // want to force new.
-                for k, attr := range result2.Attributes {
-                        if attr == nil {
-                                continue
+                        // Re-run customization
+                        if !result2.DestroyTainted && customizeDiff != nil {
+                                mc := m.DeepCopy()
+                                rd := newResourceDiff(mc, c, d.state, result2)
+                                if err := customizeDiff(rd, meta); err != nil {
+                                        return nil, err
+                                }
+                                for _, k := range rd.UpdatedKeys() {
+                                        err := m.diff(k, mc[k], result2, rd, false)
+                                        if err != nil {
+                                                return nil, err
+                                        }
+                                }
                         }
 
-                        if attr.RequiresNew {
-                                attr.RequiresNew = false
-                        }
+                        // Force all the fields to not force a new since we know what we
+                        // want to force new.
+                        for k, attr := range result2.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if s != nil {
-                                attr.Old = s.Attributes[k]
-                        }
-                }
+                                if attr.RequiresNew {
+                                        attr.RequiresNew = false
+                                }
 
-                // Now copy in all the requires new diffs...
-                for k, attr := range result.Attributes {
-                        if attr == nil {
-                                continue
+                                if s != nil {
+                                        attr.Old = s.Attributes[k]
+                                }
                         }
 
-                        newAttr, ok := result2.Attributes[k]
-                        if !ok {
-                                newAttr = attr
-                        }
+                        // Now copy in all the requires new diffs...
+                        for k, attr := range result.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if attr.RequiresNew {
-                                newAttr.RequiresNew = true
+                                newAttr, ok := result2.Attributes[k]
+                                if !ok {
+                                        newAttr = attr
+                                }
+
+                                if attr.RequiresNew {
+                                        newAttr.RequiresNew = true
+                                }
+
+                                result2.Attributes[k] = newAttr
                         }
 
-                        result2.Attributes[k] = newAttr
+                        // And set the diff!
+                        result = result2
                 }
 
-                // And set the diff!
-                result = result2
         }
 
         // Go through and detect all of the ComputedWhens now that we've
@@ -611,6 +681,10 @@ func (m schemaMap) Validate(c *terraform.ResourceConfig) ([]string, []error) {
 // from a unit test (and not in user-path code) to verify that a schema
 // is properly built.
 func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
+        return m.internalValidate(topSchemaMap, false)
+}
+
+func (m schemaMap) internalValidate(topSchemaMap schemaMap, attrsOnly bool) error {
         if topSchemaMap == nil {
                 topSchemaMap = m
         }
@@ -631,6 +705,34 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
                         return fmt.Errorf("%s: One of optional, required, or computed must be set", k)
                 }
 
+                computedOnly := v.Computed && !v.Optional
+
+                switch v.ConfigMode {
+                case SchemaConfigModeBlock:
+                        if _, ok := v.Elem.(*Resource); !ok {
+                                return fmt.Errorf("%s: ConfigMode of block is allowed only when Elem is *schema.Resource", k)
+                        }
+                        if attrsOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used in child of schema with ConfigMode of attribute", k)
+                        }
+                        if computedOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used for computed schema", k)
+                        }
+                case SchemaConfigModeAttr:
+                        // anything goes
+                case SchemaConfigModeAuto:
+                        // Since "Auto" for Elem: *Resource would create a nested block,
+                        // and that's impossible inside an attribute, we require it to be
+                        // explicitly overridden as mode "Attr" for clarity.
+                        if _, ok := v.Elem.(*Resource); ok {
+                                if attrsOnly {
+                                        return fmt.Errorf("%s: in *schema.Resource with ConfigMode of attribute, so must also have ConfigMode of attribute", k)
+                                }
+                        }
+                default:
+                        return fmt.Errorf("%s: invalid ConfigMode value", k)
+                }
+
                 if v.Computed && v.Default != nil {
                         return fmt.Errorf("%s: Default must be nil if computed", k)
                 }
@@ -695,7 +797,9 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
 
                         switch t := v.Elem.(type) {
                         case *Resource:
-                                if err := t.InternalValidate(topSchemaMap, true); err != nil {
+                                attrsOnly := attrsOnly || v.ConfigMode == SchemaConfigModeAttr
+
+                                if err := schemaMap(t.Schema).internalValidate(topSchemaMap, attrsOnly); err != nil {
                                         return err
                                 }
                         case *Schema:
@@ -785,10 +889,19 @@ func (m schemaMap) diff(
         for attrK, attrV := range unsupressedDiff.Attributes {
                 switch rd := d.(type) {
                 case *ResourceData:
-                        if schema.DiffSuppressFunc != nil &&
-                                attrV != nil &&
+                        if schema.DiffSuppressFunc != nil && attrV != nil &&
                                 schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, rd) {
-                                continue
+                                // If this attr diff is suppressed, we may still need it in the
+                                // overall diff if it's contained within a set. Rather than
+                                // dropping the diff, make it a NOOP.
+                                if !all {
+                                        continue
+                                }
+
+                                attrV = &terraform.ResourceAttrDiff{
+                                        Old: attrV.Old,
+                                        New: attrV.Old,
+                                }
                         }
                 }
                 diff.Attributes[attrK] = attrV
@@ -1171,7 +1284,7 @@ func (m schemaMap) diffString(
                 return fmt.Errorf("%s: %s", k, err)
         }
 
-        if os == ns && !all {
+        if os == ns && !all && !computed {
                 // They're the same value. If there old value is not blank or we
                 // have an ID, then return right away since we're already setup.
                 if os != "" || d.Id() != "" {
@@ -1179,7 +1292,7 @@ func (m schemaMap) diffString(
                 }
 
                 // Otherwise, only continue if we're computed
-                if !schema.Computed && !computed {
+                if !schema.Computed {
                         return nil
                 }
         }
@@ -1210,7 +1323,7 @@ func (m schemaMap) inputString(
         input terraform.UIInput,
         k string,
         schema *Schema) (interface{}, error) {
-        result, err := input.Input(&terraform.InputOpts{
+        result, err := input.Input(context.Background(), &terraform.InputOpts{
                 Id:          k,
                 Query:       k,
                 Description: schema.Description,
@@ -1252,6 +1365,13 @@ func (m schemaMap) validate(
                         "%q: this field cannot be set", k)}
         }
 
+        if raw == config.UnknownVariableValue {
+                // If the value is unknown then we can't validate it yet.
+                // In particular, this avoids spurious type errors where downstream
+                // validation code sees UnknownVariableValue as being just a string.
+                return nil, nil
+        }
+
         err := m.validateConflictingAttributes(k, schema, c)
         if err != nil {
                 return nil, []error{err}
@@ -1269,10 +1389,15 @@ func (m schemaMap) validateConflictingAttributes(
                 return nil
         }
 
-        for _, conflicting_key := range schema.ConflictsWith {
-                if _, ok := c.Get(conflicting_key); ok {
+        for _, conflictingKey := range schema.ConflictsWith {
+                if raw, ok := c.Get(conflictingKey); ok {
+                        if raw == config.UnknownVariableValue {
+                                // An unknown value might become unset (null) once known, so
+                                // we must defer validation until it's known.
+                                continue
+                        }
                         return fmt.Errorf(
-                                "%q: conflicts with %s", k, conflicting_key)
+                                "%q: conflicts with %s", k, conflictingKey)
                 }
         }
 
@@ -1284,6 +1409,13 @@ func (m schemaMap) validateList(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1355,6 +1487,13 @@ func (m schemaMap) validateMap(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1556,12 +1695,25 @@ func (m schemaMap) validatePrimitive(
                 }
                 decoded = n
         case TypeInt:
-                // Verify that we can parse this as an int
-                var n int
-                if err := mapstructure.WeakDecode(raw, &n); err != nil {
-                        return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                switch {
+                case isProto5():
+                        // We need to verify the type precisely, because WeakDecode will
+                        // decode a float as an integer.
+
+                        // the config shims only use int for integral number values
+                        if v, ok := raw.(int); ok {
+                                decoded = v
+                        } else {
+                                return nil, []error{fmt.Errorf("%s: must be a whole number, got %v", k, raw)}
+                        }
+                default:
+                        // Verify that we can parse this as an int
+                        var n int
+                        if err := mapstructure.WeakDecode(raw, &n); err != nil {
+                                return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                        }
+                        decoded = n
                 }
-                decoded = n
         case TypeFloat:
                 // Verify that we can parse this as an int
                 var n float64
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/set.go b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
index cba2890..8ee89e4 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/set.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
@@ -198,6 +198,16 @@ func (s *Set) add(item interface{}, computed bool) string {
         code := s.hash(item)
         if computed {
                 code = "~" + code
+
+                if isProto5() {
+                        tmpCode := code
+                        count := 0
+                        for _, exists := s.m[tmpCode]; exists; _, exists = s.m[tmpCode] {
+                                count++
+                                tmpCode = fmt.Sprintf("%s%d", code, count)
+                        }
+                        code = tmpCode
+                }
         }
 
         if _, ok := s.m[code]; !ok {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/shims.go b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
new file mode 100644
index 0000000..203d017
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
@@ -0,0 +1,115 @@
+package schema
+
+import (
+        "encoding/json"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// DiffFromValues takes the current state and desired state as cty.Values and
+// derives a terraform.InstanceDiff to give to the legacy providers. This is
+// used to take the states provided by the new ApplyResourceChange method and
+// convert them to a state+diff required for the legacy Apply method.
+func DiffFromValues(prior, planned cty.Value, res *Resource) (*terraform.InstanceDiff, error) {
+        return diffFromValues(prior, planned, res, nil)
+}
+
+// diffFromValues takes an additional CustomizeDiffFunc, so we can generate our
+// test fixtures from the legacy tests. In the new provider protocol the diff
+// only needs to be created for the apply operation, and any customizations
+// have already been done.
+func diffFromValues(prior, planned cty.Value, res *Resource, cust CustomizeDiffFunc) (*terraform.InstanceDiff, error) {
+        instanceState, err := res.ShimInstanceStateFromValue(prior)
+        if err != nil {
+                return nil, err
+        }
+
+        configSchema := res.CoreConfigSchema()
+
+        cfg := terraform.NewResourceConfigShimmed(planned, configSchema)
+        removeConfigUnknowns(cfg.Config)
+        removeConfigUnknowns(cfg.Raw)
+
+        diff, err := schemaMap(res.Schema).Diff(instanceState, cfg, cust, nil, false)
+        if err != nil {
+                return nil, err
+        }
+
+        return diff, err
+}
+
+// During apply the only unknown values are those which are to be computed by
+// the resource itself. These may have been marked as unknown config values, and
+// need to be removed to prevent the UnknownVariableValue from appearing the diff.
+func removeConfigUnknowns(cfg map[string]interface{}) {
+        for k, v := range cfg {
+                switch v := v.(type) {
+                case string:
+                        if v == config.UnknownVariableValue {
+                                delete(cfg, k)
+                        }
+                case []interface{}:
+                        for _, i := range v {
+                                if m, ok := i.(map[string]interface{}); ok {
+                                        removeConfigUnknowns(m)
+                                }
+                        }
+                case map[string]interface{}:
+                        removeConfigUnknowns(v)
+                }
+        }
+}
+
+// ApplyDiff takes a cty.Value state and applies a terraform.InstanceDiff to
+// get a new cty.Value state. This is used to convert the diff returned from
+// the legacy provider Diff method to the state required for the new
+// PlanResourceChange method.
+func ApplyDiff(base cty.Value, d *terraform.InstanceDiff, schema *configschema.Block) (cty.Value, error) {
+        return d.ApplyToValue(base, schema)
+}
+
+// StateValueToJSONMap converts a cty.Value to generic JSON map via the cty JSON
+// encoding.
+func StateValueToJSONMap(val cty.Value, ty cty.Type) (map[string]interface{}, error) {
+        js, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        var m map[string]interface{}
+        if err := json.Unmarshal(js, &m); err != nil {
+                return nil, err
+        }
+
+        return m, nil
+}
+
+// JSONMapToStateValue takes a generic json map[string]interface{} and converts it
+// to the specific type, ensuring that the values conform to the schema.
+func JSONMapToStateValue(m map[string]interface{}, block *configschema.Block) (cty.Value, error) {
+        var val cty.Value
+
+        js, err := json.Marshal(m)
+        if err != nil {
+                return val, err
+        }
+
+        val, err = ctyjson.Unmarshal(js, block.ImpliedType())
+        if err != nil {
+                return val, err
+        }
+
+        return block.CoerceValue(val)
+}
+
+// StateValueFromInstanceState converts a terraform.InstanceState to a
+// cty.Value as described by the provided cty.Type, and maintains the resource
+// ID as the "id" attribute.
+func StateValueFromInstanceState(is *terraform.InstanceState, ty cty.Type) (cty.Value, error) {
+        return is.AttrsAsObjectValue(ty)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
index da754ac..a367a1f 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
@@ -18,7 +18,7 @@ func TestResourceDataRaw(
         }
 
         sm := schemaMap(schema)
-        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
index 3bc3ac4..914ca32 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
@@ -4,6 +4,21 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeInvalid-0]
+        _ = x[TypeBool-1]
+        _ = x[TypeInt-2]
+        _ = x[TypeFloat-3]
+        _ = x[TypeString-4]
+        _ = x[TypeList-5]
+        _ = x[TypeMap-6]
+        _ = x[TypeSet-7]
+        _ = x[typeObject-8]
+}
+
 const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTypeMapTypeSettypeObject"
 
 var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config.go
new file mode 100644
index 0000000..a9b8f98
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config.go
@@ -0,0 +1,123 @@
+package earlyconfig
+
+import (
+        "fmt"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/moduledeps"
+        "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// A Config is a node in the tree of modules within a configuration.
+//
+// The module tree is constructed by following ModuleCall instances recursively
+// through the root module transitively into descendent modules.
+type Config struct {
+        // RootModule points to the Config for the root module within the same
+        // module tree as this module. If this module _is_ the root module then
+        // this is self-referential.
+        Root *Config
+
+        // ParentModule points to the Config for the module that directly calls
+        // this module. If this is the root module then this field is nil.
+        Parent *Config
+
+        // Path is a sequence of module logical names that traverse from the root
+        // module to this config. Path is empty for the root module.
+        //
+        // This should only be used to display paths to the end-user in rare cases
+        // where we are talking about the static module tree, before module calls
+        // have been resolved. In most cases, an addrs.ModuleInstance describing
+        // a node in the dynamic module tree is better, since it will then include
+        // any keys resulting from evaluating "count" and "for_each" arguments.
+        Path addrs.Module
+
+        // ChildModules points to the Config for each of the direct child modules
+        // called from this module. The keys in this map match the keys in
+        // Module.ModuleCalls.
+        Children map[string]*Config
+
+        // Module points to the object describing the configuration for the
+        // various elements (variables, resources, etc) defined by this module.
+        Module *tfconfig.Module
+
+        // CallPos is the source position for the header of the module block that
+        // requested this module.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        CallPos tfconfig.SourcePos
+
+        // SourceAddr is the source address that the referenced module was requested
+        // from, as specified in configuration.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        SourceAddr string
+
+        // Version is the specific version that was selected for this module,
+        // based on version constraints given in configuration.
+        //
+        // This field is nil if the module was loaded from a non-registry source,
+        // since versions are not supported for other sources.
+        //
+        // This field is meaningless for the root module, where it will always
+        // be nil.
+        Version *version.Version
+}
+
+// ProviderDependencies returns the provider dependencies for the recieving
+// config, including all of its descendent modules.
+func (c *Config) ProviderDependencies() (*moduledeps.Module, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var name string
+        if len(c.Path) > 0 {
+                name = c.Path[len(c.Path)-1]
+        }
+
+        ret := &moduledeps.Module{
+                Name: name,
+        }
+
+        providers := make(moduledeps.Providers)
+        for name, reqs := range c.Module.RequiredProviders {
+                inst := moduledeps.ProviderInstance(name)
+                var constraints version.Constraints
+                for _, reqStr := range reqs {
+                        if reqStr != "" {
+                                constraint, err := version.NewConstraint(reqStr)
+                                if err != nil {
+                                        diags = diags.Append(wrapDiagnostic(tfconfig.Diagnostic{
+                                                Severity: tfconfig.DiagError,
+                                                Summary:  "Invalid provider version constraint",
+                                                Detail:   fmt.Sprintf("Invalid version constraint %q for provider %s.", reqStr, name),
+                                        }))
+                                        continue
+                                }
+                                constraints = append(constraints, constraint...)
+                        }
+                }
+                providers[inst] = moduledeps.ProviderDependency{
+                        Constraints: discovery.NewConstraints(constraints),
+                        Reason:      moduledeps.ProviderDependencyExplicit,
+                }
+        }
+        ret.Providers = providers
+
+        childNames := make([]string, 0, len(c.Children))
+        for name := range c.Children {
+                childNames = append(childNames, name)
+        }
+        sort.Strings(childNames)
+
+        for _, name := range childNames {
+                child, childDiags := c.Children[name].ProviderDependencies()
+                ret.Children = append(ret.Children, child)
+                diags = diags.Append(childDiags)
+        }
+
+        return ret, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config_build.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config_build.go
new file mode 100644
index 0000000..770d5df
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config_build.go
@@ -0,0 +1,144 @@
+package earlyconfig
+
+import (
+        "fmt"
+        "sort"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// BuildConfig constructs a Config from a root module by loading all of its
+// descendent modules via the given ModuleWalker.
+func BuildConfig(root *tfconfig.Module, walker ModuleWalker) (*Config, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        cfg := &Config{
+                Module: root,
+        }
+        cfg.Root = cfg // Root module is self-referential.
+        cfg.Children, diags = buildChildModules(cfg, walker)
+        return cfg, diags
+}
+
+func buildChildModules(parent *Config, walker ModuleWalker) (map[string]*Config, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        ret := map[string]*Config{}
+        calls := parent.Module.ModuleCalls
+
+        // We'll sort the calls by their local names so that they'll appear in a
+        // predictable order in any logging that's produced during the walk.
+        callNames := make([]string, 0, len(calls))
+        for k := range calls {
+                callNames = append(callNames, k)
+        }
+        sort.Strings(callNames)
+
+        for _, callName := range callNames {
+                call := calls[callName]
+                path := make([]string, len(parent.Path)+1)
+                copy(path, parent.Path)
+                path[len(path)-1] = call.Name
+
+                var vc version.Constraints
+                if strings.TrimSpace(call.Version) != "" {
+                        var err error
+                        vc, err = version.NewConstraint(call.Version)
+                        if err != nil {
+                                diags = diags.Append(wrapDiagnostic(tfconfig.Diagnostic{
+                                        Severity: tfconfig.DiagError,
+                                        Summary:  "Invalid version constraint",
+                                        Detail:   fmt.Sprintf("Module %q (declared at %s line %d) has invalid version constraint %q: %s.", callName, call.Pos.Filename, call.Pos.Line, call.Version, err),
+                                }))
+                                continue
+                        }
+                }
+
+                req := ModuleRequest{
+                        Name:               call.Name,
+                        Path:               path,
+                        SourceAddr:         call.Source,
+                        VersionConstraints: vc,
+                        Parent:             parent,
+                        CallPos:            call.Pos,
+                }
+
+                mod, ver, modDiags := walker.LoadModule(&req)
+                diags = append(diags, modDiags...)
+                if mod == nil {
+                        // nil can be returned if the source address was invalid and so
+                        // nothing could be loaded whatsoever. LoadModule should've
+                        // returned at least one error diagnostic in that case.
+                        continue
+                }
+
+                child := &Config{
+                        Parent:     parent,
+                        Root:       parent.Root,
+                        Path:       path,
+                        Module:     mod,
+                        CallPos:    call.Pos,
+                        SourceAddr: call.Source,
+                        Version:    ver,
+                }
+
+                child.Children, modDiags = buildChildModules(child, walker)
+                diags = diags.Append(modDiags)
+
+                ret[call.Name] = child
+        }
+
+        return ret, diags
+}
+
+// ModuleRequest is used as part of the ModuleWalker interface used with
+// function BuildConfig.
+type ModuleRequest struct {
+        // Name is the "logical name" of the module call within configuration.
+        // This is provided in case the name is used as part of a storage key
+        // for the module, but implementations must otherwise treat it as an
+        // opaque string. It is guaranteed to have already been validated as an
+        // HCL identifier and UTF-8 encoded.
+        Name string
+
+        // Path is a list of logical names that traverse from the root module to
+        // this module. This can be used, for example, to form a lookup key for
+        // each distinct module call in a configuration, allowing for multiple
+        // calls with the same name at different points in the tree.
+        Path addrs.Module
+
+        // SourceAddr is the source address string provided by the user in
+        // configuration.
+        SourceAddr string
+
+        // VersionConstraint is the version constraint applied to the module in
+        // configuration.
+        VersionConstraints version.Constraints
+
+        // Parent is the partially-constructed module tree node that the loaded
+        // module will be added to. Callers may refer to any field of this
+        // structure except Children, which is still under construction when
+        // ModuleRequest objects are created and thus has undefined content.
+        // The main reason this is provided is so that full module paths can
+        // be constructed for uniqueness.
+        Parent *Config
+
+        // CallRange is the source position for the header of the "module" block
+        // in configuration that prompted this request.
+        CallPos tfconfig.SourcePos
+}
+
+// ModuleWalker is an interface used with BuildConfig.
+type ModuleWalker interface {
+        LoadModule(req *ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics)
+}
+
+// ModuleWalkerFunc is an implementation of ModuleWalker that directly wraps
+// a callback function, for more convenient use of that interface.
+type ModuleWalkerFunc func(req *ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics)
+
+func (f ModuleWalkerFunc) LoadModule(req *ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+        return f(req)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/diagnostics.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/diagnostics.go
new file mode 100644
index 0000000..9b2fd7f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/diagnostics.go
@@ -0,0 +1,78 @@
+package earlyconfig
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func wrapDiagnostics(diags tfconfig.Diagnostics) tfdiags.Diagnostics {
+        ret := make(tfdiags.Diagnostics, len(diags))
+        for i, diag := range diags {
+                ret[i] = wrapDiagnostic(diag)
+        }
+        return ret
+}
+
+func wrapDiagnostic(diag tfconfig.Diagnostic) tfdiags.Diagnostic {
+        return wrappedDiagnostic{
+                d: diag,
+        }
+}
+
+type wrappedDiagnostic struct {
+        d tfconfig.Diagnostic
+}
+
+func (d wrappedDiagnostic) Severity() tfdiags.Severity {
+        switch d.d.Severity {
+        case tfconfig.DiagError:
+                return tfdiags.Error
+        case tfconfig.DiagWarning:
+                return tfdiags.Warning
+        default:
+                // Should never happen since there are no other severities
+                return 0
+        }
+}
+
+func (d wrappedDiagnostic) Description() tfdiags.Description {
+        // Since the inspect library doesn't produce precise source locations,
+        // we include the position information as part of the error message text.
+        // See the comment inside method "Source" for more information.
+        switch {
+        case d.d.Pos == nil:
+                return tfdiags.Description{
+                        Summary: d.d.Summary,
+                        Detail:  d.d.Detail,
+                }
+        case d.d.Detail != "":
+                return tfdiags.Description{
+                        Summary: d.d.Summary,
+                        Detail:  fmt.Sprintf("On %s line %d: %s", d.d.Pos.Filename, d.d.Pos.Line, d.d.Detail),
+                }
+        default:
+                return tfdiags.Description{
+                        Summary: fmt.Sprintf("%s (on %s line %d)", d.d.Summary, d.d.Pos.Filename, d.d.Pos.Line),
+                }
+        }
+}
+
+func (d wrappedDiagnostic) Source() tfdiags.Source {
+        // Since the inspect library is constrained by the lowest common denominator
+        // between legacy HCL and modern HCL, it only returns ranges at whole-line
+        // granularity, and that isn't sufficient to populate a tfdiags.Source
+        // and so we'll just omit ranges altogether and include the line number in
+        // the Description text.
+        //
+        // Callers that want to return nicer errors should consider reacting to
+        // earlyconfig errors by attempting a follow-up parse with the normal
+        // config loader, which can produce more precise source location
+        // information.
+        return tfdiags.Source{}
+}
+
+func (d wrappedDiagnostic) FromExpr() *tfdiags.FromExpr {
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/doc.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/doc.go
new file mode 100644
index 0000000..a9cf10f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/doc.go
@@ -0,0 +1,20 @@
+// Package earlyconfig is a specialized alternative to the top-level "configs"
+// package that does only shallow processing of configuration and is therefore
+// able to be much more liberal than the full config loader in what it accepts.
+//
+// In particular, it can accept both current and legacy HCL syntax, and it
+// ignores top-level blocks that it doesn't recognize. These two characteristics
+// make this package ideal for dependency-checking use-cases so that we are
+// more likely to be able to return an error message about an explicit
+// incompatibility than to return a less-actionable message about a construct
+// not being supported.
+//
+// However, its liberal approach also means it should be used sparingly. It
+// exists primarily for "terraform init", so that it is able to detect
+// incompatibilities more robustly when installing dependencies. For most
+// other use-cases, use the "configs" and "configs/configload" packages.
+//
+// Package earlyconfig is a wrapper around the terraform-config-inspect
+// codebase, adding to it just some helper functionality for Terraform's own
+// use-cases.
+package earlyconfig
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/module.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/module.go
new file mode 100644
index 0000000..d2d6287
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/module.go
@@ -0,0 +1,13 @@
+package earlyconfig
+
+import (
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// LoadModule loads some top-level metadata for the module in the given
+// directory.
+func LoadModule(dir string) (*tfconfig.Module, tfdiags.Diagnostics) {
+        mod, diags := tfconfig.LoadModule(dir)
+        return mod, wrapDiagnostics(diags)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/copy_dir.go b/vendor/github.com/hashicorp/terraform/internal/initwd/copy_dir.go
new file mode 100644
index 0000000..7096ff7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/copy_dir.go
@@ -0,0 +1,125 @@
+package initwd
+
+import (
+        "io"
+        "os"
+        "path/filepath"
+        "strings"
+)
+
+// copyDir copies the src directory contents into dst. Both directories
+// should already exist.
+func copyDir(dst, src string) error {
+        src, err := filepath.EvalSymlinks(src)
+        if err != nil {
+                return err
+        }
+
+        walkFn := func(path string, info os.FileInfo, err error) error {
+                if err != nil {
+                        return err
+                }
+
+                if path == src {
+                        return nil
+                }
+
+                if strings.HasPrefix(filepath.Base(path), ".") {
+                        // Skip any dot files
+                        if info.IsDir() {
+                                return filepath.SkipDir
+                        } else {
+                                return nil
+                        }
+                }
+
+                // The "path" has the src prefixed to it. We need to join our
+                // destination with the path without the src on it.
+                dstPath := filepath.Join(dst, path[len(src):])
+
+                // we don't want to try and copy the same file over itself.
+                if eq, err := sameFile(path, dstPath); eq {
+                        return nil
+                } else if err != nil {
+                        return err
+                }
+
+                // If we have a directory, make that subdirectory, then continue
+                // the walk.
+                if info.IsDir() {
+                        if path == filepath.Join(src, dst) {
+                                // dst is in src; don't walk it.
+                                return nil
+                        }
+
+                        if err := os.MkdirAll(dstPath, 0755); err != nil {
+                                return err
+                        }
+
+                        return nil
+                }
+
+                // If the current path is a symlink, recreate the symlink relative to
+                // the dst directory
+                if info.Mode()&os.ModeSymlink == os.ModeSymlink {
+                        target, err := os.Readlink(path)
+                        if err != nil {
+                                return err
+                        }
+
+                        return os.Symlink(target, dstPath)
+                }
+
+                // If we have a file, copy the contents.
+                srcF, err := os.Open(path)
+                if err != nil {
+                        return err
+                }
+                defer srcF.Close()
+
+                dstF, err := os.Create(dstPath)
+                if err != nil {
+                        return err
+                }
+                defer dstF.Close()
+
+                if _, err := io.Copy(dstF, srcF); err != nil {
+                        return err
+                }
+
+                // Chmod it
+                return os.Chmod(dstPath, info.Mode())
+        }
+
+        return filepath.Walk(src, walkFn)
+}
+
+// sameFile tried to determine if to paths are the same file.
+// If the paths don't match, we lookup the inode on supported systems.
+func sameFile(a, b string) (bool, error) {
+        if a == b {
+                return true, nil
+        }
+
+        aIno, err := inode(a)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        bIno, err := inode(b)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        if aIno > 0 && aIno == bIno {
+                return true, nil
+        }
+
+        return false, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/doc.go b/vendor/github.com/hashicorp/terraform/internal/initwd/doc.go
new file mode 100644
index 0000000..b9d938d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/doc.go
@@ -0,0 +1,7 @@
+// Package initwd contains various helper functions used by the "terraform init"
+// command to initialize a working directory.
+//
+// These functions may also be used from testing code to simulate the behaviors
+// of "terraform init" against test fixtures, but should not be used elsewhere
+// in the main code.
+package initwd
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/from_module.go b/vendor/github.com/hashicorp/terraform/internal/initwd/from_module.go
new file mode 100644
index 0000000..6b40d08
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/from_module.go
@@ -0,0 +1,363 @@
+package initwd
+
+import (
+        "fmt"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "io/ioutil"
+        "log"
+        "os"
+        "path/filepath"
+        "sort"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+const initFromModuleRootCallName = "root"
+const initFromModuleRootKeyPrefix = initFromModuleRootCallName + "."
+
+// DirFromModule populates the given directory (which must exist and be
+// empty) with the contents of the module at the given source address.
+//
+// It does this by installing the given module and all of its descendent
+// modules in a temporary root directory and then copying the installed
+// files into suitable locations. As a consequence, any diagnostics it
+// generates will reveal the location of this temporary directory to the
+// user.
+//
+// This rather roundabout installation approach is taken to ensure that
+// installation proceeds in a manner identical to normal module installation.
+//
+// If the given source address specifies a sub-directory of the given
+// package then only the sub-directory and its descendents will be copied
+// into the given root directory, which will cause any relative module
+// references using ../ from that module to be unresolvable. Error diagnostics
+// are produced in that case, to prompt the user to rewrite the source strings
+// to be absolute references to the original remote module.
+func DirFromModule(rootDir, modulesDir, sourceAddr string, reg *registry.Client, hooks ModuleInstallHooks) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        // The way this function works is pretty ugly, but we accept it because
+        // -from-module is a less important case than normal module installation
+        // and so it's better to keep this ugly complexity out here rather than
+        // adding even more complexity to the normal module installer.
+
+        // The target directory must exist but be empty.
+        {
+                entries, err := ioutil.ReadDir(rootDir)
+                if err != nil {
+                        if os.IsNotExist(err) {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Target directory does not exist",
+                                        fmt.Sprintf("Cannot initialize non-existent directory %s.", rootDir),
+                                ))
+                        } else {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to read target directory",
+                                        fmt.Sprintf("Error reading %s to ensure it is empty: %s.", rootDir, err),
+                                ))
+                        }
+                        return diags
+                }
+                haveEntries := false
+                for _, entry := range entries {
+                        if entry.Name() == "." || entry.Name() == ".." || entry.Name() == ".terraform" {
+                                continue
+                        }
+                        haveEntries = true
+                }
+                if haveEntries {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Can't populate non-empty directory",
+                                fmt.Sprintf("The target directory %s is not empty, so it cannot be initialized with the -from-module=... option.", rootDir),
+                        ))
+                        return diags
+                }
+        }
+
+        instDir := filepath.Join(rootDir, ".terraform/init-from-module")
+        inst := NewModuleInstaller(instDir, reg)
+        log.Printf("[DEBUG] installing modules in %s to initialize working directory from %q", instDir, sourceAddr)
+        os.RemoveAll(instDir) // if this fails then we'll fail on MkdirAll below too
+        err := os.MkdirAll(instDir, os.ModePerm)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to create temporary directory",
+                        fmt.Sprintf("Failed to create temporary directory %s: %s.", instDir, err),
+                ))
+                return diags
+        }
+
+        instManifest := make(modsdir.Manifest)
+        retManifest := make(modsdir.Manifest)
+
+        fakeFilename := fmt.Sprintf("-from-module=%q", sourceAddr)
+        fakePos := tfconfig.SourcePos{
+                Filename: fakeFilename,
+                Line:     1,
+        }
+
+        // -from-module allows relative paths but it's different than a normal
+        // module address where it'd be resolved relative to the module call
+        // (which is synthetic, here.) To address this, we'll just patch up any
+        // relative paths to be absolute paths before we run, ensuring we'll
+        // get the right result. This also, as an important side-effect, ensures
+        // that the result will be "downloaded" with go-getter (copied from the
+        // source location), rather than just recorded as a relative path.
+        {
+                maybePath := filepath.ToSlash(sourceAddr)
+                if maybePath == "." || strings.HasPrefix(maybePath, "./") || strings.HasPrefix(maybePath, "../") {
+                        if wd, err := os.Getwd(); err == nil {
+                                sourceAddr = filepath.Join(wd, sourceAddr)
+                                log.Printf("[TRACE] -from-module relative path rewritten to absolute path %s", sourceAddr)
+                        }
+                }
+        }
+
+        // Now we need to create an artificial root module that will seed our
+        // installation process.
+        fakeRootModule := &tfconfig.Module{
+                ModuleCalls: map[string]*tfconfig.ModuleCall{
+                        initFromModuleRootCallName: {
+                                Name:   initFromModuleRootCallName,
+                                Source: sourceAddr,
+                                Pos:    fakePos,
+                        },
+                },
+        }
+
+        // wrapHooks filters hook notifications to only include Download calls
+        // and to trim off the initFromModuleRootCallName prefix. We'll produce
+        // our own Install notifications directly below.
+        wrapHooks := installHooksInitDir{
+                Wrapped: hooks,
+        }
+        getter := reusingGetter{}
+        _, instDiags := inst.installDescendentModules(fakeRootModule, rootDir, instManifest, true, wrapHooks, getter)
+        diags = append(diags, instDiags...)
+        if instDiags.HasErrors() {
+                return diags
+        }
+
+        // If all of that succeeded then we'll now migrate what was installed
+        // into the final directory structure.
+        err = os.MkdirAll(modulesDir, os.ModePerm)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to create local modules directory",
+                        fmt.Sprintf("Failed to create modules directory %s: %s.", modulesDir, err),
+                ))
+                return diags
+        }
+
+        recordKeys := make([]string, 0, len(instManifest))
+        for k := range instManifest {
+                recordKeys = append(recordKeys, k)
+        }
+        sort.Strings(recordKeys)
+
+        for _, recordKey := range recordKeys {
+                record := instManifest[recordKey]
+
+                if record.Key == initFromModuleRootCallName {
+                        // We've found the module the user requested, which we must
+                        // now copy into rootDir so it can be used directly.
+                        log.Printf("[TRACE] copying new root module from %s to %s", record.Dir, rootDir)
+                        err := copyDir(rootDir, record.Dir)
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to copy root module",
+                                        fmt.Sprintf("Error copying root module %q from %s to %s: %s.", sourceAddr, record.Dir, rootDir, err),
+                                ))
+                                continue
+                        }
+
+                        // We'll try to load the newly-copied module here just so we can
+                        // sniff for any module calls that ../ out of the root directory
+                        // and must thus be rewritten to be absolute addresses again.
+                        // For now we can't do this rewriting automatically, but we'll
+                        // generate an error to help the user do it manually.
+                        mod, _ := earlyconfig.LoadModule(rootDir) // ignore diagnostics since we're just doing value-add here anyway
+                        if mod != nil {
+                                for _, mc := range mod.ModuleCalls {
+                                        if pathTraversesUp(mc.Source) {
+                                                packageAddr, givenSubdir := splitAddrSubdir(sourceAddr)
+                                                newSubdir := filepath.Join(givenSubdir, mc.Source)
+                                                if pathTraversesUp(newSubdir) {
+                                                        // This should never happen in any reasonable
+                                                        // configuration since this suggests a path that
+                                                        // traverses up out of the package root. We'll just
+                                                        // ignore this, since we'll fail soon enough anyway
+                                                        // trying to resolve this path when this module is
+                                                        // loaded.
+                                                        continue
+                                                }
+
+                                                var newAddr = packageAddr
+                                                if newSubdir != "" {
+                                                        newAddr = fmt.Sprintf("%s//%s", newAddr, filepath.ToSlash(newSubdir))
+                                                }
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Root module references parent directory",
+                                                        fmt.Sprintf("The requested module %q refers to a module via its parent directory. To use this as a new root module this source string must be rewritten as a remote source address, such as %q.", sourceAddr, newAddr),
+                                                ))
+                                                continue
+                                        }
+                                }
+                        }
+
+                        retManifest[""] = modsdir.Record{
+                                Key: "",
+                                Dir: rootDir,
+                        }
+                        continue
+                }
+
+                if !strings.HasPrefix(record.Key, initFromModuleRootKeyPrefix) {
+                        // Ignore the *real* root module, whose key is empty, since
+                        // we're only interested in the module named "root" and its
+                        // descendents.
+                        continue
+                }
+
+                newKey := record.Key[len(initFromModuleRootKeyPrefix):]
+                instPath := filepath.Join(modulesDir, newKey)
+                tempPath := filepath.Join(instDir, record.Key)
+
+                // tempPath won't be present for a module that was installed from
+                // a relative path, so in that case we just record the installation
+                // directory and assume it was already copied into place as part
+                // of its parent.
+                if _, err := os.Stat(tempPath); err != nil {
+                        if !os.IsNotExist(err) {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to stat temporary module install directory",
+                                        fmt.Sprintf("Error from stat %s for module %s: %s.", instPath, newKey, err),
+                                ))
+                                continue
+                        }
+
+                        var parentKey string
+                        if lastDot := strings.LastIndexByte(newKey, '.'); lastDot != -1 {
+                                parentKey = newKey[:lastDot]
+                        } else {
+                                parentKey = "" // parent is the root module
+                        }
+
+                        parentOld := instManifest[initFromModuleRootKeyPrefix+parentKey]
+                        parentNew := retManifest[parentKey]
+
+                        // We need to figure out which portion of our directory is the
+                        // parent package path and which portion is the subdirectory
+                        // under that.
+                        baseDirRel, err := filepath.Rel(parentOld.Dir, record.Dir)
+                        if err != nil {
+                                // Should never happen, because we constructed both directories
+                                // from the same base and so they must have a common prefix.
+                                panic(err)
+                        }
+
+                        newDir := filepath.Join(parentNew.Dir, baseDirRel)
+                        log.Printf("[TRACE] relative reference for %s rewritten from %s to %s", newKey, record.Dir, newDir)
+                        newRecord := record // shallow copy
+                        newRecord.Dir = newDir
+                        newRecord.Key = newKey
+                        retManifest[newKey] = newRecord
+                        hooks.Install(newRecord.Key, newRecord.Version, newRecord.Dir)
+                        continue
+                }
+
+                err = os.MkdirAll(instPath, os.ModePerm)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to create module install directory",
+                                fmt.Sprintf("Error creating directory %s for module %s: %s.", instPath, newKey, err),
+                        ))
+                        continue
+                }
+
+                // We copy rather than "rename" here because renaming between directories
+                // can be tricky in edge-cases like network filesystems, etc.
+                log.Printf("[TRACE] copying new module %s from %s to %s", newKey, record.Dir, instPath)
+                err := copyDir(instPath, tempPath)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to copy descendent module",
+                                fmt.Sprintf("Error copying module %q from %s to %s: %s.", newKey, tempPath, rootDir, err),
+                        ))
+                        continue
+                }
+
+                subDir, err := filepath.Rel(tempPath, record.Dir)
+                if err != nil {
+                        // Should never happen, because we constructed both directories
+                        // from the same base and so they must have a common prefix.
+                        panic(err)
+                }
+
+                newRecord := record // shallow copy
+                newRecord.Dir = filepath.Join(instPath, subDir)
+                newRecord.Key = newKey
+                retManifest[newKey] = newRecord
+                hooks.Install(newRecord.Key, newRecord.Version, newRecord.Dir)
+        }
+
+        retManifest.WriteSnapshotToDir(modulesDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to write module manifest",
+                        fmt.Sprintf("Error writing module manifest: %s.", err),
+                ))
+        }
+
+        if !diags.HasErrors() {
+                // Try to clean up our temporary directory, but don't worry if we don't
+                // succeed since it shouldn't hurt anything.
+                os.RemoveAll(instDir)
+        }
+
+        return diags
+}
+
+func pathTraversesUp(path string) bool {
+        return strings.HasPrefix(filepath.ToSlash(path), "../")
+}
+
+// installHooksInitDir is an adapter wrapper for an InstallHooks that
+// does some fakery to make downloads look like they are happening in their
+// final locations, rather than in the temporary loader we use.
+//
+// It also suppresses "Install" calls entirely, since InitDirFromModule
+// does its own installation steps after the initial installation pass
+// has completed.
+type installHooksInitDir struct {
+        Wrapped ModuleInstallHooks
+        ModuleInstallHooksImpl
+}
+
+func (h installHooksInitDir) Download(moduleAddr, packageAddr string, version *version.Version) {
+        if !strings.HasPrefix(moduleAddr, initFromModuleRootKeyPrefix) {
+                // We won't announce the root module, since hook implementations
+                // don't expect to see that and the caller will usually have produced
+                // its own user-facing notification about what it's doing anyway.
+                return
+        }
+
+        trimAddr := moduleAddr[len(initFromModuleRootKeyPrefix):]
+        h.Wrapped.Download(trimAddr, packageAddr, version)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/getter.go b/vendor/github.com/hashicorp/terraform/internal/initwd/getter.go
new file mode 100644
index 0000000..50e2572
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/getter.go
@@ -0,0 +1,210 @@
+package initwd
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strings"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        getter "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/terraform/registry/regsrc"
+)
+
+// We configure our own go-getter detector and getter sets here, because
+// the set of sources we support is part of Terraform's documentation and
+// so we don't want any new sources introduced in go-getter to sneak in here
+// and work even though they aren't documented. This also insulates us from
+// any meddling that might be done by other go-getter callers linked into our
+// executable.
+
+var goGetterDetectors = []getter.Detector{
+        new(getter.GitHubDetector),
+        new(getter.BitBucketDetector),
+        new(getter.S3Detector),
+        new(getter.FileDetector),
+}
+
+var goGetterNoDetectors = []getter.Detector{}
+
+var goGetterDecompressors = map[string]getter.Decompressor{
+        "bz2": new(getter.Bzip2Decompressor),
+        "gz":  new(getter.GzipDecompressor),
+        "xz":  new(getter.XzDecompressor),
+        "zip": new(getter.ZipDecompressor),
+
+        "tar.bz2":  new(getter.TarBzip2Decompressor),
+        "tar.tbz2": new(getter.TarBzip2Decompressor),
+
+        "tar.gz": new(getter.TarGzipDecompressor),
+        "tgz":    new(getter.TarGzipDecompressor),
+
+        "tar.xz": new(getter.TarXzDecompressor),
+        "txz":    new(getter.TarXzDecompressor),
+}
+
+var goGetterGetters = map[string]getter.Getter{
+        "file":  new(getter.FileGetter),
+        "git":   new(getter.GitGetter),
+        "hg":    new(getter.HgGetter),
+        "s3":    new(getter.S3Getter),
+        "http":  getterHTTPGetter,
+        "https": getterHTTPGetter,
+}
+
+var getterHTTPClient = cleanhttp.DefaultClient()
+
+var getterHTTPGetter = &getter.HttpGetter{
+        Client: getterHTTPClient,
+        Netrc:  true,
+}
+
+// A reusingGetter is a helper for the module installer that remembers
+// the final resolved addresses of all of the sources it has already been
+// asked to install, and will copy from a prior installation directory if
+// it has the same resolved source address.
+//
+// The keys in a reusingGetter are resolved and trimmed source addresses
+// (with a scheme always present, and without any "subdir" component),
+// and the values are the paths where each source was previously installed.
+type reusingGetter map[string]string
+
+// getWithGoGetter retrieves the package referenced in the given address
+// into the installation path and then returns the full path to any subdir
+// indicated in the address.
+//
+// The errors returned by this function are those surfaced by the underlying
+// go-getter library, which have very inconsistent quality as
+// end-user-actionable error messages. At this time we do not have any
+// reasonable way to improve these error messages at this layer because
+// the underlying errors are not separately recognizable.
+func (g reusingGetter) getWithGoGetter(instPath, addr string) (string, error) {
+        packageAddr, subDir := splitAddrSubdir(addr)
+
+        log.Printf("[DEBUG] will download %q to %s", packageAddr, instPath)
+
+        realAddr, err := getter.Detect(packageAddr, instPath, getter.Detectors)
+        if err != nil {
+                return "", err
+        }
+
+        if isMaybeRelativeLocalPath(realAddr) {
+                return "", &MaybeRelativePathErr{addr}
+        }
+
+        var realSubDir string
+        realAddr, realSubDir = splitAddrSubdir(realAddr)
+        if realSubDir != "" {
+                subDir = filepath.Join(realSubDir, subDir)
+        }
+
+        if realAddr != packageAddr {
+                log.Printf("[TRACE] go-getter detectors rewrote %q to %q", packageAddr, realAddr)
+        }
+
+        if prevDir, exists := g[realAddr]; exists {
+                log.Printf("[TRACE] copying previous install %s to %s", prevDir, instPath)
+                err := os.Mkdir(instPath, os.ModePerm)
+                if err != nil {
+                        return "", fmt.Errorf("failed to create directory %s: %s", instPath, err)
+                }
+                err = copyDir(instPath, prevDir)
+                if err != nil {
+                        return "", fmt.Errorf("failed to copy from %s to %s: %s", prevDir, instPath, err)
+                }
+        } else {
+                log.Printf("[TRACE] fetching %q to %q", realAddr, instPath)
+                client := getter.Client{
+                        Src: realAddr,
+                        Dst: instPath,
+                        Pwd: instPath,
+
+                        Mode: getter.ClientModeDir,
+
+                        Detectors:     goGetterNoDetectors, // we already did detection above
+                        Decompressors: goGetterDecompressors,
+                        Getters:       goGetterGetters,
+                }
+                err = client.Get()
+                if err != nil {
+                        return "", err
+                }
+                // Remember where we installed this so we might reuse this directory
+                // on subsequent calls to avoid re-downloading.
+                g[realAddr] = instPath
+        }
+
+        // Our subDir string can contain wildcards until this point, so that
+        // e.g. a subDir of * can expand to one top-level directory in a .tar.gz
+        // archive. Now that we've expanded the archive successfully we must
+        // resolve that into a concrete path.
+        var finalDir string
+        if subDir != "" {
+                finalDir, err = getter.SubdirGlob(instPath, subDir)
+                log.Printf("[TRACE] expanded %q to %q", subDir, finalDir)
+                if err != nil {
+                        return "", err
+                }
+        } else {
+                finalDir = instPath
+        }
+
+        // If we got this far then we have apparently succeeded in downloading
+        // the requested object!
+        return filepath.Clean(finalDir), nil
+}
+
+// splitAddrSubdir splits the given address (which is assumed to be a
+// registry address or go-getter-style address) into a package portion
+// and a sub-directory portion.
+//
+// The package portion defines what should be downloaded and then the
+// sub-directory portion, if present, specifies a sub-directory within
+// the downloaded object (an archive, VCS repository, etc) that contains
+// the module's configuration files.
+//
+// The subDir portion will be returned as empty if no subdir separator
+// ("//") is present in the address.
+func splitAddrSubdir(addr string) (packageAddr, subDir string) {
+        return getter.SourceDirSubdir(addr)
+}
+
+var localSourcePrefixes = []string{
+        "./",
+        "../",
+        ".\\",
+        "..\\",
+}
+
+func isLocalSourceAddr(addr string) bool {
+        for _, prefix := range localSourcePrefixes {
+                if strings.HasPrefix(addr, prefix) {
+                        return true
+                }
+        }
+        return false
+}
+
+func isRegistrySourceAddr(addr string) bool {
+        _, err := regsrc.ParseModuleSource(addr)
+        return err == nil
+}
+
+type MaybeRelativePathErr struct {
+        Addr string
+}
+
+func (e *MaybeRelativePathErr) Error() string {
+        return fmt.Sprintf("Terraform cannot determine the module source for %s", e.Addr)
+}
+
+func isMaybeRelativeLocalPath(addr string) bool {
+        if strings.HasPrefix(addr, "file://") {
+                _, err := os.Stat(addr[7:])
+                if err != nil {
+                        return true
+                }
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/inode.go b/vendor/github.com/hashicorp/terraform/internal/initwd/inode.go
new file mode 100644
index 0000000..1150b09
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/inode.go
@@ -0,0 +1,21 @@
+// +build linux darwin openbsd netbsd solaris dragonfly
+
+package initwd
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return st.Ino, nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/inode_freebsd.go b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_freebsd.go
new file mode 100644
index 0000000..30532f5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_freebsd.go
@@ -0,0 +1,21 @@
+// +build freebsd
+
+package initwd
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return uint64(st.Ino), nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/inode_windows.go b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_windows.go
new file mode 100644
index 0000000..3ed58e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_windows.go
@@ -0,0 +1,8 @@
+// +build windows
+
+package initwd
+
+// no syscall.Stat_t on windows, return 0 for inodes
+func inode(path string) (uint64, error) {
+        return 0, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/load_config.go b/vendor/github.com/hashicorp/terraform/internal/initwd/load_config.go
new file mode 100644
index 0000000..6f77dcd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/load_config.go
@@ -0,0 +1,56 @@
+package initwd
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// LoadConfig loads a full configuration tree that has previously had all of
+// its dependent modules installed to the given modulesDir using a
+// ModuleInstaller.
+//
+// This uses the early configuration loader and thus only reads top-level
+// metadata from the modules in the configuration. Most callers should use
+// the configs/configload package to fully load a configuration.
+func LoadConfig(rootDir, modulesDir string) (*earlyconfig.Config, tfdiags.Diagnostics) {
+        rootMod, diags := earlyconfig.LoadModule(rootDir)
+        if rootMod == nil {
+                return nil, diags
+        }
+
+        manifest, err := modsdir.ReadManifestSnapshotForDir(modulesDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read module manifest",
+                        fmt.Sprintf("Terraform failed to read its manifest of locally-cached modules: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        return earlyconfig.BuildConfig(rootMod, earlyconfig.ModuleWalkerFunc(
+                func(req *earlyconfig.ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+                        var diags tfdiags.Diagnostics
+
+                        key := manifest.ModuleKey(req.Path)
+                        record, exists := manifest[key]
+                        if !exists {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Module not installed",
+                                        fmt.Sprintf("Module %s is not yet installed. Run \"terraform init\" to install all modules required by this configuration.", req.Path.String()),
+                                ))
+                                return nil, nil, diags
+                        }
+
+                        mod, mDiags := earlyconfig.LoadModule(record.Dir)
+                        diags = diags.Append(mDiags)
+                        return mod, record.Version, diags
+                },
+        ))
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/module_install.go b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install.go
new file mode 100644
index 0000000..531310a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install.go
@@ -0,0 +1,558 @@
+package initwd
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+type ModuleInstaller struct {
+        modsDir string
+        reg     *registry.Client
+}
+
+func NewModuleInstaller(modsDir string, reg *registry.Client) *ModuleInstaller {
+        return &ModuleInstaller{
+                modsDir: modsDir,
+                reg:     reg,
+        }
+}
+
+// InstallModules analyses the root module in the given directory and installs
+// all of its direct and transitive dependencies into the given modules
+// directory, which must already exist.
+//
+// Since InstallModules makes possibly-time-consuming calls to remote services,
+// a hook interface is supported to allow the caller to be notified when
+// each module is installed and, for remote modules, when downloading begins.
+// LoadConfig guarantees that two hook calls will not happen concurrently but
+// it does not guarantee any particular ordering of hook calls. This mechanism
+// is for UI feedback only and does not give the caller any control over the
+// process.
+//
+// If modules are already installed in the target directory, they will be
+// skipped unless their source address or version have changed or unless
+// the upgrade flag is set.
+//
+// InstallModules never deletes any directory, except in the case where it
+// needs to replace a directory that is already present with a newly-extracted
+// package.
+//
+// If the returned diagnostics contains errors then the module installation
+// may have wholly or partially completed. Modules must be loaded in order
+// to find their dependencies, so this function does many of the same checks
+// as LoadConfig as a side-effect.
+//
+// If successful (the returned diagnostics contains no errors) then the
+// first return value is the early configuration tree that was constructed by
+// the installation process.
+func (i *ModuleInstaller) InstallModules(rootDir string, upgrade bool, hooks ModuleInstallHooks) (*earlyconfig.Config, tfdiags.Diagnostics) {
+        log.Printf("[TRACE] ModuleInstaller: installing child modules for %s into %s", rootDir, i.modsDir)
+
+        rootMod, diags := earlyconfig.LoadModule(rootDir)
+        if rootMod == nil {
+                return nil, diags
+        }
+
+        manifest, err := modsdir.ReadManifestSnapshotForDir(i.modsDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read modules manifest file",
+                        fmt.Sprintf("Error reading manifest for %s: %s.", i.modsDir, err),
+                ))
+                return nil, diags
+        }
+
+        getter := reusingGetter{}
+        cfg, instDiags := i.installDescendentModules(rootMod, rootDir, manifest, upgrade, hooks, getter)
+        diags = append(diags, instDiags...)
+
+        return cfg, diags
+}
+
+func (i *ModuleInstaller) installDescendentModules(rootMod *tfconfig.Module, rootDir string, manifest modsdir.Manifest, upgrade bool, hooks ModuleInstallHooks, getter reusingGetter) (*earlyconfig.Config, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if hooks == nil {
+                // Use our no-op implementation as a placeholder
+                hooks = ModuleInstallHooksImpl{}
+        }
+
+        // Create a manifest record for the root module. This will be used if
+        // there are any relative-pathed modules in the root.
+        manifest[""] = modsdir.Record{
+                Key: "",
+                Dir: rootDir,
+        }
+
+        cfg, cDiags := earlyconfig.BuildConfig(rootMod, earlyconfig.ModuleWalkerFunc(
+                func(req *earlyconfig.ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+
+                        key := manifest.ModuleKey(req.Path)
+                        instPath := i.packageInstallPath(req.Path)
+
+                        log.Printf("[DEBUG] Module installer: begin %s", key)
+
+                        // First we'll check if we need to upgrade/replace an existing
+                        // installed module, and delete it out of the way if so.
+                        replace := upgrade
+                        if !replace {
+                                record, recorded := manifest[key]
+                                switch {
+                                case !recorded:
+                                        log.Printf("[TRACE] ModuleInstaller: %s is not yet installed", key)
+                                        replace = true
+                                case record.SourceAddr != req.SourceAddr:
+                                        log.Printf("[TRACE] ModuleInstaller: %s source address has changed from %q to %q", key, record.SourceAddr, req.SourceAddr)
+                                        replace = true
+                                case record.Version != nil && !req.VersionConstraints.Check(record.Version):
+                                        log.Printf("[TRACE] ModuleInstaller: %s version %s no longer compatible with constraints %s", key, record.Version, req.VersionConstraints)
+                                        replace = true
+                                }
+                        }
+
+                        // If we _are_ planning to replace this module, then we'll remove
+                        // it now so our installation code below won't conflict with any
+                        // existing remnants.
+                        if replace {
+                                if _, recorded := manifest[key]; recorded {
+                                        log.Printf("[TRACE] ModuleInstaller: discarding previous record of %s prior to reinstall", key)
+                                }
+                                delete(manifest, key)
+                                // Deleting a module invalidates all of its descendent modules too.
+                                keyPrefix := key + "."
+                                for subKey := range manifest {
+                                        if strings.HasPrefix(subKey, keyPrefix) {
+                                                if _, recorded := manifest[subKey]; recorded {
+                                                        log.Printf("[TRACE] ModuleInstaller: also discarding downstream %s", subKey)
+                                                }
+                                                delete(manifest, subKey)
+                                        }
+                                }
+                        }
+
+                        record, recorded := manifest[key]
+                        if !recorded {
+                                // Clean up any stale cache directory that might be present.
+                                // If this is a local (relative) source then the dir will
+                                // not exist, but we'll ignore that.
+                                log.Printf("[TRACE] ModuleInstaller: cleaning directory %s prior to install of %s", instPath, key)
+                                err := os.RemoveAll(instPath)
+                                if err != nil && !os.IsNotExist(err) {
+                                        log.Printf("[TRACE] ModuleInstaller: failed to remove %s: %s", key, err)
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Failed to remove local module cache",
+                                                fmt.Sprintf(
+                                                        "Terraform tried to remove %s in order to reinstall this module, but encountered an error: %s",
+                                                        instPath, err,
+                                                ),
+                                        ))
+                                        return nil, nil, diags
+                                }
+                        } else {
+                                // If this module is already recorded and its root directory
+                                // exists then we will just load what's already there and
+                                // keep our existing record.
+                                info, err := os.Stat(record.Dir)
+                                if err == nil && info.IsDir() {
+                                        mod, mDiags := earlyconfig.LoadModule(record.Dir)
+                                        diags = diags.Append(mDiags)
+
+                                        log.Printf("[TRACE] ModuleInstaller: Module installer: %s %s already installed in %s", key, record.Version, record.Dir)
+                                        return mod, record.Version, diags
+                                }
+                        }
+
+                        // If we get down here then it's finally time to actually install
+                        // the module. There are some variants to this process depending
+                        // on what type of module source address we have.
+                        switch {
+
+                        case isLocalSourceAddr(req.SourceAddr):
+                                log.Printf("[TRACE] ModuleInstaller: %s has local path %q", key, req.SourceAddr)
+                                mod, mDiags := i.installLocalModule(req, key, manifest, hooks)
+                                diags = append(diags, mDiags...)
+                                return mod, nil, diags
+
+                        case isRegistrySourceAddr(req.SourceAddr):
+                                addr, err := regsrc.ParseModuleSource(req.SourceAddr)
+                                if err != nil {
+                                        // Should never happen because isRegistrySourceAddr already validated
+                                        panic(err)
+                                }
+                                log.Printf("[TRACE] ModuleInstaller: %s is a registry module at %s", key, addr)
+
+                                mod, v, mDiags := i.installRegistryModule(req, key, instPath, addr, manifest, hooks, getter)
+                                diags = append(diags, mDiags...)
+                                return mod, v, diags
+
+                        default:
+                                log.Printf("[TRACE] ModuleInstaller: %s address %q will be handled by go-getter", key, req.SourceAddr)
+
+                                mod, mDiags := i.installGoGetterModule(req, key, instPath, manifest, hooks, getter)
+                                diags = append(diags, mDiags...)
+                                return mod, nil, diags
+                        }
+
+                },
+        ))
+        diags = append(diags, cDiags...)
+
+        err := manifest.WriteSnapshotToDir(i.modsDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to update module manifest",
+                        fmt.Sprintf("Unable to write the module manifest file: %s", err),
+                ))
+        }
+
+        return cfg, diags
+}
+
+func (i *ModuleInstaller) installLocalModule(req *earlyconfig.ModuleRequest, key string, manifest modsdir.Manifest, hooks ModuleInstallHooks) (*tfconfig.Module, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        parentKey := manifest.ModuleKey(req.Parent.Path)
+        parentRecord, recorded := manifest[parentKey]
+        if !recorded {
+                // This is indicative of a bug rather than a user-actionable error
+                panic(fmt.Errorf("missing manifest record for parent module %s", parentKey))
+        }
+
+        if len(req.VersionConstraints) != 0 {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid version constraint",
+                        fmt.Sprintf("Cannot apply a version constraint to module %q (at %s:%d) because it has a relative local path.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+        }
+
+        // For local sources we don't actually need to modify the
+        // filesystem at all because the parent already wrote
+        // the files we need, and so we just load up what's already here.
+        newDir := filepath.Join(parentRecord.Dir, req.SourceAddr)
+
+        log.Printf("[TRACE] ModuleInstaller: %s uses directory from parent: %s", key, newDir)
+        // it is possible that the local directory is a symlink
+        newDir, err := filepath.EvalSymlinks(newDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("Unable to evaluate directory symlink: %s", err.Error()),
+                ))
+        }
+
+        mod, mDiags := earlyconfig.LoadModule(newDir)
+        if mod == nil {
+                // nil indicates missing or unreadable directory, so we'll
+                // discard the returned diags and return a more specific
+                // error message here.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("The directory %s could not be read for module %q at %s:%d.", newDir, req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+        } else {
+                diags = diags.Append(mDiags)
+        }
+
+        // Note the local location in our manifest.
+        manifest[key] = modsdir.Record{
+                Key:        key,
+                Dir:        newDir,
+                SourceAddr: req.SourceAddr,
+        }
+        log.Printf("[DEBUG] Module installer: %s installed at %s", key, newDir)
+        hooks.Install(key, nil, newDir)
+
+        return mod, diags
+}
+
+func (i *ModuleInstaller) installRegistryModule(req *earlyconfig.ModuleRequest, key string, instPath string, addr *regsrc.Module, manifest modsdir.Manifest, hooks ModuleInstallHooks, getter reusingGetter) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        hostname, err := addr.SvcHost()
+        if err != nil {
+                // If it looks like the user was trying to use punycode then we'll generate
+                // a specialized error for that case. We require the unicode form of
+                // hostname so that hostnames are always human-readable in configuration
+                // and punycode can't be used to hide a malicious module hostname.
+                if strings.HasPrefix(addr.RawHost.Raw, "xn--") {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid module registry hostname",
+                                fmt.Sprintf("The hostname portion of the module %q source address (at %s:%d) is not an acceptable hostname. Internationalized domain names must be given in unicode form rather than ASCII (\"punycode\") form.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                        ))
+                } else {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid module registry hostname",
+                                fmt.Sprintf("The hostname portion of the module %q source address (at %s:%d) is not a valid hostname.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                        ))
+                }
+                return nil, nil, diags
+        }
+
+        reg := i.reg
+
+        log.Printf("[DEBUG] %s listing available versions of %s at %s", key, addr, hostname)
+        resp, err := reg.ModuleVersions(addr)
+        if err != nil {
+                if registry.IsModuleNotFound(err) {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Module not found",
+                                fmt.Sprintf("Module %q (from %s:%d) cannot be found in the module registry at %s.", req.Name, req.CallPos.Filename, req.CallPos.Line, hostname),
+                        ))
+                } else {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Error accessing remote module registry",
+                                fmt.Sprintf("Failed to retrieve available versions for module %q (%s:%d) from %s: %s.", req.Name, req.CallPos.Filename, req.CallPos.Line, hostname, err),
+                        ))
+                }
+                return nil, nil, diags
+        }
+
+        // The response might contain information about dependencies to allow us
+        // to potentially optimize future requests, but we don't currently do that
+        // and so for now we'll just take the first item which is guaranteed to
+        // be the address we requested.
+        if len(resp.Modules) < 1 {
+                // Should never happen, but since this is a remote service that may
+                // be implemented by third-parties we will handle it gracefully.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid response from remote module registry",
+                        fmt.Sprintf("The registry at %s returned an invalid response when Terraform requested available versions for module %q (%s:%d).", hostname, req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+                return nil, nil, diags
+        }
+
+        modMeta := resp.Modules[0]
+
+        var latestMatch *version.Version
+        var latestVersion *version.Version
+        for _, mv := range modMeta.Versions {
+                v, err := version.NewVersion(mv.Version)
+                if err != nil {
+                        // Should never happen if the registry server is compliant with
+                        // the protocol, but we'll warn if not to assist someone who
+                        // might be developing a module registry server.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Warning,
+                                "Invalid response from remote module registry",
+                                fmt.Sprintf("The registry at %s returned an invalid version string %q for module %q (%s:%d), which Terraform ignored.", hostname, mv.Version, req.Name, req.CallPos.Filename, req.CallPos.Line),
+                        ))
+                        continue
+                }
+
+                // If we've found a pre-release version then we'll ignore it unless
+                // it was exactly requested.
+                if v.Prerelease() != "" && req.VersionConstraints.String() != v.String() {
+                        log.Printf("[TRACE] ModuleInstaller: %s ignoring %s because it is a pre-release and was not requested exactly", key, v)
+                        continue
+                }
+
+                if latestVersion == nil || v.GreaterThan(latestVersion) {
+                        latestVersion = v
+                }
+
+                if req.VersionConstraints.Check(v) {
+                        if latestMatch == nil || v.GreaterThan(latestMatch) {
+                                latestMatch = v
+                        }
+                }
+        }
+
+        if latestVersion == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Module has no versions",
+                        fmt.Sprintf("Module %q (%s:%d) has no versions available on %s.", addr, req.CallPos.Filename, req.CallPos.Line, hostname),
+                ))
+                return nil, nil, diags
+        }
+
+        if latestMatch == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unresolvable module version constraint",
+                        fmt.Sprintf("There is no available version of module %q (%s:%d) which matches the given version constraint. The newest available version is %s.", addr, req.CallPos.Filename, req.CallPos.Line, latestVersion),
+                ))
+                return nil, nil, diags
+        }
+
+        // Report up to the caller that we're about to start downloading.
+        packageAddr, _ := splitAddrSubdir(req.SourceAddr)
+        hooks.Download(key, packageAddr, latestMatch)
+
+        // If we manage to get down here then we've found a suitable version to
+        // install, so we need to ask the registry where we should download it from.
+        // The response to this is a go-getter-style address string.
+        dlAddr, err := reg.ModuleLocation(addr, latestMatch.String())
+        if err != nil {
+                log.Printf("[ERROR] %s from %s %s: %s", key, addr, latestMatch, err)
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid response from remote module registry",
+                        fmt.Sprintf("The remote registry at %s failed to return a download URL for %s %s.", hostname, addr, latestMatch),
+                ))
+                return nil, nil, diags
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s %s %s is available at %q", key, addr, latestMatch, dlAddr)
+
+        modDir, err := getter.getWithGoGetter(instPath, dlAddr)
+        if err != nil {
+                // Errors returned by go-getter have very inconsistent quality as
+                // end-user error messages, but for now we're accepting that because
+                // we have no way to recognize any specific errors to improve them
+                // and masking the error entirely would hide valuable diagnostic
+                // information from the user.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to download module",
+                        fmt.Sprintf("Could not download module %q (%s:%d) source code from %q: %s.", req.Name, req.CallPos.Filename, req.CallPos.Line, dlAddr, err),
+                ))
+                return nil, nil, diags
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s %q was downloaded to %s", key, dlAddr, modDir)
+
+        if addr.RawSubmodule != "" {
+                // Append the user's requested subdirectory to any subdirectory that
+                // was implied by any of the nested layers we expanded within go-getter.
+                modDir = filepath.Join(modDir, addr.RawSubmodule)
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s should now be at %s", key, modDir)
+
+        // Finally we are ready to try actually loading the module.
+        mod, mDiags := earlyconfig.LoadModule(modDir)
+        if mod == nil {
+                // nil indicates missing or unreadable directory, so we'll
+                // discard the returned diags and return a more specific
+                // error message here. For registry modules this actually
+                // indicates a bug in the code above, since it's not the
+                // user's responsibility to create the directory in this case.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("The directory %s could not be read. This is a bug in Terraform and should be reported.", modDir),
+                ))
+        } else {
+                diags = append(diags, mDiags...)
+        }
+
+        // Note the local location in our manifest.
+        manifest[key] = modsdir.Record{
+                Key:        key,
+                Version:    latestMatch,
+                Dir:        modDir,
+                SourceAddr: req.SourceAddr,
+        }
+        log.Printf("[DEBUG] Module installer: %s installed at %s", key, modDir)
+        hooks.Install(key, latestMatch, modDir)
+
+        return mod, latestMatch, diags
+}
+
+func (i *ModuleInstaller) installGoGetterModule(req *earlyconfig.ModuleRequest, key string, instPath string, manifest modsdir.Manifest, hooks ModuleInstallHooks, getter reusingGetter) (*tfconfig.Module, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Report up to the caller that we're about to start downloading.
+        packageAddr, _ := splitAddrSubdir(req.SourceAddr)
+        hooks.Download(key, packageAddr, nil)
+
+        if len(req.VersionConstraints) != 0 {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid version constraint",
+                        fmt.Sprintf("Cannot apply a version constraint to module %q (at %s:%d) because it has a non Registry URL.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+                return nil, diags
+        }
+
+        modDir, err := getter.getWithGoGetter(instPath, req.SourceAddr)
+        if err != nil {
+                if _, ok := err.(*MaybeRelativePathErr); ok {
+                        log.Printf(
+                                "[TRACE] ModuleInstaller: %s looks like a local path but is missing ./ or ../",
+                                req.SourceAddr,
+                        )
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Module not found",
+                                fmt.Sprintf(
+                                        "The module address %q could not be resolved.\n\n"+
+                                                "If you intended this as a path relative to the current "+
+                                                "module, use \"./%s\" instead. The \"./\" prefix "+
+                                                "indicates that the address is a relative filesystem path.",
+                                        req.SourceAddr, req.SourceAddr,
+                                ),
+                        ))
+                } else {
+                        // Errors returned by go-getter have very inconsistent quality as
+                        // end-user error messages, but for now we're accepting that because
+                        // we have no way to recognize any specific errors to improve them
+                        // and masking the error entirely would hide valuable diagnostic
+                        // information from the user.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to download module",
+                                fmt.Sprintf("Could not download module %q (%s:%d) source code from %q: %s", req.Name, req.CallPos.Filename, req.CallPos.Line, packageAddr, err),
+                        ))
+                }
+                return nil, diags
+
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s %q was downloaded to %s", key, req.SourceAddr, modDir)
+
+        mod, mDiags := earlyconfig.LoadModule(modDir)
+        if mod == nil {
+                // nil indicates missing or unreadable directory, so we'll
+                // discard the returned diags and return a more specific
+                // error message here. For go-getter modules this actually
+                // indicates a bug in the code above, since it's not the
+                // user's responsibility to create the directory in this case.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("The directory %s could not be read. This is a bug in Terraform and should be reported.", modDir),
+                ))
+        } else {
+                diags = append(diags, mDiags...)
+        }
+
+        // Note the local location in our manifest.
+        manifest[key] = modsdir.Record{
+                Key:        key,
+                Dir:        modDir,
+                SourceAddr: req.SourceAddr,
+        }
+        log.Printf("[DEBUG] Module installer: %s installed at %s", key, modDir)
+        hooks.Install(key, nil, modDir)
+
+        return mod, diags
+}
+
+func (i *ModuleInstaller) packageInstallPath(modulePath addrs.Module) string {
+        return filepath.Join(i.modsDir, strings.Join(modulePath, "."))
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/module_install_hooks.go b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install_hooks.go
new file mode 100644
index 0000000..817a6dc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install_hooks.go
@@ -0,0 +1,36 @@
+package initwd
+
+import (
+        version "github.com/hashicorp/go-version"
+)
+
+// ModuleInstallHooks is an interface used to provide notifications about the
+// installation process being orchestrated by InstallModules.
+//
+// This interface may have new methods added in future, so implementers should
+// embed InstallHooksImpl to get no-op implementations of any unimplemented
+// methods.
+type ModuleInstallHooks interface {
+        // Download is called for modules that are retrieved from a remote source
+        // before that download begins, to allow a caller to give feedback
+        // on progress through a possibly-long sequence of downloads.
+        Download(moduleAddr, packageAddr string, version *version.Version)
+
+        // Install is called for each module that is installed, even if it did
+        // not need to be downloaded from a remote source.
+        Install(moduleAddr string, version *version.Version, localPath string)
+}
+
+// ModuleInstallHooksImpl is a do-nothing implementation of InstallHooks that
+// can be embedded in another implementation struct to allow only partial
+// implementation of the interface.
+type ModuleInstallHooksImpl struct {
+}
+
+func (h ModuleInstallHooksImpl) Download(moduleAddr, packageAddr string, version *version.Version) {
+}
+
+func (h ModuleInstallHooksImpl) Install(moduleAddr string, version *version.Version, localPath string) {
+}
+
+var _ ModuleInstallHooks = ModuleInstallHooksImpl{}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/testing.go b/vendor/github.com/hashicorp/terraform/internal/initwd/testing.go
new file mode 100644
index 0000000..8cef80a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/testing.go
@@ -0,0 +1,73 @@
+package initwd
+
+import (
+        "github.com/hashicorp/terraform/registry"
+        "testing"
+
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configload"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// LoadConfigForTests is a convenience wrapper around configload.NewLoaderForTests,
+// ModuleInstaller.InstallModules and configload.Loader.LoadConfig that allows
+// a test configuration to be loaded in a single step.
+//
+// If module installation fails, t.Fatal (or similar) is called to halt
+// execution of the test, under the assumption that installation failures are
+// not expected. If installation failures _are_ expected then use
+// NewLoaderForTests and work with the loader object directly. If module
+// installation succeeds but generates warnings, these warnings are discarded.
+//
+// If installation succeeds but errors are detected during loading then a
+// possibly-incomplete config is returned along with error diagnostics. The
+// test run is not aborted in this case, so that the caller can make assertions
+// against the returned diagnostics.
+//
+// As with NewLoaderForTests, a cleanup function is returned which must be
+// called before the test completes in order to remove the temporary
+// modules directory.
+func LoadConfigForTests(t *testing.T, rootDir string) (*configs.Config, *configload.Loader, func(), tfdiags.Diagnostics) {
+        t.Helper()
+
+        var diags tfdiags.Diagnostics
+
+        loader, cleanup := configload.NewLoaderForTests(t)
+        inst := NewModuleInstaller(loader.ModulesDir(), registry.NewClient(nil, nil))
+
+        _, moreDiags := inst.InstallModules(rootDir, true, ModuleInstallHooksImpl{})
+        diags = diags.Append(moreDiags)
+        if diags.HasErrors() {
+                cleanup()
+                t.Fatal(diags.Err())
+                return nil, nil, func() {}, diags
+        }
+
+        // Since module installer has modified the module manifest on disk, we need
+        // to refresh the cache of it in the loader.
+        if err := loader.RefreshModules(); err != nil {
+                t.Fatalf("failed to refresh modules after installation: %s", err)
+        }
+
+        config, hclDiags := loader.LoadConfig(rootDir)
+        diags = diags.Append(hclDiags)
+        return config, loader, cleanup, diags
+}
+
+// MustLoadConfigForTests is a variant of LoadConfigForTests which calls
+// t.Fatal (or similar) if there are any errors during loading, and thus
+// does not return diagnostics at all.
+//
+// This is useful for concisely writing tests that don't expect errors at
+// all. For tests that expect errors and need to assert against them, use
+// LoadConfigForTests instead.
+func MustLoadConfigForTests(t *testing.T, rootDir string) (*configs.Config, *configload.Loader, func()) {
+        t.Helper()
+
+        config, loader, cleanup, diags := LoadConfigForTests(t, rootDir)
+        if diags.HasErrors() {
+                cleanup()
+                t.Fatal(diags.Err())
+        }
+        return config, loader, cleanup
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/version_required.go b/vendor/github.com/hashicorp/terraform/internal/initwd/version_required.go
new file mode 100644
index 0000000..104840b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/version_required.go
@@ -0,0 +1,83 @@
+package initwd
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// CheckCoreVersionRequirements visits each of the modules in the given
+// early configuration tree and verifies that any given Core version constraints
+// match with the version of Terraform Core that is being used.
+//
+// The returned diagnostics will contain errors if any constraints do not match.
+// The returned diagnostics might also return warnings, which should be
+// displayed to the user.
+func CheckCoreVersionRequirements(earlyConfig *earlyconfig.Config) tfdiags.Diagnostics {
+        if earlyConfig == nil {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+        module := earlyConfig.Module
+
+        var constraints version.Constraints
+        for _, constraintStr := range module.RequiredCore {
+                constraint, err := version.NewConstraint(constraintStr)
+                if err != nil {
+                        // Unfortunately the early config parser doesn't preserve a source
+                        // location for this, so we're unable to indicate a specific
+                        // location where this constraint came from, but we can at least
+                        // say which module set it.
+                        switch {
+                        case len(earlyConfig.Path) == 0:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid provider version constraint",
+                                        fmt.Sprintf("Invalid version core constraint %q in the root module.", constraintStr),
+                                ))
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid provider version constraint",
+                                        fmt.Sprintf("Invalid version core constraint %q in %s.", constraintStr, earlyConfig.Path),
+                                ))
+                        }
+                        continue
+                }
+                constraints = append(constraints, constraint...)
+        }
+
+        if !constraints.Check(tfversion.SemVer) {
+                switch {
+                case len(earlyConfig.Path) == 0:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Unsupported Terraform Core version",
+                                fmt.Sprintf(
+                                        "This configuration does not support Terraform version %s. To proceed, either choose another supported Terraform version or update the root module's version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                        tfversion.String(),
+                                ),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Unsupported Terraform Core version",
+                                fmt.Sprintf(
+                                        "Module %s (from %q) does not support Terraform version %s. To proceed, either choose another supported Terraform version or update the module's version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                        earlyConfig.Path, earlyConfig.SourceAddr, tfversion.String(),
+                                ),
+                        ))
+                }
+        }
+
+        for _, c := range earlyConfig.Children {
+                childDiags := CheckCoreVersionRequirements(c)
+                diags = diags.Append(childDiags)
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/modsdir/doc.go b/vendor/github.com/hashicorp/terraform/internal/modsdir/doc.go
new file mode 100644
index 0000000..0d7d664
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/modsdir/doc.go
@@ -0,0 +1,3 @@
+// Package modsdir is an internal package containing the model types used to
+// represent the manifest of modules in a local modules cache directory.
+package modsdir
diff --git a/vendor/github.com/hashicorp/terraform/internal/modsdir/manifest.go b/vendor/github.com/hashicorp/terraform/internal/modsdir/manifest.go
new file mode 100644
index 0000000..36f6c03
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/modsdir/manifest.go
@@ -0,0 +1,138 @@
+package modsdir
+
+import (
+        "encoding/json"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "log"
+        "os"
+        "path/filepath"
+
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Record represents some metadata about an installed module, as part
+// of a ModuleManifest.
+type Record struct {
+        // Key is a unique identifier for this particular module, based on its
+        // position within the static module tree.
+        Key string `json:"Key"`
+
+        // SourceAddr is the source address given for this module in configuration.
+        // This is used only to detect if the source was changed in configuration
+        // since the module was last installed, which means that the installer
+        // must re-install it.
+        SourceAddr string `json:"Source"`
+
+        // Version is the exact version of the module, which results from parsing
+        // VersionStr. nil for un-versioned modules.
+        Version *version.Version `json:"-"`
+
+        // VersionStr is the version specifier string. This is used only for
+        // serialization in snapshots and should not be accessed or updated
+        // by any other codepaths; use "Version" instead.
+        VersionStr string `json:"Version,omitempty"`
+
+        // Dir is the path to the local directory where the module is installed.
+        Dir string `json:"Dir"`
+}
+
+// Manifest is a map used to keep track of the filesystem locations
+// and other metadata about installed modules.
+//
+// The configuration loader refers to this, while the module installer updates
+// it to reflect any changes to the installed modules.
+type Manifest map[string]Record
+
+func (m Manifest) ModuleKey(path addrs.Module) string {
+        return path.String()
+}
+
+// manifestSnapshotFile is an internal struct used only to assist in our JSON
+// serialization of manifest snapshots. It should not be used for any other
+// purpose.
+type manifestSnapshotFile struct {
+        Records []Record `json:"Modules"`
+}
+
+func ReadManifestSnapshot(r io.Reader) (Manifest, error) {
+        src, err := ioutil.ReadAll(r)
+        if err != nil {
+                return nil, err
+        }
+
+        if len(src) == 0 {
+                // This should never happen, but we'll tolerate it as if it were
+                // a valid empty JSON object.
+                return make(Manifest), nil
+        }
+
+        var read manifestSnapshotFile
+        err = json.Unmarshal(src, &read)
+
+        new := make(Manifest)
+        for _, record := range read.Records {
+                if record.VersionStr != "" {
+                        record.Version, err = version.NewVersion(record.VersionStr)
+                        if err != nil {
+                                return nil, fmt.Errorf("invalid version %q for %s: %s", record.VersionStr, record.Key, err)
+                        }
+                }
+                if _, exists := new[record.Key]; exists {
+                        // This should never happen in any valid file, so we'll catch it
+                        // and report it to avoid confusing/undefined behavior if the
+                        // snapshot file was edited incorrectly outside of Terraform.
+                        return nil, fmt.Errorf("snapshot file contains two records for path %s", record.Key)
+                }
+                new[record.Key] = record
+        }
+        return new, nil
+}
+
+func ReadManifestSnapshotForDir(dir string) (Manifest, error) {
+        fn := filepath.Join(dir, ManifestSnapshotFilename)
+        r, err := os.Open(fn)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return make(Manifest), nil // missing file is okay and treated as empty
+                }
+                return nil, err
+        }
+        return ReadManifestSnapshot(r)
+}
+
+func (m Manifest) WriteSnapshot(w io.Writer) error {
+        var write manifestSnapshotFile
+
+        for _, record := range m {
+                // Make sure VersionStr is in sync with Version, since we encourage
+                // callers to manipulate Version and ignore VersionStr.
+                if record.Version != nil {
+                        record.VersionStr = record.Version.String()
+                } else {
+                        record.VersionStr = ""
+                }
+                write.Records = append(write.Records, record)
+        }
+
+        src, err := json.Marshal(write)
+        if err != nil {
+                return err
+        }
+
+        _, err = w.Write(src)
+        return err
+}
+
+func (m Manifest) WriteSnapshotToDir(dir string) error {
+        fn := filepath.Join(dir, ManifestSnapshotFilename)
+        log.Printf("[TRACE] modsdir: writing modules manifest to %s", fn)
+        w, err := os.Create(fn)
+        if err != nil {
+                return err
+        }
+        return m.WriteSnapshot(w)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/modsdir/paths.go b/vendor/github.com/hashicorp/terraform/internal/modsdir/paths.go
new file mode 100644
index 0000000..9ebb524
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/modsdir/paths.go
@@ -0,0 +1,3 @@
+package modsdir
+
+const ManifestSnapshotFilename = "modules.json"
diff --git a/vendor/github.com/hashicorp/terraform/internal/tfplugin5/generate.sh b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/generate.sh
new file mode 100644
index 0000000..de1d693
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/generate.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# We do not run protoc under go:generate because we want to ensure that all
+# dependencies of go:generate are "go get"-able for general dev environment
+# usability. To compile all protobuf files in this repository, run
+# "make protobuf" at the top-level.
+
+set -eu
+
+SOURCE="${BASH_SOURCE[0]}"
+while [ -h "$SOURCE" ] ; do SOURCE="$(readlink "$SOURCE")"; done
+DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
+
+cd "$DIR"
+
+protoc -I ./ tfplugin5.proto --go_out=plugins=grpc:./
diff --git a/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.pb.go b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.pb.go
new file mode 100644
index 0000000..87a6bec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.pb.go
@@ -0,0 +1,3455 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: tfplugin5.proto
+
+package tfplugin5
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import (
+        context "golang.org/x/net/context"
+        grpc "google.golang.org/grpc"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+type Diagnostic_Severity int32
+
+const (
+        Diagnostic_INVALID Diagnostic_Severity = 0
+        Diagnostic_ERROR   Diagnostic_Severity = 1
+        Diagnostic_WARNING Diagnostic_Severity = 2
+)
+
+var Diagnostic_Severity_name = map[int32]string{
+        0: "INVALID",
+        1: "ERROR",
+        2: "WARNING",
+}
+var Diagnostic_Severity_value = map[string]int32{
+        "INVALID": 0,
+        "ERROR":   1,
+        "WARNING": 2,
+}
+
+func (x Diagnostic_Severity) String() string {
+        return proto.EnumName(Diagnostic_Severity_name, int32(x))
+}
+func (Diagnostic_Severity) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{1, 0}
+}
+
+type Schema_NestedBlock_NestingMode int32
+
+const (
+        Schema_NestedBlock_INVALID Schema_NestedBlock_NestingMode = 0
+        Schema_NestedBlock_SINGLE  Schema_NestedBlock_NestingMode = 1
+        Schema_NestedBlock_LIST    Schema_NestedBlock_NestingMode = 2
+        Schema_NestedBlock_SET     Schema_NestedBlock_NestingMode = 3
+        Schema_NestedBlock_MAP     Schema_NestedBlock_NestingMode = 4
+        Schema_NestedBlock_GROUP   Schema_NestedBlock_NestingMode = 5
+)
+
+var Schema_NestedBlock_NestingMode_name = map[int32]string{
+        0: "INVALID",
+        1: "SINGLE",
+        2: "LIST",
+        3: "SET",
+        4: "MAP",
+        5: "GROUP",
+}
+var Schema_NestedBlock_NestingMode_value = map[string]int32{
+        "INVALID": 0,
+        "SINGLE":  1,
+        "LIST":    2,
+        "SET":     3,
+        "MAP":     4,
+        "GROUP":   5,
+}
+
+func (x Schema_NestedBlock_NestingMode) String() string {
+        return proto.EnumName(Schema_NestedBlock_NestingMode_name, int32(x))
+}
+func (Schema_NestedBlock_NestingMode) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 2, 0}
+}
+
+// DynamicValue is an opaque encoding of terraform data, with the field name
+// indicating the encoding scheme used.
+type DynamicValue struct {
+        Msgpack              []byte   `protobuf:"bytes,1,opt,name=msgpack,proto3" json:"msgpack,omitempty"`
+        Json                 []byte   `protobuf:"bytes,2,opt,name=json,proto3" json:"json,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *DynamicValue) Reset()         { *m = DynamicValue{} }
+func (m *DynamicValue) String() string { return proto.CompactTextString(m) }
+func (*DynamicValue) ProtoMessage()    {}
+func (*DynamicValue) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{0}
+}
+func (m *DynamicValue) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_DynamicValue.Unmarshal(m, b)
+}
+func (m *DynamicValue) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_DynamicValue.Marshal(b, m, deterministic)
+}
+func (dst *DynamicValue) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_DynamicValue.Merge(dst, src)
+}
+func (m *DynamicValue) XXX_Size() int {
+        return xxx_messageInfo_DynamicValue.Size(m)
+}
+func (m *DynamicValue) XXX_DiscardUnknown() {
+        xxx_messageInfo_DynamicValue.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_DynamicValue proto.InternalMessageInfo
+
+func (m *DynamicValue) GetMsgpack() []byte {
+        if m != nil {
+                return m.Msgpack
+        }
+        return nil
+}
+
+func (m *DynamicValue) GetJson() []byte {
+        if m != nil {
+                return m.Json
+        }
+        return nil
+}
+
+type Diagnostic struct {
+        Severity             Diagnostic_Severity `protobuf:"varint,1,opt,name=severity,proto3,enum=tfplugin5.Diagnostic_Severity" json:"severity,omitempty"`
+        Summary              string              `protobuf:"bytes,2,opt,name=summary,proto3" json:"summary,omitempty"`
+        Detail               string              `protobuf:"bytes,3,opt,name=detail,proto3" json:"detail,omitempty"`
+        Attribute            *AttributePath      `protobuf:"bytes,4,opt,name=attribute,proto3" json:"attribute,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}            `json:"-"`
+        XXX_unrecognized     []byte              `json:"-"`
+        XXX_sizecache        int32               `json:"-"`
+}
+
+func (m *Diagnostic) Reset()         { *m = Diagnostic{} }
+func (m *Diagnostic) String() string { return proto.CompactTextString(m) }
+func (*Diagnostic) ProtoMessage()    {}
+func (*Diagnostic) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{1}
+}
+func (m *Diagnostic) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Diagnostic.Unmarshal(m, b)
+}
+func (m *Diagnostic) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Diagnostic.Marshal(b, m, deterministic)
+}
+func (dst *Diagnostic) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Diagnostic.Merge(dst, src)
+}
+func (m *Diagnostic) XXX_Size() int {
+        return xxx_messageInfo_Diagnostic.Size(m)
+}
+func (m *Diagnostic) XXX_DiscardUnknown() {
+        xxx_messageInfo_Diagnostic.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Diagnostic proto.InternalMessageInfo
+
+func (m *Diagnostic) GetSeverity() Diagnostic_Severity {
+        if m != nil {
+                return m.Severity
+        }
+        return Diagnostic_INVALID
+}
+
+func (m *Diagnostic) GetSummary() string {
+        if m != nil {
+                return m.Summary
+        }
+        return ""
+}
+
+func (m *Diagnostic) GetDetail() string {
+        if m != nil {
+                return m.Detail
+        }
+        return ""
+}
+
+func (m *Diagnostic) GetAttribute() *AttributePath {
+        if m != nil {
+                return m.Attribute
+        }
+        return nil
+}
+
+type AttributePath struct {
+        Steps                []*AttributePath_Step `protobuf:"bytes,1,rep,name=steps,proto3" json:"steps,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}              `json:"-"`
+        XXX_unrecognized     []byte                `json:"-"`
+        XXX_sizecache        int32                 `json:"-"`
+}
+
+func (m *AttributePath) Reset()         { *m = AttributePath{} }
+func (m *AttributePath) String() string { return proto.CompactTextString(m) }
+func (*AttributePath) ProtoMessage()    {}
+func (*AttributePath) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{2}
+}
+func (m *AttributePath) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_AttributePath.Unmarshal(m, b)
+}
+func (m *AttributePath) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_AttributePath.Marshal(b, m, deterministic)
+}
+func (dst *AttributePath) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_AttributePath.Merge(dst, src)
+}
+func (m *AttributePath) XXX_Size() int {
+        return xxx_messageInfo_AttributePath.Size(m)
+}
+func (m *AttributePath) XXX_DiscardUnknown() {
+        xxx_messageInfo_AttributePath.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AttributePath proto.InternalMessageInfo
+
+func (m *AttributePath) GetSteps() []*AttributePath_Step {
+        if m != nil {
+                return m.Steps
+        }
+        return nil
+}
+
+type AttributePath_Step struct {
+        // Types that are valid to be assigned to Selector:
+        //      *AttributePath_Step_AttributeName
+        //      *AttributePath_Step_ElementKeyString
+        //      *AttributePath_Step_ElementKeyInt
+        Selector             isAttributePath_Step_Selector `protobuf_oneof:"selector"`
+        XXX_NoUnkeyedLiteral struct{}                      `json:"-"`
+        XXX_unrecognized     []byte                        `json:"-"`
+        XXX_sizecache        int32                         `json:"-"`
+}
+
+func (m *AttributePath_Step) Reset()         { *m = AttributePath_Step{} }
+func (m *AttributePath_Step) String() string { return proto.CompactTextString(m) }
+func (*AttributePath_Step) ProtoMessage()    {}
+func (*AttributePath_Step) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{2, 0}
+}
+func (m *AttributePath_Step) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_AttributePath_Step.Unmarshal(m, b)
+}
+func (m *AttributePath_Step) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_AttributePath_Step.Marshal(b, m, deterministic)
+}
+func (dst *AttributePath_Step) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_AttributePath_Step.Merge(dst, src)
+}
+func (m *AttributePath_Step) XXX_Size() int {
+        return xxx_messageInfo_AttributePath_Step.Size(m)
+}
+func (m *AttributePath_Step) XXX_DiscardUnknown() {
+        xxx_messageInfo_AttributePath_Step.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AttributePath_Step proto.InternalMessageInfo
+
+type isAttributePath_Step_Selector interface {
+        isAttributePath_Step_Selector()
+}
+
+type AttributePath_Step_AttributeName struct {
+        AttributeName string `protobuf:"bytes,1,opt,name=attribute_name,json=attributeName,proto3,oneof"`
+}
+
+type AttributePath_Step_ElementKeyString struct {
+        ElementKeyString string `protobuf:"bytes,2,opt,name=element_key_string,json=elementKeyString,proto3,oneof"`
+}
+
+type AttributePath_Step_ElementKeyInt struct {
+        ElementKeyInt int64 `protobuf:"varint,3,opt,name=element_key_int,json=elementKeyInt,proto3,oneof"`
+}
+
+func (*AttributePath_Step_AttributeName) isAttributePath_Step_Selector() {}
+
+func (*AttributePath_Step_ElementKeyString) isAttributePath_Step_Selector() {}
+
+func (*AttributePath_Step_ElementKeyInt) isAttributePath_Step_Selector() {}
+
+func (m *AttributePath_Step) GetSelector() isAttributePath_Step_Selector {
+        if m != nil {
+                return m.Selector
+        }
+        return nil
+}
+
+func (m *AttributePath_Step) GetAttributeName() string {
+        if x, ok := m.GetSelector().(*AttributePath_Step_AttributeName); ok {
+                return x.AttributeName
+        }
+        return ""
+}
+
+func (m *AttributePath_Step) GetElementKeyString() string {
+        if x, ok := m.GetSelector().(*AttributePath_Step_ElementKeyString); ok {
+                return x.ElementKeyString
+        }
+        return ""
+}
+
+func (m *AttributePath_Step) GetElementKeyInt() int64 {
+        if x, ok := m.GetSelector().(*AttributePath_Step_ElementKeyInt); ok {
+                return x.ElementKeyInt
+        }
+        return 0
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*AttributePath_Step) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+        return _AttributePath_Step_OneofMarshaler, _AttributePath_Step_OneofUnmarshaler, _AttributePath_Step_OneofSizer, []interface{}{
+                (*AttributePath_Step_AttributeName)(nil),
+                (*AttributePath_Step_ElementKeyString)(nil),
+                (*AttributePath_Step_ElementKeyInt)(nil),
+        }
+}
+
+func _AttributePath_Step_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+        m := msg.(*AttributePath_Step)
+        // selector
+        switch x := m.Selector.(type) {
+        case *AttributePath_Step_AttributeName:
+                b.EncodeVarint(1<<3 | proto.WireBytes)
+                b.EncodeStringBytes(x.AttributeName)
+        case *AttributePath_Step_ElementKeyString:
+                b.EncodeVarint(2<<3 | proto.WireBytes)
+                b.EncodeStringBytes(x.ElementKeyString)
+        case *AttributePath_Step_ElementKeyInt:
+                b.EncodeVarint(3<<3 | proto.WireVarint)
+                b.EncodeVarint(uint64(x.ElementKeyInt))
+        case nil:
+        default:
+                return fmt.Errorf("AttributePath_Step.Selector has unexpected type %T", x)
+        }
+        return nil
+}
+
+func _AttributePath_Step_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+        m := msg.(*AttributePath_Step)
+        switch tag {
+        case 1: // selector.attribute_name
+                if wire != proto.WireBytes {
+                        return true, proto.ErrInternalBadWireType
+                }
+                x, err := b.DecodeStringBytes()
+                m.Selector = &AttributePath_Step_AttributeName{x}
+                return true, err
+        case 2: // selector.element_key_string
+                if wire != proto.WireBytes {
+                        return true, proto.ErrInternalBadWireType
+                }
+                x, err := b.DecodeStringBytes()
+                m.Selector = &AttributePath_Step_ElementKeyString{x}
+                return true, err
+        case 3: // selector.element_key_int
+                if wire != proto.WireVarint {
+                        return true, proto.ErrInternalBadWireType
+                }
+                x, err := b.DecodeVarint()
+                m.Selector = &AttributePath_Step_ElementKeyInt{int64(x)}
+                return true, err
+        default:
+                return false, nil
+        }
+}
+
+func _AttributePath_Step_OneofSizer(msg proto.Message) (n int) {
+        m := msg.(*AttributePath_Step)
+        // selector
+        switch x := m.Selector.(type) {
+        case *AttributePath_Step_AttributeName:
+                n += 1 // tag and wire
+                n += proto.SizeVarint(uint64(len(x.AttributeName)))
+                n += len(x.AttributeName)
+        case *AttributePath_Step_ElementKeyString:
+                n += 1 // tag and wire
+                n += proto.SizeVarint(uint64(len(x.ElementKeyString)))
+                n += len(x.ElementKeyString)
+        case *AttributePath_Step_ElementKeyInt:
+                n += 1 // tag and wire
+                n += proto.SizeVarint(uint64(x.ElementKeyInt))
+        case nil:
+        default:
+                panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+        }
+        return n
+}
+
+type Stop struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Stop) Reset()         { *m = Stop{} }
+func (m *Stop) String() string { return proto.CompactTextString(m) }
+func (*Stop) ProtoMessage()    {}
+func (*Stop) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{3}
+}
+func (m *Stop) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Stop.Unmarshal(m, b)
+}
+func (m *Stop) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Stop.Marshal(b, m, deterministic)
+}
+func (dst *Stop) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Stop.Merge(dst, src)
+}
+func (m *Stop) XXX_Size() int {
+        return xxx_messageInfo_Stop.Size(m)
+}
+func (m *Stop) XXX_DiscardUnknown() {
+        xxx_messageInfo_Stop.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Stop proto.InternalMessageInfo
+
+type Stop_Request struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Stop_Request) Reset()         { *m = Stop_Request{} }
+func (m *Stop_Request) String() string { return proto.CompactTextString(m) }
+func (*Stop_Request) ProtoMessage()    {}
+func (*Stop_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{3, 0}
+}
+func (m *Stop_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Stop_Request.Unmarshal(m, b)
+}
+func (m *Stop_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Stop_Request.Marshal(b, m, deterministic)
+}
+func (dst *Stop_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Stop_Request.Merge(dst, src)
+}
+func (m *Stop_Request) XXX_Size() int {
+        return xxx_messageInfo_Stop_Request.Size(m)
+}
+func (m *Stop_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_Stop_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Stop_Request proto.InternalMessageInfo
+
+type Stop_Response struct {
+        Error                string   `protobuf:"bytes,1,opt,name=Error,proto3" json:"Error,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Stop_Response) Reset()         { *m = Stop_Response{} }
+func (m *Stop_Response) String() string { return proto.CompactTextString(m) }
+func (*Stop_Response) ProtoMessage()    {}
+func (*Stop_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{3, 1}
+}
+func (m *Stop_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Stop_Response.Unmarshal(m, b)
+}
+func (m *Stop_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Stop_Response.Marshal(b, m, deterministic)
+}
+func (dst *Stop_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Stop_Response.Merge(dst, src)
+}
+func (m *Stop_Response) XXX_Size() int {
+        return xxx_messageInfo_Stop_Response.Size(m)
+}
+func (m *Stop_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_Stop_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Stop_Response proto.InternalMessageInfo
+
+func (m *Stop_Response) GetError() string {
+        if m != nil {
+                return m.Error
+        }
+        return ""
+}
+
+// RawState holds the stored state for a resource to be upgraded by the
+// provider. It can be in one of two formats, the current json encoded format
+// in bytes, or the legacy flatmap format as a map of strings.
+type RawState struct {
+        Json                 []byte            `protobuf:"bytes,1,opt,name=json,proto3" json:"json,omitempty"`
+        Flatmap              map[string]string `protobuf:"bytes,2,rep,name=flatmap,proto3" json:"flatmap,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+        XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+        XXX_unrecognized     []byte            `json:"-"`
+        XXX_sizecache        int32             `json:"-"`
+}
+
+func (m *RawState) Reset()         { *m = RawState{} }
+func (m *RawState) String() string { return proto.CompactTextString(m) }
+func (*RawState) ProtoMessage()    {}
+func (*RawState) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{4}
+}
+func (m *RawState) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_RawState.Unmarshal(m, b)
+}
+func (m *RawState) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_RawState.Marshal(b, m, deterministic)
+}
+func (dst *RawState) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_RawState.Merge(dst, src)
+}
+func (m *RawState) XXX_Size() int {
+        return xxx_messageInfo_RawState.Size(m)
+}
+func (m *RawState) XXX_DiscardUnknown() {
+        xxx_messageInfo_RawState.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RawState proto.InternalMessageInfo
+
+func (m *RawState) GetJson() []byte {
+        if m != nil {
+                return m.Json
+        }
+        return nil
+}
+
+func (m *RawState) GetFlatmap() map[string]string {
+        if m != nil {
+                return m.Flatmap
+        }
+        return nil
+}
+
+// Schema is the configuration schema for a Resource, Provider, or Provisioner.
+type Schema struct {
+        // The version of the schema.
+        // Schemas are versioned, so that providers can upgrade a saved resource
+        // state when the schema is changed.
+        Version int64 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+        // Block is the top level configuration block for this schema.
+        Block                *Schema_Block `protobuf:"bytes,2,opt,name=block,proto3" json:"block,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *Schema) Reset()         { *m = Schema{} }
+func (m *Schema) String() string { return proto.CompactTextString(m) }
+func (*Schema) ProtoMessage()    {}
+func (*Schema) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5}
+}
+func (m *Schema) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema.Unmarshal(m, b)
+}
+func (m *Schema) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema.Marshal(b, m, deterministic)
+}
+func (dst *Schema) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema.Merge(dst, src)
+}
+func (m *Schema) XXX_Size() int {
+        return xxx_messageInfo_Schema.Size(m)
+}
+func (m *Schema) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema proto.InternalMessageInfo
+
+func (m *Schema) GetVersion() int64 {
+        if m != nil {
+                return m.Version
+        }
+        return 0
+}
+
+func (m *Schema) GetBlock() *Schema_Block {
+        if m != nil {
+                return m.Block
+        }
+        return nil
+}
+
+type Schema_Block struct {
+        Version              int64                 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+        Attributes           []*Schema_Attribute   `protobuf:"bytes,2,rep,name=attributes,proto3" json:"attributes,omitempty"`
+        BlockTypes           []*Schema_NestedBlock `protobuf:"bytes,3,rep,name=block_types,json=blockTypes,proto3" json:"block_types,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}              `json:"-"`
+        XXX_unrecognized     []byte                `json:"-"`
+        XXX_sizecache        int32                 `json:"-"`
+}
+
+func (m *Schema_Block) Reset()         { *m = Schema_Block{} }
+func (m *Schema_Block) String() string { return proto.CompactTextString(m) }
+func (*Schema_Block) ProtoMessage()    {}
+func (*Schema_Block) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 0}
+}
+func (m *Schema_Block) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema_Block.Unmarshal(m, b)
+}
+func (m *Schema_Block) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema_Block.Marshal(b, m, deterministic)
+}
+func (dst *Schema_Block) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema_Block.Merge(dst, src)
+}
+func (m *Schema_Block) XXX_Size() int {
+        return xxx_messageInfo_Schema_Block.Size(m)
+}
+func (m *Schema_Block) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema_Block.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema_Block proto.InternalMessageInfo
+
+func (m *Schema_Block) GetVersion() int64 {
+        if m != nil {
+                return m.Version
+        }
+        return 0
+}
+
+func (m *Schema_Block) GetAttributes() []*Schema_Attribute {
+        if m != nil {
+                return m.Attributes
+        }
+        return nil
+}
+
+func (m *Schema_Block) GetBlockTypes() []*Schema_NestedBlock {
+        if m != nil {
+                return m.BlockTypes
+        }
+        return nil
+}
+
+type Schema_Attribute struct {
+        Name                 string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+        Type                 []byte   `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+        Description          string   `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+        Required             bool     `protobuf:"varint,4,opt,name=required,proto3" json:"required,omitempty"`
+        Optional             bool     `protobuf:"varint,5,opt,name=optional,proto3" json:"optional,omitempty"`
+        Computed             bool     `protobuf:"varint,6,opt,name=computed,proto3" json:"computed,omitempty"`
+        Sensitive            bool     `protobuf:"varint,7,opt,name=sensitive,proto3" json:"sensitive,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Schema_Attribute) Reset()         { *m = Schema_Attribute{} }
+func (m *Schema_Attribute) String() string { return proto.CompactTextString(m) }
+func (*Schema_Attribute) ProtoMessage()    {}
+func (*Schema_Attribute) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 1}
+}
+func (m *Schema_Attribute) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema_Attribute.Unmarshal(m, b)
+}
+func (m *Schema_Attribute) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema_Attribute.Marshal(b, m, deterministic)
+}
+func (dst *Schema_Attribute) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema_Attribute.Merge(dst, src)
+}
+func (m *Schema_Attribute) XXX_Size() int {
+        return xxx_messageInfo_Schema_Attribute.Size(m)
+}
+func (m *Schema_Attribute) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema_Attribute.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema_Attribute proto.InternalMessageInfo
+
+func (m *Schema_Attribute) GetName() string {
+        if m != nil {
+                return m.Name
+        }
+        return ""
+}
+
+func (m *Schema_Attribute) GetType() []byte {
+        if m != nil {
+                return m.Type
+        }
+        return nil
+}
+
+func (m *Schema_Attribute) GetDescription() string {
+        if m != nil {
+                return m.Description
+        }
+        return ""
+}
+
+func (m *Schema_Attribute) GetRequired() bool {
+        if m != nil {
+                return m.Required
+        }
+        return false
+}
+
+func (m *Schema_Attribute) GetOptional() bool {
+        if m != nil {
+                return m.Optional
+        }
+        return false
+}
+
+func (m *Schema_Attribute) GetComputed() bool {
+        if m != nil {
+                return m.Computed
+        }
+        return false
+}
+
+func (m *Schema_Attribute) GetSensitive() bool {
+        if m != nil {
+                return m.Sensitive
+        }
+        return false
+}
+
+type Schema_NestedBlock struct {
+        TypeName             string                         `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Block                *Schema_Block                  `protobuf:"bytes,2,opt,name=block,proto3" json:"block,omitempty"`
+        Nesting              Schema_NestedBlock_NestingMode `protobuf:"varint,3,opt,name=nesting,proto3,enum=tfplugin5.Schema_NestedBlock_NestingMode" json:"nesting,omitempty"`
+        MinItems             int64                          `protobuf:"varint,4,opt,name=min_items,json=minItems,proto3" json:"min_items,omitempty"`
+        MaxItems             int64                          `protobuf:"varint,5,opt,name=max_items,json=maxItems,proto3" json:"max_items,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}                       `json:"-"`
+        XXX_unrecognized     []byte                         `json:"-"`
+        XXX_sizecache        int32                          `json:"-"`
+}
+
+func (m *Schema_NestedBlock) Reset()         { *m = Schema_NestedBlock{} }
+func (m *Schema_NestedBlock) String() string { return proto.CompactTextString(m) }
+func (*Schema_NestedBlock) ProtoMessage()    {}
+func (*Schema_NestedBlock) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 2}
+}
+func (m *Schema_NestedBlock) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema_NestedBlock.Unmarshal(m, b)
+}
+func (m *Schema_NestedBlock) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema_NestedBlock.Marshal(b, m, deterministic)
+}
+func (dst *Schema_NestedBlock) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema_NestedBlock.Merge(dst, src)
+}
+func (m *Schema_NestedBlock) XXX_Size() int {
+        return xxx_messageInfo_Schema_NestedBlock.Size(m)
+}
+func (m *Schema_NestedBlock) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema_NestedBlock.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema_NestedBlock proto.InternalMessageInfo
+
+func (m *Schema_NestedBlock) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *Schema_NestedBlock) GetBlock() *Schema_Block {
+        if m != nil {
+                return m.Block
+        }
+        return nil
+}
+
+func (m *Schema_NestedBlock) GetNesting() Schema_NestedBlock_NestingMode {
+        if m != nil {
+                return m.Nesting
+        }
+        return Schema_NestedBlock_INVALID
+}
+
+func (m *Schema_NestedBlock) GetMinItems() int64 {
+        if m != nil {
+                return m.MinItems
+        }
+        return 0
+}
+
+func (m *Schema_NestedBlock) GetMaxItems() int64 {
+        if m != nil {
+                return m.MaxItems
+        }
+        return 0
+}
+
+type GetProviderSchema struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProviderSchema) Reset()         { *m = GetProviderSchema{} }
+func (m *GetProviderSchema) String() string { return proto.CompactTextString(m) }
+func (*GetProviderSchema) ProtoMessage()    {}
+func (*GetProviderSchema) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{6}
+}
+func (m *GetProviderSchema) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProviderSchema.Unmarshal(m, b)
+}
+func (m *GetProviderSchema) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProviderSchema.Marshal(b, m, deterministic)
+}
+func (dst *GetProviderSchema) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProviderSchema.Merge(dst, src)
+}
+func (m *GetProviderSchema) XXX_Size() int {
+        return xxx_messageInfo_GetProviderSchema.Size(m)
+}
+func (m *GetProviderSchema) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProviderSchema.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProviderSchema proto.InternalMessageInfo
+
+type GetProviderSchema_Request struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProviderSchema_Request) Reset()         { *m = GetProviderSchema_Request{} }
+func (m *GetProviderSchema_Request) String() string { return proto.CompactTextString(m) }
+func (*GetProviderSchema_Request) ProtoMessage()    {}
+func (*GetProviderSchema_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{6, 0}
+}
+func (m *GetProviderSchema_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProviderSchema_Request.Unmarshal(m, b)
+}
+func (m *GetProviderSchema_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProviderSchema_Request.Marshal(b, m, deterministic)
+}
+func (dst *GetProviderSchema_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProviderSchema_Request.Merge(dst, src)
+}
+func (m *GetProviderSchema_Request) XXX_Size() int {
+        return xxx_messageInfo_GetProviderSchema_Request.Size(m)
+}
+func (m *GetProviderSchema_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProviderSchema_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProviderSchema_Request proto.InternalMessageInfo
+
+type GetProviderSchema_Response struct {
+        Provider             *Schema            `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
+        ResourceSchemas      map[string]*Schema `protobuf:"bytes,2,rep,name=resource_schemas,json=resourceSchemas,proto3" json:"resource_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+        DataSourceSchemas    map[string]*Schema `protobuf:"bytes,3,rep,name=data_source_schemas,json=dataSourceSchemas,proto3" json:"data_source_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+        Diagnostics          []*Diagnostic      `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}           `json:"-"`
+        XXX_unrecognized     []byte             `json:"-"`
+        XXX_sizecache        int32              `json:"-"`
+}
+
+func (m *GetProviderSchema_Response) Reset()         { *m = GetProviderSchema_Response{} }
+func (m *GetProviderSchema_Response) String() string { return proto.CompactTextString(m) }
+func (*GetProviderSchema_Response) ProtoMessage()    {}
+func (*GetProviderSchema_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{6, 1}
+}
+func (m *GetProviderSchema_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProviderSchema_Response.Unmarshal(m, b)
+}
+func (m *GetProviderSchema_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProviderSchema_Response.Marshal(b, m, deterministic)
+}
+func (dst *GetProviderSchema_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProviderSchema_Response.Merge(dst, src)
+}
+func (m *GetProviderSchema_Response) XXX_Size() int {
+        return xxx_messageInfo_GetProviderSchema_Response.Size(m)
+}
+func (m *GetProviderSchema_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProviderSchema_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProviderSchema_Response proto.InternalMessageInfo
+
+func (m *GetProviderSchema_Response) GetProvider() *Schema {
+        if m != nil {
+                return m.Provider
+        }
+        return nil
+}
+
+func (m *GetProviderSchema_Response) GetResourceSchemas() map[string]*Schema {
+        if m != nil {
+                return m.ResourceSchemas
+        }
+        return nil
+}
+
+func (m *GetProviderSchema_Response) GetDataSourceSchemas() map[string]*Schema {
+        if m != nil {
+                return m.DataSourceSchemas
+        }
+        return nil
+}
+
+func (m *GetProviderSchema_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type PrepareProviderConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PrepareProviderConfig) Reset()         { *m = PrepareProviderConfig{} }
+func (m *PrepareProviderConfig) String() string { return proto.CompactTextString(m) }
+func (*PrepareProviderConfig) ProtoMessage()    {}
+func (*PrepareProviderConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{7}
+}
+func (m *PrepareProviderConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PrepareProviderConfig.Unmarshal(m, b)
+}
+func (m *PrepareProviderConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PrepareProviderConfig.Marshal(b, m, deterministic)
+}
+func (dst *PrepareProviderConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PrepareProviderConfig.Merge(dst, src)
+}
+func (m *PrepareProviderConfig) XXX_Size() int {
+        return xxx_messageInfo_PrepareProviderConfig.Size(m)
+}
+func (m *PrepareProviderConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_PrepareProviderConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PrepareProviderConfig proto.InternalMessageInfo
+
+type PrepareProviderConfig_Request struct {
+        Config               *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *PrepareProviderConfig_Request) Reset()         { *m = PrepareProviderConfig_Request{} }
+func (m *PrepareProviderConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*PrepareProviderConfig_Request) ProtoMessage()    {}
+func (*PrepareProviderConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{7, 0}
+}
+func (m *PrepareProviderConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PrepareProviderConfig_Request.Unmarshal(m, b)
+}
+func (m *PrepareProviderConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PrepareProviderConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *PrepareProviderConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PrepareProviderConfig_Request.Merge(dst, src)
+}
+func (m *PrepareProviderConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_PrepareProviderConfig_Request.Size(m)
+}
+func (m *PrepareProviderConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_PrepareProviderConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PrepareProviderConfig_Request proto.InternalMessageInfo
+
+func (m *PrepareProviderConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type PrepareProviderConfig_Response struct {
+        PreparedConfig       *DynamicValue `protobuf:"bytes,1,opt,name=prepared_config,json=preparedConfig,proto3" json:"prepared_config,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *PrepareProviderConfig_Response) Reset()         { *m = PrepareProviderConfig_Response{} }
+func (m *PrepareProviderConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*PrepareProviderConfig_Response) ProtoMessage()    {}
+func (*PrepareProviderConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{7, 1}
+}
+func (m *PrepareProviderConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PrepareProviderConfig_Response.Unmarshal(m, b)
+}
+func (m *PrepareProviderConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PrepareProviderConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *PrepareProviderConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PrepareProviderConfig_Response.Merge(dst, src)
+}
+func (m *PrepareProviderConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_PrepareProviderConfig_Response.Size(m)
+}
+func (m *PrepareProviderConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_PrepareProviderConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PrepareProviderConfig_Response proto.InternalMessageInfo
+
+func (m *PrepareProviderConfig_Response) GetPreparedConfig() *DynamicValue {
+        if m != nil {
+                return m.PreparedConfig
+        }
+        return nil
+}
+
+func (m *PrepareProviderConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type UpgradeResourceState struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *UpgradeResourceState) Reset()         { *m = UpgradeResourceState{} }
+func (m *UpgradeResourceState) String() string { return proto.CompactTextString(m) }
+func (*UpgradeResourceState) ProtoMessage()    {}
+func (*UpgradeResourceState) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{8}
+}
+func (m *UpgradeResourceState) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UpgradeResourceState.Unmarshal(m, b)
+}
+func (m *UpgradeResourceState) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UpgradeResourceState.Marshal(b, m, deterministic)
+}
+func (dst *UpgradeResourceState) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UpgradeResourceState.Merge(dst, src)
+}
+func (m *UpgradeResourceState) XXX_Size() int {
+        return xxx_messageInfo_UpgradeResourceState.Size(m)
+}
+func (m *UpgradeResourceState) XXX_DiscardUnknown() {
+        xxx_messageInfo_UpgradeResourceState.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UpgradeResourceState proto.InternalMessageInfo
+
+type UpgradeResourceState_Request struct {
+        TypeName string `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        // version is the schema_version number recorded in the state file
+        Version int64 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
+        // raw_state is the raw states as stored for the resource.  Core does
+        // not have access to the schema of prior_version, so it's the
+        // provider's responsibility to interpret this value using the
+        // appropriate older schema. The raw_state will be the json encoded
+        // state, or a legacy flat-mapped format.
+        RawState             *RawState `protobuf:"bytes,3,opt,name=raw_state,json=rawState,proto3" json:"raw_state,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}  `json:"-"`
+        XXX_unrecognized     []byte    `json:"-"`
+        XXX_sizecache        int32     `json:"-"`
+}
+
+func (m *UpgradeResourceState_Request) Reset()         { *m = UpgradeResourceState_Request{} }
+func (m *UpgradeResourceState_Request) String() string { return proto.CompactTextString(m) }
+func (*UpgradeResourceState_Request) ProtoMessage()    {}
+func (*UpgradeResourceState_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{8, 0}
+}
+func (m *UpgradeResourceState_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UpgradeResourceState_Request.Unmarshal(m, b)
+}
+func (m *UpgradeResourceState_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UpgradeResourceState_Request.Marshal(b, m, deterministic)
+}
+func (dst *UpgradeResourceState_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UpgradeResourceState_Request.Merge(dst, src)
+}
+func (m *UpgradeResourceState_Request) XXX_Size() int {
+        return xxx_messageInfo_UpgradeResourceState_Request.Size(m)
+}
+func (m *UpgradeResourceState_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_UpgradeResourceState_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UpgradeResourceState_Request proto.InternalMessageInfo
+
+func (m *UpgradeResourceState_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *UpgradeResourceState_Request) GetVersion() int64 {
+        if m != nil {
+                return m.Version
+        }
+        return 0
+}
+
+func (m *UpgradeResourceState_Request) GetRawState() *RawState {
+        if m != nil {
+                return m.RawState
+        }
+        return nil
+}
+
+type UpgradeResourceState_Response struct {
+        // new_state is a msgpack-encoded data structure that, when interpreted with
+        // the _current_ schema for this resource type, is functionally equivalent to
+        // that which was given in prior_state_raw.
+        UpgradedState *DynamicValue `protobuf:"bytes,1,opt,name=upgraded_state,json=upgradedState,proto3" json:"upgraded_state,omitempty"`
+        // diagnostics describes any errors encountered during migration that could not
+        // be safely resolved, and warnings about any possibly-risky assumptions made
+        // in the upgrade process.
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *UpgradeResourceState_Response) Reset()         { *m = UpgradeResourceState_Response{} }
+func (m *UpgradeResourceState_Response) String() string { return proto.CompactTextString(m) }
+func (*UpgradeResourceState_Response) ProtoMessage()    {}
+func (*UpgradeResourceState_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{8, 1}
+}
+func (m *UpgradeResourceState_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UpgradeResourceState_Response.Unmarshal(m, b)
+}
+func (m *UpgradeResourceState_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UpgradeResourceState_Response.Marshal(b, m, deterministic)
+}
+func (dst *UpgradeResourceState_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UpgradeResourceState_Response.Merge(dst, src)
+}
+func (m *UpgradeResourceState_Response) XXX_Size() int {
+        return xxx_messageInfo_UpgradeResourceState_Response.Size(m)
+}
+func (m *UpgradeResourceState_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_UpgradeResourceState_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UpgradeResourceState_Response proto.InternalMessageInfo
+
+func (m *UpgradeResourceState_Response) GetUpgradedState() *DynamicValue {
+        if m != nil {
+                return m.UpgradedState
+        }
+        return nil
+}
+
+func (m *UpgradeResourceState_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ValidateResourceTypeConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ValidateResourceTypeConfig) Reset()         { *m = ValidateResourceTypeConfig{} }
+func (m *ValidateResourceTypeConfig) String() string { return proto.CompactTextString(m) }
+func (*ValidateResourceTypeConfig) ProtoMessage()    {}
+func (*ValidateResourceTypeConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{9}
+}
+func (m *ValidateResourceTypeConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateResourceTypeConfig.Unmarshal(m, b)
+}
+func (m *ValidateResourceTypeConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateResourceTypeConfig.Marshal(b, m, deterministic)
+}
+func (dst *ValidateResourceTypeConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateResourceTypeConfig.Merge(dst, src)
+}
+func (m *ValidateResourceTypeConfig) XXX_Size() int {
+        return xxx_messageInfo_ValidateResourceTypeConfig.Size(m)
+}
+func (m *ValidateResourceTypeConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateResourceTypeConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateResourceTypeConfig proto.InternalMessageInfo
+
+type ValidateResourceTypeConfig_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateResourceTypeConfig_Request) Reset()         { *m = ValidateResourceTypeConfig_Request{} }
+func (m *ValidateResourceTypeConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*ValidateResourceTypeConfig_Request) ProtoMessage()    {}
+func (*ValidateResourceTypeConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{9, 0}
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Request.Unmarshal(m, b)
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *ValidateResourceTypeConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateResourceTypeConfig_Request.Merge(dst, src)
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Request.Size(m)
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateResourceTypeConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateResourceTypeConfig_Request proto.InternalMessageInfo
+
+func (m *ValidateResourceTypeConfig_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ValidateResourceTypeConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ValidateResourceTypeConfig_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateResourceTypeConfig_Response) Reset()         { *m = ValidateResourceTypeConfig_Response{} }
+func (m *ValidateResourceTypeConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*ValidateResourceTypeConfig_Response) ProtoMessage()    {}
+func (*ValidateResourceTypeConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{9, 1}
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Response.Unmarshal(m, b)
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *ValidateResourceTypeConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateResourceTypeConfig_Response.Merge(dst, src)
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Response.Size(m)
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateResourceTypeConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateResourceTypeConfig_Response proto.InternalMessageInfo
+
+func (m *ValidateResourceTypeConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ValidateDataSourceConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ValidateDataSourceConfig) Reset()         { *m = ValidateDataSourceConfig{} }
+func (m *ValidateDataSourceConfig) String() string { return proto.CompactTextString(m) }
+func (*ValidateDataSourceConfig) ProtoMessage()    {}
+func (*ValidateDataSourceConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{10}
+}
+func (m *ValidateDataSourceConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateDataSourceConfig.Unmarshal(m, b)
+}
+func (m *ValidateDataSourceConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateDataSourceConfig.Marshal(b, m, deterministic)
+}
+func (dst *ValidateDataSourceConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateDataSourceConfig.Merge(dst, src)
+}
+func (m *ValidateDataSourceConfig) XXX_Size() int {
+        return xxx_messageInfo_ValidateDataSourceConfig.Size(m)
+}
+func (m *ValidateDataSourceConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateDataSourceConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateDataSourceConfig proto.InternalMessageInfo
+
+type ValidateDataSourceConfig_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateDataSourceConfig_Request) Reset()         { *m = ValidateDataSourceConfig_Request{} }
+func (m *ValidateDataSourceConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*ValidateDataSourceConfig_Request) ProtoMessage()    {}
+func (*ValidateDataSourceConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{10, 0}
+}
+func (m *ValidateDataSourceConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateDataSourceConfig_Request.Unmarshal(m, b)
+}
+func (m *ValidateDataSourceConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateDataSourceConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *ValidateDataSourceConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateDataSourceConfig_Request.Merge(dst, src)
+}
+func (m *ValidateDataSourceConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_ValidateDataSourceConfig_Request.Size(m)
+}
+func (m *ValidateDataSourceConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateDataSourceConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateDataSourceConfig_Request proto.InternalMessageInfo
+
+func (m *ValidateDataSourceConfig_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ValidateDataSourceConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ValidateDataSourceConfig_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateDataSourceConfig_Response) Reset()         { *m = ValidateDataSourceConfig_Response{} }
+func (m *ValidateDataSourceConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*ValidateDataSourceConfig_Response) ProtoMessage()    {}
+func (*ValidateDataSourceConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{10, 1}
+}
+func (m *ValidateDataSourceConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateDataSourceConfig_Response.Unmarshal(m, b)
+}
+func (m *ValidateDataSourceConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateDataSourceConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *ValidateDataSourceConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateDataSourceConfig_Response.Merge(dst, src)
+}
+func (m *ValidateDataSourceConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_ValidateDataSourceConfig_Response.Size(m)
+}
+func (m *ValidateDataSourceConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateDataSourceConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateDataSourceConfig_Response proto.InternalMessageInfo
+
+func (m *ValidateDataSourceConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type Configure struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Configure) Reset()         { *m = Configure{} }
+func (m *Configure) String() string { return proto.CompactTextString(m) }
+func (*Configure) ProtoMessage()    {}
+func (*Configure) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{11}
+}
+func (m *Configure) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Configure.Unmarshal(m, b)
+}
+func (m *Configure) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Configure.Marshal(b, m, deterministic)
+}
+func (dst *Configure) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Configure.Merge(dst, src)
+}
+func (m *Configure) XXX_Size() int {
+        return xxx_messageInfo_Configure.Size(m)
+}
+func (m *Configure) XXX_DiscardUnknown() {
+        xxx_messageInfo_Configure.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configure proto.InternalMessageInfo
+
+type Configure_Request struct {
+        TerraformVersion     string        `protobuf:"bytes,1,opt,name=terraform_version,json=terraformVersion,proto3" json:"terraform_version,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *Configure_Request) Reset()         { *m = Configure_Request{} }
+func (m *Configure_Request) String() string { return proto.CompactTextString(m) }
+func (*Configure_Request) ProtoMessage()    {}
+func (*Configure_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{11, 0}
+}
+func (m *Configure_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Configure_Request.Unmarshal(m, b)
+}
+func (m *Configure_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Configure_Request.Marshal(b, m, deterministic)
+}
+func (dst *Configure_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Configure_Request.Merge(dst, src)
+}
+func (m *Configure_Request) XXX_Size() int {
+        return xxx_messageInfo_Configure_Request.Size(m)
+}
+func (m *Configure_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_Configure_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configure_Request proto.InternalMessageInfo
+
+func (m *Configure_Request) GetTerraformVersion() string {
+        if m != nil {
+                return m.TerraformVersion
+        }
+        return ""
+}
+
+func (m *Configure_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type Configure_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *Configure_Response) Reset()         { *m = Configure_Response{} }
+func (m *Configure_Response) String() string { return proto.CompactTextString(m) }
+func (*Configure_Response) ProtoMessage()    {}
+func (*Configure_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{11, 1}
+}
+func (m *Configure_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Configure_Response.Unmarshal(m, b)
+}
+func (m *Configure_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Configure_Response.Marshal(b, m, deterministic)
+}
+func (dst *Configure_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Configure_Response.Merge(dst, src)
+}
+func (m *Configure_Response) XXX_Size() int {
+        return xxx_messageInfo_Configure_Response.Size(m)
+}
+func (m *Configure_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_Configure_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configure_Response proto.InternalMessageInfo
+
+func (m *Configure_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ReadResource struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ReadResource) Reset()         { *m = ReadResource{} }
+func (m *ReadResource) String() string { return proto.CompactTextString(m) }
+func (*ReadResource) ProtoMessage()    {}
+func (*ReadResource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{12}
+}
+func (m *ReadResource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadResource.Unmarshal(m, b)
+}
+func (m *ReadResource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadResource.Marshal(b, m, deterministic)
+}
+func (dst *ReadResource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadResource.Merge(dst, src)
+}
+func (m *ReadResource) XXX_Size() int {
+        return xxx_messageInfo_ReadResource.Size(m)
+}
+func (m *ReadResource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadResource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadResource proto.InternalMessageInfo
+
+type ReadResource_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        CurrentState         *DynamicValue `protobuf:"bytes,2,opt,name=current_state,json=currentState,proto3" json:"current_state,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadResource_Request) Reset()         { *m = ReadResource_Request{} }
+func (m *ReadResource_Request) String() string { return proto.CompactTextString(m) }
+func (*ReadResource_Request) ProtoMessage()    {}
+func (*ReadResource_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{12, 0}
+}
+func (m *ReadResource_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadResource_Request.Unmarshal(m, b)
+}
+func (m *ReadResource_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadResource_Request.Marshal(b, m, deterministic)
+}
+func (dst *ReadResource_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadResource_Request.Merge(dst, src)
+}
+func (m *ReadResource_Request) XXX_Size() int {
+        return xxx_messageInfo_ReadResource_Request.Size(m)
+}
+func (m *ReadResource_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadResource_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadResource_Request proto.InternalMessageInfo
+
+func (m *ReadResource_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ReadResource_Request) GetCurrentState() *DynamicValue {
+        if m != nil {
+                return m.CurrentState
+        }
+        return nil
+}
+
+type ReadResource_Response struct {
+        NewState             *DynamicValue `protobuf:"bytes,1,opt,name=new_state,json=newState,proto3" json:"new_state,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadResource_Response) Reset()         { *m = ReadResource_Response{} }
+func (m *ReadResource_Response) String() string { return proto.CompactTextString(m) }
+func (*ReadResource_Response) ProtoMessage()    {}
+func (*ReadResource_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{12, 1}
+}
+func (m *ReadResource_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadResource_Response.Unmarshal(m, b)
+}
+func (m *ReadResource_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadResource_Response.Marshal(b, m, deterministic)
+}
+func (dst *ReadResource_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadResource_Response.Merge(dst, src)
+}
+func (m *ReadResource_Response) XXX_Size() int {
+        return xxx_messageInfo_ReadResource_Response.Size(m)
+}
+func (m *ReadResource_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadResource_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadResource_Response proto.InternalMessageInfo
+
+func (m *ReadResource_Response) GetNewState() *DynamicValue {
+        if m != nil {
+                return m.NewState
+        }
+        return nil
+}
+
+func (m *ReadResource_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type PlanResourceChange struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PlanResourceChange) Reset()         { *m = PlanResourceChange{} }
+func (m *PlanResourceChange) String() string { return proto.CompactTextString(m) }
+func (*PlanResourceChange) ProtoMessage()    {}
+func (*PlanResourceChange) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{13}
+}
+func (m *PlanResourceChange) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PlanResourceChange.Unmarshal(m, b)
+}
+func (m *PlanResourceChange) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PlanResourceChange.Marshal(b, m, deterministic)
+}
+func (dst *PlanResourceChange) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PlanResourceChange.Merge(dst, src)
+}
+func (m *PlanResourceChange) XXX_Size() int {
+        return xxx_messageInfo_PlanResourceChange.Size(m)
+}
+func (m *PlanResourceChange) XXX_DiscardUnknown() {
+        xxx_messageInfo_PlanResourceChange.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PlanResourceChange proto.InternalMessageInfo
+
+type PlanResourceChange_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        PriorState           *DynamicValue `protobuf:"bytes,2,opt,name=prior_state,json=priorState,proto3" json:"prior_state,omitempty"`
+        ProposedNewState     *DynamicValue `protobuf:"bytes,3,opt,name=proposed_new_state,json=proposedNewState,proto3" json:"proposed_new_state,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,4,opt,name=config,proto3" json:"config,omitempty"`
+        PriorPrivate         []byte        `protobuf:"bytes,5,opt,name=prior_private,json=priorPrivate,proto3" json:"prior_private,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *PlanResourceChange_Request) Reset()         { *m = PlanResourceChange_Request{} }
+func (m *PlanResourceChange_Request) String() string { return proto.CompactTextString(m) }
+func (*PlanResourceChange_Request) ProtoMessage()    {}
+func (*PlanResourceChange_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{13, 0}
+}
+func (m *PlanResourceChange_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PlanResourceChange_Request.Unmarshal(m, b)
+}
+func (m *PlanResourceChange_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PlanResourceChange_Request.Marshal(b, m, deterministic)
+}
+func (dst *PlanResourceChange_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PlanResourceChange_Request.Merge(dst, src)
+}
+func (m *PlanResourceChange_Request) XXX_Size() int {
+        return xxx_messageInfo_PlanResourceChange_Request.Size(m)
+}
+func (m *PlanResourceChange_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_PlanResourceChange_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PlanResourceChange_Request proto.InternalMessageInfo
+
+func (m *PlanResourceChange_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *PlanResourceChange_Request) GetPriorState() *DynamicValue {
+        if m != nil {
+                return m.PriorState
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Request) GetProposedNewState() *DynamicValue {
+        if m != nil {
+                return m.ProposedNewState
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Request) GetPriorPrivate() []byte {
+        if m != nil {
+                return m.PriorPrivate
+        }
+        return nil
+}
+
+type PlanResourceChange_Response struct {
+        PlannedState    *DynamicValue    `protobuf:"bytes,1,opt,name=planned_state,json=plannedState,proto3" json:"planned_state,omitempty"`
+        RequiresReplace []*AttributePath `protobuf:"bytes,2,rep,name=requires_replace,json=requiresReplace,proto3" json:"requires_replace,omitempty"`
+        PlannedPrivate  []byte           `protobuf:"bytes,3,opt,name=planned_private,json=plannedPrivate,proto3" json:"planned_private,omitempty"`
+        Diagnostics     []*Diagnostic    `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        LegacyTypeSystem     bool     `protobuf:"varint,5,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PlanResourceChange_Response) Reset()         { *m = PlanResourceChange_Response{} }
+func (m *PlanResourceChange_Response) String() string { return proto.CompactTextString(m) }
+func (*PlanResourceChange_Response) ProtoMessage()    {}
+func (*PlanResourceChange_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{13, 1}
+}
+func (m *PlanResourceChange_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PlanResourceChange_Response.Unmarshal(m, b)
+}
+func (m *PlanResourceChange_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PlanResourceChange_Response.Marshal(b, m, deterministic)
+}
+func (dst *PlanResourceChange_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PlanResourceChange_Response.Merge(dst, src)
+}
+func (m *PlanResourceChange_Response) XXX_Size() int {
+        return xxx_messageInfo_PlanResourceChange_Response.Size(m)
+}
+func (m *PlanResourceChange_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_PlanResourceChange_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PlanResourceChange_Response proto.InternalMessageInfo
+
+func (m *PlanResourceChange_Response) GetPlannedState() *DynamicValue {
+        if m != nil {
+                return m.PlannedState
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetRequiresReplace() []*AttributePath {
+        if m != nil {
+                return m.RequiresReplace
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetPlannedPrivate() []byte {
+        if m != nil {
+                return m.PlannedPrivate
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetLegacyTypeSystem() bool {
+        if m != nil {
+                return m.LegacyTypeSystem
+        }
+        return false
+}
+
+type ApplyResourceChange struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ApplyResourceChange) Reset()         { *m = ApplyResourceChange{} }
+func (m *ApplyResourceChange) String() string { return proto.CompactTextString(m) }
+func (*ApplyResourceChange) ProtoMessage()    {}
+func (*ApplyResourceChange) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{14}
+}
+func (m *ApplyResourceChange) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ApplyResourceChange.Unmarshal(m, b)
+}
+func (m *ApplyResourceChange) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ApplyResourceChange.Marshal(b, m, deterministic)
+}
+func (dst *ApplyResourceChange) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ApplyResourceChange.Merge(dst, src)
+}
+func (m *ApplyResourceChange) XXX_Size() int {
+        return xxx_messageInfo_ApplyResourceChange.Size(m)
+}
+func (m *ApplyResourceChange) XXX_DiscardUnknown() {
+        xxx_messageInfo_ApplyResourceChange.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ApplyResourceChange proto.InternalMessageInfo
+
+type ApplyResourceChange_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        PriorState           *DynamicValue `protobuf:"bytes,2,opt,name=prior_state,json=priorState,proto3" json:"prior_state,omitempty"`
+        PlannedState         *DynamicValue `protobuf:"bytes,3,opt,name=planned_state,json=plannedState,proto3" json:"planned_state,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,4,opt,name=config,proto3" json:"config,omitempty"`
+        PlannedPrivate       []byte        `protobuf:"bytes,5,opt,name=planned_private,json=plannedPrivate,proto3" json:"planned_private,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ApplyResourceChange_Request) Reset()         { *m = ApplyResourceChange_Request{} }
+func (m *ApplyResourceChange_Request) String() string { return proto.CompactTextString(m) }
+func (*ApplyResourceChange_Request) ProtoMessage()    {}
+func (*ApplyResourceChange_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{14, 0}
+}
+func (m *ApplyResourceChange_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ApplyResourceChange_Request.Unmarshal(m, b)
+}
+func (m *ApplyResourceChange_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ApplyResourceChange_Request.Marshal(b, m, deterministic)
+}
+func (dst *ApplyResourceChange_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ApplyResourceChange_Request.Merge(dst, src)
+}
+func (m *ApplyResourceChange_Request) XXX_Size() int {
+        return xxx_messageInfo_ApplyResourceChange_Request.Size(m)
+}
+func (m *ApplyResourceChange_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ApplyResourceChange_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ApplyResourceChange_Request proto.InternalMessageInfo
+
+func (m *ApplyResourceChange_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ApplyResourceChange_Request) GetPriorState() *DynamicValue {
+        if m != nil {
+                return m.PriorState
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Request) GetPlannedState() *DynamicValue {
+        if m != nil {
+                return m.PlannedState
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Request) GetPlannedPrivate() []byte {
+        if m != nil {
+                return m.PlannedPrivate
+        }
+        return nil
+}
+
+type ApplyResourceChange_Response struct {
+        NewState    *DynamicValue `protobuf:"bytes,1,opt,name=new_state,json=newState,proto3" json:"new_state,omitempty"`
+        Private     []byte        `protobuf:"bytes,2,opt,name=private,proto3" json:"private,omitempty"`
+        Diagnostics []*Diagnostic `protobuf:"bytes,3,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        LegacyTypeSystem     bool     `protobuf:"varint,4,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ApplyResourceChange_Response) Reset()         { *m = ApplyResourceChange_Response{} }
+func (m *ApplyResourceChange_Response) String() string { return proto.CompactTextString(m) }
+func (*ApplyResourceChange_Response) ProtoMessage()    {}
+func (*ApplyResourceChange_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{14, 1}
+}
+func (m *ApplyResourceChange_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ApplyResourceChange_Response.Unmarshal(m, b)
+}
+func (m *ApplyResourceChange_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ApplyResourceChange_Response.Marshal(b, m, deterministic)
+}
+func (dst *ApplyResourceChange_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ApplyResourceChange_Response.Merge(dst, src)
+}
+func (m *ApplyResourceChange_Response) XXX_Size() int {
+        return xxx_messageInfo_ApplyResourceChange_Response.Size(m)
+}
+func (m *ApplyResourceChange_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ApplyResourceChange_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ApplyResourceChange_Response proto.InternalMessageInfo
+
+func (m *ApplyResourceChange_Response) GetNewState() *DynamicValue {
+        if m != nil {
+                return m.NewState
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Response) GetPrivate() []byte {
+        if m != nil {
+                return m.Private
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Response) GetLegacyTypeSystem() bool {
+        if m != nil {
+                return m.LegacyTypeSystem
+        }
+        return false
+}
+
+type ImportResourceState struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ImportResourceState) Reset()         { *m = ImportResourceState{} }
+func (m *ImportResourceState) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState) ProtoMessage()    {}
+func (*ImportResourceState) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15}
+}
+func (m *ImportResourceState) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState.Unmarshal(m, b)
+}
+func (m *ImportResourceState) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState.Merge(dst, src)
+}
+func (m *ImportResourceState) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState.Size(m)
+}
+func (m *ImportResourceState) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState proto.InternalMessageInfo
+
+type ImportResourceState_Request struct {
+        TypeName             string   `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Id                   string   `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ImportResourceState_Request) Reset()         { *m = ImportResourceState_Request{} }
+func (m *ImportResourceState_Request) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState_Request) ProtoMessage()    {}
+func (*ImportResourceState_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15, 0}
+}
+func (m *ImportResourceState_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState_Request.Unmarshal(m, b)
+}
+func (m *ImportResourceState_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState_Request.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState_Request.Merge(dst, src)
+}
+func (m *ImportResourceState_Request) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState_Request.Size(m)
+}
+func (m *ImportResourceState_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState_Request proto.InternalMessageInfo
+
+func (m *ImportResourceState_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ImportResourceState_Request) GetId() string {
+        if m != nil {
+                return m.Id
+        }
+        return ""
+}
+
+type ImportResourceState_ImportedResource struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        State                *DynamicValue `protobuf:"bytes,2,opt,name=state,proto3" json:"state,omitempty"`
+        Private              []byte        `protobuf:"bytes,3,opt,name=private,proto3" json:"private,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ImportResourceState_ImportedResource) Reset()         { *m = ImportResourceState_ImportedResource{} }
+func (m *ImportResourceState_ImportedResource) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState_ImportedResource) ProtoMessage()    {}
+func (*ImportResourceState_ImportedResource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15, 1}
+}
+func (m *ImportResourceState_ImportedResource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState_ImportedResource.Unmarshal(m, b)
+}
+func (m *ImportResourceState_ImportedResource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState_ImportedResource.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState_ImportedResource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState_ImportedResource.Merge(dst, src)
+}
+func (m *ImportResourceState_ImportedResource) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState_ImportedResource.Size(m)
+}
+func (m *ImportResourceState_ImportedResource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState_ImportedResource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState_ImportedResource proto.InternalMessageInfo
+
+func (m *ImportResourceState_ImportedResource) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ImportResourceState_ImportedResource) GetState() *DynamicValue {
+        if m != nil {
+                return m.State
+        }
+        return nil
+}
+
+func (m *ImportResourceState_ImportedResource) GetPrivate() []byte {
+        if m != nil {
+                return m.Private
+        }
+        return nil
+}
+
+type ImportResourceState_Response struct {
+        ImportedResources    []*ImportResourceState_ImportedResource `protobuf:"bytes,1,rep,name=imported_resources,json=importedResources,proto3" json:"imported_resources,omitempty"`
+        Diagnostics          []*Diagnostic                           `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}                                `json:"-"`
+        XXX_unrecognized     []byte                                  `json:"-"`
+        XXX_sizecache        int32                                   `json:"-"`
+}
+
+func (m *ImportResourceState_Response) Reset()         { *m = ImportResourceState_Response{} }
+func (m *ImportResourceState_Response) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState_Response) ProtoMessage()    {}
+func (*ImportResourceState_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15, 2}
+}
+func (m *ImportResourceState_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState_Response.Unmarshal(m, b)
+}
+func (m *ImportResourceState_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState_Response.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState_Response.Merge(dst, src)
+}
+func (m *ImportResourceState_Response) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState_Response.Size(m)
+}
+func (m *ImportResourceState_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState_Response proto.InternalMessageInfo
+
+func (m *ImportResourceState_Response) GetImportedResources() []*ImportResourceState_ImportedResource {
+        if m != nil {
+                return m.ImportedResources
+        }
+        return nil
+}
+
+func (m *ImportResourceState_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ReadDataSource struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ReadDataSource) Reset()         { *m = ReadDataSource{} }
+func (m *ReadDataSource) String() string { return proto.CompactTextString(m) }
+func (*ReadDataSource) ProtoMessage()    {}
+func (*ReadDataSource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{16}
+}
+func (m *ReadDataSource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadDataSource.Unmarshal(m, b)
+}
+func (m *ReadDataSource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadDataSource.Marshal(b, m, deterministic)
+}
+func (dst *ReadDataSource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadDataSource.Merge(dst, src)
+}
+func (m *ReadDataSource) XXX_Size() int {
+        return xxx_messageInfo_ReadDataSource.Size(m)
+}
+func (m *ReadDataSource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadDataSource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadDataSource proto.InternalMessageInfo
+
+type ReadDataSource_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadDataSource_Request) Reset()         { *m = ReadDataSource_Request{} }
+func (m *ReadDataSource_Request) String() string { return proto.CompactTextString(m) }
+func (*ReadDataSource_Request) ProtoMessage()    {}
+func (*ReadDataSource_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{16, 0}
+}
+func (m *ReadDataSource_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadDataSource_Request.Unmarshal(m, b)
+}
+func (m *ReadDataSource_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadDataSource_Request.Marshal(b, m, deterministic)
+}
+func (dst *ReadDataSource_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadDataSource_Request.Merge(dst, src)
+}
+func (m *ReadDataSource_Request) XXX_Size() int {
+        return xxx_messageInfo_ReadDataSource_Request.Size(m)
+}
+func (m *ReadDataSource_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadDataSource_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadDataSource_Request proto.InternalMessageInfo
+
+func (m *ReadDataSource_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ReadDataSource_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ReadDataSource_Response struct {
+        State                *DynamicValue `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadDataSource_Response) Reset()         { *m = ReadDataSource_Response{} }
+func (m *ReadDataSource_Response) String() string { return proto.CompactTextString(m) }
+func (*ReadDataSource_Response) ProtoMessage()    {}
+func (*ReadDataSource_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{16, 1}
+}
+func (m *ReadDataSource_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadDataSource_Response.Unmarshal(m, b)
+}
+func (m *ReadDataSource_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadDataSource_Response.Marshal(b, m, deterministic)
+}
+func (dst *ReadDataSource_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadDataSource_Response.Merge(dst, src)
+}
+func (m *ReadDataSource_Response) XXX_Size() int {
+        return xxx_messageInfo_ReadDataSource_Response.Size(m)
+}
+func (m *ReadDataSource_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadDataSource_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadDataSource_Response proto.InternalMessageInfo
+
+func (m *ReadDataSource_Response) GetState() *DynamicValue {
+        if m != nil {
+                return m.State
+        }
+        return nil
+}
+
+func (m *ReadDataSource_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type GetProvisionerSchema struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProvisionerSchema) Reset()         { *m = GetProvisionerSchema{} }
+func (m *GetProvisionerSchema) String() string { return proto.CompactTextString(m) }
+func (*GetProvisionerSchema) ProtoMessage()    {}
+func (*GetProvisionerSchema) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{17}
+}
+func (m *GetProvisionerSchema) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProvisionerSchema.Unmarshal(m, b)
+}
+func (m *GetProvisionerSchema) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProvisionerSchema.Marshal(b, m, deterministic)
+}
+func (dst *GetProvisionerSchema) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProvisionerSchema.Merge(dst, src)
+}
+func (m *GetProvisionerSchema) XXX_Size() int {
+        return xxx_messageInfo_GetProvisionerSchema.Size(m)
+}
+func (m *GetProvisionerSchema) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProvisionerSchema.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProvisionerSchema proto.InternalMessageInfo
+
+type GetProvisionerSchema_Request struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProvisionerSchema_Request) Reset()         { *m = GetProvisionerSchema_Request{} }
+func (m *GetProvisionerSchema_Request) String() string { return proto.CompactTextString(m) }
+func (*GetProvisionerSchema_Request) ProtoMessage()    {}
+func (*GetProvisionerSchema_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{17, 0}
+}
+func (m *GetProvisionerSchema_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProvisionerSchema_Request.Unmarshal(m, b)
+}
+func (m *GetProvisionerSchema_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProvisionerSchema_Request.Marshal(b, m, deterministic)
+}
+func (dst *GetProvisionerSchema_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProvisionerSchema_Request.Merge(dst, src)
+}
+func (m *GetProvisionerSchema_Request) XXX_Size() int {
+        return xxx_messageInfo_GetProvisionerSchema_Request.Size(m)
+}
+func (m *GetProvisionerSchema_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProvisionerSchema_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProvisionerSchema_Request proto.InternalMessageInfo
+
+type GetProvisionerSchema_Response struct {
+        Provisioner          *Schema       `protobuf:"bytes,1,opt,name=provisioner,proto3" json:"provisioner,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *GetProvisionerSchema_Response) Reset()         { *m = GetProvisionerSchema_Response{} }
+func (m *GetProvisionerSchema_Response) String() string { return proto.CompactTextString(m) }
+func (*GetProvisionerSchema_Response) ProtoMessage()    {}
+func (*GetProvisionerSchema_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{17, 1}
+}
+func (m *GetProvisionerSchema_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProvisionerSchema_Response.Unmarshal(m, b)
+}
+func (m *GetProvisionerSchema_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProvisionerSchema_Response.Marshal(b, m, deterministic)
+}
+func (dst *GetProvisionerSchema_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProvisionerSchema_Response.Merge(dst, src)
+}
+func (m *GetProvisionerSchema_Response) XXX_Size() int {
+        return xxx_messageInfo_GetProvisionerSchema_Response.Size(m)
+}
+func (m *GetProvisionerSchema_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProvisionerSchema_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProvisionerSchema_Response proto.InternalMessageInfo
+
+func (m *GetProvisionerSchema_Response) GetProvisioner() *Schema {
+        if m != nil {
+                return m.Provisioner
+        }
+        return nil
+}
+
+func (m *GetProvisionerSchema_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ValidateProvisionerConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ValidateProvisionerConfig) Reset()         { *m = ValidateProvisionerConfig{} }
+func (m *ValidateProvisionerConfig) String() string { return proto.CompactTextString(m) }
+func (*ValidateProvisionerConfig) ProtoMessage()    {}
+func (*ValidateProvisionerConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{18}
+}
+func (m *ValidateProvisionerConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateProvisionerConfig.Unmarshal(m, b)
+}
+func (m *ValidateProvisionerConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateProvisionerConfig.Marshal(b, m, deterministic)
+}
+func (dst *ValidateProvisionerConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateProvisionerConfig.Merge(dst, src)
+}
+func (m *ValidateProvisionerConfig) XXX_Size() int {
+        return xxx_messageInfo_ValidateProvisionerConfig.Size(m)
+}
+func (m *ValidateProvisionerConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateProvisionerConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateProvisionerConfig proto.InternalMessageInfo
+
+type ValidateProvisionerConfig_Request struct {
+        Config               *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateProvisionerConfig_Request) Reset()         { *m = ValidateProvisionerConfig_Request{} }
+func (m *ValidateProvisionerConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*ValidateProvisionerConfig_Request) ProtoMessage()    {}
+func (*ValidateProvisionerConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{18, 0}
+}
+func (m *ValidateProvisionerConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateProvisionerConfig_Request.Unmarshal(m, b)
+}
+func (m *ValidateProvisionerConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateProvisionerConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *ValidateProvisionerConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateProvisionerConfig_Request.Merge(dst, src)
+}
+func (m *ValidateProvisionerConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_ValidateProvisionerConfig_Request.Size(m)
+}
+func (m *ValidateProvisionerConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateProvisionerConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateProvisionerConfig_Request proto.InternalMessageInfo
+
+func (m *ValidateProvisionerConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ValidateProvisionerConfig_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateProvisionerConfig_Response) Reset()         { *m = ValidateProvisionerConfig_Response{} }
+func (m *ValidateProvisionerConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*ValidateProvisionerConfig_Response) ProtoMessage()    {}
+func (*ValidateProvisionerConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{18, 1}
+}
+func (m *ValidateProvisionerConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateProvisionerConfig_Response.Unmarshal(m, b)
+}
+func (m *ValidateProvisionerConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateProvisionerConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *ValidateProvisionerConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateProvisionerConfig_Response.Merge(dst, src)
+}
+func (m *ValidateProvisionerConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_ValidateProvisionerConfig_Response.Size(m)
+}
+func (m *ValidateProvisionerConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateProvisionerConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateProvisionerConfig_Response proto.InternalMessageInfo
+
+func (m *ValidateProvisionerConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ProvisionResource struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ProvisionResource) Reset()         { *m = ProvisionResource{} }
+func (m *ProvisionResource) String() string { return proto.CompactTextString(m) }
+func (*ProvisionResource) ProtoMessage()    {}
+func (*ProvisionResource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{19}
+}
+func (m *ProvisionResource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ProvisionResource.Unmarshal(m, b)
+}
+func (m *ProvisionResource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ProvisionResource.Marshal(b, m, deterministic)
+}
+func (dst *ProvisionResource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ProvisionResource.Merge(dst, src)
+}
+func (m *ProvisionResource) XXX_Size() int {
+        return xxx_messageInfo_ProvisionResource.Size(m)
+}
+func (m *ProvisionResource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ProvisionResource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionResource proto.InternalMessageInfo
+
+type ProvisionResource_Request struct {
+        Config               *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+        Connection           *DynamicValue `protobuf:"bytes,2,opt,name=connection,proto3" json:"connection,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ProvisionResource_Request) Reset()         { *m = ProvisionResource_Request{} }
+func (m *ProvisionResource_Request) String() string { return proto.CompactTextString(m) }
+func (*ProvisionResource_Request) ProtoMessage()    {}
+func (*ProvisionResource_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{19, 0}
+}
+func (m *ProvisionResource_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ProvisionResource_Request.Unmarshal(m, b)
+}
+func (m *ProvisionResource_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ProvisionResource_Request.Marshal(b, m, deterministic)
+}
+func (dst *ProvisionResource_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ProvisionResource_Request.Merge(dst, src)
+}
+func (m *ProvisionResource_Request) XXX_Size() int {
+        return xxx_messageInfo_ProvisionResource_Request.Size(m)
+}
+func (m *ProvisionResource_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ProvisionResource_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionResource_Request proto.InternalMessageInfo
+
+func (m *ProvisionResource_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+func (m *ProvisionResource_Request) GetConnection() *DynamicValue {
+        if m != nil {
+                return m.Connection
+        }
+        return nil
+}
+
+type ProvisionResource_Response struct {
+        Output               string        `protobuf:"bytes,1,opt,name=output,proto3" json:"output,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ProvisionResource_Response) Reset()         { *m = ProvisionResource_Response{} }
+func (m *ProvisionResource_Response) String() string { return proto.CompactTextString(m) }
+func (*ProvisionResource_Response) ProtoMessage()    {}
+func (*ProvisionResource_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{19, 1}
+}
+func (m *ProvisionResource_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ProvisionResource_Response.Unmarshal(m, b)
+}
+func (m *ProvisionResource_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ProvisionResource_Response.Marshal(b, m, deterministic)
+}
+func (dst *ProvisionResource_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ProvisionResource_Response.Merge(dst, src)
+}
+func (m *ProvisionResource_Response) XXX_Size() int {
+        return xxx_messageInfo_ProvisionResource_Response.Size(m)
+}
+func (m *ProvisionResource_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ProvisionResource_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionResource_Response proto.InternalMessageInfo
+
+func (m *ProvisionResource_Response) GetOutput() string {
+        if m != nil {
+                return m.Output
+        }
+        return ""
+}
+
+func (m *ProvisionResource_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+func init() {
+        proto.RegisterType((*DynamicValue)(nil), "tfplugin5.DynamicValue")
+        proto.RegisterType((*Diagnostic)(nil), "tfplugin5.Diagnostic")
+        proto.RegisterType((*AttributePath)(nil), "tfplugin5.AttributePath")
+        proto.RegisterType((*AttributePath_Step)(nil), "tfplugin5.AttributePath.Step")
+        proto.RegisterType((*Stop)(nil), "tfplugin5.Stop")
+        proto.RegisterType((*Stop_Request)(nil), "tfplugin5.Stop.Request")
+        proto.RegisterType((*Stop_Response)(nil), "tfplugin5.Stop.Response")
+        proto.RegisterType((*RawState)(nil), "tfplugin5.RawState")
+        proto.RegisterMapType((map[string]string)(nil), "tfplugin5.RawState.FlatmapEntry")
+        proto.RegisterType((*Schema)(nil), "tfplugin5.Schema")
+        proto.RegisterType((*Schema_Block)(nil), "tfplugin5.Schema.Block")
+        proto.RegisterType((*Schema_Attribute)(nil), "tfplugin5.Schema.Attribute")
+        proto.RegisterType((*Schema_NestedBlock)(nil), "tfplugin5.Schema.NestedBlock")
+        proto.RegisterType((*GetProviderSchema)(nil), "tfplugin5.GetProviderSchema")
+        proto.RegisterType((*GetProviderSchema_Request)(nil), "tfplugin5.GetProviderSchema.Request")
+        proto.RegisterType((*GetProviderSchema_Response)(nil), "tfplugin5.GetProviderSchema.Response")
+        proto.RegisterMapType((map[string]*Schema)(nil), "tfplugin5.GetProviderSchema.Response.DataSourceSchemasEntry")
+        proto.RegisterMapType((map[string]*Schema)(nil), "tfplugin5.GetProviderSchema.Response.ResourceSchemasEntry")
+        proto.RegisterType((*PrepareProviderConfig)(nil), "tfplugin5.PrepareProviderConfig")
+        proto.RegisterType((*PrepareProviderConfig_Request)(nil), "tfplugin5.PrepareProviderConfig.Request")
+        proto.RegisterType((*PrepareProviderConfig_Response)(nil), "tfplugin5.PrepareProviderConfig.Response")
+        proto.RegisterType((*UpgradeResourceState)(nil), "tfplugin5.UpgradeResourceState")
+        proto.RegisterType((*UpgradeResourceState_Request)(nil), "tfplugin5.UpgradeResourceState.Request")
+        proto.RegisterType((*UpgradeResourceState_Response)(nil), "tfplugin5.UpgradeResourceState.Response")
+        proto.RegisterType((*ValidateResourceTypeConfig)(nil), "tfplugin5.ValidateResourceTypeConfig")
+        proto.RegisterType((*ValidateResourceTypeConfig_Request)(nil), "tfplugin5.ValidateResourceTypeConfig.Request")
+        proto.RegisterType((*ValidateResourceTypeConfig_Response)(nil), "tfplugin5.ValidateResourceTypeConfig.Response")
+        proto.RegisterType((*ValidateDataSourceConfig)(nil), "tfplugin5.ValidateDataSourceConfig")
+        proto.RegisterType((*ValidateDataSourceConfig_Request)(nil), "tfplugin5.ValidateDataSourceConfig.Request")
+        proto.RegisterType((*ValidateDataSourceConfig_Response)(nil), "tfplugin5.ValidateDataSourceConfig.Response")
+        proto.RegisterType((*Configure)(nil), "tfplugin5.Configure")
+        proto.RegisterType((*Configure_Request)(nil), "tfplugin5.Configure.Request")
+        proto.RegisterType((*Configure_Response)(nil), "tfplugin5.Configure.Response")
+        proto.RegisterType((*ReadResource)(nil), "tfplugin5.ReadResource")
+        proto.RegisterType((*ReadResource_Request)(nil), "tfplugin5.ReadResource.Request")
+        proto.RegisterType((*ReadResource_Response)(nil), "tfplugin5.ReadResource.Response")
+        proto.RegisterType((*PlanResourceChange)(nil), "tfplugin5.PlanResourceChange")
+        proto.RegisterType((*PlanResourceChange_Request)(nil), "tfplugin5.PlanResourceChange.Request")
+        proto.RegisterType((*PlanResourceChange_Response)(nil), "tfplugin5.PlanResourceChange.Response")
+        proto.RegisterType((*ApplyResourceChange)(nil), "tfplugin5.ApplyResourceChange")
+        proto.RegisterType((*ApplyResourceChange_Request)(nil), "tfplugin5.ApplyResourceChange.Request")
+        proto.RegisterType((*ApplyResourceChange_Response)(nil), "tfplugin5.ApplyResourceChange.Response")
+        proto.RegisterType((*ImportResourceState)(nil), "tfplugin5.ImportResourceState")
+        proto.RegisterType((*ImportResourceState_Request)(nil), "tfplugin5.ImportResourceState.Request")
+        proto.RegisterType((*ImportResourceState_ImportedResource)(nil), "tfplugin5.ImportResourceState.ImportedResource")
+        proto.RegisterType((*ImportResourceState_Response)(nil), "tfplugin5.ImportResourceState.Response")
+        proto.RegisterType((*ReadDataSource)(nil), "tfplugin5.ReadDataSource")
+        proto.RegisterType((*ReadDataSource_Request)(nil), "tfplugin5.ReadDataSource.Request")
+        proto.RegisterType((*ReadDataSource_Response)(nil), "tfplugin5.ReadDataSource.Response")
+        proto.RegisterType((*GetProvisionerSchema)(nil), "tfplugin5.GetProvisionerSchema")
+        proto.RegisterType((*GetProvisionerSchema_Request)(nil), "tfplugin5.GetProvisionerSchema.Request")
+        proto.RegisterType((*GetProvisionerSchema_Response)(nil), "tfplugin5.GetProvisionerSchema.Response")
+        proto.RegisterType((*ValidateProvisionerConfig)(nil), "tfplugin5.ValidateProvisionerConfig")
+        proto.RegisterType((*ValidateProvisionerConfig_Request)(nil), "tfplugin5.ValidateProvisionerConfig.Request")
+        proto.RegisterType((*ValidateProvisionerConfig_Response)(nil), "tfplugin5.ValidateProvisionerConfig.Response")
+        proto.RegisterType((*ProvisionResource)(nil), "tfplugin5.ProvisionResource")
+        proto.RegisterType((*ProvisionResource_Request)(nil), "tfplugin5.ProvisionResource.Request")
+        proto.RegisterType((*ProvisionResource_Response)(nil), "tfplugin5.ProvisionResource.Response")
+        proto.RegisterEnum("tfplugin5.Diagnostic_Severity", Diagnostic_Severity_name, Diagnostic_Severity_value)
+        proto.RegisterEnum("tfplugin5.Schema_NestedBlock_NestingMode", Schema_NestedBlock_NestingMode_name, Schema_NestedBlock_NestingMode_value)
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// ProviderClient is the client API for Provider service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type ProviderClient interface {
+        // ////// Information about what a provider supports/expects
+        GetSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error)
+        PrepareProviderConfig(ctx context.Context, in *PrepareProviderConfig_Request, opts ...grpc.CallOption) (*PrepareProviderConfig_Response, error)
+        ValidateResourceTypeConfig(ctx context.Context, in *ValidateResourceTypeConfig_Request, opts ...grpc.CallOption) (*ValidateResourceTypeConfig_Response, error)
+        ValidateDataSourceConfig(ctx context.Context, in *ValidateDataSourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataSourceConfig_Response, error)
+        UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error)
+        // ////// One-time initialization, called before other functions below
+        Configure(ctx context.Context, in *Configure_Request, opts ...grpc.CallOption) (*Configure_Response, error)
+        // ////// Managed Resource Lifecycle
+        ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error)
+        PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error)
+        ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error)
+        ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error)
+        ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error)
+        // ////// Graceful Shutdown
+        Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error)
+}
+
+type providerClient struct {
+        cc *grpc.ClientConn
+}
+
+func NewProviderClient(cc *grpc.ClientConn) ProviderClient {
+        return &providerClient{cc}
+}
+
+func (c *providerClient) GetSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error) {
+        out := new(GetProviderSchema_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/GetSchema", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) PrepareProviderConfig(ctx context.Context, in *PrepareProviderConfig_Request, opts ...grpc.CallOption) (*PrepareProviderConfig_Response, error) {
+        out := new(PrepareProviderConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/PrepareProviderConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ValidateResourceTypeConfig(ctx context.Context, in *ValidateResourceTypeConfig_Request, opts ...grpc.CallOption) (*ValidateResourceTypeConfig_Response, error) {
+        out := new(ValidateResourceTypeConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ValidateResourceTypeConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ValidateDataSourceConfig(ctx context.Context, in *ValidateDataSourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataSourceConfig_Response, error) {
+        out := new(ValidateDataSourceConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ValidateDataSourceConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error) {
+        out := new(UpgradeResourceState_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/UpgradeResourceState", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) Configure(ctx context.Context, in *Configure_Request, opts ...grpc.CallOption) (*Configure_Response, error) {
+        out := new(Configure_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/Configure", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error) {
+        out := new(ReadResource_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ReadResource", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error) {
+        out := new(PlanResourceChange_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/PlanResourceChange", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error) {
+        out := new(ApplyResourceChange_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ApplyResourceChange", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error) {
+        out := new(ImportResourceState_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ImportResourceState", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error) {
+        out := new(ReadDataSource_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ReadDataSource", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error) {
+        out := new(Stop_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/Stop", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// ProviderServer is the server API for Provider service.
+type ProviderServer interface {
+        // ////// Information about what a provider supports/expects
+        GetSchema(context.Context, *GetProviderSchema_Request) (*GetProviderSchema_Response, error)
+        PrepareProviderConfig(context.Context, *PrepareProviderConfig_Request) (*PrepareProviderConfig_Response, error)
+        ValidateResourceTypeConfig(context.Context, *ValidateResourceTypeConfig_Request) (*ValidateResourceTypeConfig_Response, error)
+        ValidateDataSourceConfig(context.Context, *ValidateDataSourceConfig_Request) (*ValidateDataSourceConfig_Response, error)
+        UpgradeResourceState(context.Context, *UpgradeResourceState_Request) (*UpgradeResourceState_Response, error)
+        // ////// One-time initialization, called before other functions below
+        Configure(context.Context, *Configure_Request) (*Configure_Response, error)
+        // ////// Managed Resource Lifecycle
+        ReadResource(context.Context, *ReadResource_Request) (*ReadResource_Response, error)
+        PlanResourceChange(context.Context, *PlanResourceChange_Request) (*PlanResourceChange_Response, error)
+        ApplyResourceChange(context.Context, *ApplyResourceChange_Request) (*ApplyResourceChange_Response, error)
+        ImportResourceState(context.Context, *ImportResourceState_Request) (*ImportResourceState_Response, error)
+        ReadDataSource(context.Context, *ReadDataSource_Request) (*ReadDataSource_Response, error)
+        // ////// Graceful Shutdown
+        Stop(context.Context, *Stop_Request) (*Stop_Response, error)
+}
+
+func RegisterProviderServer(s *grpc.Server, srv ProviderServer) {
+        s.RegisterService(&_Provider_serviceDesc, srv)
+}
+
+func _Provider_GetSchema_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(GetProviderSchema_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).GetSchema(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/GetSchema",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).GetSchema(ctx, req.(*GetProviderSchema_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_PrepareProviderConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(PrepareProviderConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).PrepareProviderConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/PrepareProviderConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).PrepareProviderConfig(ctx, req.(*PrepareProviderConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ValidateResourceTypeConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ValidateResourceTypeConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ValidateResourceTypeConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ValidateResourceTypeConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ValidateResourceTypeConfig(ctx, req.(*ValidateResourceTypeConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ValidateDataSourceConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ValidateDataSourceConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ValidateDataSourceConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ValidateDataSourceConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ValidateDataSourceConfig(ctx, req.(*ValidateDataSourceConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_UpgradeResourceState_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(UpgradeResourceState_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).UpgradeResourceState(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/UpgradeResourceState",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).UpgradeResourceState(ctx, req.(*UpgradeResourceState_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_Configure_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Configure_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).Configure(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/Configure",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).Configure(ctx, req.(*Configure_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ReadResource_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ReadResource_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ReadResource(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ReadResource",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ReadResource(ctx, req.(*ReadResource_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_PlanResourceChange_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(PlanResourceChange_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).PlanResourceChange(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/PlanResourceChange",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).PlanResourceChange(ctx, req.(*PlanResourceChange_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ApplyResourceChange_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ApplyResourceChange_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ApplyResourceChange(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ApplyResourceChange",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ApplyResourceChange(ctx, req.(*ApplyResourceChange_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ImportResourceState_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ImportResourceState_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ImportResourceState(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ImportResourceState",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ImportResourceState(ctx, req.(*ImportResourceState_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ReadDataSource_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ReadDataSource_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ReadDataSource(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ReadDataSource",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ReadDataSource(ctx, req.(*ReadDataSource_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_Stop_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Stop_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).Stop(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/Stop",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).Stop(ctx, req.(*Stop_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+var _Provider_serviceDesc = grpc.ServiceDesc{
+        ServiceName: "tfplugin5.Provider",
+        HandlerType: (*ProviderServer)(nil),
+        Methods: []grpc.MethodDesc{
+                {
+                        MethodName: "GetSchema",
+                        Handler:    _Provider_GetSchema_Handler,
+                },
+                {
+                        MethodName: "PrepareProviderConfig",
+                        Handler:    _Provider_PrepareProviderConfig_Handler,
+                },
+                {
+                        MethodName: "ValidateResourceTypeConfig",
+                        Handler:    _Provider_ValidateResourceTypeConfig_Handler,
+                },
+                {
+                        MethodName: "ValidateDataSourceConfig",
+                        Handler:    _Provider_ValidateDataSourceConfig_Handler,
+                },
+                {
+                        MethodName: "UpgradeResourceState",
+                        Handler:    _Provider_UpgradeResourceState_Handler,
+                },
+                {
+                        MethodName: "Configure",
+                        Handler:    _Provider_Configure_Handler,
+                },
+                {
+                        MethodName: "ReadResource",
+                        Handler:    _Provider_ReadResource_Handler,
+                },
+                {
+                        MethodName: "PlanResourceChange",
+                        Handler:    _Provider_PlanResourceChange_Handler,
+                },
+                {
+                        MethodName: "ApplyResourceChange",
+                        Handler:    _Provider_ApplyResourceChange_Handler,
+                },
+                {
+                        MethodName: "ImportResourceState",
+                        Handler:    _Provider_ImportResourceState_Handler,
+                },
+                {
+                        MethodName: "ReadDataSource",
+                        Handler:    _Provider_ReadDataSource_Handler,
+                },
+                {
+                        MethodName: "Stop",
+                        Handler:    _Provider_Stop_Handler,
+                },
+        },
+        Streams:  []grpc.StreamDesc{},
+        Metadata: "tfplugin5.proto",
+}
+
+// ProvisionerClient is the client API for Provisioner service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type ProvisionerClient interface {
+        GetSchema(ctx context.Context, in *GetProvisionerSchema_Request, opts ...grpc.CallOption) (*GetProvisionerSchema_Response, error)
+        ValidateProvisionerConfig(ctx context.Context, in *ValidateProvisionerConfig_Request, opts ...grpc.CallOption) (*ValidateProvisionerConfig_Response, error)
+        ProvisionResource(ctx context.Context, in *ProvisionResource_Request, opts ...grpc.CallOption) (Provisioner_ProvisionResourceClient, error)
+        Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error)
+}
+
+type provisionerClient struct {
+        cc *grpc.ClientConn
+}
+
+func NewProvisionerClient(cc *grpc.ClientConn) ProvisionerClient {
+        return &provisionerClient{cc}
+}
+
+func (c *provisionerClient) GetSchema(ctx context.Context, in *GetProvisionerSchema_Request, opts ...grpc.CallOption) (*GetProvisionerSchema_Response, error) {
+        out := new(GetProvisionerSchema_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/GetSchema", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *provisionerClient) ValidateProvisionerConfig(ctx context.Context, in *ValidateProvisionerConfig_Request, opts ...grpc.CallOption) (*ValidateProvisionerConfig_Response, error) {
+        out := new(ValidateProvisionerConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/ValidateProvisionerConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *provisionerClient) ProvisionResource(ctx context.Context, in *ProvisionResource_Request, opts ...grpc.CallOption) (Provisioner_ProvisionResourceClient, error) {
+        stream, err := c.cc.NewStream(ctx, &_Provisioner_serviceDesc.Streams[0], "/tfplugin5.Provisioner/ProvisionResource", opts...)
+        if err != nil {
+                return nil, err
+        }
+        x := &provisionerProvisionResourceClient{stream}
+        if err := x.ClientStream.SendMsg(in); err != nil {
+                return nil, err
+        }
+        if err := x.ClientStream.CloseSend(); err != nil {
+                return nil, err
+        }
+        return x, nil
+}
+
+type Provisioner_ProvisionResourceClient interface {
+        Recv() (*ProvisionResource_Response, error)
+        grpc.ClientStream
+}
+
+type provisionerProvisionResourceClient struct {
+        grpc.ClientStream
+}
+
+func (x *provisionerProvisionResourceClient) Recv() (*ProvisionResource_Response, error) {
+        m := new(ProvisionResource_Response)
+        if err := x.ClientStream.RecvMsg(m); err != nil {
+                return nil, err
+        }
+        return m, nil
+}
+
+func (c *provisionerClient) Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error) {
+        out := new(Stop_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/Stop", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// ProvisionerServer is the server API for Provisioner service.
+type ProvisionerServer interface {
+        GetSchema(context.Context, *GetProvisionerSchema_Request) (*GetProvisionerSchema_Response, error)
+        ValidateProvisionerConfig(context.Context, *ValidateProvisionerConfig_Request) (*ValidateProvisionerConfig_Response, error)
+        ProvisionResource(*ProvisionResource_Request, Provisioner_ProvisionResourceServer) error
+        Stop(context.Context, *Stop_Request) (*Stop_Response, error)
+}
+
+func RegisterProvisionerServer(s *grpc.Server, srv ProvisionerServer) {
+        s.RegisterService(&_Provisioner_serviceDesc, srv)
+}
+
+func _Provisioner_GetSchema_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(GetProvisionerSchema_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProvisionerServer).GetSchema(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provisioner/GetSchema",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProvisionerServer).GetSchema(ctx, req.(*GetProvisionerSchema_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provisioner_ValidateProvisionerConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ValidateProvisionerConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProvisionerServer).ValidateProvisionerConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provisioner/ValidateProvisionerConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProvisionerServer).ValidateProvisionerConfig(ctx, req.(*ValidateProvisionerConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provisioner_ProvisionResource_Handler(srv interface{}, stream grpc.ServerStream) error {
+        m := new(ProvisionResource_Request)
+        if err := stream.RecvMsg(m); err != nil {
+                return err
+        }
+        return srv.(ProvisionerServer).ProvisionResource(m, &provisionerProvisionResourceServer{stream})
+}
+
+type Provisioner_ProvisionResourceServer interface {
+        Send(*ProvisionResource_Response) error
+        grpc.ServerStream
+}
+
+type provisionerProvisionResourceServer struct {
+        grpc.ServerStream
+}
+
+func (x *provisionerProvisionResourceServer) Send(m *ProvisionResource_Response) error {
+        return x.ServerStream.SendMsg(m)
+}
+
+func _Provisioner_Stop_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Stop_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProvisionerServer).Stop(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provisioner/Stop",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProvisionerServer).Stop(ctx, req.(*Stop_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+var _Provisioner_serviceDesc = grpc.ServiceDesc{
+        ServiceName: "tfplugin5.Provisioner",
+        HandlerType: (*ProvisionerServer)(nil),
+        Methods: []grpc.MethodDesc{
+                {
+                        MethodName: "GetSchema",
+                        Handler:    _Provisioner_GetSchema_Handler,
+                },
+                {
+                        MethodName: "ValidateProvisionerConfig",
+                        Handler:    _Provisioner_ValidateProvisionerConfig_Handler,
+                },
+                {
+                        MethodName: "Stop",
+                        Handler:    _Provisioner_Stop_Handler,
+                },
+        },
+        Streams: []grpc.StreamDesc{
+                {
+                        StreamName:    "ProvisionResource",
+                        Handler:       _Provisioner_ProvisionResource_Handler,
+                        ServerStreams: true,
+                },
+        },
+        Metadata: "tfplugin5.proto",
+}
+
+func init() { proto.RegisterFile("tfplugin5.proto", fileDescriptor_tfplugin5_56820f4fb67360c5) }
+
+var fileDescriptor_tfplugin5_56820f4fb67360c5 = []byte{
+        // 1876 bytes of a gzipped FileDescriptorProto
+        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xd4, 0x59, 0xcd, 0x6f, 0x23, 0x49,
+        0x15, 0x9f, 0x76, 0xdb, 0x89, 0xfd, 0x9c, 0x0f, 0xa7, 0x66, 0x76, 0x30, 0xbd, 0xbb, 0x10, 0xcc,
+        0x47, 0xb2, 0xda, 0x1d, 0xcf, 0x2a, 0x03, 0xbb, 0x4b, 0x18, 0xad, 0xc8, 0x66, 0x42, 0x26, 0x62,
+        0x26, 0x1b, 0xca, 0xf3, 0x81, 0x84, 0xb4, 0x56, 0x8d, 0xbb, 0xe2, 0x69, 0xc6, 0xee, 0xee, 0xad,
+        0x2e, 0x67, 0x62, 0x71, 0x44, 0x70, 0xe6, 0xc2, 0x87, 0xc4, 0xc7, 0x85, 0x03, 0xff, 0x00, 0x07,
+        0xe0, 0xc6, 0x89, 0x7f, 0x80, 0x1b, 0x70, 0x42, 0x70, 0x43, 0x1c, 0xe1, 0x82, 0x84, 0xea, 0xab,
+        0xbb, 0x6c, 0xb7, 0x93, 0x9e, 0x64, 0x57, 0x88, 0x5b, 0x57, 0xbd, 0x5f, 0xbd, 0xf7, 0xab, 0xf7,
+        0x5e, 0xbd, 0x57, 0x65, 0xc3, 0x2a, 0x3f, 0x8e, 0x07, 0xa3, 0x7e, 0x10, 0x7e, 0xa9, 0x1d, 0xb3,
+        0x88, 0x47, 0xa8, 0x96, 0x4e, 0xb4, 0x6e, 0xc3, 0xd2, 0x9d, 0x71, 0x48, 0x86, 0x41, 0xef, 0x11,
+        0x19, 0x8c, 0x28, 0x6a, 0xc2, 0xe2, 0x30, 0xe9, 0xc7, 0xa4, 0xf7, 0xac, 0xe9, 0xac, 0x3b, 0x9b,
+        0x4b, 0xd8, 0x0c, 0x11, 0x82, 0xf2, 0xb7, 0x93, 0x28, 0x6c, 0x96, 0xe4, 0xb4, 0xfc, 0x6e, 0xfd,
+        0xd5, 0x01, 0xb8, 0x13, 0x90, 0x7e, 0x18, 0x25, 0x3c, 0xe8, 0xa1, 0x6d, 0xa8, 0x26, 0xf4, 0x84,
+        0xb2, 0x80, 0x8f, 0xe5, 0xea, 0x95, 0xad, 0x4f, 0xb5, 0x33, 0xdb, 0x19, 0xb0, 0xdd, 0xd1, 0x28,
+        0x9c, 0xe2, 0x85, 0xe1, 0x64, 0x34, 0x1c, 0x12, 0x36, 0x96, 0x16, 0x6a, 0xd8, 0x0c, 0xd1, 0x75,
+        0x58, 0xf0, 0x29, 0x27, 0xc1, 0xa0, 0xe9, 0x4a, 0x81, 0x1e, 0xa1, 0xb7, 0xa0, 0x46, 0x38, 0x67,
+        0xc1, 0x93, 0x11, 0xa7, 0xcd, 0xf2, 0xba, 0xb3, 0x59, 0xdf, 0x6a, 0x5a, 0xe6, 0x76, 0x8c, 0xec,
+        0x88, 0xf0, 0xa7, 0x38, 0x83, 0xb6, 0x6e, 0x42, 0xd5, 0xd8, 0x47, 0x75, 0x58, 0x3c, 0x38, 0x7c,
+        0xb4, 0x73, 0xef, 0xe0, 0x4e, 0xe3, 0x0a, 0xaa, 0x41, 0x65, 0x0f, 0xe3, 0xf7, 0x71, 0xc3, 0x11,
+        0xf3, 0x8f, 0x77, 0xf0, 0xe1, 0xc1, 0xe1, 0x7e, 0xa3, 0xd4, 0xfa, 0xb3, 0x03, 0xcb, 0x13, 0xda,
+        0xd0, 0x2d, 0xa8, 0x24, 0x9c, 0xc6, 0x49, 0xd3, 0x59, 0x77, 0x37, 0xeb, 0x5b, 0xaf, 0xce, 0x33,
+        0xdb, 0xee, 0x70, 0x1a, 0x63, 0x85, 0xf5, 0x7e, 0xe8, 0x40, 0x59, 0x8c, 0xd1, 0x06, 0xac, 0xa4,
+        0x6c, 0xba, 0x21, 0x19, 0x52, 0xe9, 0xac, 0xda, 0xdd, 0x2b, 0x78, 0x39, 0x9d, 0x3f, 0x24, 0x43,
+        0x8a, 0xda, 0x80, 0xe8, 0x80, 0x0e, 0x69, 0xc8, 0xbb, 0xcf, 0xe8, 0xb8, 0x9b, 0x70, 0x16, 0x84,
+        0x7d, 0xe5, 0x9e, 0xbb, 0x57, 0x70, 0x43, 0xcb, 0xbe, 0x4e, 0xc7, 0x1d, 0x29, 0x41, 0x9b, 0xb0,
+        0x6a, 0xe3, 0x83, 0x90, 0x4b, 0x97, 0xb9, 0x42, 0x73, 0x06, 0x3e, 0x08, 0xf9, 0x7b, 0x20, 0x22,
+        0x35, 0xa0, 0x3d, 0x1e, 0xb1, 0xd6, 0x2d, 0x41, 0x2b, 0x8a, 0xbd, 0x1a, 0x2c, 0x62, 0xfa, 0xe1,
+        0x88, 0x26, 0xdc, 0x5b, 0x87, 0x2a, 0xa6, 0x49, 0x1c, 0x85, 0x09, 0x45, 0xd7, 0xa0, 0xb2, 0xc7,
+        0x58, 0xc4, 0x14, 0x49, 0xac, 0x06, 0xad, 0x1f, 0x39, 0x50, 0xc5, 0xe4, 0x79, 0x87, 0x13, 0x4e,
+        0xd3, 0xd4, 0x70, 0xb2, 0xd4, 0x40, 0xdb, 0xb0, 0x78, 0x3c, 0x20, 0x7c, 0x48, 0xe2, 0x66, 0x49,
+        0x3a, 0x69, 0xdd, 0x72, 0x92, 0x59, 0xd9, 0xfe, 0x9a, 0x82, 0xec, 0x85, 0x9c, 0x8d, 0xb1, 0x59,
+        0xe0, 0x6d, 0xc3, 0x92, 0x2d, 0x40, 0x0d, 0x70, 0x9f, 0xd1, 0xb1, 0x26, 0x20, 0x3e, 0x05, 0xa9,
+        0x13, 0x91, 0xaf, 0x3a, 0x57, 0xd4, 0x60, 0xbb, 0xf4, 0x8e, 0xd3, 0xfa, 0x7b, 0x05, 0x16, 0x3a,
+        0xbd, 0xa7, 0x74, 0x48, 0x44, 0x4a, 0x9d, 0x50, 0x96, 0x04, 0x9a, 0x99, 0x8b, 0xcd, 0x10, 0xdd,
+        0x80, 0xca, 0x93, 0x41, 0xd4, 0x7b, 0x26, 0x97, 0xd7, 0xb7, 0x3e, 0x61, 0x51, 0x53, 0x6b, 0xdb,
+        0xef, 0x09, 0x31, 0x56, 0x28, 0xef, 0x17, 0x0e, 0x54, 0xe4, 0xc4, 0x19, 0x2a, 0xbf, 0x02, 0x90,
+        0x06, 0x2f, 0xd1, 0x5b, 0x7e, 0x79, 0x56, 0x6f, 0x9a, 0x1e, 0xd8, 0x82, 0xa3, 0x77, 0xa1, 0x2e,
+        0x2d, 0x75, 0xf9, 0x38, 0xa6, 0x49, 0xd3, 0x9d, 0xc9, 0x2a, 0xbd, 0xfa, 0x90, 0x26, 0x9c, 0xfa,
+        0x8a, 0x1b, 0xc8, 0x15, 0x0f, 0xc4, 0x02, 0xef, 0x0f, 0x0e, 0xd4, 0x52, 0xcd, 0x22, 0x1c, 0x59,
+        0x56, 0x61, 0xf9, 0x2d, 0xe6, 0x84, 0x6e, 0x73, 0x7a, 0xc5, 0x37, 0x5a, 0x87, 0xba, 0x4f, 0x93,
+        0x1e, 0x0b, 0x62, 0x2e, 0x36, 0xa4, 0x4e, 0x97, 0x3d, 0x85, 0x3c, 0xa8, 0x32, 0xfa, 0xe1, 0x28,
+        0x60, 0xd4, 0x97, 0x27, 0xac, 0x8a, 0xd3, 0xb1, 0x90, 0x45, 0x12, 0x45, 0x06, 0xcd, 0x8a, 0x92,
+        0x99, 0xb1, 0x90, 0xf5, 0xa2, 0x61, 0x3c, 0xe2, 0xd4, 0x6f, 0x2e, 0x28, 0x99, 0x19, 0xa3, 0x57,
+        0xa0, 0x96, 0xd0, 0x30, 0x09, 0x78, 0x70, 0x42, 0x9b, 0x8b, 0x52, 0x98, 0x4d, 0x78, 0xbf, 0x2a,
+        0x41, 0xdd, 0xda, 0x25, 0x7a, 0x19, 0x6a, 0x82, 0xab, 0x75, 0x4c, 0x70, 0x55, 0x4c, 0xc8, 0xf3,
+        0xf1, 0x62, 0x61, 0x44, 0xbb, 0xb0, 0x18, 0xd2, 0x84, 0x8b, 0x33, 0xe4, 0xca, 0xea, 0xf4, 0xda,
+        0x99, 0x1e, 0x96, 0xdf, 0x41, 0xd8, 0xbf, 0x1f, 0xf9, 0x14, 0x9b, 0x95, 0x82, 0xd0, 0x30, 0x08,
+        0xbb, 0x01, 0xa7, 0xc3, 0x44, 0xfa, 0xc4, 0xc5, 0xd5, 0x61, 0x10, 0x1e, 0x88, 0xb1, 0x14, 0x92,
+        0x53, 0x2d, 0xac, 0x68, 0x21, 0x39, 0x95, 0xc2, 0xd6, 0x7d, 0xb5, 0x33, 0xad, 0x71, 0xb2, 0xf4,
+        0x00, 0x2c, 0x74, 0x0e, 0x0e, 0xf7, 0xef, 0xed, 0x35, 0x1c, 0x54, 0x85, 0xf2, 0xbd, 0x83, 0xce,
+        0x83, 0x46, 0x09, 0x2d, 0x82, 0xdb, 0xd9, 0x7b, 0xd0, 0x70, 0xc5, 0xc7, 0xfd, 0x9d, 0xa3, 0x46,
+        0x59, 0x94, 0xa8, 0x7d, 0xfc, 0xfe, 0xc3, 0xa3, 0x46, 0xa5, 0xf5, 0x93, 0x32, 0xac, 0xed, 0x53,
+        0x7e, 0xc4, 0xa2, 0x93, 0xc0, 0xa7, 0x4c, 0xf1, 0xb7, 0x0f, 0xf1, 0xbf, 0x5c, 0xeb, 0x14, 0xdf,
+        0x80, 0x6a, 0xac, 0x91, 0xd2, 0x8d, 0xf5, 0xad, 0xb5, 0x99, 0xcd, 0xe3, 0x14, 0x82, 0x28, 0x34,
+        0x18, 0x4d, 0xa2, 0x11, 0xeb, 0xd1, 0x6e, 0x22, 0x85, 0x26, 0xa7, 0xb7, 0xad, 0x65, 0x33, 0xe6,
+        0xdb, 0xc6, 0x9e, 0xf8, 0x90, 0xab, 0xd5, 0x7c, 0xa2, 0x0e, 0xf8, 0x2a, 0x9b, 0x9c, 0x45, 0x03,
+        0xb8, 0xea, 0x13, 0x4e, 0xba, 0x53, 0x96, 0x54, 0xfe, 0xdf, 0x2e, 0x66, 0xe9, 0x0e, 0xe1, 0xa4,
+        0x33, 0x6b, 0x6b, 0xcd, 0x9f, 0x9e, 0x47, 0x6f, 0x43, 0xdd, 0x4f, 0x7b, 0x90, 0x08, 0x9e, 0xb0,
+        0xf2, 0x52, 0x6e, 0x87, 0xc2, 0x36, 0xd2, 0x7b, 0x08, 0xd7, 0xf2, 0xf6, 0x93, 0x53, 0x97, 0x36,
+        0xec, 0xba, 0x94, 0xeb, 0xe3, 0xac, 0x54, 0x79, 0x8f, 0xe1, 0x7a, 0x3e, 0xf9, 0x4b, 0x2a, 0x6e,
+        0xfd, 0xc9, 0x81, 0x97, 0x8e, 0x18, 0x8d, 0x09, 0xa3, 0xc6, 0x6b, 0xbb, 0x51, 0x78, 0x1c, 0xf4,
+        0xbd, 0xed, 0x34, 0x3d, 0xd0, 0x4d, 0x58, 0xe8, 0xc9, 0x49, 0x9d, 0x0f, 0xf6, 0xe9, 0xb1, 0xaf,
+        0x04, 0x58, 0xc3, 0xbc, 0xef, 0x39, 0x56, 0x3e, 0x7d, 0x15, 0x56, 0x63, 0x65, 0xc1, 0xef, 0x16,
+        0x53, 0xb3, 0x62, 0xf0, 0x8a, 0xca, 0x74, 0x34, 0x4a, 0x45, 0xa3, 0xd1, 0xfa, 0x41, 0x09, 0xae,
+        0x3d, 0x8c, 0xfb, 0x8c, 0xf8, 0x34, 0x8d, 0x8a, 0x68, 0x26, 0x1e, 0xcb, 0x36, 0x77, 0x66, 0xd9,
+        0xb0, 0x8a, 0x78, 0x69, 0xb2, 0x88, 0xbf, 0x09, 0x35, 0x46, 0x9e, 0x77, 0x13, 0xa1, 0x4e, 0xd6,
+        0x88, 0xfa, 0xd6, 0xd5, 0x9c, 0xb6, 0x85, 0xab, 0x4c, 0x7f, 0x79, 0xdf, 0xb5, 0x9d, 0xf2, 0x2e,
+        0xac, 0x8c, 0x14, 0x31, 0x5f, 0xeb, 0x38, 0xc7, 0x27, 0xcb, 0x06, 0xae, 0xfa, 0xe8, 0x85, 0x5d,
+        0xf2, 0x3b, 0x07, 0xbc, 0x47, 0x64, 0x10, 0xf8, 0x82, 0x9c, 0xf6, 0x89, 0xe8, 0x0c, 0x3a, 0xea,
+        0x8f, 0x0b, 0x3a, 0x26, 0x4b, 0x89, 0x52, 0xb1, 0x94, 0xd8, 0xb5, 0x36, 0x3f, 0x45, 0xde, 0x29,
+        0x4c, 0xfe, 0x37, 0x0e, 0x34, 0x0d, 0xf9, 0xec, 0x3c, 0xfc, 0x5f, 0x50, 0xff, 0xad, 0x03, 0x35,
+        0x45, 0x74, 0xc4, 0xa8, 0xd7, 0xcf, 0xb8, 0xbe, 0x0e, 0x6b, 0x9c, 0x32, 0x46, 0x8e, 0x23, 0x36,
+        0xec, 0xda, 0x37, 0x86, 0x1a, 0x6e, 0xa4, 0x82, 0x47, 0x3a, 0xeb, 0xfe, 0x37, 0xdc, 0xff, 0xe9,
+        0xc0, 0x12, 0xa6, 0xc4, 0x37, 0xf9, 0xe2, 0xf9, 0x05, 0x5d, 0x7d, 0x1b, 0x96, 0x7b, 0x23, 0xc6,
+        0xc4, 0x2d, 0x53, 0x25, 0xf9, 0x39, 0xac, 0x97, 0x34, 0x5a, 0x1d, 0x98, 0xb1, 0xc5, 0xfd, 0x8b,
+        0x50, 0x0b, 0xe9, 0xf3, 0x62, 0x47, 0xa5, 0x1a, 0xd2, 0xe7, 0x97, 0x3c, 0x25, 0xbf, 0x2e, 0x03,
+        0x3a, 0x1a, 0x90, 0xd0, 0xec, 0x78, 0xf7, 0x29, 0x09, 0xfb, 0xd4, 0xfb, 0x8f, 0x53, 0x70, 0xe3,
+        0xef, 0x40, 0x3d, 0x66, 0x41, 0xc4, 0x8a, 0x6d, 0x1b, 0x24, 0x56, 0x51, 0xde, 0x03, 0x14, 0xb3,
+        0x28, 0x8e, 0x12, 0xea, 0x77, 0xb3, 0x1d, 0xbb, 0x67, 0x2b, 0x68, 0x98, 0x25, 0x87, 0x66, 0xe7,
+        0x59, 0xa2, 0x94, 0x0b, 0x25, 0x0a, 0xfa, 0x2c, 0x2c, 0x2b, 0xc6, 0x31, 0x0b, 0x4e, 0x84, 0xc9,
+        0x8a, 0xbc, 0xfe, 0x2d, 0xc9, 0xc9, 0x23, 0x35, 0xe7, 0xfd, 0xbc, 0x64, 0x85, 0xe4, 0x36, 0x2c,
+        0xc7, 0x03, 0x12, 0x86, 0x45, 0x2b, 0xd8, 0x92, 0x46, 0x2b, 0x82, 0xbb, 0xe2, 0xda, 0x20, 0xef,
+        0x87, 0x49, 0x97, 0xd1, 0x78, 0x40, 0x7a, 0x54, 0xc7, 0x67, 0xfe, 0xcb, 0x6c, 0xd5, 0xac, 0xc0,
+        0x6a, 0x01, 0xda, 0x80, 0x55, 0x43, 0xc1, 0xd0, 0x76, 0x25, 0xed, 0x15, 0x3d, 0xad, 0x89, 0x5f,
+        0xb8, 0x9f, 0xa3, 0x37, 0x00, 0x0d, 0x68, 0x9f, 0xf4, 0xc6, 0xf2, 0xbe, 0xdd, 0x4d, 0xc6, 0x09,
+        0xa7, 0x43, 0x7d, 0x89, 0x6d, 0x28, 0x89, 0xa8, 0x9e, 0x1d, 0x39, 0xdf, 0xfa, 0xa3, 0x0b, 0x57,
+        0x77, 0xe2, 0x78, 0x30, 0x9e, 0xca, 0x9b, 0x7f, 0x7f, 0xfc, 0x79, 0x33, 0x13, 0x0d, 0xf7, 0x45,
+        0xa2, 0xf1, 0xc2, 0xe9, 0x92, 0xe3, 0xf9, 0x4a, 0x9e, 0xe7, 0xbd, 0xdf, 0x3b, 0x97, 0x3e, 0xc5,
+        0x4d, 0x58, 0x34, 0x36, 0xd4, 0x9b, 0xc4, 0x0c, 0xa7, 0xc3, 0xea, 0x5e, 0x32, 0xac, 0xe5, 0x39,
+        0x61, 0xfd, 0x47, 0x09, 0xae, 0x1e, 0x0c, 0xe3, 0x88, 0xf1, 0xc9, 0x5b, 0xc4, 0x5b, 0x05, 0xa3,
+        0xba, 0x02, 0xa5, 0xc0, 0xd7, 0xef, 0xcf, 0x52, 0xe0, 0x7b, 0xa7, 0xd0, 0x50, 0xea, 0x68, 0x5a,
+        0x52, 0xcf, 0x7d, 0xbd, 0x14, 0x4a, 0x08, 0x85, 0xb2, 0x1d, 0xe6, 0x4e, 0x38, 0xcc, 0xfb, 0xa5,
+        0x1d, 0x8d, 0x0f, 0x00, 0x05, 0x9a, 0x46, 0xd7, 0x5c, 0xb7, 0x4d, 0x5b, 0xb8, 0x69, 0x99, 0xc8,
+        0xd9, 0x7a, 0x7b, 0x9a, 0x3f, 0x5e, 0x0b, 0xa6, 0x66, 0x92, 0x8b, 0x57, 0xdf, 0xbf, 0x38, 0xb0,
+        0x22, 0xfa, 0x4d, 0xd6, 0xe2, 0x3f, 0xbe, 0xe6, 0xce, 0x26, 0x5e, 0x3e, 0x95, 0x42, 0xa9, 0xa9,
+        0xdd, 0x7c, 0xe1, 0xfd, 0xfd, 0xd4, 0x81, 0x6b, 0xe6, 0x99, 0x22, 0xda, 0x7a, 0xde, 0x93, 0xec,
+        0xd4, 0xe2, 0x75, 0x4b, 0x54, 0x85, 0x14, 0x3b, 0xff, 0x51, 0x66, 0xa3, 0x2e, 0xce, 0xee, 0x67,
+        0x0e, 0x7c, 0xd2, 0x5c, 0xb2, 0x2c, 0x8a, 0x1f, 0xc1, 0xb3, 0xe0, 0x23, 0xb9, 0x8c, 0xfc, 0xcd,
+        0x81, 0xb5, 0x94, 0x56, 0x7a, 0x23, 0x49, 0x2e, 0x4e, 0x0b, 0xbd, 0x0d, 0xd0, 0x8b, 0xc2, 0x90,
+        0xf6, 0xb8, 0xb9, 0xe7, 0x9f, 0x55, 0x73, 0x33, 0xa8, 0xf7, 0x2d, 0x6b, 0x3f, 0xd7, 0x61, 0x21,
+        0x1a, 0xf1, 0x78, 0xc4, 0x75, 0x4a, 0xea, 0xd1, 0x85, 0xc3, 0xb0, 0xf5, 0xe3, 0x1a, 0x54, 0xcd,
+        0x93, 0x0c, 0x7d, 0x13, 0x6a, 0xfb, 0x94, 0xeb, 0x1f, 0xab, 0x3e, 0x77, 0xce, 0x6b, 0x57, 0x25,
+        0xd0, 0xe7, 0x0b, 0xbd, 0x89, 0xd1, 0x60, 0xce, 0xfb, 0x0f, 0x6d, 0x5a, 0xeb, 0x73, 0x11, 0xa9,
+        0xa5, 0xd7, 0x0a, 0x20, 0xb5, 0xb5, 0xef, 0x9c, 0xf5, 0xf8, 0x40, 0x37, 0x2c, 0x45, 0xf3, 0x61,
+        0xa9, 0xdd, 0x76, 0x51, 0xb8, 0x36, 0x3e, 0x9a, 0xff, 0x78, 0x40, 0xaf, 0xe7, 0xe8, 0x9a, 0x06,
+        0xa5, 0x86, 0xdf, 0x28, 0x06, 0xd6, 0x66, 0x83, 0xfc, 0x37, 0x28, 0xda, 0xb0, 0xb4, 0xe4, 0x01,
+        0x52, 0x73, 0x9b, 0xe7, 0x03, 0xb5, 0xa9, 0xbb, 0xd6, 0x1b, 0x03, 0xbd, 0x62, 0x2d, 0x4b, 0x67,
+        0x53, 0xa5, 0xaf, 0xce, 0x91, 0x6a, 0x4d, 0xdf, 0x98, 0xbc, 0xf1, 0xa3, 0x4f, 0xdb, 0x6f, 0x5b,
+        0x4b, 0x90, 0xea, 0x5b, 0x9f, 0x0f, 0xd0, 0x2a, 0x7b, 0x79, 0x57, 0x6a, 0x64, 0xa7, 0xe9, 0xac,
+        0x38, 0x55, 0xff, 0x85, 0xf3, 0x60, 0xda, 0xc8, 0x71, 0xee, 0x05, 0x0c, 0xd9, 0xcb, 0x73, 0xe4,
+        0xa9, 0x99, 0x8d, 0x73, 0x71, 0x99, 0x9d, 0x9c, 0xb6, 0x38, 0x61, 0x27, 0xaf, 0x6d, 0xe6, 0xd9,
+        0xc9, 0xc7, 0x69, 0x3b, 0x8f, 0xa7, 0x3b, 0x21, 0xfa, 0xcc, 0x94, 0xa3, 0x33, 0x51, 0xaa, 0xbd,
+        0x75, 0x16, 0x44, 0x2b, 0xfe, 0xb2, 0xfa, 0x29, 0x1f, 0x4d, 0xfc, 0x12, 0xca, 0xa3, 0x38, 0x55,
+        0xd2, 0x9c, 0x15, 0xa8, 0xa5, 0x5b, 0xdf, 0x77, 0xa1, 0x6e, 0x35, 0x06, 0xf4, 0x81, 0x5d, 0x9c,
+        0x36, 0x72, 0xca, 0x8e, 0xdd, 0xe3, 0x72, 0xb3, 0x7a, 0x0e, 0x50, 0x53, 0x3d, 0x3d, 0xa3, 0x1f,
+        0xa1, 0xbc, 0xb3, 0x38, 0x83, 0x4a, 0x8d, 0xde, 0x28, 0x88, 0xd6, 0x96, 0x9f, 0xe4, 0xb4, 0x9a,
+        0x89, 0xf2, 0x3b, 0x23, 0xcd, 0x2d, 0xbf, 0x79, 0x28, 0x65, 0xe1, 0x4d, 0xe7, 0x12, 0x81, 0x78,
+        0xb2, 0x20, 0xff, 0xa3, 0xbb, 0xf5, 0xdf, 0x00, 0x00, 0x00, 0xff, 0xff, 0xc8, 0x16, 0x0b, 0x32,
+        0xb6, 0x1b, 0x00, 0x00,
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.proto b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.proto
new file mode 100644
index 0000000..370faf7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.proto
@@ -0,0 +1,351 @@
+// Terraform Plugin RPC protocol version 5.0
+//
+// This file defines version 5.0 of the RPC protocol. To implement a plugin
+// against this protocol, copy this definition into your own codebase and
+// use protoc to generate stubs for your target language.
+//
+// This file will be updated in-place in the source Terraform repository for
+// any minor versions of protocol 5, but later minor versions will always be
+// backwards compatible. Breaking changes, if any are required, will come
+// in a subsequent major version with its own separate proto definition.
+//
+// Note that only the proto files included in a release tag of Terraform are
+// official protocol releases. Proto files taken from other commits may include
+// incomplete changes or features that did not make it into a final release.
+// In all reasonable cases, plugin developers should take the proto file from
+// the tag of the most recent release of Terraform, and not from the master
+// branch or any other development branch.
+//
+syntax = "proto3";
+
+package tfplugin5;
+
+// DynamicValue is an opaque encoding of terraform data, with the field name
+// indicating the encoding scheme used.
+message DynamicValue {
+    bytes msgpack = 1;
+    bytes json = 2;
+}
+
+message Diagnostic {
+    enum Severity {
+        INVALID = 0;
+        ERROR = 1;
+        WARNING = 2;
+    }
+    Severity severity = 1;
+    string summary = 2;
+    string detail = 3;
+    AttributePath attribute = 4;
+}
+
+message AttributePath {
+    message Step {
+        oneof selector {
+            // Set "attribute_name" to represent looking up an attribute
+            // in the current object value.
+            string attribute_name = 1;
+            // Set "element_key_*" to represent looking up an element in
+            // an indexable collection type.
+            string element_key_string = 2;
+            int64 element_key_int = 3;
+        }
+    }
+    repeated Step steps = 1;
+}
+
+message Stop {
+    message Request {
+    }
+    message Response {
+                string Error = 1;
+    }
+}
+
+// RawState holds the stored state for a resource to be upgraded by the
+// provider. It can be in one of two formats, the current json encoded format
+// in bytes, or the legacy flatmap format as a map of strings.
+message RawState {
+    bytes json = 1;
+    map<string, string> flatmap = 2;
+}
+
+// Schema is the configuration schema for a Resource, Provider, or Provisioner.
+message Schema {
+    message Block {
+        int64 version = 1;
+        repeated Attribute attributes = 2;
+        repeated NestedBlock block_types = 3;
+    }
+
+    message Attribute {
+        string name = 1;
+        bytes type = 2;
+        string description = 3;
+        bool required = 4;
+        bool optional = 5;
+        bool computed = 6;
+        bool sensitive = 7;
+    }
+
+    message NestedBlock {
+        enum NestingMode {
+            INVALID = 0;
+            SINGLE = 1;
+            LIST = 2;
+            SET = 3;
+            MAP = 4;
+            GROUP = 5;
+        }
+
+        string type_name = 1;
+        Block block = 2;
+        NestingMode nesting = 3;
+        int64 min_items = 4;
+        int64 max_items = 5;
+    }
+
+    // The version of the schema.
+    // Schemas are versioned, so that providers can upgrade a saved resource
+    // state when the schema is changed. 
+    int64 version = 1;
+
+    // Block is the top level configuration block for this schema.
+    Block block = 2;
+}
+
+service Provider {
+    //////// Information about what a provider supports/expects
+    rpc GetSchema(GetProviderSchema.Request) returns (GetProviderSchema.Response);
+    rpc PrepareProviderConfig(PrepareProviderConfig.Request) returns (PrepareProviderConfig.Response);
+    rpc ValidateResourceTypeConfig(ValidateResourceTypeConfig.Request) returns (ValidateResourceTypeConfig.Response);
+    rpc ValidateDataSourceConfig(ValidateDataSourceConfig.Request) returns (ValidateDataSourceConfig.Response);
+    rpc UpgradeResourceState(UpgradeResourceState.Request) returns (UpgradeResourceState.Response);
+
+    //////// One-time initialization, called before other functions below
+    rpc Configure(Configure.Request) returns (Configure.Response);
+
+    //////// Managed Resource Lifecycle
+    rpc ReadResource(ReadResource.Request) returns (ReadResource.Response);
+    rpc PlanResourceChange(PlanResourceChange.Request) returns (PlanResourceChange.Response);
+    rpc ApplyResourceChange(ApplyResourceChange.Request) returns (ApplyResourceChange.Response);
+    rpc ImportResourceState(ImportResourceState.Request) returns (ImportResourceState.Response);
+
+    rpc ReadDataSource(ReadDataSource.Request) returns (ReadDataSource.Response);
+
+    //////// Graceful Shutdown
+    rpc Stop(Stop.Request) returns (Stop.Response);
+}
+
+message GetProviderSchema {
+    message Request {
+    }
+    message Response {
+        Schema provider = 1;
+        map<string, Schema> resource_schemas = 2;
+        map<string, Schema> data_source_schemas = 3;
+        repeated Diagnostic diagnostics = 4;
+    }
+}
+
+message PrepareProviderConfig {
+    message Request {
+        DynamicValue config = 1;
+    }
+    message Response {
+        DynamicValue prepared_config = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message UpgradeResourceState {
+    message Request {
+        string type_name = 1;
+
+        // version is the schema_version number recorded in the state file
+        int64 version = 2;
+
+        // raw_state is the raw states as stored for the resource.  Core does
+        // not have access to the schema of prior_version, so it's the
+        // provider's responsibility to interpret this value using the
+        // appropriate older schema. The raw_state will be the json encoded
+        // state, or a legacy flat-mapped format.
+        RawState raw_state = 3;
+    }
+    message Response {
+        // new_state is a msgpack-encoded data structure that, when interpreted with
+        // the _current_ schema for this resource type, is functionally equivalent to
+        // that which was given in prior_state_raw.
+        DynamicValue upgraded_state = 1;
+
+        // diagnostics describes any errors encountered during migration that could not
+        // be safely resolved, and warnings about any possibly-risky assumptions made
+        // in the upgrade process.
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message ValidateResourceTypeConfig {
+    message Request {
+        string type_name = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message ValidateDataSourceConfig {
+    message Request {
+        string type_name = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message Configure {
+    message Request {
+        string terraform_version = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message ReadResource {
+    message Request {
+        string type_name = 1;
+        DynamicValue current_state = 2;
+    }
+    message Response {
+        DynamicValue new_state = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message PlanResourceChange {
+    message Request {
+        string type_name = 1;
+        DynamicValue prior_state = 2;
+        DynamicValue proposed_new_state = 3;
+        DynamicValue config = 4;
+        bytes prior_private = 5; 
+    }
+
+    message Response {
+        DynamicValue planned_state = 1;
+        repeated AttributePath requires_replace = 2;
+        bytes planned_private = 3; 
+        repeated Diagnostic diagnostics = 4;
+
+
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        bool legacy_type_system = 5;
+    }
+}
+
+message ApplyResourceChange {
+    message Request {
+        string type_name = 1;
+        DynamicValue prior_state = 2;
+        DynamicValue planned_state = 3;
+        DynamicValue config = 4;
+        bytes planned_private = 5; 
+    }
+    message Response {
+        DynamicValue new_state = 1;
+        bytes private = 2; 
+        repeated Diagnostic diagnostics = 3;
+
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        bool legacy_type_system = 4;
+    }
+}
+
+message ImportResourceState {
+    message Request {
+        string type_name = 1;
+        string id = 2;
+    }
+
+    message ImportedResource {
+        string type_name = 1;
+        DynamicValue state = 2;
+        bytes private = 3;
+    }
+
+    message Response {
+        repeated ImportedResource imported_resources = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message ReadDataSource {
+    message Request {
+        string type_name = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        DynamicValue state = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+service Provisioner {
+    rpc GetSchema(GetProvisionerSchema.Request) returns (GetProvisionerSchema.Response);
+    rpc ValidateProvisionerConfig(ValidateProvisionerConfig.Request) returns (ValidateProvisionerConfig.Response);
+    rpc ProvisionResource(ProvisionResource.Request) returns (stream ProvisionResource.Response);
+    rpc Stop(Stop.Request) returns (Stop.Response);
+}
+
+message GetProvisionerSchema {
+    message Request {
+    }
+    message Response {
+        Schema provisioner = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message ValidateProvisionerConfig {
+    message Request {
+        DynamicValue config = 1;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message ProvisionResource {
+    message Request {
+        DynamicValue config = 1;
+        DynamicValue connection = 2;
+    }
+    message Response {
+        string output  = 1;
+        repeated Diagnostic diagnostics = 2;
+    }   
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/doc.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/doc.go
new file mode 100644
index 0000000..8f89909
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/doc.go
@@ -0,0 +1,5 @@
+// Package blocktoattr includes some helper functions that can perform
+// preprocessing on a HCL body where a configschema.Block schema is available
+// in order to allow list and set attributes defined in the schema to be
+// optionally written by the user as block syntax.
+package blocktoattr
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/fixup.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/fixup.go
new file mode 100644
index 0000000..d8c2e77
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/fixup.go
@@ -0,0 +1,187 @@
+package blocktoattr
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// FixUpBlockAttrs takes a raw HCL body and adds some additional normalization
+// functionality to allow attributes that are specified as having list or set
+// type in the schema to be written with HCL block syntax as multiple nested
+// blocks with the attribute name as the block type.
+//
+// This partially restores some of the block/attribute confusion from HCL 1
+// so that existing patterns that depended on that confusion can continue to
+// be used in the short term while we settle on a longer-term strategy.
+//
+// Most of the fixup work is actually done when the returned body is
+// subsequently decoded, so while FixUpBlockAttrs always succeeds, the eventual
+// decode of the body might not, if the content of the body is so ambiguous
+// that there's no safe way to map it to the schema.
+func FixUpBlockAttrs(body hcl.Body, schema *configschema.Block) hcl.Body {
+        // The schema should never be nil, but in practice it seems to be sometimes
+        // in the presence of poorly-configured test mocks, so we'll be robust
+        // by synthesizing an empty one.
+        if schema == nil {
+                schema = &configschema.Block{}
+        }
+
+        return &fixupBody{
+                original: body,
+                schema:   schema,
+                names:    ambiguousNames(schema),
+        }
+}
+
+type fixupBody struct {
+        original hcl.Body
+        schema   *configschema.Block
+        names    map[string]struct{}
+}
+
+// Content decodes content from the body. The given schema must be the lower-level
+// representation of the same schema that was previously passed to FixUpBlockAttrs,
+// or else the result is undefined.
+func (b *fixupBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        schema = b.effectiveSchema(schema)
+        content, diags := b.original.Content(schema)
+        return b.fixupContent(content), diags
+}
+
+func (b *fixupBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        schema = b.effectiveSchema(schema)
+        content, remain, diags := b.original.PartialContent(schema)
+        remain = &fixupBody{
+                original: remain,
+                schema:   b.schema,
+                names:    b.names,
+        }
+        return b.fixupContent(content), remain, diags
+}
+
+func (b *fixupBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        // FixUpBlockAttrs is not intended to be used in situations where we'd use
+        // JustAttributes, so we just pass this through verbatim to complete our
+        // implementation of hcl.Body.
+        return b.original.JustAttributes()
+}
+
+func (b *fixupBody) MissingItemRange() hcl.Range {
+        return b.original.MissingItemRange()
+}
+
+// effectiveSchema produces a derived *hcl.BodySchema by sniffing the body's
+// content to determine whether the author has used attribute or block syntax
+// for each of the ambigious attributes where both are permitted.
+//
+// The resulting schema will always contain all of the same names that are
+// in the given schema, but some attribute schemas may instead be replaced by
+// block header schemas.
+func (b *fixupBody) effectiveSchema(given *hcl.BodySchema) *hcl.BodySchema {
+        return effectiveSchema(given, b.original, b.names, true)
+}
+
+func (b *fixupBody) fixupContent(content *hcl.BodyContent) *hcl.BodyContent {
+        var ret hcl.BodyContent
+        ret.Attributes = make(hcl.Attributes)
+        for name, attr := range content.Attributes {
+                ret.Attributes[name] = attr
+        }
+        blockAttrVals := make(map[string][]*hcl.Block)
+        for _, block := range content.Blocks {
+                if _, exists := b.names[block.Type]; exists {
+                        // If we get here then we've found a block type whose instances need
+                        // to be re-interpreted as a list-of-objects attribute. We'll gather
+                        // those up and fix them up below.
+                        blockAttrVals[block.Type] = append(blockAttrVals[block.Type], block)
+                        continue
+                }
+
+                // We need to now re-wrap our inner body so it will be subject to the
+                // same attribute-as-block fixup when recursively decoded.
+                retBlock := *block // shallow copy
+                if blockS, ok := b.schema.BlockTypes[block.Type]; ok {
+                        // Would be weird if not ok, but we'll allow it for robustness; body just won't be fixed up, then
+                        retBlock.Body = FixUpBlockAttrs(retBlock.Body, &blockS.Block)
+                }
+
+                ret.Blocks = append(ret.Blocks, &retBlock)
+        }
+        // No we'll install synthetic attributes for each of our fixups. We can't
+        // do this exactly because HCL's information model expects an attribute
+        // to be a single decl but we have multiple separate blocks. We'll
+        // approximate things, then, by using only our first block for the source
+        // location information. (We are guaranteed at least one by the above logic.)
+        for name, blocks := range blockAttrVals {
+                ret.Attributes[name] = &hcl.Attribute{
+                        Name: name,
+                        Expr: &fixupBlocksExpr{
+                                blocks: blocks,
+                                ety:    b.schema.Attributes[name].Type.ElementType(),
+                        },
+
+                        Range:     blocks[0].DefRange,
+                        NameRange: blocks[0].TypeRange,
+                }
+        }
+        return &ret
+}
+
+type fixupBlocksExpr struct {
+        blocks hcl.Blocks
+        ety    cty.Type
+}
+
+func (e *fixupBlocksExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        // In order to produce a suitable value for our expression we need to
+        // now decode the whole descendent block structure under each of our block
+        // bodies.
+        //
+        // That requires us to do something rather strange: we must construct a
+        // synthetic block type schema derived from the element type of the
+        // attribute, thus inverting our usual direction of lowering a schema
+        // into an implied type. Because a type is less detailed than a schema,
+        // the result is imprecise and in particular will just consider all
+        // the attributes to be optional and let the provider eventually decide
+        // whether to return errors if they turn out to be null when required.
+        schema := SchemaForCtyElementType(e.ety) // this schema's ImpliedType will match e.ety
+        spec := schema.DecoderSpec()
+
+        vals := make([]cty.Value, len(e.blocks))
+        var diags hcl.Diagnostics
+        for i, block := range e.blocks {
+                body := FixUpBlockAttrs(block.Body, schema)
+                val, blockDiags := hcldec.Decode(body, spec, ctx)
+                diags = append(diags, blockDiags...)
+                if val == cty.NilVal {
+                        val = cty.UnknownVal(e.ety)
+                }
+                vals[i] = val
+        }
+        if len(vals) == 0 {
+                return cty.ListValEmpty(e.ety), diags
+        }
+        return cty.ListVal(vals), diags
+}
+
+func (e *fixupBlocksExpr) Variables() []hcl.Traversal {
+        var ret []hcl.Traversal
+        schema := SchemaForCtyElementType(e.ety)
+        spec := schema.DecoderSpec()
+        for _, block := range e.blocks {
+                ret = append(ret, hcldec.Variables(block.Body, spec)...)
+        }
+        return ret
+}
+
+func (e *fixupBlocksExpr) Range() hcl.Range {
+        // This is not really an appropriate range for the expression but it's
+        // the best we can do from here.
+        return e.blocks[0].DefRange
+}
+
+func (e *fixupBlocksExpr) StartRange() hcl.Range {
+        return e.blocks[0].DefRange
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/schema.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/schema.go
new file mode 100644
index 0000000..2f2463a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/schema.go
@@ -0,0 +1,145 @@
+package blocktoattr
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+func ambiguousNames(schema *configschema.Block) map[string]struct{} {
+        if schema == nil {
+                return nil
+        }
+        ambiguousNames := make(map[string]struct{})
+        for name, attrS := range schema.Attributes {
+                aty := attrS.Type
+                if (aty.IsListType() || aty.IsSetType()) && aty.ElementType().IsObjectType() {
+                        ambiguousNames[name] = struct{}{}
+                }
+        }
+        return ambiguousNames
+}
+
+func effectiveSchema(given *hcl.BodySchema, body hcl.Body, ambiguousNames map[string]struct{}, dynamicExpanded bool) *hcl.BodySchema {
+        ret := &hcl.BodySchema{}
+
+        appearsAsBlock := make(map[string]struct{})
+        {
+                // We'll construct some throwaway schemas here just to probe for
+                // whether each of our ambiguous names seems to be being used as
+                // an attribute or a block. We need to check both because in JSON
+                // syntax we rely on the schema to decide between attribute or block
+                // interpretation and so JSON will always answer yes to both of
+                // these questions and we want to prefer the attribute interpretation
+                // in that case.
+                var probeSchema hcl.BodySchema
+
+                for name := range ambiguousNames {
+                        probeSchema = hcl.BodySchema{
+                                Attributes: []hcl.AttributeSchema{
+                                        {
+                                                Name: name,
+                                        },
+                                },
+                        }
+                        content, _, _ := body.PartialContent(&probeSchema)
+                        if _, exists := content.Attributes[name]; exists {
+                                // Can decode as an attribute, so we'll go with that.
+                                continue
+                        }
+                        probeSchema = hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type: name,
+                                        },
+                                },
+                        }
+                        content, _, _ = body.PartialContent(&probeSchema)
+                        if len(content.Blocks) > 0 {
+                                // No attribute present and at least one block present, so
+                                // we'll need to rewrite this one as a block for a successful
+                                // result.
+                                appearsAsBlock[name] = struct{}{}
+                        }
+                }
+                if !dynamicExpanded {
+                        // If we're deciding for a context where dynamic blocks haven't
+                        // been expanded yet then we need to probe for those too.
+                        probeSchema = hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type:       "dynamic",
+                                                LabelNames: []string{"type"},
+                                        },
+                                },
+                        }
+                        content, _, _ := body.PartialContent(&probeSchema)
+                        for _, block := range content.Blocks {
+                                if _, exists := ambiguousNames[block.Labels[0]]; exists {
+                                        appearsAsBlock[block.Labels[0]] = struct{}{}
+                                }
+                        }
+                }
+        }
+
+        for _, attrS := range given.Attributes {
+                if _, exists := appearsAsBlock[attrS.Name]; exists {
+                        ret.Blocks = append(ret.Blocks, hcl.BlockHeaderSchema{
+                                Type: attrS.Name,
+                        })
+                } else {
+                        ret.Attributes = append(ret.Attributes, attrS)
+                }
+        }
+
+        // Anything that is specified as a block type in the input schema remains
+        // that way by just passing through verbatim.
+        ret.Blocks = append(ret.Blocks, given.Blocks...)
+
+        return ret
+}
+
+// SchemaForCtyElementType converts a cty object type into an
+// approximately-equivalent configschema.Block representing the element of
+// a list or set. If the given type is not an object type then this
+// function will panic.
+func SchemaForCtyElementType(ty cty.Type) *configschema.Block {
+        atys := ty.AttributeTypes()
+        ret := &configschema.Block{
+                Attributes: make(map[string]*configschema.Attribute, len(atys)),
+        }
+        for name, aty := range atys {
+                ret.Attributes[name] = &configschema.Attribute{
+                        Type:     aty,
+                        Optional: true,
+                }
+        }
+        return ret
+}
+
+// SchemaForCtyContainerType converts a cty list-of-object or set-of-object type
+// into an approximately-equivalent configschema.NestedBlock. If the given type
+// is not of the expected kind then this function will panic.
+func SchemaForCtyContainerType(ty cty.Type) *configschema.NestedBlock {
+        var nesting configschema.NestingMode
+        switch {
+        case ty.IsListType():
+                nesting = configschema.NestingList
+        case ty.IsSetType():
+                nesting = configschema.NestingSet
+        default:
+                panic("unsuitable type")
+        }
+        nested := SchemaForCtyElementType(ty.ElementType())
+        return &configschema.NestedBlock{
+                Nesting: nesting,
+                Block:   *nested,
+        }
+}
+
+// TypeCanBeBlocks returns true if the given type is a list-of-object or
+// set-of-object type, and would thus be subject to the blocktoattr fixup
+// if used as an attribute type.
+func TypeCanBeBlocks(ty cty.Type) bool {
+        return (ty.IsListType() || ty.IsSetType()) && ty.ElementType().IsObjectType()
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/variables.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/variables.go
new file mode 100644
index 0000000..e123b8a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/variables.go
@@ -0,0 +1,43 @@
+package blocktoattr
+
+import (
+        "github.com/hashicorp/hcl2/ext/dynblock"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// ExpandedVariables finds all of the global variables referenced in the
+// given body with the given schema while taking into account the possibilities
+// both of "dynamic" blocks being expanded and the possibility of certain
+// attributes being written instead as nested blocks as allowed by the
+// FixUpBlockAttrs function.
+//
+// This function exists to allow variables to be analyzed prior to dynamic
+// block expansion while also dealing with the fact that dynamic block expansion
+// might in turn produce nested blocks that are subject to FixUpBlockAttrs.
+//
+// This is intended as a drop-in replacement for dynblock.VariablesHCLDec,
+// which is itself a drop-in replacement for hcldec.Variables.
+func ExpandedVariables(body hcl.Body, schema *configschema.Block) []hcl.Traversal {
+        rootNode := dynblock.WalkVariables(body)
+        return walkVariables(rootNode, body, schema)
+}
+
+func walkVariables(node dynblock.WalkVariablesNode, body hcl.Body, schema *configschema.Block) []hcl.Traversal {
+        givenRawSchema := hcldec.ImpliedSchema(schema.DecoderSpec())
+        ambiguousNames := ambiguousNames(schema)
+        effectiveRawSchema := effectiveSchema(givenRawSchema, body, ambiguousNames, false)
+        vars, children := node.Visit(effectiveRawSchema)
+
+        for _, child := range children {
+                if blockS, exists := schema.BlockTypes[child.BlockTypeName]; exists {
+                        vars = append(vars, walkVariables(child.Node, child.Body(), &blockS.Block)...)
+                } else if attrS, exists := schema.Attributes[child.BlockTypeName]; exists {
+                        synthSchema := SchemaForCtyElementType(attrS.Type.ElementType())
+                        vars = append(vars, walkVariables(child.Node, child.Body(), synthSchema)...)
+                }
+        }
+
+        return vars
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/data.go b/vendor/github.com/hashicorp/terraform/lang/data.go
new file mode 100644
index 0000000..80313d6
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/data.go
@@ -0,0 +1,33 @@
+package lang
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Data is an interface whose implementations can provide cty.Value
+// representations of objects identified by referenceable addresses from
+// the addrs package.
+//
+// This interface will grow each time a new type of reference is added, and so
+// implementations outside of the Terraform codebases are not advised.
+//
+// Each method returns a suitable value and optionally some diagnostics. If the
+// returned diagnostics contains errors then the type of the returned value is
+// used to construct an unknown value of the same type which is then used in
+// place of the requested object so that type checking can still proceed. In
+// cases where it's not possible to even determine a suitable result type,
+// cty.DynamicVal is returned along with errors describing the problem.
+type Data interface {
+        StaticValidateReferences(refs []*addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics
+
+        GetCountAttr(addrs.CountAttr, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetResourceInstance(addrs.ResourceInstance, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetLocalValue(addrs.LocalValue, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetModuleInstance(addrs.ModuleCallInstance, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetModuleInstanceOutput(addrs.ModuleCallOutput, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetPathAttr(addrs.PathAttr, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetTerraformAttr(addrs.TerraformAttr, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetInputVariable(addrs.InputVariable, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/doc.go b/vendor/github.com/hashicorp/terraform/lang/doc.go
new file mode 100644
index 0000000..af5c5ca
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/doc.go
@@ -0,0 +1,5 @@
+// Package lang deals with the runtime aspects of Terraform's configuration
+// language, with concerns such as expression evaluation. It is closely related
+// to sibling package "configs", which is responsible for configuration
+// parsing and static validation.
+package lang
diff --git a/vendor/github.com/hashicorp/terraform/lang/eval.go b/vendor/github.com/hashicorp/terraform/lang/eval.go
new file mode 100644
index 0000000..a3fb363
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/eval.go
@@ -0,0 +1,477 @@
+package lang
+
+import (
+        "fmt"
+        "log"
+        "strconv"
+
+        "github.com/hashicorp/hcl2/ext/dynblock"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang/blocktoattr"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// ExpandBlock expands any "dynamic" blocks present in the given body. The
+// result is a body with those blocks expanded, ready to be evaluated with
+// EvalBlock.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete or invalid.
+func (s *Scope) ExpandBlock(body hcl.Body, schema *configschema.Block) (hcl.Body, tfdiags.Diagnostics) {
+        spec := schema.DecoderSpec()
+
+        traversals := dynblock.ExpandVariablesHCLDec(body, spec)
+        refs, diags := References(traversals)
+
+        ctx, ctxDiags := s.EvalContext(refs)
+        diags = diags.Append(ctxDiags)
+
+        return dynblock.Expand(body, ctx), diags
+}
+
+// EvalBlock evaluates the given body using the given block schema and returns
+// a cty object value representing its contents. The type of the result conforms
+// to the implied type of the given schema.
+//
+// This function does not automatically expand "dynamic" blocks within the
+// body. If that is desired, first call the ExpandBlock method to obtain
+// an expanded body to pass to this method.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete or invalid.
+func (s *Scope) EvalBlock(body hcl.Body, schema *configschema.Block) (cty.Value, tfdiags.Diagnostics) {
+        spec := schema.DecoderSpec()
+
+        refs, diags := ReferencesInBlock(body, schema)
+
+        ctx, ctxDiags := s.EvalContext(refs)
+        diags = diags.Append(ctxDiags)
+        if diags.HasErrors() {
+                // We'll stop early if we found problems in the references, because
+                // it's likely evaluation will produce redundant copies of the same errors.
+                return cty.UnknownVal(schema.ImpliedType()), diags
+        }
+
+        // HACK: In order to remain compatible with some assumptions made in
+        // Terraform v0.11 and earlier about the approximate equivalence of
+        // attribute vs. block syntax, we do a just-in-time fixup here to allow
+        // any attribute in the schema that has a list-of-objects or set-of-objects
+        // kind to potentially be populated instead by one or more nested blocks
+        // whose type is the attribute name.
+        body = blocktoattr.FixUpBlockAttrs(body, schema)
+
+        val, evalDiags := hcldec.Decode(body, spec, ctx)
+        diags = diags.Append(evalDiags)
+
+        return val, diags
+}
+
+// EvalExpr evaluates a single expression in the receiving context and returns
+// the resulting value. The value will be converted to the given type before
+// it is returned if possible, or else an error diagnostic will be produced
+// describing the conversion error.
+//
+// Pass an expected type of cty.DynamicPseudoType to skip automatic conversion
+// and just obtain the returned value directly.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete, but will always be of the requested type.
+func (s *Scope) EvalExpr(expr hcl.Expression, wantType cty.Type) (cty.Value, tfdiags.Diagnostics) {
+        refs, diags := ReferencesInExpr(expr)
+
+        ctx, ctxDiags := s.EvalContext(refs)
+        diags = diags.Append(ctxDiags)
+        if diags.HasErrors() {
+                // We'll stop early if we found problems in the references, because
+                // it's likely evaluation will produce redundant copies of the same errors.
+                return cty.UnknownVal(wantType), diags
+        }
+
+        val, evalDiags := expr.Value(ctx)
+        diags = diags.Append(evalDiags)
+
+        if wantType != cty.DynamicPseudoType {
+                var convErr error
+                val, convErr = convert.Convert(val, wantType)
+                if convErr != nil {
+                        val = cty.UnknownVal(wantType)
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Incorrect value type",
+                                Detail:   fmt.Sprintf("Invalid expression value: %s.", tfdiags.FormatError(convErr)),
+                                Subject:  expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        return val, diags
+}
+
+// EvalReference evaluates the given reference in the receiving scope and
+// returns the resulting value. The value will be converted to the given type before
+// it is returned if possible, or else an error diagnostic will be produced
+// describing the conversion error.
+//
+// Pass an expected type of cty.DynamicPseudoType to skip automatic conversion
+// and just obtain the returned value directly.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete, but will always be of the requested type.
+func (s *Scope) EvalReference(ref *addrs.Reference, wantType cty.Type) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // We cheat a bit here and just build an EvalContext for our requested
+        // reference with the "self" address overridden, and then pull the "self"
+        // result out of it to return.
+        ctx, ctxDiags := s.evalContext([]*addrs.Reference{ref}, ref.Subject)
+        diags = diags.Append(ctxDiags)
+        val := ctx.Variables["self"]
+        if val == cty.NilVal {
+                val = cty.DynamicVal
+        }
+
+        var convErr error
+        val, convErr = convert.Convert(val, wantType)
+        if convErr != nil {
+                val = cty.UnknownVal(wantType)
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Incorrect value type",
+                        Detail:   fmt.Sprintf("Invalid expression value: %s.", tfdiags.FormatError(convErr)),
+                        Subject:  ref.SourceRange.ToHCL().Ptr(),
+                })
+        }
+
+        return val, diags
+}
+
+// EvalContext constructs a HCL expression evaluation context whose variable
+// scope contains sufficient values to satisfy the given set of references.
+//
+// Most callers should prefer to use the evaluation helper methods that
+// this type offers, but this is here for less common situations where the
+// caller will handle the evaluation calls itself.
+func (s *Scope) EvalContext(refs []*addrs.Reference) (*hcl.EvalContext, tfdiags.Diagnostics) {
+        return s.evalContext(refs, s.SelfAddr)
+}
+
+func (s *Scope) evalContext(refs []*addrs.Reference, selfAddr addrs.Referenceable) (*hcl.EvalContext, tfdiags.Diagnostics) {
+        if s == nil {
+                panic("attempt to construct EvalContext for nil Scope")
+        }
+
+        var diags tfdiags.Diagnostics
+        vals := make(map[string]cty.Value)
+        funcs := s.Functions()
+        ctx := &hcl.EvalContext{
+                Variables: vals,
+                Functions: funcs,
+        }
+
+        if len(refs) == 0 {
+                // Easy path for common case where there are no references at all.
+                return ctx, diags
+        }
+
+        // First we'll do static validation of the references. This catches things
+        // early that might otherwise not get caught due to unknown values being
+        // present in the scope during planning.
+        if staticDiags := s.Data.StaticValidateReferences(refs, selfAddr); staticDiags.HasErrors() {
+                diags = diags.Append(staticDiags)
+                return ctx, diags
+        }
+
+        // The reference set we are given has not been de-duped, and so there can
+        // be redundant requests in it for two reasons:
+        //  - The same item is referenced multiple times
+        //  - Both an item and that item's container are separately referenced.
+        // We will still visit every reference here and ask our data source for
+        // it, since that allows us to gather a full set of any errors and
+        // warnings, but once we've gathered all the data we'll then skip anything
+        // that's redundant in the process of populating our values map.
+        dataResources := map[string]map[string]map[addrs.InstanceKey]cty.Value{}
+        managedResources := map[string]map[string]map[addrs.InstanceKey]cty.Value{}
+        wholeModules := map[string]map[addrs.InstanceKey]cty.Value{}
+        moduleOutputs := map[string]map[addrs.InstanceKey]map[string]cty.Value{}
+        inputVariables := map[string]cty.Value{}
+        localValues := map[string]cty.Value{}
+        pathAttrs := map[string]cty.Value{}
+        terraformAttrs := map[string]cty.Value{}
+        countAttrs := map[string]cty.Value{}
+        var self cty.Value
+
+        for _, ref := range refs {
+                rng := ref.SourceRange
+                isSelf := false
+
+                rawSubj := ref.Subject
+                if rawSubj == addrs.Self {
+                        if selfAddr == nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  `Invalid "self" reference`,
+                                        // This detail message mentions some current practice that
+                                        // this codepath doesn't really "know about". If the "self"
+                                        // object starts being supported in more contexts later then
+                                        // we'll need to adjust this message.
+                                        Detail:  `The "self" object is not available in this context. This object can be used only in resource provisioner and connection blocks.`,
+                                        Subject: ref.SourceRange.ToHCL().Ptr(),
+                                })
+                                continue
+                        }
+
+                        // Treat "self" as an alias for the configured self address.
+                        rawSubj = selfAddr
+                        isSelf = true
+
+                        if rawSubj == addrs.Self {
+                                // Programming error: the self address cannot alias itself.
+                                panic("scope SelfAddr attempting to alias itself")
+                        }
+                }
+
+                // This type switch must cover all of the "Referenceable" implementations
+                // in package addrs.
+                switch subj := rawSubj.(type) {
+
+                case addrs.ResourceInstance:
+                        var into map[string]map[string]map[addrs.InstanceKey]cty.Value
+                        switch subj.Resource.Mode {
+                        case addrs.ManagedResourceMode:
+                                into = managedResources
+                        case addrs.DataResourceMode:
+                                into = dataResources
+                        default:
+                                panic(fmt.Errorf("unsupported ResourceMode %s", subj.Resource.Mode))
+                        }
+
+                        val, valDiags := normalizeRefValue(s.Data.GetResourceInstance(subj, rng))
+                        diags = diags.Append(valDiags)
+
+                        r := subj.Resource
+                        if into[r.Type] == nil {
+                                into[r.Type] = make(map[string]map[addrs.InstanceKey]cty.Value)
+                        }
+                        if into[r.Type][r.Name] == nil {
+                                into[r.Type][r.Name] = make(map[addrs.InstanceKey]cty.Value)
+                        }
+                        into[r.Type][r.Name][subj.Key] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.ModuleCallInstance:
+                        val, valDiags := normalizeRefValue(s.Data.GetModuleInstance(subj, rng))
+                        diags = diags.Append(valDiags)
+
+                        if wholeModules[subj.Call.Name] == nil {
+                                wholeModules[subj.Call.Name] = make(map[addrs.InstanceKey]cty.Value)
+                        }
+                        wholeModules[subj.Call.Name][subj.Key] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.ModuleCallOutput:
+                        val, valDiags := normalizeRefValue(s.Data.GetModuleInstanceOutput(subj, rng))
+                        diags = diags.Append(valDiags)
+
+                        callName := subj.Call.Call.Name
+                        callKey := subj.Call.Key
+                        if moduleOutputs[callName] == nil {
+                                moduleOutputs[callName] = make(map[addrs.InstanceKey]map[string]cty.Value)
+                        }
+                        if moduleOutputs[callName][callKey] == nil {
+                                moduleOutputs[callName][callKey] = make(map[string]cty.Value)
+                        }
+                        moduleOutputs[callName][callKey][subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.InputVariable:
+                        val, valDiags := normalizeRefValue(s.Data.GetInputVariable(subj, rng))
+                        diags = diags.Append(valDiags)
+                        inputVariables[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.LocalValue:
+                        val, valDiags := normalizeRefValue(s.Data.GetLocalValue(subj, rng))
+                        diags = diags.Append(valDiags)
+                        localValues[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.PathAttr:
+                        val, valDiags := normalizeRefValue(s.Data.GetPathAttr(subj, rng))
+                        diags = diags.Append(valDiags)
+                        pathAttrs[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.TerraformAttr:
+                        val, valDiags := normalizeRefValue(s.Data.GetTerraformAttr(subj, rng))
+                        diags = diags.Append(valDiags)
+                        terraformAttrs[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.CountAttr:
+                        val, valDiags := normalizeRefValue(s.Data.GetCountAttr(subj, rng))
+                        diags = diags.Append(valDiags)
+                        countAttrs[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                default:
+                        // Should never happen
+                        panic(fmt.Errorf("Scope.buildEvalContext cannot handle address type %T", rawSubj))
+                }
+        }
+
+        for k, v := range buildResourceObjects(managedResources) {
+                vals[k] = v
+        }
+        vals["data"] = cty.ObjectVal(buildResourceObjects(dataResources))
+        vals["module"] = cty.ObjectVal(buildModuleObjects(wholeModules, moduleOutputs))
+        vals["var"] = cty.ObjectVal(inputVariables)
+        vals["local"] = cty.ObjectVal(localValues)
+        vals["path"] = cty.ObjectVal(pathAttrs)
+        vals["terraform"] = cty.ObjectVal(terraformAttrs)
+        vals["count"] = cty.ObjectVal(countAttrs)
+        if self != cty.NilVal {
+                vals["self"] = self
+        }
+
+        return ctx, diags
+}
+
+func buildResourceObjects(resources map[string]map[string]map[addrs.InstanceKey]cty.Value) map[string]cty.Value {
+        vals := make(map[string]cty.Value)
+        for typeName, names := range resources {
+                nameVals := make(map[string]cty.Value)
+                for name, keys := range names {
+                        nameVals[name] = buildInstanceObjects(keys)
+                }
+                vals[typeName] = cty.ObjectVal(nameVals)
+        }
+        return vals
+}
+
+func buildModuleObjects(wholeModules map[string]map[addrs.InstanceKey]cty.Value, moduleOutputs map[string]map[addrs.InstanceKey]map[string]cty.Value) map[string]cty.Value {
+        vals := make(map[string]cty.Value)
+
+        for name, keys := range wholeModules {
+                vals[name] = buildInstanceObjects(keys)
+        }
+
+        for name, keys := range moduleOutputs {
+                if _, exists := wholeModules[name]; exists {
+                        // If we also have a whole module value for this name then we'll
+                        // skip this since the individual outputs are embedded in that result.
+                        continue
+                }
+
+                // The shape of this collection isn't compatible with buildInstanceObjects,
+                // but rather than replicating most of the buildInstanceObjects logic
+                // here we'll instead first transform the structure to be what that
+                // function expects and then use it. This is a little wasteful, but
+                // we do not expect this these maps to be large and so the extra work
+                // here should not hurt too much.
+                flattened := make(map[addrs.InstanceKey]cty.Value, len(keys))
+                for k, vals := range keys {
+                        flattened[k] = cty.ObjectVal(vals)
+                }
+                vals[name] = buildInstanceObjects(flattened)
+        }
+
+        return vals
+}
+
+func buildInstanceObjects(keys map[addrs.InstanceKey]cty.Value) cty.Value {
+        if val, exists := keys[addrs.NoKey]; exists {
+                // If present, a "no key" value supersedes all other values,
+                // since they should be embedded inside it.
+                return val
+        }
+
+        // If we only have individual values then we need to construct
+        // either a list or a map, depending on what sort of keys we
+        // have.
+        haveInt := false
+        haveString := false
+        maxInt := 0
+
+        for k := range keys {
+                switch tk := k.(type) {
+                case addrs.IntKey:
+                        haveInt = true
+                        if int(tk) > maxInt {
+                                maxInt = int(tk)
+                        }
+                case addrs.StringKey:
+                        haveString = true
+                }
+        }
+
+        // We should either have ints or strings and not both, but
+        // if we have both then we'll prefer strings and let the
+        // language interpreter try to convert the int keys into
+        // strings in a map.
+        switch {
+        case haveString:
+                vals := make(map[string]cty.Value)
+                for k, v := range keys {
+                        switch tk := k.(type) {
+                        case addrs.StringKey:
+                                vals[string(tk)] = v
+                        case addrs.IntKey:
+                                sk := strconv.Itoa(int(tk))
+                                vals[sk] = v
+                        }
+                }
+                return cty.ObjectVal(vals)
+        case haveInt:
+                // We'll make a tuple that is long enough for our maximum
+                // index value. It doesn't matter if we end up shorter than
+                // the number of instances because if length(...) were
+                // being evaluated we would've got a NoKey reference and
+                // thus not ended up in this codepath at all.
+                vals := make([]cty.Value, maxInt+1)
+                for i := range vals {
+                        if v, exists := keys[addrs.IntKey(i)]; exists {
+                                vals[i] = v
+                        } else {
+                                // Just a placeholder, since nothing will access this anyway
+                                vals[i] = cty.DynamicVal
+                        }
+                }
+                return cty.TupleVal(vals)
+        default:
+                // Should never happen because there are no other key types.
+                log.Printf("[ERROR] strange makeInstanceObjects call with no supported key types")
+                return cty.EmptyObjectVal
+        }
+}
+
+func normalizeRefValue(val cty.Value, diags tfdiags.Diagnostics) (cty.Value, tfdiags.Diagnostics) {
+        if diags.HasErrors() {
+                // If there are errors then we will force an unknown result so that
+                // we can still evaluate and catch type errors but we'll avoid
+                // producing redundant re-statements of the same errors we've already
+                // dealt with here.
+                return cty.UnknownVal(val.Type()), diags
+        }
+        return val, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/cidr.go b/vendor/github.com/hashicorp/terraform/lang/funcs/cidr.go
new file mode 100644
index 0000000..6ce8aa9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/cidr.go
@@ -0,0 +1,129 @@
+package funcs
+
+import (
+        "fmt"
+        "net"
+
+        "github.com/apparentlymart/go-cidr/cidr"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// CidrHostFunc contructs a function that calculates a full host IP address
+// within a given IP network address prefix.
+var CidrHostFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "prefix",
+                        Type: cty.String,
+                },
+                {
+                        Name: "hostnum",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var hostNum int
+                if err := gocty.FromCtyValue(args[1], &hostNum); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                _, network, err := net.ParseCIDR(args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("invalid CIDR expression: %s", err)
+                }
+
+                ip, err := cidr.Host(network, hostNum)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(ip.String()), nil
+        },
+})
+
+// CidrNetmaskFunc contructs a function that converts an IPv4 address prefix given
+// in CIDR notation into a subnet mask address.
+var CidrNetmaskFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "prefix",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                _, network, err := net.ParseCIDR(args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("invalid CIDR expression: %s", err)
+                }
+
+                return cty.StringVal(net.IP(network.Mask).String()), nil
+        },
+})
+
+// CidrSubnetFunc contructs a function that calculates a subnet address within
+// a given IP network address prefix.
+var CidrSubnetFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "prefix",
+                        Type: cty.String,
+                },
+                {
+                        Name: "newbits",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "netnum",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var newbits int
+                if err := gocty.FromCtyValue(args[1], &newbits); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                var netnum int
+                if err := gocty.FromCtyValue(args[2], &netnum); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                _, network, err := net.ParseCIDR(args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("invalid CIDR expression: %s", err)
+                }
+
+                // For portability with 32-bit systems where the subnet number
+                // will be a 32-bit int, we only allow extension of 32 bits in
+                // one call even if we're running on a 64-bit machine.
+                // (Of course, this is significant only for IPv6.)
+                if newbits > 32 {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("may not extend prefix by more than 32 bits")
+                }
+
+                newNetwork, err := cidr.Subnet(network, newbits, netnum)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(newNetwork.String()), nil
+        },
+})
+
+// CidrHost calculates a full host IP address within a given IP network address prefix.
+func CidrHost(prefix, hostnum cty.Value) (cty.Value, error) {
+        return CidrHostFunc.Call([]cty.Value{prefix, hostnum})
+}
+
+// CidrNetmask converts an IPv4 address prefix given in CIDR notation into a subnet mask address.
+func CidrNetmask(prefix cty.Value) (cty.Value, error) {
+        return CidrNetmaskFunc.Call([]cty.Value{prefix})
+}
+
+// CidrSubnet calculates a subnet address within a given IP network address prefix.
+func CidrSubnet(prefix, newbits, netnum cty.Value) (cty.Value, error) {
+        return CidrSubnetFunc.Call([]cty.Value{prefix, newbits, netnum})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/collection.go b/vendor/github.com/hashicorp/terraform/lang/funcs/collection.go
new file mode 100644
index 0000000..71b7a84
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/collection.go
@@ -0,0 +1,1511 @@
+package funcs
+
+import (
+        "errors"
+        "fmt"
+        "sort"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/function/stdlib"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+var ElementFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "index",
+                        Type: cty.Number,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                list := args[0]
+                listTy := list.Type()
+                switch {
+                case listTy.IsListType():
+                        return listTy.ElementType(), nil
+                case listTy.IsTupleType():
+                        if !args[1].IsKnown() {
+                                // If the index isn't known yet then we can't predict the
+                                // result type since each tuple element can have its own type.
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        etys := listTy.TupleElementTypes()
+                        var index int
+                        err := gocty.FromCtyValue(args[1], &index)
+                        if err != nil {
+                                // e.g. fractional number where whole number is required
+                                return cty.DynamicPseudoType, fmt.Errorf("invalid index: %s", err)
+                        }
+                        if len(etys) == 0 {
+                                return cty.DynamicPseudoType, errors.New("cannot use element function with an empty list")
+                        }
+                        index = index % len(etys)
+                        return etys[index], nil
+                default:
+                        return cty.DynamicPseudoType, fmt.Errorf("cannot read elements from %s", listTy.FriendlyName())
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                var index int
+                err := gocty.FromCtyValue(args[1], &index)
+                if err != nil {
+                        // can't happen because we checked this in the Type function above
+                        return cty.DynamicVal, fmt.Errorf("invalid index: %s", err)
+                }
+
+                if !args[0].IsKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                l := args[0].LengthInt()
+                if l == 0 {
+                        return cty.DynamicVal, errors.New("cannot use element function with an empty list")
+                }
+                index = index % l
+
+                // We did all the necessary type checks in the type function above,
+                // so this is guaranteed not to fail.
+                return args[0].Index(cty.NumberIntVal(int64(index))), nil
+        },
+})
+
+var LengthFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name:             "value",
+                        Type:             cty.DynamicPseudoType,
+                        AllowDynamicType: true,
+                        AllowUnknown:     true,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                collTy := args[0].Type()
+                switch {
+                case collTy == cty.String || collTy.IsTupleType() || collTy.IsObjectType() || collTy.IsListType() || collTy.IsMapType() || collTy.IsSetType() || collTy == cty.DynamicPseudoType:
+                        return cty.Number, nil
+                default:
+                        return cty.Number, errors.New("argument must be a string, a collection type, or a structural type")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                coll := args[0]
+                collTy := args[0].Type()
+                switch {
+                case collTy == cty.DynamicPseudoType:
+                        return cty.UnknownVal(cty.Number), nil
+                case collTy.IsTupleType():
+                        l := len(collTy.TupleElementTypes())
+                        return cty.NumberIntVal(int64(l)), nil
+                case collTy.IsObjectType():
+                        l := len(collTy.AttributeTypes())
+                        return cty.NumberIntVal(int64(l)), nil
+                case collTy == cty.String:
+                        // We'll delegate to the cty stdlib strlen function here, because
+                        // it deals with all of the complexities of tokenizing unicode
+                        // grapheme clusters.
+                        return stdlib.Strlen(coll)
+                case collTy.IsListType() || collTy.IsSetType() || collTy.IsMapType():
+                        return coll.Length(), nil
+                default:
+                        // Should never happen, because of the checks in our Type func above
+                        return cty.UnknownVal(cty.Number), errors.New("impossible value type for length(...)")
+                }
+        },
+})
+
+// CoalesceFunc constructs a function that takes any number of arguments and
+// returns the first one that isn't empty. This function was copied from go-cty
+// stdlib and modified so that it returns the first *non-empty* non-null element
+// from a sequence, instead of merely the first non-null.
+var CoalesceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                argTypes := make([]cty.Type, len(args))
+                for i, val := range args {
+                        argTypes[i] = val.Type()
+                }
+                retType, _ := convert.UnifyUnsafe(argTypes)
+                if retType == cty.NilType {
+                        return cty.NilType, errors.New("all arguments must have the same type")
+                }
+                return retType, nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                for _, argVal := range args {
+                        // We already know this will succeed because of the checks in our Type func above
+                        argVal, _ = convert.Convert(argVal, retType)
+                        if !argVal.IsKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+                        if argVal.IsNull() {
+                                continue
+                        }
+                        if retType == cty.String && argVal.RawEquals(cty.StringVal("")) {
+                                continue
+                        }
+
+                        return argVal, nil
+                }
+                return cty.NilVal, errors.New("no non-null, non-empty-string arguments")
+        },
+})
+
+// CoalesceListFunc constructs a function that takes any number of list arguments
+// and returns the first one that isn't empty.
+var CoalesceListFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) == 0 {
+                        return cty.NilType, errors.New("at least one argument is required")
+                }
+
+                argTypes := make([]cty.Type, len(args))
+
+                for i, arg := range args {
+                        // if any argument is unknown, we can't be certain know which type we will return
+                        if !arg.IsKnown() {
+                                return cty.DynamicPseudoType, nil
+                        }
+                        ty := arg.Type()
+
+                        if !ty.IsListType() && !ty.IsTupleType() {
+                                return cty.NilType, errors.New("coalescelist arguments must be lists or tuples")
+                        }
+
+                        argTypes[i] = arg.Type()
+                }
+
+                last := argTypes[0]
+                // If there are mixed types, we have to return a dynamic type.
+                for _, next := range argTypes[1:] {
+                        if !next.Equals(last) {
+                                return cty.DynamicPseudoType, nil
+                        }
+                }
+
+                return last, nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                for _, arg := range args {
+                        if !arg.IsKnown() {
+                                // If we run into an unknown list at some point, we can't
+                                // predict the final result yet. (If there's a known, non-empty
+                                // arg before this then we won't get here.)
+                                return cty.UnknownVal(retType), nil
+                        }
+
+                        if arg.LengthInt() > 0 {
+                                return arg, nil
+                        }
+                }
+
+                return cty.NilVal, errors.New("no non-null arguments")
+        },
+})
+
+// CompactFunc constructs a function that takes a list of strings and returns a new list
+// with any empty string elements removed.
+var CompactFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.String),
+                },
+        },
+        Type: function.StaticReturnType(cty.List(cty.String)),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                listVal := args[0]
+                if !listVal.IsWhollyKnown() {
+                        // If some of the element values aren't known yet then we
+                        // can't yet return a compacted list
+                        return cty.UnknownVal(retType), nil
+                }
+
+                var outputList []cty.Value
+
+                for it := listVal.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        if v.AsString() == "" {
+                                continue
+                        }
+                        outputList = append(outputList, v)
+                }
+
+                if len(outputList) == 0 {
+                        return cty.ListValEmpty(cty.String), nil
+                }
+
+                return cty.ListVal(outputList), nil
+        },
+})
+
+// ContainsFunc constructs a function that determines whether a given list or
+// set contains a given single value as one of its elements.
+var ContainsFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "value",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: function.StaticReturnType(cty.Bool),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                arg := args[0]
+                ty := arg.Type()
+
+                if !ty.IsListType() && !ty.IsTupleType() && !ty.IsSetType() {
+                        return cty.NilVal, errors.New("argument must be list, tuple, or set")
+                }
+
+                _, err = Index(cty.TupleVal(arg.AsValueSlice()), args[1])
+                if err != nil {
+                        return cty.False, nil
+                }
+
+                return cty.True, nil
+        },
+})
+
+// IndexFunc constructs a function that finds the element index for a given value in a list.
+var IndexFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "value",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                if !(args[0].Type().IsListType() || args[0].Type().IsTupleType()) {
+                        return cty.NilVal, errors.New("argument must be a list or tuple")
+                }
+
+                if !args[0].IsKnown() {
+                        return cty.UnknownVal(cty.Number), nil
+                }
+
+                if args[0].LengthInt() == 0 { // Easy path
+                        return cty.NilVal, errors.New("cannot search an empty list")
+                }
+
+                for it := args[0].ElementIterator(); it.Next(); {
+                        i, v := it.Element()
+                        eq, err := stdlib.Equal(v, args[1])
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+                        if !eq.IsKnown() {
+                                return cty.UnknownVal(cty.Number), nil
+                        }
+                        if eq.True() {
+                                return i, nil
+                        }
+                }
+                return cty.NilVal, errors.New("item not found")
+
+        },
+})
+
+// DistinctFunc constructs a function that takes a list and returns a new list
+// with any duplicate elements removed.
+var DistinctFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                return args[0].Type(), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                listVal := args[0]
+
+                if !listVal.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+                var list []cty.Value
+
+                for it := listVal.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        list, err = appendIfMissing(list, v)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+                }
+
+                return cty.ListVal(list), nil
+        },
+})
+
+// ChunklistFunc constructs a function that splits a single list into fixed-size chunks,
+// returning a list of lists.
+var ChunklistFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+                {
+                        Name: "size",
+                        Type: cty.Number,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                return cty.List(args[0].Type()), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                listVal := args[0]
+                if !listVal.IsKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                var size int
+                err = gocty.FromCtyValue(args[1], &size)
+                if err != nil {
+                        return cty.NilVal, fmt.Errorf("invalid index: %s", err)
+                }
+
+                if size < 0 {
+                        return cty.NilVal, errors.New("the size argument must be positive")
+                }
+
+                output := make([]cty.Value, 0)
+
+                // if size is 0, returns a list made of the initial list
+                if size == 0 {
+                        output = append(output, listVal)
+                        return cty.ListVal(output), nil
+                }
+
+                chunk := make([]cty.Value, 0)
+
+                l := args[0].LengthInt()
+                i := 0
+
+                for it := listVal.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        chunk = append(chunk, v)
+
+                        // Chunk when index isn't 0, or when reaching the values's length
+                        if (i+1)%size == 0 || (i+1) == l {
+                                output = append(output, cty.ListVal(chunk))
+                                chunk = make([]cty.Value, 0)
+                        }
+                        i++
+                }
+
+                return cty.ListVal(output), nil
+        },
+})
+
+// FlattenFunc constructs a function that takes a list and replaces any elements
+// that are lists with a flattened sequence of the list contents.
+var FlattenFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                if !args[0].IsWhollyKnown() {
+                        return cty.DynamicPseudoType, nil
+                }
+
+                argTy := args[0].Type()
+                if !argTy.IsListType() && !argTy.IsSetType() && !argTy.IsTupleType() {
+                        return cty.NilType, errors.New("can only flatten lists, sets and tuples")
+                }
+
+                retVal, known := flattener(args[0])
+                if !known {
+                        return cty.DynamicPseudoType, nil
+                }
+
+                tys := make([]cty.Type, len(retVal))
+                for i, ty := range retVal {
+                        tys[i] = ty.Type()
+                }
+                return cty.Tuple(tys), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                inputList := args[0]
+                if inputList.LengthInt() == 0 {
+                        return cty.EmptyTupleVal, nil
+                }
+
+                out, known := flattener(inputList)
+                if !known {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                return cty.TupleVal(out), nil
+        },
+})
+
+// Flatten until it's not a cty.List, and return whether the value is known.
+// We can flatten lists with unknown values, as long as they are not
+// lists themselves.
+func flattener(flattenList cty.Value) ([]cty.Value, bool) {
+        out := make([]cty.Value, 0)
+        for it := flattenList.ElementIterator(); it.Next(); {
+                _, val := it.Element()
+                if val.Type().IsListType() || val.Type().IsSetType() || val.Type().IsTupleType() {
+                        if !val.IsKnown() {
+                                return out, false
+                        }
+
+                        res, known := flattener(val)
+                        if !known {
+                                return res, known
+                        }
+                        out = append(out, res...)
+                } else {
+                        out = append(out, val)
+                }
+        }
+        return out, true
+}
+
+// KeysFunc constructs a function that takes a map and returns a sorted list of the map keys.
+var KeysFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name:         "inputMap",
+                        Type:         cty.DynamicPseudoType,
+                        AllowUnknown: true,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                ty := args[0].Type()
+                switch {
+                case ty.IsMapType():
+                        return cty.List(cty.String), nil
+                case ty.IsObjectType():
+                        atys := ty.AttributeTypes()
+                        if len(atys) == 0 {
+                                return cty.EmptyTuple, nil
+                        }
+                        // All of our result elements will be strings, and atys just
+                        // decides how many there are.
+                        etys := make([]cty.Type, len(atys))
+                        for i := range etys {
+                                etys[i] = cty.String
+                        }
+                        return cty.Tuple(etys), nil
+                default:
+                        return cty.DynamicPseudoType, function.NewArgErrorf(0, "must have map or object type")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                m := args[0]
+                var keys []cty.Value
+
+                switch {
+                case m.Type().IsObjectType():
+                        // In this case we allow unknown values so we must work only with
+                        // the attribute _types_, not with the value itself.
+                        var names []string
+                        for name := range m.Type().AttributeTypes() {
+                                names = append(names, name)
+                        }
+                        sort.Strings(names) // same ordering guaranteed by cty's ElementIterator
+                        if len(names) == 0 {
+                                return cty.EmptyTupleVal, nil
+                        }
+                        keys = make([]cty.Value, len(names))
+                        for i, name := range names {
+                                keys[i] = cty.StringVal(name)
+                        }
+                        return cty.TupleVal(keys), nil
+                default:
+                        if !m.IsKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+
+                        // cty guarantees that ElementIterator will iterate in lexicographical
+                        // order by key.
+                        for it := args[0].ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keys = append(keys, k)
+                        }
+                        if len(keys) == 0 {
+                                return cty.ListValEmpty(cty.String), nil
+                        }
+                        return cty.ListVal(keys), nil
+                }
+        },
+})
+
+// ListFunc constructs a function that takes an arbitrary number of arguments
+// and returns a list containing those values in the same order.
+//
+// This function is deprecated in Terraform v0.12
+var ListFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) == 0 {
+                        return cty.NilType, errors.New("at least one argument is required")
+                }
+
+                argTypes := make([]cty.Type, len(args))
+
+                for i, arg := range args {
+                        argTypes[i] = arg.Type()
+                }
+
+                retType, _ := convert.UnifyUnsafe(argTypes)
+                if retType == cty.NilType {
+                        return cty.NilType, errors.New("all arguments must have the same type")
+                }
+
+                return cty.List(retType), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                newList := make([]cty.Value, 0, len(args))
+
+                for _, arg := range args {
+                        // We already know this will succeed because of the checks in our Type func above
+                        arg, _ = convert.Convert(arg, retType.ElementType())
+                        newList = append(newList, arg)
+                }
+
+                return cty.ListVal(newList), nil
+        },
+})
+
+// LookupFunc constructs a function that performs dynamic lookups of map types.
+var LookupFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "inputMap",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "key",
+                        Type: cty.String,
+                },
+        },
+        VarParam: &function.Parameter{
+                Name:             "default",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) < 1 || len(args) > 3 {
+                        return cty.NilType, fmt.Errorf("lookup() takes two or three arguments, got %d", len(args))
+                }
+
+                ty := args[0].Type()
+
+                switch {
+                case ty.IsObjectType():
+                        if !args[1].IsKnown() {
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        key := args[1].AsString()
+                        if ty.HasAttribute(key) {
+                                return args[0].GetAttr(key).Type(), nil
+                        } else if len(args) == 3 {
+                                // if the key isn't found but a default is provided,
+                                // return the default type
+                                return args[2].Type(), nil
+                        }
+                        return cty.DynamicPseudoType, function.NewArgErrorf(0, "the given object has no attribute %q", key)
+                case ty.IsMapType():
+                        return ty.ElementType(), nil
+                default:
+                        return cty.NilType, function.NewArgErrorf(0, "lookup() requires a map as the first argument")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var defaultVal cty.Value
+                defaultValueSet := false
+
+                if len(args) == 3 {
+                        defaultVal = args[2]
+                        defaultValueSet = true
+                }
+
+                mapVar := args[0]
+                lookupKey := args[1].AsString()
+
+                if !mapVar.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                if mapVar.Type().IsObjectType() {
+                        if mapVar.Type().HasAttribute(lookupKey) {
+                                return mapVar.GetAttr(lookupKey), nil
+                        }
+                } else if mapVar.HasIndex(cty.StringVal(lookupKey)) == cty.True {
+                        v := mapVar.Index(cty.StringVal(lookupKey))
+                        if ty := v.Type(); !ty.Equals(cty.NilType) {
+                                switch {
+                                case ty.Equals(cty.String):
+                                        return cty.StringVal(v.AsString()), nil
+                                case ty.Equals(cty.Number):
+                                        return cty.NumberVal(v.AsBigFloat()), nil
+                                default:
+                                        return cty.NilVal, errors.New("lookup() can only be used with flat lists")
+                                }
+                        }
+                }
+
+                if defaultValueSet {
+                        defaultVal, err = convert.Convert(defaultVal, retType)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+                        return defaultVal, nil
+                }
+
+                return cty.UnknownVal(cty.DynamicPseudoType), fmt.Errorf(
+                        "lookup failed to find '%s'", lookupKey)
+        },
+})
+
+// MapFunc constructs a function that takes an even number of arguments and
+// returns a map whose elements are constructed from consecutive pairs of arguments.
+//
+// This function is deprecated in Terraform v0.12
+var MapFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) < 2 || len(args)%2 != 0 {
+                        return cty.NilType, fmt.Errorf("map requires an even number of two or more arguments, got %d", len(args))
+                }
+
+                argTypes := make([]cty.Type, len(args)/2)
+                index := 0
+
+                for i := 0; i < len(args); i += 2 {
+                        argTypes[index] = args[i+1].Type()
+                        index++
+                }
+
+                valType, _ := convert.UnifyUnsafe(argTypes)
+                if valType == cty.NilType {
+                        return cty.NilType, errors.New("all arguments must have the same type")
+                }
+
+                return cty.Map(valType), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                for _, arg := range args {
+                        if !arg.IsWhollyKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+                }
+
+                outputMap := make(map[string]cty.Value)
+
+                for i := 0; i < len(args); i += 2 {
+
+                        key := args[i].AsString()
+
+                        err := gocty.FromCtyValue(args[i], &key)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+
+                        val := args[i+1]
+
+                        var variable cty.Value
+                        err = gocty.FromCtyValue(val, &variable)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+
+                        // We already know this will succeed because of the checks in our Type func above
+                        variable, _ = convert.Convert(variable, retType.ElementType())
+
+                        // Check for duplicate keys
+                        if _, ok := outputMap[key]; ok {
+                                return cty.NilVal, fmt.Errorf("argument %d is a duplicate key: %q", i+1, key)
+                        }
+                        outputMap[key] = variable
+                }
+
+                return cty.MapVal(outputMap), nil
+        },
+})
+
+// MatchkeysFunc constructs a function that constructs a new list by taking a
+// subset of elements from one list whose indexes match the corresponding
+// indexes of values in another list.
+var MatchkeysFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "values",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+                {
+                        Name: "keys",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+                {
+                        Name: "searchset",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                if !args[1].Type().Equals(args[2].Type()) {
+                        return cty.NilType, errors.New("lists must be of the same type")
+                }
+
+                return args[0].Type(), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                if !args[0].IsKnown() {
+                        return cty.UnknownVal(cty.List(retType.ElementType())), nil
+                }
+
+                if args[0].LengthInt() != args[1].LengthInt() {
+                        return cty.ListValEmpty(retType.ElementType()), errors.New("length of keys and values should be equal")
+                }
+
+                output := make([]cty.Value, 0)
+
+                values := args[0]
+                keys := args[1]
+                searchset := args[2]
+
+                // if searchset is empty, return an empty list.
+                if searchset.LengthInt() == 0 {
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+
+                if !values.IsWhollyKnown() || !keys.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                i := 0
+                for it := keys.ElementIterator(); it.Next(); {
+                        _, key := it.Element()
+                        for iter := searchset.ElementIterator(); iter.Next(); {
+                                _, search := iter.Element()
+                                eq, err := stdlib.Equal(key, search)
+                                if err != nil {
+                                        return cty.NilVal, err
+                                }
+                                if !eq.IsKnown() {
+                                        return cty.ListValEmpty(retType.ElementType()), nil
+                                }
+                                if eq.True() {
+                                        v := values.Index(cty.NumberIntVal(int64(i)))
+                                        output = append(output, v)
+                                        break
+                                }
+                        }
+                        i++
+                }
+
+                // if we haven't matched any key, then output is an empty list.
+                if len(output) == 0 {
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+                return cty.ListVal(output), nil
+        },
+})
+
+// MergeFunc constructs a function that takes an arbitrary number of maps and
+// returns a single map that contains a merged set of elements from all of the maps.
+//
+// If more than one given map defines the same key then the one that is later in
+// the argument sequence takes precedence.
+var MergeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "maps",
+                Type:             cty.DynamicPseudoType,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: function.StaticReturnType(cty.DynamicPseudoType),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                outputMap := make(map[string]cty.Value)
+
+                for _, arg := range args {
+                        if !arg.IsWhollyKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+                        if !arg.Type().IsObjectType() && !arg.Type().IsMapType() {
+                                return cty.NilVal, fmt.Errorf("arguments must be maps or objects, got %#v", arg.Type().FriendlyName())
+                        }
+                        for it := arg.ElementIterator(); it.Next(); {
+                                k, v := it.Element()
+                                outputMap[k.AsString()] = v
+                        }
+                }
+                return cty.ObjectVal(outputMap), nil
+        },
+})
+
+// ReverseFunc takes a sequence and produces a new sequence of the same length
+// with all of the same elements as the given sequence but in reverse order.
+var ReverseFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                argTy := args[0].Type()
+                switch {
+                case argTy.IsTupleType():
+                        argTys := argTy.TupleElementTypes()
+                        retTys := make([]cty.Type, len(argTys))
+                        for i, ty := range argTys {
+                                retTys[len(retTys)-i-1] = ty
+                        }
+                        return cty.Tuple(retTys), nil
+                case argTy.IsListType(), argTy.IsSetType(): // We accept sets here to mimic the usual behavior of auto-converting to list
+                        return cty.List(argTy.ElementType()), nil
+                default:
+                        return cty.NilType, function.NewArgErrorf(0, "can only reverse list or tuple values, not %s", argTy.FriendlyName())
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                in := args[0].AsValueSlice()
+                outVals := make([]cty.Value, len(in))
+                for i, v := range in {
+                        outVals[len(outVals)-i-1] = v
+                }
+                switch {
+                case retType.IsTupleType():
+                        return cty.TupleVal(outVals), nil
+                default:
+                        if len(outVals) == 0 {
+                                return cty.ListValEmpty(retType.ElementType()), nil
+                        }
+                        return cty.ListVal(outVals), nil
+                }
+        },
+})
+
+// SetProductFunc calculates the cartesian product of two or more sets or
+// sequences. If the arguments are all lists then the result is a list of tuples,
+// preserving the ordering of all of the input lists. Otherwise the result is a
+// set of tuples.
+var SetProductFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name: "sets",
+                Type: cty.DynamicPseudoType,
+        },
+        Type: func(args []cty.Value) (retType cty.Type, err error) {
+                if len(args) < 2 {
+                        return cty.NilType, errors.New("at least two arguments are required")
+                }
+
+                listCount := 0
+                elemTys := make([]cty.Type, len(args))
+                for i, arg := range args {
+                        aty := arg.Type()
+                        switch {
+                        case aty.IsSetType():
+                                elemTys[i] = aty.ElementType()
+                        case aty.IsListType():
+                                elemTys[i] = aty.ElementType()
+                                listCount++
+                        case aty.IsTupleType():
+                                // We can accept a tuple type only if there's some common type
+                                // that all of its elements can be converted to.
+                                allEtys := aty.TupleElementTypes()
+                                if len(allEtys) == 0 {
+                                        elemTys[i] = cty.DynamicPseudoType
+                                        listCount++
+                                        break
+                                }
+                                ety, _ := convert.UnifyUnsafe(allEtys)
+                                if ety == cty.NilType {
+                                        return cty.NilType, function.NewArgErrorf(i, "all elements must be of the same type")
+                                }
+                                elemTys[i] = ety
+                                listCount++
+                        default:
+                                return cty.NilType, function.NewArgErrorf(i, "a set or a list is required")
+                        }
+                }
+
+                if listCount == len(args) {
+                        return cty.List(cty.Tuple(elemTys)), nil
+                }
+                return cty.Set(cty.Tuple(elemTys)), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                ety := retType.ElementType()
+
+                total := 1
+                for _, arg := range args {
+                        // Because of our type checking function, we are guaranteed that
+                        // all of the arguments are known, non-null values of types that
+                        // support LengthInt.
+                        total *= arg.LengthInt()
+                }
+
+                if total == 0 {
+                        // If any of the arguments was an empty collection then our result
+                        // is also an empty collection, which we'll short-circuit here.
+                        if retType.IsListType() {
+                                return cty.ListValEmpty(ety), nil
+                        }
+                        return cty.SetValEmpty(ety), nil
+                }
+
+                subEtys := ety.TupleElementTypes()
+                product := make([][]cty.Value, total)
+
+                b := make([]cty.Value, total*len(args))
+                n := make([]int, len(args))
+                s := 0
+                argVals := make([][]cty.Value, len(args))
+                for i, arg := range args {
+                        argVals[i] = arg.AsValueSlice()
+                }
+
+                for i := range product {
+                        e := s + len(args)
+                        pi := b[s:e]
+                        product[i] = pi
+                        s = e
+
+                        for j, n := range n {
+                                val := argVals[j][n]
+                                ty := subEtys[j]
+                                if !val.Type().Equals(ty) {
+                                        var err error
+                                        val, err = convert.Convert(val, ty)
+                                        if err != nil {
+                                                // Should never happen since we checked this in our
+                                                // type-checking function.
+                                                return cty.NilVal, fmt.Errorf("failed to convert argVals[%d][%d] to %s; this is a bug in Terraform", j, n, ty.FriendlyName())
+                                        }
+                                }
+                                pi[j] = val
+                        }
+
+                        for j := len(n) - 1; j >= 0; j-- {
+                                n[j]++
+                                if n[j] < len(argVals[j]) {
+                                        break
+                                }
+                                n[j] = 0
+                        }
+                }
+
+                productVals := make([]cty.Value, total)
+                for i, vals := range product {
+                        productVals[i] = cty.TupleVal(vals)
+                }
+
+                if retType.IsListType() {
+                        return cty.ListVal(productVals), nil
+                }
+                return cty.SetVal(productVals), nil
+        },
+})
+
+// SliceFunc constructs a function that extracts some consecutive elements
+// from within a list.
+var SliceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "start_index",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "end_index",
+                        Type: cty.Number,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                arg := args[0]
+                argTy := arg.Type()
+
+                if argTy.IsSetType() {
+                        return cty.NilType, function.NewArgErrorf(0, "cannot slice a set, because its elements do not have indices; use the tolist function to force conversion to list if the ordering of the result is not important")
+                }
+                if !argTy.IsListType() && !argTy.IsTupleType() {
+                        return cty.NilType, function.NewArgErrorf(0, "must be a list or tuple value")
+                }
+
+                startIndex, endIndex, idxsKnown, err := sliceIndexes(args)
+                if err != nil {
+                        return cty.NilType, err
+                }
+
+                if argTy.IsListType() {
+                        return argTy, nil
+                }
+
+                if !idxsKnown {
+                        // If we don't know our start/end indices then we can't predict
+                        // the result type if we're planning to return a tuple.
+                        return cty.DynamicPseudoType, nil
+                }
+                return cty.Tuple(argTy.TupleElementTypes()[startIndex:endIndex]), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                inputList := args[0]
+
+                if retType == cty.DynamicPseudoType {
+                        return cty.DynamicVal, nil
+                }
+
+                // we ignore idxsKnown return value here because the indices are always
+                // known here, or else the call would've short-circuited.
+                startIndex, endIndex, _, err := sliceIndexes(args)
+                if err != nil {
+                        return cty.NilVal, err
+                }
+
+                if endIndex-startIndex == 0 {
+                        if retType.IsTupleType() {
+                                return cty.EmptyTupleVal, nil
+                        }
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+
+                outputList := inputList.AsValueSlice()[startIndex:endIndex]
+
+                if retType.IsTupleType() {
+                        return cty.TupleVal(outputList), nil
+                }
+
+                return cty.ListVal(outputList), nil
+        },
+})
+
+func sliceIndexes(args []cty.Value) (int, int, bool, error) {
+        var startIndex, endIndex, length int
+        var startKnown, endKnown, lengthKnown bool
+
+        if args[0].Type().IsTupleType() || args[0].IsKnown() { // if it's a tuple then we always know the length by the type, but lists must be known
+                length = args[0].LengthInt()
+                lengthKnown = true
+        }
+
+        if args[1].IsKnown() {
+                if err := gocty.FromCtyValue(args[1], &startIndex); err != nil {
+                        return 0, 0, false, function.NewArgErrorf(1, "invalid start index: %s", err)
+                }
+                if startIndex < 0 {
+                        return 0, 0, false, function.NewArgErrorf(1, "start index must not be less than zero")
+                }
+                if lengthKnown && startIndex > length {
+                        return 0, 0, false, function.NewArgErrorf(1, "start index must not be greater than the length of the list")
+                }
+                startKnown = true
+        }
+        if args[2].IsKnown() {
+                if err := gocty.FromCtyValue(args[2], &endIndex); err != nil {
+                        return 0, 0, false, function.NewArgErrorf(2, "invalid end index: %s", err)
+                }
+                if endIndex < 0 {
+                        return 0, 0, false, function.NewArgErrorf(2, "end index must not be less than zero")
+                }
+                if lengthKnown && endIndex > length {
+                        return 0, 0, false, function.NewArgErrorf(2, "end index must not be greater than the length of the list")
+                }
+                endKnown = true
+        }
+        if startKnown && endKnown {
+                if startIndex > endIndex {
+                        return 0, 0, false, function.NewArgErrorf(1, "start index must not be greater than end index")
+                }
+        }
+        return startIndex, endIndex, startKnown && endKnown, nil
+}
+
+// TransposeFunc contructs a function that takes a map of lists of strings and
+// TransposeFunc constructs a function that takes a map of lists of strings and
+// swaps the keys and values to produce a new map of lists of strings.
+var TransposeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "values",
+                        Type: cty.Map(cty.List(cty.String)),
+                },
+        },
+        Type: function.StaticReturnType(cty.Map(cty.List(cty.String))),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                inputMap := args[0]
+                if !inputMap.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                outputMap := make(map[string]cty.Value)
+                tmpMap := make(map[string][]string)
+
+                for it := inputMap.ElementIterator(); it.Next(); {
+                        inKey, inVal := it.Element()
+                        for iter := inVal.ElementIterator(); iter.Next(); {
+                                _, val := iter.Element()
+                                if !val.Type().Equals(cty.String) {
+                                        return cty.MapValEmpty(cty.List(cty.String)), errors.New("input must be a map of lists of strings")
+                                }
+
+                                outKey := val.AsString()
+                                if _, ok := tmpMap[outKey]; !ok {
+                                        tmpMap[outKey] = make([]string, 0)
+                                }
+                                outVal := tmpMap[outKey]
+                                outVal = append(outVal, inKey.AsString())
+                                sort.Strings(outVal)
+                                tmpMap[outKey] = outVal
+                        }
+                }
+
+                for outKey, outVal := range tmpMap {
+                        values := make([]cty.Value, 0)
+                        for _, v := range outVal {
+                                values = append(values, cty.StringVal(v))
+                        }
+                        outputMap[outKey] = cty.ListVal(values)
+                }
+
+                return cty.MapVal(outputMap), nil
+        },
+})
+
+// ValuesFunc constructs a function that returns a list of the map values,
+// in the order of the sorted keys.
+var ValuesFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "values",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                ty := args[0].Type()
+                if ty.IsMapType() {
+                        return cty.List(ty.ElementType()), nil
+                } else if ty.IsObjectType() {
+                        // The result is a tuple type with all of the same types as our
+                        // object type's attributes, sorted in lexicographical order by the
+                        // keys. (This matches the sort order guaranteed by ElementIterator
+                        // on a cty object value.)
+                        atys := ty.AttributeTypes()
+                        if len(atys) == 0 {
+                                return cty.EmptyTuple, nil
+                        }
+                        attrNames := make([]string, 0, len(atys))
+                        for name := range atys {
+                                attrNames = append(attrNames, name)
+                        }
+                        sort.Strings(attrNames)
+
+                        tys := make([]cty.Type, len(attrNames))
+                        for i, name := range attrNames {
+                                tys[i] = atys[name]
+                        }
+                        return cty.Tuple(tys), nil
+                }
+                return cty.NilType, errors.New("values() requires a map as the first argument")
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                mapVar := args[0]
+
+                // We can just iterate the map/object value here because cty guarantees
+                // that these types always iterate in key lexicographical order.
+                var values []cty.Value
+                for it := mapVar.ElementIterator(); it.Next(); {
+                        _, val := it.Element()
+                        values = append(values, val)
+                }
+
+                if retType.IsTupleType() {
+                        return cty.TupleVal(values), nil
+                }
+                if len(values) == 0 {
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+                return cty.ListVal(values), nil
+        },
+})
+
+// ZipmapFunc constructs a function that constructs a map from a list of keys
+// and a corresponding list of values.
+var ZipmapFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "keys",
+                        Type: cty.List(cty.String),
+                },
+                {
+                        Name: "values",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                keys := args[0]
+                values := args[1]
+                valuesTy := values.Type()
+
+                switch {
+                case valuesTy.IsListType():
+                        return cty.Map(values.Type().ElementType()), nil
+                case valuesTy.IsTupleType():
+                        if !keys.IsWhollyKnown() {
+                                // Since zipmap with a tuple produces an object, we need to know
+                                // all of the key names before we can predict our result type.
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        keysRaw := keys.AsValueSlice()
+                        valueTypesRaw := valuesTy.TupleElementTypes()
+                        if len(keysRaw) != len(valueTypesRaw) {
+                                return cty.NilType, fmt.Errorf("number of keys (%d) does not match number of values (%d)", len(keysRaw), len(valueTypesRaw))
+                        }
+                        atys := make(map[string]cty.Type, len(valueTypesRaw))
+                        for i, keyVal := range keysRaw {
+                                if keyVal.IsNull() {
+                                        return cty.NilType, fmt.Errorf("keys list has null value at index %d", i)
+                                }
+                                key := keyVal.AsString()
+                                atys[key] = valueTypesRaw[i]
+                        }
+                        return cty.Object(atys), nil
+
+                default:
+                        return cty.NilType, errors.New("values argument must be a list or tuple value")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                keys := args[0]
+                values := args[1]
+
+                if !keys.IsWhollyKnown() {
+                        // Unknown map keys and object attributes are not supported, so
+                        // our entire result must be unknown in this case.
+                        return cty.UnknownVal(retType), nil
+                }
+
+                // both keys and values are guaranteed to be shallowly-known here,
+                // because our declared params above don't allow unknown or null values.
+                if keys.LengthInt() != values.LengthInt() {
+                        return cty.NilVal, fmt.Errorf("number of keys (%d) does not match number of values (%d)", keys.LengthInt(), values.LengthInt())
+                }
+
+                output := make(map[string]cty.Value)
+
+                i := 0
+                for it := keys.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        val := values.Index(cty.NumberIntVal(int64(i)))
+                        output[v.AsString()] = val
+                        i++
+                }
+
+                switch {
+                case retType.IsMapType():
+                        if len(output) == 0 {
+                                return cty.MapValEmpty(retType.ElementType()), nil
+                        }
+                        return cty.MapVal(output), nil
+                case retType.IsObjectType():
+                        return cty.ObjectVal(output), nil
+                default:
+                        // Should never happen because the type-check function should've
+                        // caught any other case.
+                        return cty.NilVal, fmt.Errorf("internally selected incorrect result type %s (this is a bug)", retType.FriendlyName())
+                }
+        },
+})
+
+// helper function to add an element to a list, if it does not already exist
+func appendIfMissing(slice []cty.Value, element cty.Value) ([]cty.Value, error) {
+        for _, ele := range slice {
+                eq, err := stdlib.Equal(ele, element)
+                if err != nil {
+                        return slice, err
+                }
+                if eq.True() {
+                        return slice, nil
+                }
+        }
+        return append(slice, element), nil
+}
+
+// Element returns a single element from a given list at the given index. If
+// index is greater than the length of the list then it is wrapped modulo
+// the list length.
+func Element(list, index cty.Value) (cty.Value, error) {
+        return ElementFunc.Call([]cty.Value{list, index})
+}
+
+// Length returns the number of elements in the given collection or number of
+// Unicode characters in the given string.
+func Length(collection cty.Value) (cty.Value, error) {
+        return LengthFunc.Call([]cty.Value{collection})
+}
+
+// Coalesce takes any number of arguments and returns the first one that isn't empty.
+func Coalesce(args ...cty.Value) (cty.Value, error) {
+        return CoalesceFunc.Call(args)
+}
+
+// CoalesceList takes any number of list arguments and returns the first one that isn't empty.
+func CoalesceList(args ...cty.Value) (cty.Value, error) {
+        return CoalesceListFunc.Call(args)
+}
+
+// Compact takes a list of strings and returns a new list
+// with any empty string elements removed.
+func Compact(list cty.Value) (cty.Value, error) {
+        return CompactFunc.Call([]cty.Value{list})
+}
+
+// Contains determines whether a given list contains a given single value
+// as one of its elements.
+func Contains(list, value cty.Value) (cty.Value, error) {
+        return ContainsFunc.Call([]cty.Value{list, value})
+}
+
+// Index finds the element index for a given value in a list.
+func Index(list, value cty.Value) (cty.Value, error) {
+        return IndexFunc.Call([]cty.Value{list, value})
+}
+
+// Distinct takes a list and returns a new list with any duplicate elements removed.
+func Distinct(list cty.Value) (cty.Value, error) {
+        return DistinctFunc.Call([]cty.Value{list})
+}
+
+// Chunklist splits a single list into fixed-size chunks, returning a list of lists.
+func Chunklist(list, size cty.Value) (cty.Value, error) {
+        return ChunklistFunc.Call([]cty.Value{list, size})
+}
+
+// Flatten takes a list and replaces any elements that are lists with a flattened
+// sequence of the list contents.
+func Flatten(list cty.Value) (cty.Value, error) {
+        return FlattenFunc.Call([]cty.Value{list})
+}
+
+// Keys takes a map and returns a sorted list of the map keys.
+func Keys(inputMap cty.Value) (cty.Value, error) {
+        return KeysFunc.Call([]cty.Value{inputMap})
+}
+
+// List takes any number of list arguments and returns a list containing those
+//  values in the same order.
+func List(args ...cty.Value) (cty.Value, error) {
+        return ListFunc.Call(args)
+}
+
+// Lookup performs a dynamic lookup into a map.
+// There are two required arguments, map and key, plus an optional default,
+// which is a value to return if no key is found in map.
+func Lookup(args ...cty.Value) (cty.Value, error) {
+        return LookupFunc.Call(args)
+}
+
+// Map takes an even number of arguments and returns a map whose elements are constructed
+// from consecutive pairs of arguments.
+func Map(args ...cty.Value) (cty.Value, error) {
+        return MapFunc.Call(args)
+}
+
+// Matchkeys constructs a new list by taking a subset of elements from one list
+// whose indexes match the corresponding indexes of values in another list.
+func Matchkeys(values, keys, searchset cty.Value) (cty.Value, error) {
+        return MatchkeysFunc.Call([]cty.Value{values, keys, searchset})
+}
+
+// Merge takes an arbitrary number of maps and returns a single map that contains
+// a merged set of elements from all of the maps.
+//
+// If more than one given map defines the same key then the one that is later in
+// the argument sequence takes precedence.
+func Merge(maps ...cty.Value) (cty.Value, error) {
+        return MergeFunc.Call(maps)
+}
+
+// Reverse takes a sequence and produces a new sequence of the same length
+// with all of the same elements as the given sequence but in reverse order.
+func Reverse(list cty.Value) (cty.Value, error) {
+        return ReverseFunc.Call([]cty.Value{list})
+}
+
+// SetProduct computes the cartesian product of sets or sequences.
+func SetProduct(sets ...cty.Value) (cty.Value, error) {
+        return SetProductFunc.Call(sets)
+}
+
+// Slice extracts some consecutive elements from within a list.
+func Slice(list, start, end cty.Value) (cty.Value, error) {
+        return SliceFunc.Call([]cty.Value{list, start, end})
+}
+
+// Transpose takes a map of lists of strings and swaps the keys and values to
+// produce a new map of lists of strings.
+func Transpose(values cty.Value) (cty.Value, error) {
+        return TransposeFunc.Call([]cty.Value{values})
+}
+
+// Values returns a list of the map values, in the order of the sorted keys.
+// This function only works on flat maps.
+func Values(values cty.Value) (cty.Value, error) {
+        return ValuesFunc.Call([]cty.Value{values})
+}
+
+// Zipmap constructs a map from a list of keys and a corresponding list of values.
+func Zipmap(keys, values cty.Value) (cty.Value, error) {
+        return ZipmapFunc.Call([]cty.Value{keys, values})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/conversion.go b/vendor/github.com/hashicorp/terraform/lang/funcs/conversion.go
new file mode 100644
index 0000000..83f8597
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/conversion.go
@@ -0,0 +1,87 @@
+package funcs
+
+import (
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// MakeToFunc constructs a "to..." function, like "tostring", which converts
+// its argument to a specific type or type kind.
+//
+// The given type wantTy can be any type constraint that cty's "convert" package
+// would accept. In particular, this means that you can pass
+// cty.List(cty.DynamicPseudoType) to mean "list of any single type", which
+// will then cause cty to attempt to unify all of the element types when given
+// a tuple.
+func MakeToFunc(wantTy cty.Type) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "v",
+                                // We use DynamicPseudoType rather than wantTy here so that
+                                // all values will pass through the function API verbatim and
+                                // we can handle the conversion logic within the Type and
+                                // Impl functions. This allows us to customize the error
+                                // messages to be more appropriate for an explicit type
+                                // conversion, whereas the cty function system produces
+                                // messages aimed at _implicit_ type conversions.
+                                Type:      cty.DynamicPseudoType,
+                                AllowNull: true,
+                        },
+                },
+                Type: func(args []cty.Value) (cty.Type, error) {
+                        gotTy := args[0].Type()
+                        if gotTy.Equals(wantTy) {
+                                return wantTy, nil
+                        }
+                        conv := convert.GetConversionUnsafe(args[0].Type(), wantTy)
+                        if conv == nil {
+                                // We'll use some specialized errors for some trickier cases,
+                                // but most we can handle in a simple way.
+                                switch {
+                                case gotTy.IsTupleType() && wantTy.IsTupleType():
+                                        return cty.NilType, function.NewArgErrorf(0, "incompatible tuple type for conversion: %s", convert.MismatchMessage(gotTy, wantTy))
+                                case gotTy.IsObjectType() && wantTy.IsObjectType():
+                                        return cty.NilType, function.NewArgErrorf(0, "incompatible object type for conversion: %s", convert.MismatchMessage(gotTy, wantTy))
+                                default:
+                                        return cty.NilType, function.NewArgErrorf(0, "cannot convert %s to %s", gotTy.FriendlyName(), wantTy.FriendlyNameForConstraint())
+                                }
+                        }
+                        // If a conversion is available then everything is fine.
+                        return wantTy, nil
+                },
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        // We didn't set "AllowUnknown" on our argument, so it is guaranteed
+                        // to be known here but may still be null.
+                        ret, err := convert.Convert(args[0], retType)
+                        if err != nil {
+                                // Because we used GetConversionUnsafe above, conversion can
+                                // still potentially fail in here. For example, if the user
+                                // asks to convert the string "a" to bool then we'll
+                                // optimistically permit it during type checking but fail here
+                                // once we note that the value isn't either "true" or "false".
+                                gotTy := args[0].Type()
+                                switch {
+                                case gotTy == cty.String && wantTy == cty.Bool:
+                                        what := "string"
+                                        if !args[0].IsNull() {
+                                                what = strconv.Quote(args[0].AsString())
+                                        }
+                                        return cty.NilVal, function.NewArgErrorf(0, `cannot convert %s to bool; only the strings "true" or "false" are allowed`, what)
+                                case gotTy == cty.String && wantTy == cty.Number:
+                                        what := "string"
+                                        if !args[0].IsNull() {
+                                                what = strconv.Quote(args[0].AsString())
+                                        }
+                                        return cty.NilVal, function.NewArgErrorf(0, `cannot convert %s to number; given string must be a decimal representation of a number`, what)
+                                default:
+                                        return cty.NilVal, function.NewArgErrorf(0, "cannot convert %s to %s", gotTy.FriendlyName(), wantTy.FriendlyNameForConstraint())
+                                }
+                        }
+                        return ret, nil
+                },
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/crypto.go b/vendor/github.com/hashicorp/terraform/lang/funcs/crypto.go
new file mode 100644
index 0000000..5cb4bc5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/crypto.go
@@ -0,0 +1,285 @@
+package funcs
+
+import (
+        "crypto/md5"
+        "crypto/rsa"
+        "crypto/sha1"
+        "crypto/sha256"
+        "crypto/sha512"
+        "crypto/x509"
+        "encoding/base64"
+        "encoding/hex"
+        "encoding/pem"
+        "fmt"
+        "hash"
+
+        uuid "github.com/hashicorp/go-uuid"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+        "golang.org/x/crypto/bcrypt"
+)
+
+var UUIDFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        Type:   function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                result, err := uuid.GenerateUUID()
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                return cty.StringVal(result), nil
+        },
+})
+
+// Base64Sha256Func constructs a function that computes the SHA256 hash of a given string
+// and encodes it with Base64.
+var Base64Sha256Func = makeStringHashFunction(sha256.New, base64.StdEncoding.EncodeToString)
+
+// MakeFileBase64Sha256Func constructs a function that is like Base64Sha256Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileBase64Sha256Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha256.New, base64.StdEncoding.EncodeToString)
+}
+
+// Base64Sha512Func constructs a function that computes the SHA256 hash of a given string
+// and encodes it with Base64.
+var Base64Sha512Func = makeStringHashFunction(sha512.New, base64.StdEncoding.EncodeToString)
+
+// MakeFileBase64Sha512Func constructs a function that is like Base64Sha512Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileBase64Sha512Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha512.New, base64.StdEncoding.EncodeToString)
+}
+
+// BcryptFunc constructs a function that computes a hash of the given string using the Blowfish cipher.
+var BcryptFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        VarParam: &function.Parameter{
+                Name: "cost",
+                Type: cty.Number,
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                defaultCost := 10
+
+                if len(args) > 1 {
+                        var val int
+                        if err := gocty.FromCtyValue(args[1], &val); err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+                        defaultCost = val
+                }
+
+                if len(args) > 2 {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("bcrypt() takes no more than two arguments")
+                }
+
+                input := args[0].AsString()
+                out, err := bcrypt.GenerateFromPassword([]byte(input), defaultCost)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("error occured generating password %s", err.Error())
+                }
+
+                return cty.StringVal(string(out)), nil
+        },
+})
+
+// Md5Func constructs a function that computes the MD5 hash of a given string and encodes it with hexadecimal digits.
+var Md5Func = makeStringHashFunction(md5.New, hex.EncodeToString)
+
+// MakeFileMd5Func constructs a function that is like Md5Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileMd5Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, md5.New, hex.EncodeToString)
+}
+
+// RsaDecryptFunc constructs a function that decrypts an RSA-encrypted ciphertext.
+var RsaDecryptFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "ciphertext",
+                        Type: cty.String,
+                },
+                {
+                        Name: "privatekey",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                s := args[0].AsString()
+                key := args[1].AsString()
+
+                b, err := base64.StdEncoding.DecodeString(s)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to decode input %q: cipher text must be base64-encoded", s)
+                }
+
+                block, _ := pem.Decode([]byte(key))
+                if block == nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to parse key: no key found")
+                }
+                if block.Headers["Proc-Type"] == "4,ENCRYPTED" {
+                        return cty.UnknownVal(cty.String), fmt.Errorf(
+                                "failed to parse key: password protected keys are not supported. Please decrypt the key prior to use",
+                        )
+                }
+
+                x509Key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                out, err := rsa.DecryptPKCS1v15(nil, x509Key, b)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(string(out)), nil
+        },
+})
+
+// Sha1Func contructs a function that computes the SHA1 hash of a given string
+// and encodes it with hexadecimal digits.
+var Sha1Func = makeStringHashFunction(sha1.New, hex.EncodeToString)
+
+// MakeFileSha1Func constructs a function that is like Sha1Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileSha1Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha1.New, hex.EncodeToString)
+}
+
+// Sha256Func contructs a function that computes the SHA256 hash of a given string
+// and encodes it with hexadecimal digits.
+var Sha256Func = makeStringHashFunction(sha256.New, hex.EncodeToString)
+
+// MakeFileSha256Func constructs a function that is like Sha256Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileSha256Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha256.New, hex.EncodeToString)
+}
+
+// Sha512Func contructs a function that computes the SHA512 hash of a given string
+// and encodes it with hexadecimal digits.
+var Sha512Func = makeStringHashFunction(sha512.New, hex.EncodeToString)
+
+// MakeFileSha512Func constructs a function that is like Sha512Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileSha512Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha512.New, hex.EncodeToString)
+}
+
+func makeStringHashFunction(hf func() hash.Hash, enc func([]byte) string) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "str",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.String),
+                Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                        s := args[0].AsString()
+                        h := hf()
+                        h.Write([]byte(s))
+                        rv := enc(h.Sum(nil))
+                        return cty.StringVal(rv), nil
+                },
+        })
+}
+
+func makeFileHashFunction(baseDir string, hf func() hash.Hash, enc func([]byte) string) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "path",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.String),
+                Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                        path := args[0].AsString()
+                        src, err := readFileBytes(baseDir, path)
+                        if err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+
+                        h := hf()
+                        h.Write(src)
+                        rv := enc(h.Sum(nil))
+                        return cty.StringVal(rv), nil
+                },
+        })
+}
+
+// UUID generates and returns a Type-4 UUID in the standard hexadecimal string
+// format.
+//
+// This is not a pure function: it will generate a different result for each
+// call. It must therefore be registered as an impure function in the function
+// table in the "lang" package.
+func UUID() (cty.Value, error) {
+        return UUIDFunc.Call(nil)
+}
+
+// Base64Sha256 computes the SHA256 hash of a given string and encodes it with
+// Base64.
+//
+// The given string is first encoded as UTF-8 and then the SHA256 algorithm is applied
+// as defined in RFC 4634. The raw hash is then encoded with Base64 before returning.
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+func Base64Sha256(str cty.Value) (cty.Value, error) {
+        return Base64Sha256Func.Call([]cty.Value{str})
+}
+
+// Base64Sha512 computes the SHA512 hash of a given string and encodes it with
+// Base64.
+//
+// The given string is first encoded as UTF-8 and then the SHA256 algorithm is applied
+// as defined in RFC 4634. The raw hash is then encoded with Base64 before returning.
+// Terraform uses the "standard" Base64  alphabet as defined in RFC 4648 section 4
+func Base64Sha512(str cty.Value) (cty.Value, error) {
+        return Base64Sha512Func.Call([]cty.Value{str})
+}
+
+// Bcrypt computes a hash of the given string using the Blowfish cipher,
+// returning a string in the Modular Crypt Format
+// usually expected in the shadow password file on many Unix systems.
+func Bcrypt(str cty.Value, cost ...cty.Value) (cty.Value, error) {
+        args := make([]cty.Value, len(cost)+1)
+        args[0] = str
+        copy(args[1:], cost)
+        return BcryptFunc.Call(args)
+}
+
+// Md5 computes the MD5 hash of a given string and encodes it with hexadecimal digits.
+func Md5(str cty.Value) (cty.Value, error) {
+        return Md5Func.Call([]cty.Value{str})
+}
+
+// RsaDecrypt decrypts an RSA-encrypted ciphertext, returning the corresponding
+// cleartext.
+func RsaDecrypt(ciphertext, privatekey cty.Value) (cty.Value, error) {
+        return RsaDecryptFunc.Call([]cty.Value{ciphertext, privatekey})
+}
+
+// Sha1 computes the SHA1 hash of a given string and encodes it with hexadecimal digits.
+func Sha1(str cty.Value) (cty.Value, error) {
+        return Sha1Func.Call([]cty.Value{str})
+}
+
+// Sha256 computes the SHA256 hash of a given string and encodes it with hexadecimal digits.
+func Sha256(str cty.Value) (cty.Value, error) {
+        return Sha256Func.Call([]cty.Value{str})
+}
+
+// Sha512 computes the SHA512 hash of a given string and encodes it with hexadecimal digits.
+func Sha512(str cty.Value) (cty.Value, error) {
+        return Sha512Func.Call([]cty.Value{str})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/datetime.go b/vendor/github.com/hashicorp/terraform/lang/funcs/datetime.go
new file mode 100644
index 0000000..5dae198
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/datetime.go
@@ -0,0 +1,70 @@
+package funcs
+
+import (
+        "time"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// TimestampFunc constructs a function that returns a string representation of the current date and time.
+var TimestampFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        Type:   function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(time.Now().UTC().Format(time.RFC3339)), nil
+        },
+})
+
+// TimeAddFunc constructs a function that adds a duration to a timestamp, returning a new timestamp.
+var TimeAddFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "timestamp",
+                        Type: cty.String,
+                },
+                {
+                        Name: "duration",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                ts, err := time.Parse(time.RFC3339, args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                duration, err := time.ParseDuration(args[1].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(ts.Add(duration).Format(time.RFC3339)), nil
+        },
+})
+
+// Timestamp returns a string representation of the current date and time.
+//
+// In the Terraform language, timestamps are conventionally represented as
+// strings using RFC 3339 "Date and Time format" syntax, and so timestamp
+// returns a string in this format.
+func Timestamp() (cty.Value, error) {
+        return TimestampFunc.Call([]cty.Value{})
+}
+
+// TimeAdd adds a duration to a timestamp, returning a new timestamp.
+//
+// In the Terraform language, timestamps are conventionally represented as
+// strings using RFC 3339 "Date and Time format" syntax. Timeadd requires
+// the timestamp argument to be a string conforming to this syntax.
+//
+// `duration` is a string representation of a time difference, consisting of
+// sequences of number and unit pairs, like `"1.5h"` or `1h30m`. The accepted
+// units are `ns`, `us` (or `µs`), `"ms"`, `"s"`, `"m"`, and `"h"`. The first
+// number may be negative to indicate a negative duration, like `"-2h5m"`.
+//
+// The result is a string, also in RFC 3339 format, representing the result
+// of adding the given direction to the given timestamp.
+func TimeAdd(timestamp cty.Value, duration cty.Value) (cty.Value, error) {
+        return TimeAddFunc.Call([]cty.Value{timestamp, duration})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/encoding.go b/vendor/github.com/hashicorp/terraform/lang/funcs/encoding.go
new file mode 100644
index 0000000..af93f08
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/encoding.go
@@ -0,0 +1,140 @@
+package funcs
+
+import (
+        "bytes"
+        "compress/gzip"
+        "encoding/base64"
+        "fmt"
+        "log"
+        "net/url"
+        "unicode/utf8"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// Base64DecodeFunc constructs a function that decodes a string containing a base64 sequence.
+var Base64DecodeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                s := args[0].AsString()
+                sDec, err := base64.StdEncoding.DecodeString(s)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to decode base64 data '%s'", s)
+                }
+                if !utf8.Valid([]byte(sDec)) {
+                        log.Printf("[DEBUG] the result of decoding the the provided string is not valid UTF-8: %s", sDec)
+                        return cty.UnknownVal(cty.String), fmt.Errorf("the result of decoding the the provided string is not valid UTF-8")
+                }
+                return cty.StringVal(string(sDec)), nil
+        },
+})
+
+// Base64EncodeFunc constructs a function that encodes a string to a base64 sequence.
+var Base64EncodeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(base64.StdEncoding.EncodeToString([]byte(args[0].AsString()))), nil
+        },
+})
+
+// Base64GzipFunc constructs a function that compresses a string with gzip and then encodes the result in
+// Base64 encoding.
+var Base64GzipFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                s := args[0].AsString()
+
+                var b bytes.Buffer
+                gz := gzip.NewWriter(&b)
+                if _, err := gz.Write([]byte(s)); err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to write gzip raw data: '%s'", s)
+                }
+                if err := gz.Flush(); err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to flush gzip writer: '%s'", s)
+                }
+                if err := gz.Close(); err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to close gzip writer: '%s'", s)
+                }
+                return cty.StringVal(base64.StdEncoding.EncodeToString(b.Bytes())), nil
+        },
+})
+
+// URLEncodeFunc constructs a function that applies URL encoding to a given string.
+var URLEncodeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(url.QueryEscape(args[0].AsString())), nil
+        },
+})
+
+// Base64Decode decodes a string containing a base64 sequence.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will also interpret the resulting bytes as
+// UTF-8. If the bytes after Base64 decoding are _not_ valid UTF-8, this function
+// produces an error.
+func Base64Decode(str cty.Value) (cty.Value, error) {
+        return Base64DecodeFunc.Call([]cty.Value{str})
+}
+
+// Base64Encode applies Base64 encoding to a string.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will first encode the characters from the string
+// as UTF-8, and then apply Base64 encoding to the result.
+func Base64Encode(str cty.Value) (cty.Value, error) {
+        return Base64EncodeFunc.Call([]cty.Value{str})
+}
+
+// Base64Gzip compresses a string with gzip and then encodes the result in
+// Base64 encoding.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will first encode the characters from the string
+// as UTF-8, then apply gzip compression, and then finally apply Base64 encoding.
+func Base64Gzip(str cty.Value) (cty.Value, error) {
+        return Base64GzipFunc.Call([]cty.Value{str})
+}
+
+// URLEncode applies URL encoding to a given string.
+//
+// This function identifies characters in the given string that would have a
+// special meaning when included as a query string argument in a URL and
+// escapes them using RFC 3986 "percent encoding".
+//
+// If the given string contains non-ASCII characters, these are first encoded as
+// UTF-8 and then percent encoding is applied separately to each UTF-8 byte.
+func URLEncode(str cty.Value) (cty.Value, error) {
+        return URLEncodeFunc.Call([]cty.Value{str})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/filesystem.go b/vendor/github.com/hashicorp/terraform/lang/funcs/filesystem.go
new file mode 100644
index 0000000..7dfc905
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/filesystem.go
@@ -0,0 +1,345 @@
+package funcs
+
+import (
+        "encoding/base64"
+        "fmt"
+        "io/ioutil"
+        "os"
+        "path/filepath"
+        "unicode/utf8"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        homedir "github.com/mitchellh/go-homedir"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// MakeFileFunc constructs a function that takes a file path and returns the
+// contents of that file, either directly as a string (where valid UTF-8 is
+// required) or as a string containing base64 bytes.
+func MakeFileFunc(baseDir string, encBase64 bool) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "path",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.String),
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        path := args[0].AsString()
+                        src, err := readFileBytes(baseDir, path)
+                        if err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+
+                        switch {
+                        case encBase64:
+                                enc := base64.StdEncoding.EncodeToString(src)
+                                return cty.StringVal(enc), nil
+                        default:
+                                if !utf8.Valid(src) {
+                                        return cty.UnknownVal(cty.String), fmt.Errorf("contents of %s are not valid UTF-8; use the filebase64 function to obtain the Base64 encoded contents or the other file functions (e.g. filemd5, filesha256) to obtain file hashing results instead", path)
+                                }
+                                return cty.StringVal(string(src)), nil
+                        }
+                },
+        })
+}
+
+// MakeTemplateFileFunc constructs a function that takes a file path and
+// an arbitrary object of named values and attempts to render the referenced
+// file as a template using HCL template syntax.
+//
+// The template itself may recursively call other functions so a callback
+// must be provided to get access to those functions. The template cannot,
+// however, access any variables defined in the scope: it is restricted only to
+// those variables provided in the second function argument, to ensure that all
+// dependencies on other graph nodes can be seen before executing this function.
+//
+// As a special exception, a referenced template file may not recursively call
+// the templatefile function, since that would risk the same file being
+// included into itself indefinitely.
+func MakeTemplateFileFunc(baseDir string, funcsCb func() map[string]function.Function) function.Function {
+
+        params := []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+                {
+                        Name: "vars",
+                        Type: cty.DynamicPseudoType,
+                },
+        }
+
+        loadTmpl := func(fn string) (hcl.Expression, error) {
+                // We re-use File here to ensure the same filename interpretation
+                // as it does, along with its other safety checks.
+                tmplVal, err := File(baseDir, cty.StringVal(fn))
+                if err != nil {
+                        return nil, err
+                }
+
+                expr, diags := hclsyntax.ParseTemplate([]byte(tmplVal.AsString()), fn, hcl.Pos{Line: 1, Column: 1})
+                if diags.HasErrors() {
+                        return nil, diags
+                }
+
+                return expr, nil
+        }
+
+        renderTmpl := func(expr hcl.Expression, varsVal cty.Value) (cty.Value, error) {
+                if varsTy := varsVal.Type(); !(varsTy.IsMapType() || varsTy.IsObjectType()) {
+                        return cty.DynamicVal, function.NewArgErrorf(1, "invalid vars value: must be a map") // or an object, but we don't strongly distinguish these most of the time
+                }
+
+                ctx := &hcl.EvalContext{
+                        Variables: varsVal.AsValueMap(),
+                }
+
+                // We'll pre-check references in the template here so we can give a
+                // more specialized error message than HCL would by default, so it's
+                // clearer that this problem is coming from a templatefile call.
+                for _, traversal := range expr.Variables() {
+                        root := traversal.RootName()
+                        if _, ok := ctx.Variables[root]; !ok {
+                                return cty.DynamicVal, function.NewArgErrorf(1, "vars map does not contain key %q, referenced at %s", root, traversal[0].SourceRange())
+                        }
+                }
+
+                givenFuncs := funcsCb() // this callback indirection is to avoid chicken/egg problems
+                funcs := make(map[string]function.Function, len(givenFuncs))
+                for name, fn := range givenFuncs {
+                        if name == "templatefile" {
+                                // We stub this one out to prevent recursive calls.
+                                funcs[name] = function.New(&function.Spec{
+                                        Params: params,
+                                        Type: func(args []cty.Value) (cty.Type, error) {
+                                                return cty.NilType, fmt.Errorf("cannot recursively call templatefile from inside templatefile call")
+                                        },
+                                })
+                                continue
+                        }
+                        funcs[name] = fn
+                }
+                ctx.Functions = funcs
+
+                val, diags := expr.Value(ctx)
+                if diags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+                return val, nil
+        }
+
+        return function.New(&function.Spec{
+                Params: params,
+                Type: func(args []cty.Value) (cty.Type, error) {
+                        if !(args[0].IsKnown() && args[1].IsKnown()) {
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        // We'll render our template now to see what result type it produces.
+                        // A template consisting only of a single interpolation an potentially
+                        // return any type.
+                        expr, err := loadTmpl(args[0].AsString())
+                        if err != nil {
+                                return cty.DynamicPseudoType, err
+                        }
+
+                        // This is safe even if args[1] contains unknowns because the HCL
+                        // template renderer itself knows how to short-circuit those.
+                        val, err := renderTmpl(expr, args[1])
+                        return val.Type(), err
+                },
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        expr, err := loadTmpl(args[0].AsString())
+                        if err != nil {
+                                return cty.DynamicVal, err
+                        }
+                        return renderTmpl(expr, args[1])
+                },
+        })
+
+}
+
+// MakeFileExistsFunc constructs a function that takes a path
+// and determines whether a file exists at that path
+func MakeFileExistsFunc(baseDir string) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "path",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.Bool),
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        path := args[0].AsString()
+                        path, err := homedir.Expand(path)
+                        if err != nil {
+                                return cty.UnknownVal(cty.Bool), fmt.Errorf("failed to expand ~: %s", err)
+                        }
+
+                        if !filepath.IsAbs(path) {
+                                path = filepath.Join(baseDir, path)
+                        }
+
+                        // Ensure that the path is canonical for the host OS
+                        path = filepath.Clean(path)
+
+                        fi, err := os.Stat(path)
+                        if err != nil {
+                                if os.IsNotExist(err) {
+                                        return cty.False, nil
+                                }
+                                return cty.UnknownVal(cty.Bool), fmt.Errorf("failed to stat %s", path)
+                        }
+
+                        if fi.Mode().IsRegular() {
+                                return cty.True, nil
+                        }
+
+                        return cty.False, fmt.Errorf("%s is not a regular file, but %q",
+                                path, fi.Mode().String())
+                },
+        })
+}
+
+// BasenameFunc constructs a function that takes a string containing a filesystem path
+// and removes all except the last portion from it.
+var BasenameFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(filepath.Base(args[0].AsString())), nil
+        },
+})
+
+// DirnameFunc constructs a function that takes a string containing a filesystem path
+// and removes the last portion from it.
+var DirnameFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(filepath.Dir(args[0].AsString())), nil
+        },
+})
+
+// PathExpandFunc constructs a function that expands a leading ~ character to the current user's home directory.
+var PathExpandFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+
+                homePath, err := homedir.Expand(args[0].AsString())
+                return cty.StringVal(homePath), err
+        },
+})
+
+func readFileBytes(baseDir, path string) ([]byte, error) {
+        path, err := homedir.Expand(path)
+        if err != nil {
+                return nil, fmt.Errorf("failed to expand ~: %s", err)
+        }
+
+        if !filepath.IsAbs(path) {
+                path = filepath.Join(baseDir, path)
+        }
+
+        // Ensure that the path is canonical for the host OS
+        path = filepath.Clean(path)
+
+        src, err := ioutil.ReadFile(path)
+        if err != nil {
+                // ReadFile does not return Terraform-user-friendly error
+                // messages, so we'll provide our own.
+                if os.IsNotExist(err) {
+                        return nil, fmt.Errorf("no file exists at %s", path)
+                }
+                return nil, fmt.Errorf("failed to read %s", path)
+        }
+
+        return src, nil
+}
+
+// File reads the contents of the file at the given path.
+//
+// The file must contain valid UTF-8 bytes, or this function will return an error.
+//
+// The underlying function implementation works relative to a particular base
+// directory, so this wrapper takes a base directory string and uses it to
+// construct the underlying function before calling it.
+func File(baseDir string, path cty.Value) (cty.Value, error) {
+        fn := MakeFileFunc(baseDir, false)
+        return fn.Call([]cty.Value{path})
+}
+
+// FileExists determines whether a file exists at the given path.
+//
+// The underlying function implementation works relative to a particular base
+// directory, so this wrapper takes a base directory string and uses it to
+// construct the underlying function before calling it.
+func FileExists(baseDir string, path cty.Value) (cty.Value, error) {
+        fn := MakeFileExistsFunc(baseDir)
+        return fn.Call([]cty.Value{path})
+}
+
+// FileBase64 reads the contents of the file at the given path.
+//
+// The bytes from the file are encoded as base64 before returning.
+//
+// The underlying function implementation works relative to a particular base
+// directory, so this wrapper takes a base directory string and uses it to
+// construct the underlying function before calling it.
+func FileBase64(baseDir string, path cty.Value) (cty.Value, error) {
+        fn := MakeFileFunc(baseDir, true)
+        return fn.Call([]cty.Value{path})
+}
+
+// Basename takes a string containing a filesystem path and removes all except the last portion from it.
+//
+// The underlying function implementation works only with the path string and does not access the filesystem itself.
+// It is therefore unable to take into account filesystem features such as symlinks.
+//
+// If the path is empty then the result is ".", representing the current working directory.
+func Basename(path cty.Value) (cty.Value, error) {
+        return BasenameFunc.Call([]cty.Value{path})
+}
+
+// Dirname takes a string containing a filesystem path and removes the last portion from it.
+//
+// The underlying function implementation works only with the path string and does not access the filesystem itself.
+// It is therefore unable to take into account filesystem features such as symlinks.
+//
+// If the path is empty then the result is ".", representing the current working directory.
+func Dirname(path cty.Value) (cty.Value, error) {
+        return DirnameFunc.Call([]cty.Value{path})
+}
+
+// Pathexpand takes a string that might begin with a `~` segment, and if so it replaces that segment with
+// the current user's home directory path.
+//
+// The underlying function implementation works only with the path string and does not access the filesystem itself.
+// It is therefore unable to take into account filesystem features such as symlinks.
+//
+// If the leading segment in the path is not `~` then the given path is returned unmodified.
+func Pathexpand(path cty.Value) (cty.Value, error) {
+        return PathExpandFunc.Call([]cty.Value{path})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/number.go b/vendor/github.com/hashicorp/terraform/lang/funcs/number.go
new file mode 100644
index 0000000..15cfe71
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/number.go
@@ -0,0 +1,155 @@
+package funcs
+
+import (
+        "math"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// CeilFunc contructs a function that returns the closest whole number greater
+// than or equal to the given value.
+var CeilFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var val float64
+                if err := gocty.FromCtyValue(args[0], &val); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                return cty.NumberIntVal(int64(math.Ceil(val))), nil
+        },
+})
+
+// FloorFunc contructs a function that returns the closest whole number lesser
+// than or equal to the given value.
+var FloorFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var val float64
+                if err := gocty.FromCtyValue(args[0], &val); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                return cty.NumberIntVal(int64(math.Floor(val))), nil
+        },
+})
+
+// LogFunc contructs a function that returns the logarithm of a given number in a given base.
+var LogFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "base",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var num float64
+                if err := gocty.FromCtyValue(args[0], &num); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                var base float64
+                if err := gocty.FromCtyValue(args[1], &base); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.NumberFloatVal(math.Log(num) / math.Log(base)), nil
+        },
+})
+
+// PowFunc contructs a function that returns the logarithm of a given number in a given base.
+var PowFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "power",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var num float64
+                if err := gocty.FromCtyValue(args[0], &num); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                var power float64
+                if err := gocty.FromCtyValue(args[1], &power); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.NumberFloatVal(math.Pow(num, power)), nil
+        },
+})
+
+// SignumFunc contructs a function that returns the closest whole number greater
+// than or equal to the given value.
+var SignumFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var num int
+                if err := gocty.FromCtyValue(args[0], &num); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                switch {
+                case num < 0:
+                        return cty.NumberIntVal(-1), nil
+                case num > 0:
+                        return cty.NumberIntVal(+1), nil
+                default:
+                        return cty.NumberIntVal(0), nil
+                }
+        },
+})
+
+// Ceil returns the closest whole number greater than or equal to the given value.
+func Ceil(num cty.Value) (cty.Value, error) {
+        return CeilFunc.Call([]cty.Value{num})
+}
+
+// Floor returns the closest whole number lesser than or equal to the given value.
+func Floor(num cty.Value) (cty.Value, error) {
+        return FloorFunc.Call([]cty.Value{num})
+}
+
+// Log returns returns the logarithm of a given number in a given base.
+func Log(num, base cty.Value) (cty.Value, error) {
+        return LogFunc.Call([]cty.Value{num, base})
+}
+
+// Pow returns the logarithm of a given number in a given base.
+func Pow(num, power cty.Value) (cty.Value, error) {
+        return PowFunc.Call([]cty.Value{num, power})
+}
+
+// Signum determines the sign of a number, returning a number between -1 and
+// 1 to represent the sign.
+func Signum(num cty.Value) (cty.Value, error) {
+        return SignumFunc.Call([]cty.Value{num})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/string.go b/vendor/github.com/hashicorp/terraform/lang/funcs/string.go
new file mode 100644
index 0000000..c9ddf19
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/string.go
@@ -0,0 +1,280 @@
+package funcs
+
+import (
+        "fmt"
+        "regexp"
+        "sort"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+var JoinFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "separator",
+                        Type: cty.String,
+                },
+        },
+        VarParam: &function.Parameter{
+                Name: "lists",
+                Type: cty.List(cty.String),
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                sep := args[0].AsString()
+                listVals := args[1:]
+                if len(listVals) < 1 {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("at least one list is required")
+                }
+
+                l := 0
+                for _, list := range listVals {
+                        if !list.IsWhollyKnown() {
+                                return cty.UnknownVal(cty.String), nil
+                        }
+                        l += list.LengthInt()
+                }
+
+                items := make([]string, 0, l)
+                for ai, list := range listVals {
+                        ei := 0
+                        for it := list.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+                                if val.IsNull() {
+                                        if len(listVals) > 1 {
+                                                return cty.UnknownVal(cty.String), function.NewArgErrorf(ai+1, "element %d of list %d is null; cannot concatenate null values", ei, ai+1)
+                                        }
+                                        return cty.UnknownVal(cty.String), function.NewArgErrorf(ai+1, "element %d is null; cannot concatenate null values", ei)
+                                }
+                                items = append(items, val.AsString())
+                                ei++
+                        }
+                }
+
+                return cty.StringVal(strings.Join(items, sep)), nil
+        },
+})
+
+var SortFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.String),
+                },
+        },
+        Type: function.StaticReturnType(cty.List(cty.String)),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                listVal := args[0]
+
+                if !listVal.IsWhollyKnown() {
+                        // If some of the element values aren't known yet then we
+                        // can't yet preduct the order of the result.
+                        return cty.UnknownVal(retType), nil
+                }
+                if listVal.LengthInt() == 0 { // Easy path
+                        return listVal, nil
+                }
+
+                list := make([]string, 0, listVal.LengthInt())
+                for it := listVal.ElementIterator(); it.Next(); {
+                        iv, v := it.Element()
+                        if v.IsNull() {
+                                return cty.UnknownVal(retType), fmt.Errorf("given list element %s is null; a null string cannot be sorted", iv.AsBigFloat().String())
+                        }
+                        list = append(list, v.AsString())
+                }
+
+                sort.Strings(list)
+                retVals := make([]cty.Value, len(list))
+                for i, s := range list {
+                        retVals[i] = cty.StringVal(s)
+                }
+                return cty.ListVal(retVals), nil
+        },
+})
+
+var SplitFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "separator",
+                        Type: cty.String,
+                },
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.List(cty.String)),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                sep := args[0].AsString()
+                str := args[1].AsString()
+                elems := strings.Split(str, sep)
+                elemVals := make([]cty.Value, len(elems))
+                for i, s := range elems {
+                        elemVals[i] = cty.StringVal(s)
+                }
+                if len(elemVals) == 0 {
+                        return cty.ListValEmpty(cty.String), nil
+                }
+                return cty.ListVal(elemVals), nil
+        },
+})
+
+// ChompFunc constructions a function that removes newline characters at the end of a string.
+var ChompFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                newlines := regexp.MustCompile(`(?:\r\n?|\n)*\z`)
+                return cty.StringVal(newlines.ReplaceAllString(args[0].AsString(), "")), nil
+        },
+})
+
+// IndentFunc constructions a function that adds a given number of spaces to the
+// beginnings of all but the first line in a given multi-line string.
+var IndentFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "spaces",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var spaces int
+                if err := gocty.FromCtyValue(args[0], &spaces); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                data := args[1].AsString()
+                pad := strings.Repeat(" ", spaces)
+                return cty.StringVal(strings.Replace(data, "\n", "\n"+pad, -1)), nil
+        },
+})
+
+// ReplaceFunc constructions a function that searches a given string for another
+// given substring, and replaces each occurence with a given replacement string.
+var ReplaceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+                {
+                        Name: "substr",
+                        Type: cty.String,
+                },
+                {
+                        Name: "replace",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                str := args[0].AsString()
+                substr := args[1].AsString()
+                replace := args[2].AsString()
+
+                // We search/replace using a regexp if the string is surrounded
+                // in forward slashes.
+                if len(substr) > 1 && substr[0] == '/' && substr[len(substr)-1] == '/' {
+                        re, err := regexp.Compile(substr[1 : len(substr)-1])
+                        if err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+
+                        return cty.StringVal(re.ReplaceAllString(str, replace)), nil
+                }
+
+                return cty.StringVal(strings.Replace(str, substr, replace, -1)), nil
+        },
+})
+
+// TitleFunc constructions a function that converts the first letter of each word
+// in the given string to uppercase.
+var TitleFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                return cty.StringVal(strings.Title(args[0].AsString())), nil
+        },
+})
+
+// TrimSpaceFunc constructions a function that removes any space characters from
+// the start and end of the given string.
+var TrimSpaceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                return cty.StringVal(strings.TrimSpace(args[0].AsString())), nil
+        },
+})
+
+// Join concatenates together the string elements of one or more lists with a
+// given separator.
+func Join(sep cty.Value, lists ...cty.Value) (cty.Value, error) {
+        args := make([]cty.Value, len(lists)+1)
+        args[0] = sep
+        copy(args[1:], lists)
+        return JoinFunc.Call(args)
+}
+
+// Sort re-orders the elements of a given list of strings so that they are
+// in ascending lexicographical order.
+func Sort(list cty.Value) (cty.Value, error) {
+        return SortFunc.Call([]cty.Value{list})
+}
+
+// Split divides a given string by a given separator, returning a list of
+// strings containing the characters between the separator sequences.
+func Split(sep, str cty.Value) (cty.Value, error) {
+        return SplitFunc.Call([]cty.Value{sep, str})
+}
+
+// Chomp removes newline characters at the end of a string.
+func Chomp(str cty.Value) (cty.Value, error) {
+        return ChompFunc.Call([]cty.Value{str})
+}
+
+// Indent adds a given number of spaces to the beginnings of all but the first
+// line in a given multi-line string.
+func Indent(spaces, str cty.Value) (cty.Value, error) {
+        return IndentFunc.Call([]cty.Value{spaces, str})
+}
+
+// Replace searches a given string for another given substring,
+// and replaces all occurences with a given replacement string.
+func Replace(str, substr, replace cty.Value) (cty.Value, error) {
+        return ReplaceFunc.Call([]cty.Value{str, substr, replace})
+}
+
+// Title converts the first letter of each word in the given string to uppercase.
+func Title(str cty.Value) (cty.Value, error) {
+        return TitleFunc.Call([]cty.Value{str})
+}
+
+// TrimSpace removes any space characters from the start and end of the given string.
+func TrimSpace(str cty.Value) (cty.Value, error) {
+        return TrimSpaceFunc.Call([]cty.Value{str})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/functions.go b/vendor/github.com/hashicorp/terraform/lang/functions.go
new file mode 100644
index 0000000..2c7b548
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/functions.go
@@ -0,0 +1,147 @@
+package lang
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/function/stdlib"
+
+        "github.com/hashicorp/terraform/lang/funcs"
+)
+
+var impureFunctions = []string{
+        "bcrypt",
+        "timestamp",
+        "uuid",
+}
+
+// Functions returns the set of functions that should be used to when evaluating
+// expressions in the receiving scope.
+func (s *Scope) Functions() map[string]function.Function {
+        s.funcsLock.Lock()
+        if s.funcs == nil {
+                // Some of our functions are just directly the cty stdlib functions.
+                // Others are implemented in the subdirectory "funcs" here in this
+                // repository. New functions should generally start out their lives
+                // in the "funcs" directory and potentially graduate to cty stdlib
+                // later if the functionality seems to be something domain-agnostic
+                // that would be useful to all applications using cty functions.
+
+                s.funcs = map[string]function.Function{
+                        "abs":              stdlib.AbsoluteFunc,
+                        "basename":         funcs.BasenameFunc,
+                        "base64decode":     funcs.Base64DecodeFunc,
+                        "base64encode":     funcs.Base64EncodeFunc,
+                        "base64gzip":       funcs.Base64GzipFunc,
+                        "base64sha256":     funcs.Base64Sha256Func,
+                        "base64sha512":     funcs.Base64Sha512Func,
+                        "bcrypt":           funcs.BcryptFunc,
+                        "ceil":             funcs.CeilFunc,
+                        "chomp":            funcs.ChompFunc,
+                        "cidrhost":         funcs.CidrHostFunc,
+                        "cidrnetmask":      funcs.CidrNetmaskFunc,
+                        "cidrsubnet":       funcs.CidrSubnetFunc,
+                        "coalesce":         funcs.CoalesceFunc,
+                        "coalescelist":     funcs.CoalesceListFunc,
+                        "compact":          funcs.CompactFunc,
+                        "concat":           stdlib.ConcatFunc,
+                        "contains":         funcs.ContainsFunc,
+                        "csvdecode":        stdlib.CSVDecodeFunc,
+                        "dirname":          funcs.DirnameFunc,
+                        "distinct":         funcs.DistinctFunc,
+                        "element":          funcs.ElementFunc,
+                        "chunklist":        funcs.ChunklistFunc,
+                        "file":             funcs.MakeFileFunc(s.BaseDir, false),
+                        "fileexists":       funcs.MakeFileExistsFunc(s.BaseDir),
+                        "filebase64":       funcs.MakeFileFunc(s.BaseDir, true),
+                        "filebase64sha256": funcs.MakeFileBase64Sha256Func(s.BaseDir),
+                        "filebase64sha512": funcs.MakeFileBase64Sha512Func(s.BaseDir),
+                        "filemd5":          funcs.MakeFileMd5Func(s.BaseDir),
+                        "filesha1":         funcs.MakeFileSha1Func(s.BaseDir),
+                        "filesha256":       funcs.MakeFileSha256Func(s.BaseDir),
+                        "filesha512":       funcs.MakeFileSha512Func(s.BaseDir),
+                        "flatten":          funcs.FlattenFunc,
+                        "floor":            funcs.FloorFunc,
+                        "format":           stdlib.FormatFunc,
+                        "formatdate":       stdlib.FormatDateFunc,
+                        "formatlist":       stdlib.FormatListFunc,
+                        "indent":           funcs.IndentFunc,
+                        "index":            funcs.IndexFunc,
+                        "join":             funcs.JoinFunc,
+                        "jsondecode":       stdlib.JSONDecodeFunc,
+                        "jsonencode":       stdlib.JSONEncodeFunc,
+                        "keys":             funcs.KeysFunc,
+                        "length":           funcs.LengthFunc,
+                        "list":             funcs.ListFunc,
+                        "log":              funcs.LogFunc,
+                        "lookup":           funcs.LookupFunc,
+                        "lower":            stdlib.LowerFunc,
+                        "map":              funcs.MapFunc,
+                        "matchkeys":        funcs.MatchkeysFunc,
+                        "max":              stdlib.MaxFunc,
+                        "md5":              funcs.Md5Func,
+                        "merge":            funcs.MergeFunc,
+                        "min":              stdlib.MinFunc,
+                        "pathexpand":       funcs.PathExpandFunc,
+                        "pow":              funcs.PowFunc,
+                        "replace":          funcs.ReplaceFunc,
+                        "reverse":          funcs.ReverseFunc,
+                        "rsadecrypt":       funcs.RsaDecryptFunc,
+                        "setintersection":  stdlib.SetIntersectionFunc,
+                        "setproduct":       funcs.SetProductFunc,
+                        "setunion":         stdlib.SetUnionFunc,
+                        "sha1":             funcs.Sha1Func,
+                        "sha256":           funcs.Sha256Func,
+                        "sha512":           funcs.Sha512Func,
+                        "signum":           funcs.SignumFunc,
+                        "slice":            funcs.SliceFunc,
+                        "sort":             funcs.SortFunc,
+                        "split":            funcs.SplitFunc,
+                        "strrev":           stdlib.ReverseFunc,
+                        "substr":           stdlib.SubstrFunc,
+                        "timestamp":        funcs.TimestampFunc,
+                        "timeadd":          funcs.TimeAddFunc,
+                        "title":            funcs.TitleFunc,
+                        "tostring":         funcs.MakeToFunc(cty.String),
+                        "tonumber":         funcs.MakeToFunc(cty.Number),
+                        "tobool":           funcs.MakeToFunc(cty.Bool),
+                        "toset":            funcs.MakeToFunc(cty.Set(cty.DynamicPseudoType)),
+                        "tolist":           funcs.MakeToFunc(cty.List(cty.DynamicPseudoType)),
+                        "tomap":            funcs.MakeToFunc(cty.Map(cty.DynamicPseudoType)),
+                        "transpose":        funcs.TransposeFunc,
+                        "trimspace":        funcs.TrimSpaceFunc,
+                        "upper":            stdlib.UpperFunc,
+                        "urlencode":        funcs.URLEncodeFunc,
+                        "uuid":             funcs.UUIDFunc,
+                        "values":           funcs.ValuesFunc,
+                        "zipmap":           funcs.ZipmapFunc,
+                }
+
+                s.funcs["templatefile"] = funcs.MakeTemplateFileFunc(s.BaseDir, func() map[string]function.Function {
+                        // The templatefile function prevents recursive calls to itself
+                        // by copying this map and overwriting the "templatefile" entry.
+                        return s.funcs
+                })
+
+                if s.PureOnly {
+                        // Force our few impure functions to return unknown so that we
+                        // can defer evaluating them until a later pass.
+                        for _, name := range impureFunctions {
+                                s.funcs[name] = function.Unpredictable(s.funcs[name])
+                        }
+                }
+        }
+        s.funcsLock.Unlock()
+
+        return s.funcs
+}
+
+var unimplFunc = function.New(&function.Spec{
+        Type: func([]cty.Value) (cty.Type, error) {
+                return cty.DynamicPseudoType, fmt.Errorf("function not yet implemented")
+        },
+        Impl: func([]cty.Value, cty.Type) (cty.Value, error) {
+                return cty.DynamicVal, fmt.Errorf("function not yet implemented")
+        },
+})
diff --git a/vendor/github.com/hashicorp/terraform/lang/references.go b/vendor/github.com/hashicorp/terraform/lang/references.go
new file mode 100644
index 0000000..d688477
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/references.go
@@ -0,0 +1,81 @@
+package lang
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang/blocktoattr"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// References finds all of the references in the given set of traversals,
+// returning diagnostics if any of the traversals cannot be interpreted as a
+// reference.
+//
+// This function does not do any de-duplication of references, since references
+// have source location information embedded in them and so any invalid
+// references that are duplicated should have errors reported for each
+// occurence.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete or invalid. Otherwise, the returned slice has one reference per
+// given traversal, though it is not guaranteed that the references will
+// appear in the same order as the given traversals.
+func References(traversals []hcl.Traversal) ([]*addrs.Reference, tfdiags.Diagnostics) {
+        if len(traversals) == 0 {
+                return nil, nil
+        }
+
+        var diags tfdiags.Diagnostics
+        refs := make([]*addrs.Reference, 0, len(traversals))
+
+        for _, traversal := range traversals {
+                ref, refDiags := addrs.ParseRef(traversal)
+                diags = diags.Append(refDiags)
+                if ref == nil {
+                        continue
+                }
+                refs = append(refs, ref)
+        }
+
+        return refs, diags
+}
+
+// ReferencesInBlock is a helper wrapper around References that first searches
+// the given body for traversals, before converting those traversals to
+// references.
+//
+// A block schema must be provided so that this function can determine where in
+// the body variables are expected.
+func ReferencesInBlock(body hcl.Body, schema *configschema.Block) ([]*addrs.Reference, tfdiags.Diagnostics) {
+        if body == nil {
+                return nil, nil
+        }
+
+        // We use blocktoattr.ExpandedVariables instead of hcldec.Variables or
+        // dynblock.VariablesHCLDec here because when we evaluate a block we'll
+        // first apply the dynamic block extension and _then_ the blocktoattr
+        // transform, and so blocktoattr.ExpandedVariables takes into account
+        // both of those transforms when it analyzes the body to ensure we find
+        // all of the references as if they'd already moved into their final
+        // locations, even though we can't expand dynamic blocks yet until we
+        // already know which variables are required.
+        //
+        // The set of cases we want to detect here is covered by the tests for
+        // the plan graph builder in the main 'terraform' package, since it's
+        // in a better position to test this due to having mock providers etc
+        // available.
+        traversals := blocktoattr.ExpandedVariables(body, schema)
+        return References(traversals)
+}
+
+// ReferencesInExpr is a helper wrapper around References that first searches
+// the given expression for traversals, before converting those traversals
+// to references.
+func ReferencesInExpr(expr hcl.Expression) ([]*addrs.Reference, tfdiags.Diagnostics) {
+        if expr == nil {
+                return nil, nil
+        }
+        traversals := expr.Variables()
+        return References(traversals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/scope.go b/vendor/github.com/hashicorp/terraform/lang/scope.go
new file mode 100644
index 0000000..98fca6b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/scope.go
@@ -0,0 +1,34 @@
+package lang
+
+import (
+        "sync"
+
+        "github.com/zclconf/go-cty/cty/function"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Scope is the main type in this package, allowing dynamic evaluation of
+// blocks and expressions based on some contextual information that informs
+// which variables and functions will be available.
+type Scope struct {
+        // Data is used to resolve references in expressions.
+        Data Data
+
+        // SelfAddr is the address that the "self" object should be an alias of,
+        // or nil if the "self" object should not be available at all.
+        SelfAddr addrs.Referenceable
+
+        // BaseDir is the base directory used by any interpolation functions that
+        // accept filesystem paths as arguments.
+        BaseDir string
+
+        // PureOnly can be set to true to request that any non-pure functions
+        // produce unknown value results rather than actually executing. This is
+        // important during a plan phase to avoid generating results that could
+        // then differ during apply.
+        PureOnly bool
+
+        funcs     map[string]function.Function
+        funcsLock sync.Mutex
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/action.go b/vendor/github.com/hashicorp/terraform/plans/action.go
new file mode 100644
index 0000000..c3e6a32
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/action.go
@@ -0,0 +1,22 @@
+package plans
+
+type Action rune
+
+const (
+        NoOp             Action = 0
+        Create           Action = '+'
+        Read             Action = '←'
+        Update           Action = '~'
+        DeleteThenCreate Action = '∓'
+        CreateThenDelete Action = '±'
+        Delete           Action = '-'
+)
+
+//go:generate stringer -type Action
+
+// IsReplace returns true if the action is one of the two actions that
+// represents replacing an existing object with a new object:
+// DeleteThenCreate or CreateThenDelete.
+func (a Action) IsReplace() bool {
+        return a == DeleteThenCreate || a == CreateThenDelete
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/action_string.go b/vendor/github.com/hashicorp/terraform/plans/action_string.go
new file mode 100644
index 0000000..be43ab1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/action_string.go
@@ -0,0 +1,49 @@
+// Code generated by "stringer -type Action"; DO NOT EDIT.
+
+package plans
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[NoOp-0]
+        _ = x[Create-43]
+        _ = x[Read-8592]
+        _ = x[Update-126]
+        _ = x[DeleteThenCreate-8723]
+        _ = x[CreateThenDelete-177]
+        _ = x[Delete-45]
+}
+
+const (
+        _Action_name_0 = "NoOp"
+        _Action_name_1 = "Create"
+        _Action_name_2 = "Delete"
+        _Action_name_3 = "Update"
+        _Action_name_4 = "CreateThenDelete"
+        _Action_name_5 = "Read"
+        _Action_name_6 = "DeleteThenCreate"
+)
+
+func (i Action) String() string {
+        switch {
+        case i == 0:
+                return _Action_name_0
+        case i == 43:
+                return _Action_name_1
+        case i == 45:
+                return _Action_name_2
+        case i == 126:
+                return _Action_name_3
+        case i == 177:
+                return _Action_name_4
+        case i == 8592:
+                return _Action_name_5
+        case i == 8723:
+                return _Action_name_6
+        default:
+                return "Action(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes.go b/vendor/github.com/hashicorp/terraform/plans/changes.go
new file mode 100644
index 0000000..d7e0dcd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes.go
@@ -0,0 +1,308 @@
+package plans
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Changes describes various actions that Terraform will attempt to take if
+// the corresponding plan is applied.
+//
+// A Changes object can be rendered into a visual diff (by the caller, using
+// code in another package) for display to the user.
+type Changes struct {
+        // Resources tracks planned changes to resource instance objects.
+        Resources []*ResourceInstanceChangeSrc
+
+        // Outputs tracks planned changes output values.
+        //
+        // Note that although an in-memory plan contains planned changes for
+        // outputs throughout the configuration, a plan serialized
+        // to disk retains only the root outputs because they are
+        // externally-visible, while other outputs are implementation details and
+        // can be easily re-calculated during the apply phase. Therefore only root
+        // module outputs will survive a round-trip through a plan file.
+        Outputs []*OutputChangeSrc
+}
+
+// NewChanges returns a valid Changes object that describes no changes.
+func NewChanges() *Changes {
+        return &Changes{}
+}
+
+func (c *Changes) Empty() bool {
+        for _, res := range c.Resources {
+                if res.Action != NoOp {
+                        return false
+                }
+        }
+        return true
+}
+
+// ResourceInstance returns the planned change for the current object of the
+// resource instance of the given address, if any. Returns nil if no change is
+// planned.
+func (c *Changes) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstanceChangeSrc {
+        addrStr := addr.String()
+        for _, rc := range c.Resources {
+                if rc.Addr.String() == addrStr && rc.DeposedKey == states.NotDeposed {
+                        return rc
+                }
+        }
+
+        return nil
+}
+
+// ResourceInstanceDeposed returns the plan change of a deposed object of
+// the resource instance of the given address, if any. Returns nil if no change
+// is planned.
+func (c *Changes) ResourceInstanceDeposed(addr addrs.AbsResourceInstance, key states.DeposedKey) *ResourceInstanceChangeSrc {
+        addrStr := addr.String()
+        for _, rc := range c.Resources {
+                if rc.Addr.String() == addrStr && rc.DeposedKey == key {
+                        return rc
+                }
+        }
+
+        return nil
+}
+
+// OutputValue returns the planned change for the output value with the
+//  given address, if any. Returns nil if no change is planned.
+func (c *Changes) OutputValue(addr addrs.AbsOutputValue) *OutputChangeSrc {
+        addrStr := addr.String()
+        for _, oc := range c.Outputs {
+                if oc.Addr.String() == addrStr {
+                        return oc
+                }
+        }
+
+        return nil
+}
+
+// SyncWrapper returns a wrapper object around the receiver that can be used
+// to make certain changes to the receiver in a concurrency-safe way, as long
+// as all callers share the same wrapper object.
+func (c *Changes) SyncWrapper() *ChangesSync {
+        return &ChangesSync{
+                changes: c,
+        }
+}
+
+// ResourceInstanceChange describes a change to a particular resource instance
+// object.
+type ResourceInstanceChange struct {
+        // Addr is the absolute address of the resource instance that the change
+        // will apply to.
+        Addr addrs.AbsResourceInstance
+
+        // DeposedKey is the identifier for a deposed object associated with the
+        // given instance, or states.NotDeposed if this change applies to the
+        // current object.
+        //
+        // A Replace change for a resource with create_before_destroy set will
+        // create a new DeposedKey temporarily during replacement. In that case,
+        // DeposedKey in the plan is always states.NotDeposed, representing that
+        // the current object is being replaced with the deposed.
+        DeposedKey states.DeposedKey
+
+        // Provider is the address of the provider configuration that was used
+        // to plan this change, and thus the configuration that must also be
+        // used to apply it.
+        ProviderAddr addrs.AbsProviderConfig
+
+        // Change is an embedded description of the change.
+        Change
+
+        // RequiredReplace is a set of paths that caused the change action to be
+        // Replace rather than Update. Always nil if the change action is not
+        // Replace.
+        //
+        // This is retained only for UI-plan-rendering purposes and so it does not
+        // currently survive a round-trip through a saved plan file.
+        RequiredReplace cty.PathSet
+
+        // Private allows a provider to stash any extra data that is opaque to
+        // Terraform that relates to this change. Terraform will save this
+        // byte-for-byte and return it to the provider in the apply call.
+        Private []byte
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file. Pass the implied type of the
+// corresponding resource type schema for correct operation.
+func (rc *ResourceInstanceChange) Encode(ty cty.Type) (*ResourceInstanceChangeSrc, error) {
+        cs, err := rc.Change.Encode(ty)
+        if err != nil {
+                return nil, err
+        }
+        return &ResourceInstanceChangeSrc{
+                Addr:            rc.Addr,
+                DeposedKey:      rc.DeposedKey,
+                ProviderAddr:    rc.ProviderAddr,
+                ChangeSrc:       *cs,
+                RequiredReplace: rc.RequiredReplace,
+                Private:         rc.Private,
+        }, err
+}
+
+// Simplify will, where possible, produce a change with a simpler action than
+// the receiever given a flag indicating whether the caller is dealing with
+// a normal apply or a destroy. This flag deals with the fact that Terraform
+// Core uses a specialized graph node type for destroying; only that
+// specialized node should set "destroying" to true.
+//
+// The following table shows the simplification behavior:
+//
+//     Action    Destroying?   New Action
+//     --------+-------------+-----------
+//     Create    true          NoOp
+//     Delete    false         NoOp
+//     Replace   true          Delete
+//     Replace   false         Create
+//
+// For any combination not in the above table, the Simplify just returns the
+// receiver as-is.
+func (rc *ResourceInstanceChange) Simplify(destroying bool) *ResourceInstanceChange {
+        if destroying {
+                switch rc.Action {
+                case Delete:
+                        // We'll fall out and just return rc verbatim, then.
+                case CreateThenDelete, DeleteThenCreate:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: Delete,
+                                        Before: rc.Before,
+                                        After:  cty.NullVal(rc.Before.Type()),
+                                },
+                        }
+                default:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: NoOp,
+                                        Before: rc.Before,
+                                        After:  rc.Before,
+                                },
+                        }
+                }
+        } else {
+                switch rc.Action {
+                case Delete:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: NoOp,
+                                        Before: rc.Before,
+                                        After:  rc.Before,
+                                },
+                        }
+                case CreateThenDelete, DeleteThenCreate:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: Create,
+                                        Before: cty.NullVal(rc.After.Type()),
+                                        After:  rc.After,
+                                },
+                        }
+                }
+        }
+
+        // If we fall out here then our change is already simple enough.
+        return rc
+}
+
+// OutputChange describes a change to an output value.
+type OutputChange struct {
+        // Addr is the absolute address of the output value that the change
+        // will apply to.
+        Addr addrs.AbsOutputValue
+
+        // Change is an embedded description of the change.
+        //
+        // For output value changes, the type constraint for the DynamicValue
+        // instances is always cty.DynamicPseudoType.
+        Change
+
+        // Sensitive, if true, indicates that either the old or new value in the
+        // change is sensitive and so a rendered version of the plan in the UI
+        // should elide the actual values while still indicating the action of the
+        // change.
+        Sensitive bool
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file.
+func (oc *OutputChange) Encode() (*OutputChangeSrc, error) {
+        cs, err := oc.Change.Encode(cty.DynamicPseudoType)
+        if err != nil {
+                return nil, err
+        }
+        return &OutputChangeSrc{
+                Addr:      oc.Addr,
+                ChangeSrc: *cs,
+                Sensitive: oc.Sensitive,
+        }, err
+}
+
+// Change describes a single change with a given action.
+type Change struct {
+        // Action defines what kind of change is being made.
+        Action Action
+
+        // Interpretation of Before and After depend on Action:
+        //
+        //     NoOp     Before and After are the same, unchanged value
+        //     Create   Before is nil, and After is the expected value after create.
+        //     Read     Before is any prior value (nil if no prior), and After is the
+        //              value that was or will be read.
+        //     Update   Before is the value prior to update, and After is the expected
+        //              value after update.
+        //     Replace  As with Update.
+        //     Delete   Before is the value prior to delete, and After is always nil.
+        //
+        // Unknown values may appear anywhere within the Before and After values,
+        // either as the values themselves or as nested elements within known
+        // collections/structures.
+        Before, After cty.Value
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file. Pass the type constraint
+// that the values are expected to conform to; to properly decode the values
+// later an identical type constraint must be provided at that time.
+//
+// Where a Change is embedded in some other struct, it's generally better
+// to call the corresponding Encode method of that struct rather than working
+// directly with its embedded Change.
+func (c *Change) Encode(ty cty.Type) (*ChangeSrc, error) {
+        beforeDV, err := NewDynamicValue(c.Before, ty)
+        if err != nil {
+                return nil, err
+        }
+        afterDV, err := NewDynamicValue(c.After, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return &ChangeSrc{
+                Action: c.Action,
+                Before: beforeDV,
+                After:  afterDV,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_src.go b/vendor/github.com/hashicorp/terraform/plans/changes_src.go
new file mode 100644
index 0000000..90153ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_src.go
@@ -0,0 +1,190 @@
+package plans
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ResourceInstanceChangeSrc is a not-yet-decoded ResourceInstanceChange.
+// Pass the associated resource type's schema type to method Decode to
+// obtain a ResourceInstancChange.
+type ResourceInstanceChangeSrc struct {
+        // Addr is the absolute address of the resource instance that the change
+        // will apply to.
+        Addr addrs.AbsResourceInstance
+
+        // DeposedKey is the identifier for a deposed object associated with the
+        // given instance, or states.NotDeposed if this change applies to the
+        // current object.
+        //
+        // A Replace change for a resource with create_before_destroy set will
+        // create a new DeposedKey temporarily during replacement. In that case,
+        // DeposedKey in the plan is always states.NotDeposed, representing that
+        // the current object is being replaced with the deposed.
+        DeposedKey states.DeposedKey
+
+        // Provider is the address of the provider configuration that was used
+        // to plan this change, and thus the configuration that must also be
+        // used to apply it.
+        ProviderAddr addrs.AbsProviderConfig
+
+        // ChangeSrc is an embedded description of the not-yet-decoded change.
+        ChangeSrc
+
+        // RequiredReplace is a set of paths that caused the change action to be
+        // Replace rather than Update. Always nil if the change action is not
+        // Replace.
+        //
+        // This is retained only for UI-plan-rendering purposes and so it does not
+        // currently survive a round-trip through a saved plan file.
+        RequiredReplace cty.PathSet
+
+        // Private allows a provider to stash any extra data that is opaque to
+        // Terraform that relates to this change. Terraform will save this
+        // byte-for-byte and return it to the provider in the apply call.
+        Private []byte
+}
+
+// Decode unmarshals the raw representation of the instance object being
+// changed. Pass the implied type of the corresponding resource type schema
+// for correct operation.
+func (rcs *ResourceInstanceChangeSrc) Decode(ty cty.Type) (*ResourceInstanceChange, error) {
+        change, err := rcs.ChangeSrc.Decode(ty)
+        if err != nil {
+                return nil, err
+        }
+        return &ResourceInstanceChange{
+                Addr:            rcs.Addr,
+                DeposedKey:      rcs.DeposedKey,
+                ProviderAddr:    rcs.ProviderAddr,
+                Change:          *change,
+                RequiredReplace: rcs.RequiredReplace,
+                Private:         rcs.Private,
+        }, nil
+}
+
+// DeepCopy creates a copy of the receiver where any pointers to nested mutable
+// values are also copied, thus ensuring that future mutations of the receiver
+// will not affect the copy.
+//
+// Some types used within a resource change are immutable by convention even
+// though the Go language allows them to be mutated, such as the types from
+// the addrs package. These are _not_ copied by this method, under the
+// assumption that callers will behave themselves.
+func (rcs *ResourceInstanceChangeSrc) DeepCopy() *ResourceInstanceChangeSrc {
+        if rcs == nil {
+                return nil
+        }
+        ret := *rcs
+
+        ret.RequiredReplace = cty.NewPathSet(ret.RequiredReplace.List()...)
+
+        if len(ret.Private) != 0 {
+                private := make([]byte, len(ret.Private))
+                copy(private, ret.Private)
+                ret.Private = private
+        }
+
+        ret.ChangeSrc.Before = ret.ChangeSrc.Before.Copy()
+        ret.ChangeSrc.After = ret.ChangeSrc.After.Copy()
+
+        return &ret
+}
+
+// OutputChangeSrc describes a change to an output value.
+type OutputChangeSrc struct {
+        // Addr is the absolute address of the output value that the change
+        // will apply to.
+        Addr addrs.AbsOutputValue
+
+        // ChangeSrc is an embedded description of the not-yet-decoded change.
+        //
+        // For output value changes, the type constraint for the DynamicValue
+        // instances is always cty.DynamicPseudoType.
+        ChangeSrc
+
+        // Sensitive, if true, indicates that either the old or new value in the
+        // change is sensitive and so a rendered version of the plan in the UI
+        // should elide the actual values while still indicating the action of the
+        // change.
+        Sensitive bool
+}
+
+// Decode unmarshals the raw representation of the output value being
+// changed.
+func (ocs *OutputChangeSrc) Decode() (*OutputChange, error) {
+        change, err := ocs.ChangeSrc.Decode(cty.DynamicPseudoType)
+        if err != nil {
+                return nil, err
+        }
+        return &OutputChange{
+                Addr:      ocs.Addr,
+                Change:    *change,
+                Sensitive: ocs.Sensitive,
+        }, nil
+}
+
+// DeepCopy creates a copy of the receiver where any pointers to nested mutable
+// values are also copied, thus ensuring that future mutations of the receiver
+// will not affect the copy.
+//
+// Some types used within a resource change are immutable by convention even
+// though the Go language allows them to be mutated, such as the types from
+// the addrs package. These are _not_ copied by this method, under the
+// assumption that callers will behave themselves.
+func (ocs *OutputChangeSrc) DeepCopy() *OutputChangeSrc {
+        if ocs == nil {
+                return nil
+        }
+        ret := *ocs
+
+        ret.ChangeSrc.Before = ret.ChangeSrc.Before.Copy()
+        ret.ChangeSrc.After = ret.ChangeSrc.After.Copy()
+
+        return &ret
+}
+
+// ChangeSrc is a not-yet-decoded Change.
+type ChangeSrc struct {
+        // Action defines what kind of change is being made.
+        Action Action
+
+        // Before and After correspond to the fields of the same name in Change,
+        // but have not yet been decoded from the serialized value used for
+        // storage.
+        Before, After DynamicValue
+}
+
+// Decode unmarshals the raw representations of the before and after values
+// to produce a Change object. Pass the type constraint that the result must
+// conform to.
+//
+// Where a ChangeSrc is embedded in some other struct, it's generally better
+// to call the corresponding Decode method of that struct rather than working
+// directly with its embedded Change.
+func (cs *ChangeSrc) Decode(ty cty.Type) (*Change, error) {
+        var err error
+        before := cty.NullVal(ty)
+        after := cty.NullVal(ty)
+
+        if len(cs.Before) > 0 {
+                before, err = cs.Before.Decode(ty)
+                if err != nil {
+                        return nil, fmt.Errorf("error decoding 'before' value: %s", err)
+                }
+        }
+        if len(cs.After) > 0 {
+                after, err = cs.After.Decode(ty)
+                if err != nil {
+                        return nil, fmt.Errorf("error decoding 'after' value: %s", err)
+                }
+        }
+        return &Change{
+                Action: cs.Action,
+                Before: before,
+                After:  after,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_state.go b/vendor/github.com/hashicorp/terraform/plans/changes_state.go
new file mode 100644
index 0000000..543e6c2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_state.go
@@ -0,0 +1,15 @@
+package plans
+
+import (
+        "github.com/hashicorp/terraform/states"
+)
+
+// PlannedState merges the set of changes described by the receiver into the
+// given prior state to produce the planned result state.
+//
+// The result is an approximation of the state as it would exist after
+// applying these changes, omitting any values that cannot be determined until
+// the changes are actually applied.
+func (c *Changes) PlannedState(prior *states.State) (*states.State, error) {
+        panic("Changes.PlannedState not yet implemented")
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_sync.go b/vendor/github.com/hashicorp/terraform/plans/changes_sync.go
new file mode 100644
index 0000000..6b4ff98
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_sync.go
@@ -0,0 +1,144 @@
+package plans
+
+import (
+        "fmt"
+        "sync"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ChangesSync is a wrapper around a Changes that provides a concurrency-safe
+// interface to insert new changes and retrieve copies of existing changes.
+//
+// Each ChangesSync is independent of all others, so all concurrent writers
+// to a particular Changes must share a single ChangesSync. Behavior is
+// undefined if any other caller makes changes to the underlying Changes
+// object or its nested objects concurrently with any of the methods of a
+// particular ChangesSync.
+type ChangesSync struct {
+        lock    sync.Mutex
+        changes *Changes
+}
+
+// AppendResourceInstanceChange records the given resource instance change in
+// the set of planned resource changes.
+//
+// The caller must ensure that there are no concurrent writes to the given
+// change while this method is running, but it is safe to resume mutating
+// it after this method returns without affecting the saved change.
+func (cs *ChangesSync) AppendResourceInstanceChange(changeSrc *ResourceInstanceChangeSrc) {
+        if cs == nil {
+                panic("AppendResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        s := changeSrc.DeepCopy()
+        cs.changes.Resources = append(cs.changes.Resources, s)
+}
+
+// GetResourceInstanceChange searches the set of resource instance changes for
+// one matching the given address and generation, returning it if it exists.
+//
+// If no such change exists, nil is returned.
+//
+// The returned object is a deep copy of the change recorded in the plan, so
+// callers may mutate it although it's generally better (less confusing) to
+// treat planned changes as immutable after they've been initially constructed.
+func (cs *ChangesSync) GetResourceInstanceChange(addr addrs.AbsResourceInstance, gen states.Generation) *ResourceInstanceChangeSrc {
+        if cs == nil {
+                panic("GetResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        if gen == states.CurrentGen {
+                return cs.changes.ResourceInstance(addr).DeepCopy()
+        }
+        if dk, ok := gen.(states.DeposedKey); ok {
+                return cs.changes.ResourceInstanceDeposed(addr, dk).DeepCopy()
+        }
+        panic(fmt.Sprintf("unsupported generation value %#v", gen))
+}
+
+// RemoveResourceInstanceChange searches the set of resource instance changes
+// for one matching the given address and generation, and removes it from the
+// set if it exists.
+func (cs *ChangesSync) RemoveResourceInstanceChange(addr addrs.AbsResourceInstance, gen states.Generation) {
+        if cs == nil {
+                panic("RemoveResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        dk := states.NotDeposed
+        if realDK, ok := gen.(states.DeposedKey); ok {
+                dk = realDK
+        }
+
+        addrStr := addr.String()
+        for i, r := range cs.changes.Resources {
+                if r.Addr.String() != addrStr || r.DeposedKey != dk {
+                        continue
+                }
+                copy(cs.changes.Resources[i:], cs.changes.Resources[i+1:])
+                cs.changes.Resources = cs.changes.Resources[:len(cs.changes.Resources)-1]
+                return
+        }
+}
+
+// AppendOutputChange records the given output value change in the set of
+// planned value changes.
+//
+// The caller must ensure that there are no concurrent writes to the given
+// change while this method is running, but it is safe to resume mutating
+// it after this method returns without affecting the saved change.
+func (cs *ChangesSync) AppendOutputChange(changeSrc *OutputChangeSrc) {
+        if cs == nil {
+                panic("AppendOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        s := changeSrc.DeepCopy()
+        cs.changes.Outputs = append(cs.changes.Outputs, s)
+}
+
+// GetOutputChange searches the set of output value changes for one matching
+// the given address, returning it if it exists.
+//
+// If no such change exists, nil is returned.
+//
+// The returned object is a deep copy of the change recorded in the plan, so
+// callers may mutate it although it's generally better (less confusing) to
+// treat planned changes as immutable after they've been initially constructed.
+func (cs *ChangesSync) GetOutputChange(addr addrs.AbsOutputValue) *OutputChangeSrc {
+        if cs == nil {
+                panic("GetOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        return cs.changes.OutputValue(addr)
+}
+
+// RemoveOutputChange searches the set of output value changes for one matching
+// the given address, and removes it from the set if it exists.
+func (cs *ChangesSync) RemoveOutputChange(addr addrs.AbsOutputValue) {
+        if cs == nil {
+                panic("RemoveOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        addrStr := addr.String()
+        for i, o := range cs.changes.Outputs {
+                if o.Addr.String() != addrStr {
+                        continue
+                }
+                copy(cs.changes.Outputs[i:], cs.changes.Outputs[i+1:])
+                cs.changes.Outputs = cs.changes.Outputs[:len(cs.changes.Outputs)-1]
+                return
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/doc.go b/vendor/github.com/hashicorp/terraform/plans/doc.go
new file mode 100644
index 0000000..01ca389
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/doc.go
@@ -0,0 +1,5 @@
+// Package plans contains the types that are used to represent Terraform plans.
+//
+// A plan describes a set of changes that Terraform will make to update remote
+// objects to match with changes to the configuration.
+package plans
diff --git a/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go b/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go
new file mode 100644
index 0000000..51fbb24
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go
@@ -0,0 +1,96 @@
+package plans
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctymsgpack "github.com/zclconf/go-cty/cty/msgpack"
+)
+
+// DynamicValue is the representation in the plan of a value whose type cannot
+// be determined at compile time, such as because it comes from a schema
+// defined in a plugin.
+//
+// This type is used as an indirection so that the overall plan structure can
+// be decoded without schema available, and then the dynamic values accessed
+// at a later time once the appropriate schema has been determined.
+//
+// Internally, DynamicValue is a serialized version of a cty.Value created
+// against a particular type constraint. Callers should not access directly
+// the serialized form, whose format may change in future. Values of this
+// type must always be created by calling NewDynamicValue.
+//
+// The zero value of DynamicValue is nil, and represents the absense of a
+// value within the Go type system. This is distinct from a cty.NullVal
+// result, which represents the absense of a value within the cty type system.
+type DynamicValue []byte
+
+// NewDynamicValue creates a DynamicValue by serializing the given value
+// against the given type constraint. The value must conform to the type
+// constraint, or the result is undefined.
+//
+// If the value to be encoded has no predefined schema (for example, for
+// module output values and input variables), set the type constraint to
+// cty.DynamicPseudoType in order to save type information as part of the
+// value, and then also pass cty.DynamicPseudoType to method Decode to recover
+// the original value.
+//
+// cty.NilVal can be used to represent the absense of a value, but callers
+// must be careful to distinguish values that are absent at the Go layer
+// (cty.NilVal) vs. values that are absent at the cty layer (cty.NullVal
+// results).
+func NewDynamicValue(val cty.Value, ty cty.Type) (DynamicValue, error) {
+        // If we're given cty.NilVal (the zero value of cty.Value, which is
+        // distinct from a typed null value created by cty.NullVal) then we'll
+        // assume the caller is trying to represent the _absense_ of a value,
+        // and so we'll return a nil DynamicValue.
+        if val == cty.NilVal {
+                return DynamicValue(nil), nil
+        }
+
+        // Currently our internal encoding is msgpack, via ctymsgpack.
+        buf, err := ctymsgpack.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return DynamicValue(buf), nil
+}
+
+// Decode retrieves the effective value from the receiever by interpreting the
+// serialized form against the given type constraint. For correct results,
+// the type constraint must match (or be consistent with) the one that was
+// used to create the receiver.
+//
+// A nil DynamicValue decodes to cty.NilVal, which is not a valid value and
+// instead represents the absense of a value.
+func (v DynamicValue) Decode(ty cty.Type) (cty.Value, error) {
+        if v == nil {
+                return cty.NilVal, nil
+        }
+
+        return ctymsgpack.Unmarshal([]byte(v), ty)
+}
+
+// ImpliedType returns the type implied by the serialized structure of the
+// receiving value.
+//
+// This will not necessarily be exactly the type that was given when the
+// value was encoded, and in particular must not be used for values that
+// were encoded with their static type given as cty.DynamicPseudoType.
+// It is however safe to use this method for values that were encoded using
+// their runtime type as the conforming type, with the result being
+// semantically equivalent but with all lists and sets represented as tuples,
+// and maps as objects, due to ambiguities of the serialization.
+func (v DynamicValue) ImpliedType() (cty.Type, error) {
+        return ctymsgpack.ImpliedType([]byte(v))
+}
+
+// Copy produces a copy of the receiver with a distinct backing array.
+func (v DynamicValue) Copy() DynamicValue {
+        if v == nil {
+                return nil
+        }
+
+        ret := make(DynamicValue, len(v))
+        copy(ret, v)
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go b/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go
new file mode 100644
index 0000000..18a7e99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go
@@ -0,0 +1,18 @@
+package objchange
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// AllAttributesNull constructs a non-null cty.Value of the object type implied
+// by the given schema that has all of its leaf attributes set to null and all
+// of its nested block collections set to zero-length.
+//
+// This simulates what would result from decoding an empty configuration block
+// with the given schema, except that it does not produce errors
+func AllAttributesNull(schema *configschema.Block) cty.Value {
+        // "All attributes null" happens to be the definition of EmptyValue for
+        // a Block, so we can just delegate to that.
+        return schema.EmptyValue()
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go b/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go
new file mode 100644
index 0000000..8b7ef43
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go
@@ -0,0 +1,437 @@
+package objchange
+
+import (
+        "fmt"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// AssertObjectCompatible checks whether the given "actual" value is a valid
+// completion of the possibly-partially-unknown "planned" value.
+//
+// This means that any known leaf value in "planned" must be equal to the
+// corresponding value in "actual", and various other similar constraints.
+//
+// Any inconsistencies are reported by returning a non-zero number of errors.
+// These errors are usually (but not necessarily) cty.PathError values
+// referring to a particular nested value within the "actual" value.
+//
+// The two values must have types that conform to the given schema's implied
+// type, or this function will panic.
+func AssertObjectCompatible(schema *configschema.Block, planned, actual cty.Value) []error {
+        return assertObjectCompatible(schema, planned, actual, nil)
+}
+
+func assertObjectCompatible(schema *configschema.Block, planned, actual cty.Value, path cty.Path) []error {
+        var errs []error
+        if planned.IsNull() && !actual.IsNull() {
+                errs = append(errs, path.NewErrorf("was absent, but now present"))
+                return errs
+        }
+        if actual.IsNull() && !planned.IsNull() {
+                errs = append(errs, path.NewErrorf("was present, but now absent"))
+                return errs
+        }
+        if planned.IsNull() {
+                // No further checks possible if both values are null
+                return errs
+        }
+
+        for name, attrS := range schema.Attributes {
+                plannedV := planned.GetAttr(name)
+                actualV := actual.GetAttr(name)
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                moreErrs := assertValueCompatible(plannedV, actualV, path)
+                if attrS.Sensitive {
+                        if len(moreErrs) > 0 {
+                                // Use a vague placeholder message instead, to avoid disclosing
+                                // sensitive information.
+                                errs = append(errs, path.NewErrorf("inconsistent values for sensitive attribute"))
+                        }
+                } else {
+                        errs = append(errs, moreErrs...)
+                }
+        }
+        for name, blockS := range schema.BlockTypes {
+                plannedV := planned.GetAttr(name)
+                actualV := actual.GetAttr(name)
+
+                // As a special case, if there were any blocks whose leaf attributes
+                // are all unknown then we assume (possibly incorrectly) that the
+                // HCL dynamic block extension is in use with an unknown for_each
+                // argument, and so we will do looser validation here that allows
+                // for those blocks to have expanded into a different number of blocks
+                // if the for_each value is now known.
+                maybeUnknownBlocks := couldHaveUnknownBlockPlaceholder(plannedV, blockS, false)
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        // If an unknown block placeholder was present then the placeholder
+                        // may have expanded out into zero blocks, which is okay.
+                        if maybeUnknownBlocks && actualV.IsNull() {
+                                continue
+                        }
+                        moreErrs := assertObjectCompatible(&blockS.Block, plannedV, actualV, path)
+                        errs = append(errs, moreErrs...)
+                case configschema.NestingList:
+                        // A NestingList might either be a list or a tuple, depending on
+                        // whether there are dynamically-typed attributes inside. However,
+                        // both support a similar-enough API that we can treat them the
+                        // same for our purposes here.
+                        if !plannedV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                continue
+                        }
+
+                        if maybeUnknownBlocks {
+                                // When unknown blocks are present the final blocks may be
+                                // at different indices than the planned blocks, so unfortunately
+                                // we can't do our usual checks in this case without generating
+                                // false negatives.
+                                continue
+                        }
+
+                        plannedL := plannedV.LengthInt()
+                        actualL := actualV.LengthInt()
+                        if plannedL != actualL {
+                                errs = append(errs, path.NewErrorf("block count changed from %d to %d", plannedL, actualL))
+                                continue
+                        }
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                if !actualV.HasIndex(idx).True() {
+                                        continue
+                                }
+                                actualEV := actualV.Index(idx)
+                                moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: idx}))
+                                errs = append(errs, moreErrs...)
+                        }
+                case configschema.NestingMap:
+                        // A NestingMap might either be a map or an object, depending on
+                        // whether there are dynamically-typed attributes inside, but
+                        // that's decided statically and so both values will have the same
+                        // kind.
+                        if plannedV.Type().IsObjectType() {
+                                plannedAtys := plannedV.Type().AttributeTypes()
+                                actualAtys := actualV.Type().AttributeTypes()
+                                for k := range plannedAtys {
+                                        if _, ok := actualAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q has vanished", k))
+                                                continue
+                                        }
+
+                                        plannedEV := plannedV.GetAttr(k)
+                                        actualEV := actualV.GetAttr(k)
+                                        moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.GetAttrStep{Name: k}))
+                                        errs = append(errs, moreErrs...)
+                                }
+                                if !maybeUnknownBlocks { // new blocks may appear if unknown blocks were present in the plan
+                                        for k := range actualAtys {
+                                                if _, ok := plannedAtys[k]; !ok {
+                                                        errs = append(errs, path.NewErrorf("new block key %q has appeared", k))
+                                                        continue
+                                                }
+                                        }
+                                }
+                        } else {
+                                if !plannedV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                        continue
+                                }
+                                plannedL := plannedV.LengthInt()
+                                actualL := actualV.LengthInt()
+                                if plannedL != actualL && !maybeUnknownBlocks { // new blocks may appear if unknown blocks were persent in the plan
+                                        errs = append(errs, path.NewErrorf("block count changed from %d to %d", plannedL, actualL))
+                                        continue
+                                }
+                                for it := plannedV.ElementIterator(); it.Next(); {
+                                        idx, plannedEV := it.Element()
+                                        if !actualV.HasIndex(idx).True() {
+                                                continue
+                                        }
+                                        actualEV := actualV.Index(idx)
+                                        moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: idx}))
+                                        errs = append(errs, moreErrs...)
+                                }
+                        }
+                case configschema.NestingSet:
+                        if !plannedV.IsKnown() || !actualV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                continue
+                        }
+
+                        setErrs := assertSetValuesCompatible(plannedV, actualV, path, func(plannedEV, actualEV cty.Value) bool {
+                                errs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: actualEV}))
+                                return len(errs) == 0
+                        })
+                        errs = append(errs, setErrs...)
+
+                        // There can be fewer elements in a set after its elements are all
+                        // known (values that turn out to be equal will coalesce) but the
+                        // number of elements must never get larger.
+                        plannedL := plannedV.LengthInt()
+                        actualL := actualV.LengthInt()
+                        if plannedL < actualL {
+                                errs = append(errs, path.NewErrorf("block set length changed from %d to %d", plannedL, actualL))
+                        }
+                default:
+                        panic(fmt.Sprintf("unsupported nesting mode %s", blockS.Nesting))
+                }
+        }
+        return errs
+}
+
+func assertValueCompatible(planned, actual cty.Value, path cty.Path) []error {
+        // NOTE: We don't normally use the GoString rendering of cty.Value in
+        // user-facing error messages as a rule, but we make an exception
+        // for this function because we expect the user to pass this message on
+        // verbatim to the provider development team and so more detail is better.
+
+        var errs []error
+        if planned.Type() == cty.DynamicPseudoType {
+                // Anything goes, then
+                return errs
+        }
+        if problems := planned.Type().TestConformance(actual.Type()); len(problems) > 0 {
+                errs = append(errs, path.NewErrorf("wrong final value type: %s", convert.MismatchMessage(actual.Type(), planned.Type())))
+                // If the types don't match then we can't do any other comparisons,
+                // so we bail early.
+                return errs
+        }
+
+        if !planned.IsKnown() {
+                // We didn't know what were going to end up with during plan, so
+                // anything goes during apply.
+                return errs
+        }
+
+        if actual.IsNull() {
+                if planned.IsNull() {
+                        return nil
+                }
+                errs = append(errs, path.NewErrorf("was %#v, but now null", planned))
+                return errs
+        }
+        if planned.IsNull() {
+                errs = append(errs, path.NewErrorf("was null, but now %#v", actual))
+                return errs
+        }
+
+        ty := planned.Type()
+        switch {
+
+        case !actual.IsKnown():
+                errs = append(errs, path.NewErrorf("was known, but now unknown"))
+
+        case ty.IsPrimitiveType():
+                if !actual.Equals(planned).True() {
+                        errs = append(errs, path.NewErrorf("was %#v, but now %#v", planned, actual))
+                }
+
+        case ty.IsListType() || ty.IsMapType() || ty.IsTupleType():
+                for it := planned.ElementIterator(); it.Next(); {
+                        k, plannedV := it.Element()
+                        if !actual.HasIndex(k).True() {
+                                errs = append(errs, path.NewErrorf("element %s has vanished", indexStrForErrors(k)))
+                                continue
+                        }
+
+                        actualV := actual.Index(k)
+                        moreErrs := assertValueCompatible(plannedV, actualV, append(path, cty.IndexStep{Key: k}))
+                        errs = append(errs, moreErrs...)
+                }
+
+                for it := actual.ElementIterator(); it.Next(); {
+                        k, _ := it.Element()
+                        if !planned.HasIndex(k).True() {
+                                errs = append(errs, path.NewErrorf("new element %s has appeared", indexStrForErrors(k)))
+                        }
+                }
+
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                for name := range atys {
+                        // Because we already tested that the two values have the same type,
+                        // we can assume that the same attributes are present in both and
+                        // focus just on testing their values.
+                        plannedV := planned.GetAttr(name)
+                        actualV := actual.GetAttr(name)
+                        moreErrs := assertValueCompatible(plannedV, actualV, append(path, cty.GetAttrStep{Name: name}))
+                        errs = append(errs, moreErrs...)
+                }
+
+        case ty.IsSetType():
+                // We can't really do anything useful for sets here because changing
+                // an unknown element to known changes the identity of the element, and
+                // so we can't correlate them properly. However, we will at least check
+                // to ensure that the number of elements is consistent, along with
+                // the general type-match checks we ran earlier in this function.
+                if planned.IsKnown() && !planned.IsNull() && !actual.IsNull() {
+
+                        setErrs := assertSetValuesCompatible(planned, actual, path, func(plannedV, actualV cty.Value) bool {
+                                errs := assertValueCompatible(plannedV, actualV, append(path, cty.IndexStep{Key: actualV}))
+                                return len(errs) == 0
+                        })
+                        errs = append(errs, setErrs...)
+
+                        // There can be fewer elements in a set after its elements are all
+                        // known (values that turn out to be equal will coalesce) but the
+                        // number of elements must never get larger.
+
+                        plannedL := planned.LengthInt()
+                        actualL := actual.LengthInt()
+                        if plannedL < actualL {
+                                errs = append(errs, path.NewErrorf("length changed from %d to %d", plannedL, actualL))
+                        }
+                }
+        }
+
+        return errs
+}
+
+func indexStrForErrors(v cty.Value) string {
+        switch v.Type() {
+        case cty.Number:
+                return v.AsBigFloat().Text('f', -1)
+        case cty.String:
+                return strconv.Quote(v.AsString())
+        default:
+                // Should be impossible, since no other index types are allowed!
+                return fmt.Sprintf("%#v", v)
+        }
+}
+
+// couldHaveUnknownBlockPlaceholder is a heuristic that recognizes how the
+// HCL dynamic block extension behaves when it's asked to expand a block whose
+// for_each argument is unknown. In such cases, it generates a single placeholder
+// block with all leaf attribute values unknown, and once the for_each
+// expression becomes known the placeholder may be replaced with any number
+// of blocks, so object compatibility checks would need to be more liberal.
+//
+// Set "nested" if testing a block that is nested inside a candidate block
+// placeholder; this changes the interpretation of there being no blocks of
+// a type to allow for there being zero nested blocks.
+func couldHaveUnknownBlockPlaceholder(v cty.Value, blockS *configschema.NestedBlock, nested bool) bool {
+        switch blockS.Nesting {
+        case configschema.NestingSingle, configschema.NestingGroup:
+                if nested && v.IsNull() {
+                        return true // for nested blocks, a single block being unset doesn't disqualify from being an unknown block placeholder
+                }
+                return couldBeUnknownBlockPlaceholderElement(v, &blockS.Block)
+        default:
+                // These situations should be impossible for correct providers, but
+                // we permit the legacy SDK to produce some incorrect outcomes
+                // for compatibility with its existing logic, and so we must be
+                // tolerant here.
+                if !v.IsKnown() {
+                        return true
+                }
+                if v.IsNull() {
+                        return false // treated as if the list were empty, so we would see zero iterations below
+                }
+
+                // For all other nesting modes, our value should be something iterable.
+                for it := v.ElementIterator(); it.Next(); {
+                        _, ev := it.Element()
+                        if couldBeUnknownBlockPlaceholderElement(ev, &blockS.Block) {
+                                return true
+                        }
+                }
+
+                // Our default changes depending on whether we're testing the candidate
+                // block itself or something nested inside of it: zero blocks of a type
+                // can never contain a dynamic block placeholder, but a dynamic block
+                // placeholder might contain zero blocks of one of its own nested block
+                // types, if none were set in the config at all.
+                return nested
+        }
+}
+
+func couldBeUnknownBlockPlaceholderElement(v cty.Value, schema *configschema.Block) bool {
+        if v.IsNull() {
+                return false // null value can never be a placeholder element
+        }
+        if !v.IsKnown() {
+                return true // this should never happen for well-behaved providers, but can happen with the legacy SDK opt-outs
+        }
+        for name := range schema.Attributes {
+                av := v.GetAttr(name)
+
+                // Unknown block placeholders contain only unknown or null attribute
+                // values, depending on whether or not a particular attribute was set
+                // explicitly inside the content block. Note that this is imprecise:
+                // non-placeholders can also match this, so this function can generate
+                // false positives.
+                if av.IsKnown() && !av.IsNull() {
+                        return false
+                }
+        }
+        for name, blockS := range schema.BlockTypes {
+                if !couldHaveUnknownBlockPlaceholder(v.GetAttr(name), blockS, true) {
+                        return false
+                }
+        }
+        return true
+}
+
+// assertSetValuesCompatible checks that each of the elements in a can
+// be correlated with at least one equivalent element in b and vice-versa,
+// using the given correlation function.
+//
+// This allows the number of elements in the sets to change as long as all
+// elements in both sets can be correlated, making this function safe to use
+// with sets that may contain unknown values as long as the unknown case is
+// addressed in some reasonable way in the callback function.
+//
+// The callback always recieves values from set a as its first argument and
+// values from set b in its second argument, so it is safe to use with
+// non-commutative functions.
+//
+// As with assertValueCompatible, we assume that the target audience of error
+// messages here is a provider developer (via a bug report from a user) and so
+// we intentionally violate our usual rule of keeping cty implementation
+// details out of error messages.
+func assertSetValuesCompatible(planned, actual cty.Value, path cty.Path, f func(aVal, bVal cty.Value) bool) []error {
+        a := planned
+        b := actual
+
+        // Our methodology here is a little tricky, to deal with the fact that
+        // it's impossible to directly correlate two non-equal set elements because
+        // they don't have identities separate from their values.
+        // The approach is to count the number of equivalent elements each element
+        // of a has in b and vice-versa, and then return true only if each element
+        // in both sets has at least one equivalent.
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        aeqs := make([]bool, len(as))
+        beqs := make([]bool, len(bs))
+        for ai, av := range as {
+                for bi, bv := range bs {
+                        if f(av, bv) {
+                                aeqs[ai] = true
+                                beqs[bi] = true
+                        }
+                }
+        }
+
+        var errs []error
+        for i, eq := range aeqs {
+                if !eq {
+                        errs = append(errs, path.NewErrorf("planned set element %#v does not correlate with any element in actual", as[i]))
+                }
+        }
+        if len(errs) > 0 {
+                // Exit early since otherwise we're likely to generate duplicate
+                // error messages from the other perspective in the subsequent loop.
+                return errs
+        }
+        for i, eq := range beqs {
+                if !eq {
+                        errs = append(errs, path.NewErrorf("actual set element %#v does not correlate with any element in plan", bs[i]))
+                }
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go b/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go
new file mode 100644
index 0000000..2c18a01
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go
@@ -0,0 +1,4 @@
+// Package objchange deals with the business logic of taking a prior state
+// value and a config value and producing a proposed new merged value, along
+// with other related rules in this domain.
+package objchange
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go b/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go
new file mode 100644
index 0000000..cbfefdd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go
@@ -0,0 +1,104 @@
+package objchange
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// LongestCommonSubsequence finds a sequence of values that are common to both
+// x and y, with the same relative ordering as in both collections. This result
+// is useful as a first step towards computing a diff showing added/removed
+// elements in a sequence.
+//
+// The approached used here is a "naive" one, assuming that both xs and ys will
+// generally be small in most reasonable Terraform configurations. For larger
+// lists the time/space usage may be sub-optimal.
+//
+// A pair of lists may have multiple longest common subsequences. In that
+// case, the one selected by this function is undefined.
+func LongestCommonSubsequence(xs, ys []cty.Value) []cty.Value {
+        if len(xs) == 0 || len(ys) == 0 {
+                return make([]cty.Value, 0)
+        }
+
+        c := make([]int, len(xs)*len(ys))
+        eqs := make([]bool, len(xs)*len(ys))
+        w := len(xs)
+
+        for y := 0; y < len(ys); y++ {
+                for x := 0; x < len(xs); x++ {
+                        eqV := xs[x].Equals(ys[y])
+                        eq := false
+                        if eqV.IsKnown() && eqV.True() {
+                                eq = true
+                                eqs[(w*y)+x] = true // equality tests can be expensive, so cache it
+                        }
+                        if eq {
+                                // Sequence gets one longer than for the cell at top left,
+                                // since we'd append a new item to the sequence here.
+                                if x == 0 || y == 0 {
+                                        c[(w*y)+x] = 1
+                                } else {
+                                        c[(w*y)+x] = c[(w*(y-1))+(x-1)] + 1
+                                }
+                        } else {
+                                // We follow the longest of the sequence above and the sequence
+                                // to the left of us in the matrix.
+                                l := 0
+                                u := 0
+                                if x > 0 {
+                                        l = c[(w*y)+(x-1)]
+                                }
+                                if y > 0 {
+                                        u = c[(w*(y-1))+x]
+                                }
+                                if l > u {
+                                        c[(w*y)+x] = l
+                                } else {
+                                        c[(w*y)+x] = u
+                                }
+                        }
+                }
+        }
+
+        // The bottom right cell tells us how long our longest sequence will be
+        seq := make([]cty.Value, c[len(c)-1])
+
+        // Now we will walk back from the bottom right cell, finding again all
+        // of the equal pairs to construct our sequence.
+        x := len(xs) - 1
+        y := len(ys) - 1
+        i := len(seq) - 1
+
+        for x > -1 && y > -1 {
+                if eqs[(w*y)+x] {
+                        // Add the value to our result list and then walk diagonally
+                        // up and to the left.
+                        seq[i] = xs[x]
+                        x--
+                        y--
+                        i--
+                } else {
+                        // Take the path with the greatest sequence length in the matrix.
+                        l := 0
+                        u := 0
+                        if x > 0 {
+                                l = c[(w*y)+(x-1)]
+                        }
+                        if y > 0 {
+                                u = c[(w*(y-1))+x]
+                        }
+                        if l > u {
+                                x--
+                        } else {
+                                y--
+                        }
+                }
+        }
+
+        if i > -1 {
+                // should never happen if the matrix was constructed properly
+                panic("not enough elements in sequence")
+        }
+
+        return seq
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go b/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go
new file mode 100644
index 0000000..c23f44d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go
@@ -0,0 +1,132 @@
+package objchange
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// NormalizeObjectFromLegacySDK takes an object that may have been generated
+// by the legacy Terraform SDK (i.e. returned from a provider with the
+// LegacyTypeSystem opt-out set) and does its best to normalize it for the
+// assumptions we would normally enforce if the provider had not opted out.
+//
+// In particular, this function guarantees that a value representing a nested
+// block will never itself be unknown or null, instead representing that as
+// a non-null value that may contain null/unknown values.
+//
+// The input value must still conform to the implied type of the given schema,
+// or else this function may produce garbage results or panic. This is usually
+// okay because type consistency is enforced when deserializing the value
+// returned from the provider over the RPC wire protocol anyway.
+func NormalizeObjectFromLegacySDK(val cty.Value, schema *configschema.Block) cty.Value {
+        if val == cty.NilVal || val.IsNull() {
+                // This should never happen in reasonable use, but we'll allow it
+                // and normalize to a null of the expected type rather than panicking
+                // below.
+                return cty.NullVal(schema.ImpliedType())
+        }
+
+        vals := make(map[string]cty.Value)
+        for name := range schema.Attributes {
+                // No normalization for attributes, since them being type-conformant
+                // is all that we require.
+                vals[name] = val.GetAttr(name)
+        }
+        for name, blockS := range schema.BlockTypes {
+                lv := val.GetAttr(name)
+
+                // Legacy SDK never generates dynamically-typed attributes and so our
+                // normalization code doesn't deal with them, but we need to make sure
+                // we still pass them through properly so that we don't interfere with
+                // objects generated by other SDKs.
+                if ty := blockS.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        vals[name] = lv
+                        continue
+                }
+
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        if lv.IsKnown() {
+                                if lv.IsNull() && blockS.Nesting == configschema.NestingGroup {
+                                        vals[name] = blockS.EmptyValue()
+                                } else {
+                                        vals[name] = NormalizeObjectFromLegacySDK(lv, &blockS.Block)
+                                }
+                        } else {
+                                vals[name] = unknownBlockStub(&blockS.Block)
+                        }
+                case configschema.NestingList:
+                        switch {
+                        case !lv.IsKnown():
+                                vals[name] = cty.ListVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                        case lv.IsNull() || lv.LengthInt() == 0:
+                                vals[name] = cty.ListValEmpty(blockS.Block.ImpliedType())
+                        default:
+                                subVals := make([]cty.Value, 0, lv.LengthInt())
+                                for it := lv.ElementIterator(); it.Next(); {
+                                        _, subVal := it.Element()
+                                        subVals = append(subVals, NormalizeObjectFromLegacySDK(subVal, &blockS.Block))
+                                }
+                                vals[name] = cty.ListVal(subVals)
+                        }
+                case configschema.NestingSet:
+                        switch {
+                        case !lv.IsKnown():
+                                vals[name] = cty.SetVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                        case lv.IsNull() || lv.LengthInt() == 0:
+                                vals[name] = cty.SetValEmpty(blockS.Block.ImpliedType())
+                        default:
+                                subVals := make([]cty.Value, 0, lv.LengthInt())
+                                for it := lv.ElementIterator(); it.Next(); {
+                                        _, subVal := it.Element()
+                                        subVals = append(subVals, NormalizeObjectFromLegacySDK(subVal, &blockS.Block))
+                                }
+                                vals[name] = cty.SetVal(subVals)
+                        }
+                default:
+                        // The legacy SDK doesn't support NestingMap, so we just assume
+                        // maps are always okay. (If not, we would've detected and returned
+                        // an error to the user before we got here.)
+                        vals[name] = lv
+                }
+        }
+        return cty.ObjectVal(vals)
+}
+
+// unknownBlockStub constructs an object value that approximates an unknown
+// block by producing a known block object with all of its leaf attribute
+// values set to unknown.
+//
+// Blocks themselves cannot be unknown, so if the legacy SDK tries to return
+// such a thing, we'll use this result instead. This convention mimics how
+// the dynamic block feature deals with being asked to iterate over an unknown
+// value, because our value-checking functions already accept this convention
+// as a special case.
+func unknownBlockStub(schema *configschema.Block) cty.Value {
+        vals := make(map[string]cty.Value)
+        for name, attrS := range schema.Attributes {
+                vals[name] = cty.UnknownVal(attrS.Type)
+        }
+        for name, blockS := range schema.BlockTypes {
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        vals[name] = unknownBlockStub(&blockS.Block)
+                case configschema.NestingList:
+                        // In principle we may be expected to produce a tuple value here,
+                        // if there are any dynamically-typed attributes in our nested block,
+                        // but the legacy SDK doesn't support that, so we just assume it'll
+                        // never be necessary to normalize those. (Incorrect usage in any
+                        // other SDK would be caught and returned as an error before we
+                        // get here.)
+                        vals[name] = cty.ListVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                case configschema.NestingSet:
+                        vals[name] = cty.SetVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                case configschema.NestingMap:
+                        // A nesting map can never be unknown since we then wouldn't know
+                        // what the keys are. (Legacy SDK doesn't support NestingMap anyway,
+                        // so this should never arise.)
+                        vals[name] = cty.MapValEmpty(blockS.Block.ImpliedType())
+                }
+        }
+        return cty.ObjectVal(vals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go b/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go
new file mode 100644
index 0000000..5a8af14
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go
@@ -0,0 +1,390 @@
+package objchange
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// ProposedNewObject constructs a proposed new object value by combining the
+// computed attribute values from "prior" with the configured attribute values
+// from "config".
+//
+// Both value must conform to the given schema's implied type, or this function
+// will panic.
+//
+// The prior value must be wholly known, but the config value may be unknown
+// or have nested unknown values.
+//
+// The merging of the two objects includes the attributes of any nested blocks,
+// which will be correlated in a manner appropriate for their nesting mode.
+// Note in particular that the correlation for blocks backed by sets is a
+// heuristic based on matching non-computed attribute values and so it may
+// produce strange results with more "extreme" cases, such as a nested set
+// block where _all_ attributes are computed.
+func ProposedNewObject(schema *configschema.Block, prior, config cty.Value) cty.Value {
+        // If the config and prior are both null, return early here before
+        // populating the prior block. The prevents non-null blocks from appearing
+        // the proposed state value.
+        if config.IsNull() && prior.IsNull() {
+                return prior
+        }
+
+        if prior.IsNull() {
+                // In this case, we will construct a synthetic prior value that is
+                // similar to the result of decoding an empty configuration block,
+                // which simplifies our handling of the top-level attributes/blocks
+                // below by giving us one non-null level of object to pull values from.
+                prior = AllAttributesNull(schema)
+        }
+        return proposedNewObject(schema, prior, config)
+}
+
+// PlannedDataResourceObject is similar to ProposedNewObject but tailored for
+// planning data resources in particular. Specifically, it replaces the values
+// of any Computed attributes not set in the configuration with an unknown
+// value, which serves as a placeholder for a value to be filled in by the
+// provider when the data resource is finally read.
+//
+// Data resources are different because the planning of them is handled
+// entirely within Terraform Core and not subject to customization by the
+// provider. This function is, in effect, producing an equivalent result to
+// passing the ProposedNewObject result into a provider's PlanResourceChange
+// function, assuming a fixed implementation of PlanResourceChange that just
+// fills in unknown values as needed.
+func PlannedDataResourceObject(schema *configschema.Block, config cty.Value) cty.Value {
+        // Our trick here is to run the ProposedNewObject logic with an
+        // entirely-unknown prior value. Because of cty's unknown short-circuit
+        // behavior, any operation on prior returns another unknown, and so
+        // unknown values propagate into all of the parts of the resulting value
+        // that would normally be filled in by preserving the prior state.
+        prior := cty.UnknownVal(schema.ImpliedType())
+        return proposedNewObject(schema, prior, config)
+}
+
+func proposedNewObject(schema *configschema.Block, prior, config cty.Value) cty.Value {
+        if config.IsNull() || !config.IsKnown() {
+                // This is a weird situation, but we'll allow it anyway to free
+                // callers from needing to specifically check for these cases.
+                return prior
+        }
+        if (!prior.Type().IsObjectType()) || (!config.Type().IsObjectType()) {
+                panic("ProposedNewObject only supports object-typed values")
+        }
+
+        // From this point onwards, we can assume that both values are non-null
+        // object types, and that the config value itself is known (though it
+        // may contain nested values that are unknown.)
+
+        newAttrs := map[string]cty.Value{}
+        for name, attr := range schema.Attributes {
+                priorV := prior.GetAttr(name)
+                configV := config.GetAttr(name)
+                var newV cty.Value
+                switch {
+                case attr.Computed && attr.Optional:
+                        // This is the trickiest scenario: we want to keep the prior value
+                        // if the config isn't overriding it. Note that due to some
+                        // ambiguity here, setting an optional+computed attribute from
+                        // config and then later switching the config to null in a
+                        // subsequent change causes the initial config value to be "sticky"
+                        // unless the provider specifically overrides it during its own
+                        // plan customization step.
+                        if configV.IsNull() {
+                                newV = priorV
+                        } else {
+                                newV = configV
+                        }
+                case attr.Computed:
+                        // configV will always be null in this case, by definition.
+                        // priorV may also be null, but that's okay.
+                        newV = priorV
+                default:
+                        // For non-computed attributes, we always take the config value,
+                        // even if it is null. If it's _required_ then null values
+                        // should've been caught during an earlier validation step, and
+                        // so we don't really care about that here.
+                        newV = configV
+                }
+                newAttrs[name] = newV
+        }
+
+        // Merging nested blocks is a little more complex, since we need to
+        // correlate blocks between both objects and then recursively propose
+        // a new object for each. The correlation logic depends on the nesting
+        // mode for each block type.
+        for name, blockType := range schema.BlockTypes {
+                priorV := prior.GetAttr(name)
+                configV := config.GetAttr(name)
+                var newV cty.Value
+                switch blockType.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        newV = ProposedNewObject(&blockType.Block, priorV, configV)
+
+                case configschema.NestingList:
+                        // Nested blocks are correlated by index.
+                        configVLen := 0
+                        if configV.IsKnown() && !configV.IsNull() {
+                                configVLen = configV.LengthInt()
+                        }
+                        if configVLen > 0 {
+                                newVals := make([]cty.Value, 0, configVLen)
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        idx, configEV := it.Element()
+                                        if priorV.IsKnown() && (priorV.IsNull() || !priorV.HasIndex(idx).True()) {
+                                                // If there is no corresponding prior element then
+                                                // we just take the config value as-is.
+                                                newVals = append(newVals, configEV)
+                                                continue
+                                        }
+                                        priorEV := priorV.Index(idx)
+
+                                        newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                        newVals = append(newVals, newEV)
+                                }
+                                // Despite the name, a NestingList might also be a tuple, if
+                                // its nested schema contains dynamically-typed attributes.
+                                if configV.Type().IsTupleType() {
+                                        newV = cty.TupleVal(newVals)
+                                } else {
+                                        newV = cty.ListVal(newVals)
+                                }
+                        } else {
+                                // Despite the name, a NestingList might also be a tuple, if
+                                // its nested schema contains dynamically-typed attributes.
+                                if configV.Type().IsTupleType() {
+                                        newV = cty.EmptyTupleVal
+                                } else {
+                                        newV = cty.ListValEmpty(blockType.ImpliedType())
+                                }
+                        }
+
+                case configschema.NestingMap:
+                        // Despite the name, a NestingMap may produce either a map or
+                        // object value, depending on whether the nested schema contains
+                        // dynamically-typed attributes.
+                        if configV.Type().IsObjectType() {
+                                // Nested blocks are correlated by key.
+                                configVLen := 0
+                                if configV.IsKnown() && !configV.IsNull() {
+                                        configVLen = configV.LengthInt()
+                                }
+                                if configVLen > 0 {
+                                        newVals := make(map[string]cty.Value, configVLen)
+                                        atys := configV.Type().AttributeTypes()
+                                        for name := range atys {
+                                                configEV := configV.GetAttr(name)
+                                                if !priorV.IsKnown() || priorV.IsNull() || !priorV.Type().HasAttribute(name) {
+                                                        // If there is no corresponding prior element then
+                                                        // we just take the config value as-is.
+                                                        newVals[name] = configEV
+                                                        continue
+                                                }
+                                                priorEV := priorV.GetAttr(name)
+
+                                                newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                                newVals[name] = newEV
+                                        }
+                                        // Although we call the nesting mode "map", we actually use
+                                        // object values so that elements might have different types
+                                        // in case of dynamically-typed attributes.
+                                        newV = cty.ObjectVal(newVals)
+                                } else {
+                                        newV = cty.EmptyObjectVal
+                                }
+                        } else {
+                                configVLen := 0
+                                if configV.IsKnown() && !configV.IsNull() {
+                                        configVLen = configV.LengthInt()
+                                }
+                                if configVLen > 0 {
+                                        newVals := make(map[string]cty.Value, configVLen)
+                                        for it := configV.ElementIterator(); it.Next(); {
+                                                idx, configEV := it.Element()
+                                                k := idx.AsString()
+                                                if priorV.IsKnown() && (priorV.IsNull() || !priorV.HasIndex(idx).True()) {
+                                                        // If there is no corresponding prior element then
+                                                        // we just take the config value as-is.
+                                                        newVals[k] = configEV
+                                                        continue
+                                                }
+                                                priorEV := priorV.Index(idx)
+
+                                                newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                                newVals[k] = newEV
+                                        }
+                                        newV = cty.MapVal(newVals)
+                                } else {
+                                        newV = cty.MapValEmpty(blockType.ImpliedType())
+                                }
+                        }
+
+                case configschema.NestingSet:
+                        if !configV.Type().IsSetType() {
+                                panic("configschema.NestingSet value is not a set as expected")
+                        }
+
+                        // Nested blocks are correlated by comparing the element values
+                        // after eliminating all of the computed attributes. In practice,
+                        // this means that any config change produces an entirely new
+                        // nested object, and we only propagate prior computed values
+                        // if the non-computed attribute values are identical.
+                        var cmpVals [][2]cty.Value
+                        if priorV.IsKnown() && !priorV.IsNull() {
+                                cmpVals = setElementCompareValues(&blockType.Block, priorV, false)
+                        }
+                        configVLen := 0
+                        if configV.IsKnown() && !configV.IsNull() {
+                                configVLen = configV.LengthInt()
+                        }
+                        if configVLen > 0 {
+                                used := make([]bool, len(cmpVals)) // track used elements in case multiple have the same compare value
+                                newVals := make([]cty.Value, 0, configVLen)
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        _, configEV := it.Element()
+                                        var priorEV cty.Value
+                                        for i, cmp := range cmpVals {
+                                                if used[i] {
+                                                        continue
+                                                }
+                                                if cmp[1].RawEquals(configEV) {
+                                                        priorEV = cmp[0]
+                                                        used[i] = true // we can't use this value on a future iteration
+                                                        break
+                                                }
+                                        }
+                                        if priorEV == cty.NilVal {
+                                                priorEV = cty.NullVal(blockType.ImpliedType())
+                                        }
+
+                                        newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                        newVals = append(newVals, newEV)
+                                }
+                                newV = cty.SetVal(newVals)
+                        } else {
+                                newV = cty.SetValEmpty(blockType.Block.ImpliedType())
+                        }
+
+                default:
+                        // Should never happen, since the above cases are comprehensive.
+                        panic(fmt.Sprintf("unsupported block nesting mode %s", blockType.Nesting))
+                }
+
+                newAttrs[name] = newV
+        }
+
+        return cty.ObjectVal(newAttrs)
+}
+
+// setElementCompareValues takes a known, non-null value of a cty.Set type and
+// returns a table -- constructed of two-element arrays -- that maps original
+// set element values to corresponding values that have all of the computed
+// values removed, making them suitable for comparison with values obtained
+// from configuration. The element type of the set must conform to the implied
+// type of the given schema, or this function will panic.
+//
+// In the resulting slice, the zeroth element of each array is the original
+// value and the one-indexed element is the corresponding "compare value".
+//
+// This is intended to help correlate prior elements with configured elements
+// in ProposedNewObject. The result is a heuristic rather than an exact science,
+// since e.g. two separate elements may reduce to the same value through this
+// process. The caller must therefore be ready to deal with duplicates.
+func setElementCompareValues(schema *configschema.Block, set cty.Value, isConfig bool) [][2]cty.Value {
+        ret := make([][2]cty.Value, 0, set.LengthInt())
+        for it := set.ElementIterator(); it.Next(); {
+                _, ev := it.Element()
+                ret = append(ret, [2]cty.Value{ev, setElementCompareValue(schema, ev, isConfig)})
+        }
+        return ret
+}
+
+// setElementCompareValue creates a new value that has all of the same
+// non-computed attribute values as the one given but has all computed
+// attribute values forced to null.
+//
+// If isConfig is true then non-null Optional+Computed attribute values will
+// be preserved. Otherwise, they will also be set to null.
+//
+// The input value must conform to the schema's implied type, and the return
+// value is guaranteed to conform to it.
+func setElementCompareValue(schema *configschema.Block, v cty.Value, isConfig bool) cty.Value {
+        if v.IsNull() || !v.IsKnown() {
+                return v
+        }
+
+        attrs := map[string]cty.Value{}
+        for name, attr := range schema.Attributes {
+                switch {
+                case attr.Computed && attr.Optional:
+                        if isConfig {
+                                attrs[name] = v.GetAttr(name)
+                        } else {
+                                attrs[name] = cty.NullVal(attr.Type)
+                        }
+                case attr.Computed:
+                        attrs[name] = cty.NullVal(attr.Type)
+                default:
+                        attrs[name] = v.GetAttr(name)
+                }
+        }
+
+        for name, blockType := range schema.BlockTypes {
+                switch blockType.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        attrs[name] = setElementCompareValue(&blockType.Block, v.GetAttr(name), isConfig)
+
+                case configschema.NestingList, configschema.NestingSet:
+                        cv := v.GetAttr(name)
+                        if cv.IsNull() || !cv.IsKnown() {
+                                attrs[name] = cv
+                                continue
+                        }
+                        if l := cv.LengthInt(); l > 0 {
+                                elems := make([]cty.Value, 0, l)
+                                for it := cv.ElementIterator(); it.Next(); {
+                                        _, ev := it.Element()
+                                        elems = append(elems, setElementCompareValue(&blockType.Block, ev, isConfig))
+                                }
+                                if blockType.Nesting == configschema.NestingSet {
+                                        // SetValEmpty would panic if given elements that are not
+                                        // all of the same type, but that's guaranteed not to
+                                        // happen here because our input value was _already_ a
+                                        // set and we've not changed the types of any elements here.
+                                        attrs[name] = cty.SetVal(elems)
+                                } else {
+                                        attrs[name] = cty.TupleVal(elems)
+                                }
+                        } else {
+                                if blockType.Nesting == configschema.NestingSet {
+                                        attrs[name] = cty.SetValEmpty(blockType.Block.ImpliedType())
+                                } else {
+                                        attrs[name] = cty.EmptyTupleVal
+                                }
+                        }
+
+                case configschema.NestingMap:
+                        cv := v.GetAttr(name)
+                        if cv.IsNull() || !cv.IsKnown() {
+                                attrs[name] = cv
+                                continue
+                        }
+                        elems := make(map[string]cty.Value)
+                        for it := cv.ElementIterator(); it.Next(); {
+                                kv, ev := it.Element()
+                                elems[kv.AsString()] = setElementCompareValue(&blockType.Block, ev, isConfig)
+                        }
+                        attrs[name] = cty.ObjectVal(elems)
+
+                default:
+                        // Should never happen, since the above cases are comprehensive.
+                        panic(fmt.Sprintf("unsupported block nesting mode %s", blockType.Nesting))
+                }
+        }
+
+        return cty.ObjectVal(attrs)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go b/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go
new file mode 100644
index 0000000..69acb89
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go
@@ -0,0 +1,267 @@
+package objchange
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// AssertPlanValid checks checks whether a planned new state returned by a
+// provider's PlanResourceChange method is suitable to achieve a change
+// from priorState to config. It returns a slice with nonzero length if
+// any problems are detected. Because problems here indicate bugs in the
+// provider that generated the plannedState, they are written with provider
+// developers as an audience, rather than end-users.
+//
+// All of the given values must have the same type and must conform to the
+// implied type of the given schema, or this function may panic or produce
+// garbage results.
+//
+// During planning, a provider may only make changes to attributes that are
+// null (unset) in the configuration and are marked as "computed" in the
+// resource type schema, in order to insert any default values the provider
+// may know about. If the default value cannot be determined until apply time,
+// the provider can return an unknown value. Providers are forbidden from
+// planning a change that disagrees with any non-null argument in the
+// configuration.
+//
+// As a special exception, providers _are_ allowed to provide attribute values
+// conflicting with configuration if and only if the planned value exactly
+// matches the corresponding attribute value in the prior state. The provider
+// can use this to signal that the new value is functionally equivalent to
+// the old and thus no change is required.
+func AssertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value) []error {
+        return assertPlanValid(schema, priorState, config, plannedState, nil)
+}
+
+func assertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value, path cty.Path) []error {
+        var errs []error
+        if plannedState.IsNull() && !config.IsNull() {
+                errs = append(errs, path.NewErrorf("planned for absense but config wants existence"))
+                return errs
+        }
+        if config.IsNull() && !plannedState.IsNull() {
+                errs = append(errs, path.NewErrorf("planned for existence but config wants absense"))
+                return errs
+        }
+        if plannedState.IsNull() {
+                // No further checks possible if the planned value is null
+                return errs
+        }
+
+        impTy := schema.ImpliedType()
+
+        for name, attrS := range schema.Attributes {
+                plannedV := plannedState.GetAttr(name)
+                configV := config.GetAttr(name)
+                priorV := cty.NullVal(attrS.Type)
+                if !priorState.IsNull() {
+                        priorV = priorState.GetAttr(name)
+                }
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                moreErrs := assertPlannedValueValid(attrS, priorV, configV, plannedV, path)
+                errs = append(errs, moreErrs...)
+        }
+        for name, blockS := range schema.BlockTypes {
+                path := append(path, cty.GetAttrStep{Name: name})
+                plannedV := plannedState.GetAttr(name)
+                configV := config.GetAttr(name)
+                priorV := cty.NullVal(impTy.AttributeType(name))
+                if !priorState.IsNull() {
+                        priorV = priorState.GetAttr(name)
+                }
+                if plannedV.RawEquals(configV) {
+                        // Easy path: nothing has changed at all
+                        continue
+                }
+                if !plannedV.IsKnown() {
+                        errs = append(errs, path.NewErrorf("attribute representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                        continue
+                }
+
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        moreErrs := assertPlanValid(&blockS.Block, priorV, configV, plannedV, path)
+                        errs = append(errs, moreErrs...)
+                case configschema.NestingList:
+                        // A NestingList might either be a list or a tuple, depending on
+                        // whether there are dynamically-typed attributes inside. However,
+                        // both support a similar-enough API that we can treat them the
+                        // same for our purposes here.
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a list of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        plannedL := plannedV.LengthInt()
+                        configL := configV.LengthInt()
+                        if plannedL != configL {
+                                errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+                                continue
+                        }
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                path := append(path, cty.IndexStep{Key: idx})
+                                if !plannedEV.IsKnown() {
+                                        errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                        continue
+                                }
+                                if !configV.HasIndex(idx).True() {
+                                        continue // should never happen since we checked the lengths above
+                                }
+                                configEV := configV.Index(idx)
+                                priorEV := cty.NullVal(blockS.ImpliedType())
+                                if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+                                        priorEV = priorV.Index(idx)
+                                }
+
+                                moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                errs = append(errs, moreErrs...)
+                        }
+                case configschema.NestingMap:
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a map of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        // A NestingMap might either be a map or an object, depending on
+                        // whether there are dynamically-typed attributes inside, but
+                        // that's decided statically and so all values will have the same
+                        // kind.
+                        if plannedV.Type().IsObjectType() {
+                                plannedAtys := plannedV.Type().AttributeTypes()
+                                configAtys := configV.Type().AttributeTypes()
+                                for k := range plannedAtys {
+                                        if _, ok := configAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+                                                continue
+                                        }
+                                        path := append(path, cty.GetAttrStep{Name: k})
+
+                                        plannedEV := plannedV.GetAttr(k)
+                                        if !plannedEV.IsKnown() {
+                                                errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                                continue
+                                        }
+                                        configEV := configV.GetAttr(k)
+                                        priorEV := cty.NullVal(blockS.ImpliedType())
+                                        if !priorV.IsNull() && priorV.Type().HasAttribute(k) {
+                                                priorEV = priorV.GetAttr(k)
+                                        }
+                                        moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                        errs = append(errs, moreErrs...)
+                                }
+                                for k := range configAtys {
+                                        if _, ok := plannedAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", k))
+                                                continue
+                                        }
+                                }
+                        } else {
+                                plannedL := plannedV.LengthInt()
+                                configL := configV.LengthInt()
+                                if plannedL != configL {
+                                        errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+                                        continue
+                                }
+                                for it := plannedV.ElementIterator(); it.Next(); {
+                                        idx, plannedEV := it.Element()
+                                        path := append(path, cty.IndexStep{Key: idx})
+                                        if !plannedEV.IsKnown() {
+                                                errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                                continue
+                                        }
+                                        k := idx.AsString()
+                                        if !configV.HasIndex(idx).True() {
+                                                errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+                                                continue
+                                        }
+                                        configEV := configV.Index(idx)
+                                        priorEV := cty.NullVal(blockS.ImpliedType())
+                                        if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+                                                priorEV = priorV.Index(idx)
+                                        }
+                                        moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                        errs = append(errs, moreErrs...)
+                                }
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        idx, _ := it.Element()
+                                        if !plannedV.HasIndex(idx).True() {
+                                                errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", idx.AsString()))
+                                                continue
+                                        }
+                                }
+                        }
+                case configschema.NestingSet:
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a set of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        // Because set elements have no identifier with which to correlate
+                        // them, we can't robustly validate the plan for a nested block
+                        // backed by a set, and so unfortunately we need to just trust the
+                        // provider to do the right thing. :(
+                        //
+                        // (In principle we could correlate elements by matching the
+                        // subset of attributes explicitly set in config, except for the
+                        // special diff suppression rule which allows for there to be a
+                        // planned value that is constructed by mixing part of a prior
+                        // value with part of a config value, creating an entirely new
+                        // element that is not present in either prior nor config.)
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                path := append(path, cty.IndexStep{Key: idx})
+                                if !plannedEV.IsKnown() {
+                                        errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                        continue
+                                }
+                        }
+
+                default:
+                        panic(fmt.Sprintf("unsupported nesting mode %s", blockS.Nesting))
+                }
+        }
+
+        return errs
+}
+
+func assertPlannedValueValid(attrS *configschema.Attribute, priorV, configV, plannedV cty.Value, path cty.Path) []error {
+        var errs []error
+        if plannedV.RawEquals(configV) {
+                // This is the easy path: provider didn't change anything at all.
+                return errs
+        }
+        if plannedV.RawEquals(priorV) && !priorV.IsNull() {
+                // Also pretty easy: there is a prior value and the provider has
+                // returned it unchanged. This indicates that configV and plannedV
+                // are functionally equivalent and so the provider wishes to disregard
+                // the configuration value in favor of the prior.
+                return errs
+        }
+        if attrS.Computed && configV.IsNull() {
+                // The provider is allowed to change the value of any computed
+                // attribute that isn't explicitly set in the config.
+                return errs
+        }
+
+        // If none of the above conditions match, the provider has made an invalid
+        // change to this attribute.
+        if priorV.IsNull() {
+                if attrS.Sensitive {
+                        errs = append(errs, path.NewErrorf("sensitive planned value does not match config value"))
+                } else {
+                        errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v", plannedV, configV))
+                }
+                return errs
+        }
+        if attrS.Sensitive {
+                errs = append(errs, path.NewErrorf("sensitive planned value does not match config value nor prior value"))
+        } else {
+                errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v nor prior value %#v", plannedV, configV, priorV))
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/plan.go b/vendor/github.com/hashicorp/terraform/plans/plan.go
new file mode 100644
index 0000000..5a3e454
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/plan.go
@@ -0,0 +1,92 @@
+package plans
+
+import (
+        "sort"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Plan is the top-level type representing a planned set of changes.
+//
+// A plan is a summary of the set of changes required to move from a current
+// state to a goal state derived from configuration. The described changes
+// are not applied directly, but contain an approximation of the final
+// result that will be completed during apply by resolving any values that
+// cannot be predicted.
+//
+// A plan must always be accompanied by the state and configuration it was
+// built from, since the plan does not itself include all of the information
+// required to make the changes indicated.
+type Plan struct {
+        VariableValues  map[string]DynamicValue
+        Changes         *Changes
+        TargetAddrs     []addrs.Targetable
+        ProviderSHA256s map[string][]byte
+        Backend         Backend
+}
+
+// Backend represents the backend-related configuration and other data as it
+// existed when a plan was created.
+type Backend struct {
+        // Type is the type of backend that the plan will apply against.
+        Type string
+
+        // Config is the configuration of the backend, whose schema is decided by
+        // the backend Type.
+        Config DynamicValue
+
+        // Workspace is the name of the workspace that was active when the plan
+        // was created. It is illegal to apply a plan created for one workspace
+        // to the state of another workspace.
+        // (This constraint is already enforced by the statefile lineage mechanism,
+        // but storing this explicitly allows us to return a better error message
+        // in the situation where the user has the wrong workspace selected.)
+        Workspace string
+}
+
+func NewBackend(typeName string, config cty.Value, configSchema *configschema.Block, workspaceName string) (*Backend, error) {
+        dv, err := NewDynamicValue(config, configSchema.ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        return &Backend{
+                Type:      typeName,
+                Config:    dv,
+                Workspace: workspaceName,
+        }, nil
+}
+
+// ProviderAddrs returns a list of all of the provider configuration addresses
+// referenced throughout the receiving plan.
+//
+// The result is de-duplicated so that each distinct address appears only once.
+func (p *Plan) ProviderAddrs() []addrs.AbsProviderConfig {
+        if p == nil || p.Changes == nil {
+                return nil
+        }
+
+        m := map[string]addrs.AbsProviderConfig{}
+        for _, rc := range p.Changes.Resources {
+                m[rc.ProviderAddr.String()] = rc.ProviderAddr
+        }
+        if len(m) == 0 {
+                return nil
+        }
+
+        // This is mainly just so we'll get stable results for testing purposes.
+        keys := make([]string, 0, len(m))
+        for k := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        ret := make([]addrs.AbsProviderConfig, len(keys))
+        for i, key := range keys {
+                ret[i] = m[key]
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/client.go b/vendor/github.com/hashicorp/terraform/plugin/client.go
index 7e2f4fe..0eab538 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/client.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/client.go
@@ -19,11 +19,13 @@ func ClientConfig(m discovery.PluginMeta) *plugin.ClientConfig {
         })
 
         return &plugin.ClientConfig{
-                Cmd:             exec.Command(m.Path),
-                HandshakeConfig: Handshake,
-                Managed:         true,
-                Plugins:         PluginMap,
-                Logger:          logger,
+                Cmd:              exec.Command(m.Path),
+                HandshakeConfig:  Handshake,
+                VersionedPlugins: VersionedPlugins,
+                Managed:          true,
+                Logger:           logger,
+                AllowedProtocols: []plugin.Protocol{plugin.ProtocolGRPC},
+                AutoMTLS:         true,
         }
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/plugin/convert/diagnostics.go b/vendor/github.com/hashicorp/terraform/plugin/convert/diagnostics.go
new file mode 100644
index 0000000..51cb2fe
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/convert/diagnostics.go
@@ -0,0 +1,132 @@
+package convert
+
+import (
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// WarnsAndErrorsToProto converts the warnings and errors return by the legacy
+// provider to protobuf diagnostics.
+func WarnsAndErrsToProto(warns []string, errs []error) (diags []*proto.Diagnostic) {
+        for _, w := range warns {
+                diags = AppendProtoDiag(diags, w)
+        }
+
+        for _, e := range errs {
+                diags = AppendProtoDiag(diags, e)
+        }
+
+        return diags
+}
+
+// AppendProtoDiag appends a new diagnostic from a warning string or an error.
+// This panics if d is not a string or error.
+func AppendProtoDiag(diags []*proto.Diagnostic, d interface{}) []*proto.Diagnostic {
+        switch d := d.(type) {
+        case cty.PathError:
+                ap := PathToAttributePath(d.Path)
+                diags = append(diags, &proto.Diagnostic{
+                        Severity:  proto.Diagnostic_ERROR,
+                        Summary:   d.Error(),
+                        Attribute: ap,
+                })
+        case error:
+                diags = append(diags, &proto.Diagnostic{
+                        Severity: proto.Diagnostic_ERROR,
+                        Summary:  d.Error(),
+                })
+        case string:
+                diags = append(diags, &proto.Diagnostic{
+                        Severity: proto.Diagnostic_WARNING,
+                        Summary:  d,
+                })
+        case *proto.Diagnostic:
+                diags = append(diags, d)
+        case []*proto.Diagnostic:
+                diags = append(diags, d...)
+        }
+        return diags
+}
+
+// ProtoToDiagnostics converts a list of proto.Diagnostics to a tf.Diagnostics.
+func ProtoToDiagnostics(ds []*proto.Diagnostic) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        for _, d := range ds {
+                var severity tfdiags.Severity
+
+                switch d.Severity {
+                case proto.Diagnostic_ERROR:
+                        severity = tfdiags.Error
+                case proto.Diagnostic_WARNING:
+                        severity = tfdiags.Warning
+                }
+
+                var newDiag tfdiags.Diagnostic
+
+                // if there's an attribute path, we need to create a AttributeValue diagnostic
+                if d.Attribute != nil {
+                        path := AttributePathToPath(d.Attribute)
+                        newDiag = tfdiags.AttributeValue(severity, d.Summary, d.Detail, path)
+                } else {
+                        newDiag = tfdiags.WholeContainingBody(severity, d.Summary, d.Detail)
+                }
+
+                diags = diags.Append(newDiag)
+        }
+
+        return diags
+}
+
+// AttributePathToPath takes the proto encoded path and converts it to a cty.Path
+func AttributePathToPath(ap *proto.AttributePath) cty.Path {
+        var p cty.Path
+        for _, step := range ap.Steps {
+                switch selector := step.Selector.(type) {
+                case *proto.AttributePath_Step_AttributeName:
+                        p = p.GetAttr(selector.AttributeName)
+                case *proto.AttributePath_Step_ElementKeyString:
+                        p = p.Index(cty.StringVal(selector.ElementKeyString))
+                case *proto.AttributePath_Step_ElementKeyInt:
+                        p = p.Index(cty.NumberIntVal(selector.ElementKeyInt))
+                }
+        }
+        return p
+}
+
+// AttributePathToPath takes a cty.Path and converts it to a proto-encoded path.
+func PathToAttributePath(p cty.Path) *proto.AttributePath {
+        ap := &proto.AttributePath{}
+        for _, step := range p {
+                switch selector := step.(type) {
+                case cty.GetAttrStep:
+                        ap.Steps = append(ap.Steps, &proto.AttributePath_Step{
+                                Selector: &proto.AttributePath_Step_AttributeName{
+                                        AttributeName: selector.Name,
+                                },
+                        })
+                case cty.IndexStep:
+                        key := selector.Key
+                        switch key.Type() {
+                        case cty.String:
+                                ap.Steps = append(ap.Steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyString{
+                                                ElementKeyString: key.AsString(),
+                                        },
+                                })
+                        case cty.Number:
+                                v, _ := key.AsBigFloat().Int64()
+                                ap.Steps = append(ap.Steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyInt{
+                                                ElementKeyInt: v,
+                                        },
+                                })
+                        default:
+                                // We'll bail early if we encounter anything else, and just
+                                // return the valid prefix.
+                                return ap
+                        }
+                }
+        }
+        return ap
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/convert/schema.go b/vendor/github.com/hashicorp/terraform/plugin/convert/schema.go
new file mode 100644
index 0000000..6a45f54
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/convert/schema.go
@@ -0,0 +1,154 @@
+package convert
+
+import (
+        "encoding/json"
+        "reflect"
+        "sort"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/providers"
+)
+
+// ConfigSchemaToProto takes a *configschema.Block and converts it to a
+// proto.Schema_Block for a grpc response.
+func ConfigSchemaToProto(b *configschema.Block) *proto.Schema_Block {
+        block := &proto.Schema_Block{}
+
+        for _, name := range sortedKeys(b.Attributes) {
+                a := b.Attributes[name]
+                attr := &proto.Schema_Attribute{
+                        Name:        name,
+                        Description: a.Description,
+                        Optional:    a.Optional,
+                        Computed:    a.Computed,
+                        Required:    a.Required,
+                        Sensitive:   a.Sensitive,
+                }
+
+                ty, err := json.Marshal(a.Type)
+                if err != nil {
+                        panic(err)
+                }
+
+                attr.Type = ty
+
+                block.Attributes = append(block.Attributes, attr)
+        }
+
+        for _, name := range sortedKeys(b.BlockTypes) {
+                b := b.BlockTypes[name]
+                block.BlockTypes = append(block.BlockTypes, protoSchemaNestedBlock(name, b))
+        }
+
+        return block
+}
+
+func protoSchemaNestedBlock(name string, b *configschema.NestedBlock) *proto.Schema_NestedBlock {
+        var nesting proto.Schema_NestedBlock_NestingMode
+        switch b.Nesting {
+        case configschema.NestingSingle:
+                nesting = proto.Schema_NestedBlock_SINGLE
+        case configschema.NestingGroup:
+                nesting = proto.Schema_NestedBlock_GROUP
+        case configschema.NestingList:
+                nesting = proto.Schema_NestedBlock_LIST
+        case configschema.NestingSet:
+                nesting = proto.Schema_NestedBlock_SET
+        case configschema.NestingMap:
+                nesting = proto.Schema_NestedBlock_MAP
+        default:
+                nesting = proto.Schema_NestedBlock_INVALID
+        }
+        return &proto.Schema_NestedBlock{
+                TypeName: name,
+                Block:    ConfigSchemaToProto(&b.Block),
+                Nesting:  nesting,
+                MinItems: int64(b.MinItems),
+                MaxItems: int64(b.MaxItems),
+        }
+}
+
+// ProtoToProviderSchema takes a proto.Schema and converts it to a providers.Schema.
+func ProtoToProviderSchema(s *proto.Schema) providers.Schema {
+        return providers.Schema{
+                Version: s.Version,
+                Block:   ProtoToConfigSchema(s.Block),
+        }
+}
+
+// ProtoToConfigSchema takes the GetSchcema_Block from a grpc response and converts it
+// to a terraform *configschema.Block.
+func ProtoToConfigSchema(b *proto.Schema_Block) *configschema.Block {
+        block := &configschema.Block{
+                Attributes: make(map[string]*configschema.Attribute),
+                BlockTypes: make(map[string]*configschema.NestedBlock),
+        }
+
+        for _, a := range b.Attributes {
+                attr := &configschema.Attribute{
+                        Description: a.Description,
+                        Required:    a.Required,
+                        Optional:    a.Optional,
+                        Computed:    a.Computed,
+                        Sensitive:   a.Sensitive,
+                }
+
+                if err := json.Unmarshal(a.Type, &attr.Type); err != nil {
+                        panic(err)
+                }
+
+                block.Attributes[a.Name] = attr
+        }
+
+        for _, b := range b.BlockTypes {
+                block.BlockTypes[b.TypeName] = schemaNestedBlock(b)
+        }
+
+        return block
+}
+
+func schemaNestedBlock(b *proto.Schema_NestedBlock) *configschema.NestedBlock {
+        var nesting configschema.NestingMode
+        switch b.Nesting {
+        case proto.Schema_NestedBlock_SINGLE:
+                nesting = configschema.NestingSingle
+        case proto.Schema_NestedBlock_GROUP:
+                nesting = configschema.NestingGroup
+        case proto.Schema_NestedBlock_LIST:
+                nesting = configschema.NestingList
+        case proto.Schema_NestedBlock_MAP:
+                nesting = configschema.NestingMap
+        case proto.Schema_NestedBlock_SET:
+                nesting = configschema.NestingSet
+        default:
+                // In all other cases we'll leave it as the zero value (invalid) and
+                // let the caller validate it and deal with this.
+        }
+
+        nb := &configschema.NestedBlock{
+                Nesting:  nesting,
+                MinItems: int(b.MinItems),
+                MaxItems: int(b.MaxItems),
+        }
+
+        nested := ProtoToConfigSchema(b.Block)
+        nb.Block = *nested
+        return nb
+}
+
+// sortedKeys returns the lexically sorted keys from the given map. This is
+// used to make schema conversions are deterministic. This panics if map keys
+// are not a string.
+func sortedKeys(m interface{}) []string {
+        v := reflect.ValueOf(m)
+        keys := make([]string, v.Len())
+
+        mapKeys := v.MapKeys()
+        for i, k := range mapKeys {
+                keys[i] = k.Interface().(string)
+        }
+
+        sort.Strings(keys)
+        return keys
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
index df855a7..729e970 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
@@ -22,9 +22,43 @@ const ErrorNoSuitableVersion = Error("no suitable version is available")
 // version of Terraform.
 const ErrorNoVersionCompatible = Error("no available version is compatible with this version of Terraform")
 
+// ErrorVersionIncompatible indicates that all of the versions within the
+// constraints are not compatible with the current version of Terrafrom, though
+// there does exist a version outside of the constaints that is compatible.
+const ErrorVersionIncompatible = Error("incompatible provider version")
+
 // ErrorNoSuchProvider indicates that no provider exists with a name given
 const ErrorNoSuchProvider = Error("no provider exists with the given name")
 
+// ErrorNoVersionCompatibleWithPlatform indicates that all of the available
+// versions that otherwise met constraints are not compatible with the
+// requested platform
+const ErrorNoVersionCompatibleWithPlatform = Error("no available version is compatible for the requested platform")
+
+// ErrorMissingChecksumVerification indicates that either the provider
+// distribution is missing the SHA256SUMS file or the checksum file does
+// not contain a checksum for the binary plugin
+const ErrorMissingChecksumVerification = Error("unable to verify checksum")
+
+// ErrorChecksumVerification indicates that the current checksum of the
+// provider plugin has changed since the initial release and is not trusted
+// to download
+const ErrorChecksumVerification = Error("unexpected plugin checksum")
+
+// ErrorSignatureVerification indicates that the digital signature for a
+// provider distribution could not be verified for one of the following
+// reasons: missing signature file, missing public key, or the signature
+// was not signed by any known key for the publisher
+const ErrorSignatureVerification = Error("unable to verify signature")
+
+// ErrorServiceUnreachable indicates that the network was unable to connect
+// to the registry service
+const ErrorServiceUnreachable = Error("registry service is unreachable")
+
+// ErrorPublicRegistryUnreachable indicates that the network was unable to connect
+// to the public registry in particular, so we can show a link to the statuspage
+const ErrorPublicRegistryUnreachable = Error("registry service is unreachable, check https://status.hashicorp.com/ for status updates")
+
 func (err Error) Error() string {
         return string(err)
 }
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
index 815640f..b1d01fb 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
@@ -13,28 +13,27 @@ import (
         "strconv"
         "strings"
 
-        "golang.org/x/net/html"
-
+        "github.com/hashicorp/errwrap"
         getter "github.com/hashicorp/go-getter"
         multierror "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/httpclient"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/registry/response"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
         "github.com/mitchellh/cli"
 )
 
-// Releases are located by parsing the html listing from releases.hashicorp.com.
-//
-// The URL for releases follows the pattern:
-//    https://releases.hashicorp.com/terraform-provider-name/<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
-//
-// The plugin protocol version will be saved with the release and returned in
-// the header X-TERRAFORM_PROTOCOL_VERSION.
+// Releases are located by querying the terraform registry.
 
 const protocolVersionHeader = "x-terraform-protocol-version"
 
-var releaseHost = "https://releases.hashicorp.com"
-
 var httpClient *http.Client
 
+var errVersionNotFound = errors.New("version not found")
+
 func init() {
         httpClient = httpclient.New()
 
@@ -50,7 +49,7 @@ func init() {
 // An Installer maintains a local cache of plugins by downloading plugins
 // from an online repository.
 type Installer interface {
-        Get(name string, req Constraints) (PluginMeta, error)
+        Get(name string, req Constraints) (PluginMeta, tfdiags.Diagnostics, error)
         PurgeUnused(used map[string]PluginMeta) (removed PluginMetaSet, err error)
 }
 
@@ -79,6 +78,13 @@ type ProviderInstaller struct {
         SkipVerify bool
 
         Ui cli.Ui // Ui for output
+
+        // Services is a required *disco.Disco, which may have services and
+        // credentials pre-loaded.
+        Services *disco.Disco
+
+        // registry client
+        registry *registry.Client
 }
 
 // Get is part of an implementation of type Installer, and attempts to download
@@ -100,96 +106,170 @@ type ProviderInstaller struct {
 // are produced under the assumption that if presented to the user they will
 // be presented alongside context about what is being installed, and thus the
 // error messages do not redundantly include such information.
-func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, error) {
-        versions, err := i.listProviderVersions(provider)
+func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, tfdiags.Diagnostics, error) {
+        var diags tfdiags.Diagnostics
+
+        // a little bit of initialization.
+        if i.OS == "" {
+                i.OS = runtime.GOOS
+        }
+        if i.Arch == "" {
+                i.Arch = runtime.GOARCH
+        }
+        if i.registry == nil {
+                i.registry = registry.NewClient(i.Services, nil)
+        }
+
+        // get a full listing of versions for the requested provider
+        allVersions, err := i.listProviderVersions(provider)
+
         // TODO: return multiple errors
         if err != nil {
-                return PluginMeta{}, err
+                log.Printf("[DEBUG] %s", err)
+                if registry.IsServiceUnreachable(err) {
+                        registryHost, err := i.hostname()
+                        if err == nil && registryHost == regsrc.PublicRegistryHost.Raw {
+                                return PluginMeta{}, diags, ErrorPublicRegistryUnreachable
+                        }
+                        return PluginMeta{}, diags, ErrorServiceUnreachable
+                }
+                if registry.IsServiceNotProvided(err) {
+                        return PluginMeta{}, diags, err
+                }
+                return PluginMeta{}, diags, ErrorNoSuchProvider
         }
 
-        if len(versions) == 0 {
-                return PluginMeta{}, ErrorNoSuitableVersion
+        // Add any warnings from the response to diags
+        for _, warning := range allVersions.Warnings {
+                hostname, err := i.hostname()
+                if err != nil {
+                        return PluginMeta{}, diags, err
+                }
+                diag := tfdiags.SimpleWarning(fmt.Sprintf("%s: %s", hostname, warning))
+                diags = diags.Append(diag)
         }
 
-        versions = allowedVersions(versions, req)
+        if len(allVersions.Versions) == 0 {
+                return PluginMeta{}, diags, ErrorNoSuitableVersion
+        }
+        providerSource := allVersions.ID
+
+        // Filter the list of plugin versions to those which meet the version constraints
+        versions := allowedVersions(allVersions, req)
         if len(versions) == 0 {
-                return PluginMeta{}, ErrorNoSuitableVersion
+                return PluginMeta{}, diags, ErrorNoSuitableVersion
         }
 
-        // sort them newest to oldest
-        Versions(versions).Sort()
+        // sort them newest to oldest. The newest version wins!
+        response.ProviderVersionCollection(versions).Sort()
 
-        // Ensure that our installation directory exists
-        err = os.MkdirAll(i.Dir, os.ModePerm)
-        if err != nil {
-                return PluginMeta{}, fmt.Errorf("failed to create plugin dir %s: %s", i.Dir, err)
+        // if the chosen provider version does not support the requested platform,
+        // filter the list of acceptable versions to those that support that platform
+        if err := i.checkPlatformCompatibility(versions[0]); err != nil {
+                versions = i.platformCompatibleVersions(versions)
+                if len(versions) == 0 {
+                        return PluginMeta{}, diags, ErrorNoVersionCompatibleWithPlatform
+                }
         }
 
-        // take the first matching plugin we find
-        for _, v := range versions {
-                url := i.providerURL(provider, v.String())
+        // we now have a winning platform-compatible version
+        versionMeta := versions[0]
+        v := VersionStr(versionMeta.Version).MustParse()
 
-                if !i.SkipVerify {
-                        sha256, err := i.getProviderChecksum(provider, v.String())
-                        if err != nil {
-                                return PluginMeta{}, err
-                        }
+        // check protocol compatibility
+        if err := i.checkPluginProtocol(versionMeta); err != nil {
+                closestMatch, err := i.findClosestProtocolCompatibleVersion(allVersions.Versions)
+                if err != nil {
+                        // No operation here if we can't find a version with compatible protocol
+                        return PluginMeta{}, diags, err
+                }
 
-                        // add the checksum parameter for go-getter to verify the download for us.
-                        if sha256 != "" {
-                                url = url + "?checksum=sha256:" + sha256
-                        }
+                // Prompt version suggestion to UI based on closest protocol match
+                var errMsg string
+                closestVersion := VersionStr(closestMatch.Version).MustParse()
+                if v.NewerThan(closestVersion) {
+                        errMsg = providerProtocolTooNew
+                } else {
+                        errMsg = providerProtocolTooOld
                 }
 
-                log.Printf("[DEBUG] fetching provider info for %s version %s", provider, v)
-                if checkPlugin(url, i.PluginProtocolVersion) {
-                        i.Ui.Info(fmt.Sprintf("- Downloading plugin for provider %q (%s)...", provider, v.String()))
-                        log.Printf("[DEBUG] getting provider %q version %q", provider, v)
-                        err := i.install(provider, v, url)
-                        if err != nil {
-                                return PluginMeta{}, err
-                        }
+                constraintStr := req.String()
+                if constraintStr == "" {
+                        constraintStr = "(any version)"
+                }
 
-                        // Find what we just installed
-                        // (This is weird, because go-getter doesn't directly return
-                        //  information about what was extracted, and we just extracted
-                        //  the archive directly into a shared dir here.)
-                        log.Printf("[DEBUG] looking for the %s %s plugin we just installed", provider, v)
-                        metas := FindPlugins("provider", []string{i.Dir})
-                        log.Printf("[DEBUG] all plugins found %#v", metas)
-                        metas, _ = metas.ValidateVersions()
-                        metas = metas.WithName(provider).WithVersion(v)
-                        log.Printf("[DEBUG] filtered plugins %#v", metas)
-                        if metas.Count() == 0 {
-                                // This should never happen. Suggests that the release archive
-                                // contains an executable file whose name doesn't match the
-                                // expected convention.
-                                return PluginMeta{}, fmt.Errorf(
-                                        "failed to find installed plugin version %s; this is a bug in Terraform and should be reported",
-                                        v,
-                                )
-                        }
+                return PluginMeta{}, diags, errwrap.Wrap(ErrorVersionIncompatible, fmt.Errorf(fmt.Sprintf(
+                        errMsg, provider, v.String(), tfversion.String(),
+                        closestVersion.String(), closestVersion.MinorUpgradeConstraintStr(), constraintStr)))
+        }
 
-                        if metas.Count() > 1 {
-                                // This should also never happen, and suggests that a
-                                // particular version was re-released with a different
-                                // executable filename. We consider releases as immutable, so
-                                // this is an error.
-                                return PluginMeta{}, fmt.Errorf(
-                                        "multiple plugins installed for version %s; this is a bug in Terraform and should be reported",
-                                        v,
-                                )
-                        }
+        downloadURLs, err := i.listProviderDownloadURLs(providerSource, versionMeta.Version)
+        providerURL := downloadURLs.DownloadURL
+
+        if !i.SkipVerify {
+                // Terraform verifies the integrity of a provider release before downloading
+                // the plugin binary. The digital signature (SHA256SUMS.sig) on the
+                // release distribution (SHA256SUMS) is verified with the public key of the
+                // publisher provided in the Terraform Registry response, ensuring that
+                // everything is as intended by the publisher. The checksum of the provider
+                // plugin is expected in the SHA256SUMS file and is double checked to match
+                // the checksum of the original published release to the Registry. This
+                // enforces immutability of releases between the Registry and the plugin's
+                // host location. Lastly, the integrity of the binary is verified upon
+                // download matches the Registry and signed checksum.
+                sha256, err := i.getProviderChecksum(downloadURLs)
+                if err != nil {
+                        return PluginMeta{}, diags, err
+                }
 
-                        // By now we know we have exactly one meta, and so "Newest" will
-                        // return that one.
-                        return metas.Newest(), nil
+                // add the checksum parameter for go-getter to verify the download for us.
+                if sha256 != "" {
+                        providerURL = providerURL + "?checksum=sha256:" + sha256
                 }
+        }
+
+        printedProviderName := fmt.Sprintf("%q (%s)", provider, providerSource)
+        i.Ui.Info(fmt.Sprintf("- Downloading plugin for provider %s %s...", printedProviderName, versionMeta.Version))
+        log.Printf("[DEBUG] getting provider %s version %q", printedProviderName, versionMeta.Version)
+        err = i.install(provider, v, providerURL)
+        if err != nil {
+                return PluginMeta{}, diags, err
+        }
+
+        // Find what we just installed
+        // (This is weird, because go-getter doesn't directly return
+        //  information about what was extracted, and we just extracted
+        //  the archive directly into a shared dir here.)
+        log.Printf("[DEBUG] looking for the %s %s plugin we just installed", provider, versionMeta.Version)
+        metas := FindPlugins("provider", []string{i.Dir})
+        log.Printf("[DEBUG] all plugins found %#v", metas)
+        metas, _ = metas.ValidateVersions()
+        metas = metas.WithName(provider).WithVersion(v)
+        log.Printf("[DEBUG] filtered plugins %#v", metas)
+        if metas.Count() == 0 {
+                // This should never happen. Suggests that the release archive
+                // contains an executable file whose name doesn't match the
+                // expected convention.
+                return PluginMeta{}, diags, fmt.Errorf(
+                        "failed to find installed plugin version %s; this is a bug in Terraform and should be reported",
+                        versionMeta.Version,
+                )
+        }
 
-                log.Printf("[INFO] incompatible ProtocolVersion for %s version %s", provider, v)
+        if metas.Count() > 1 {
+                // This should also never happen, and suggests that a
+                // particular version was re-released with a different
+                // executable filename. We consider releases as immutable, so
+                // this is an error.
+                return PluginMeta{}, diags, fmt.Errorf(
+                        "multiple plugins installed for version %s; this is a bug in Terraform and should be reported",
+                        versionMeta.Version,
+                )
         }
 
-        return PluginMeta{}, ErrorNoVersionCompatible
+        // By now we know we have exactly one meta, and so "Newest" will
+        // return that one.
+        return metas.Newest(), diags, nil
 }
 
 func (i *ProviderInstaller) install(provider string, version Version, url string) error {
@@ -215,6 +295,14 @@ func (i *ProviderInstaller) install(provider string, version Version, url string
                 // normal resolution machinery can find it.
                 filename := filepath.Base(cached)
                 targetPath := filepath.Join(i.Dir, filename)
+                // check if the target dir exists, and create it if not
+                var err error
+                if _, StatErr := os.Stat(i.Dir); os.IsNotExist(StatErr) {
+                        err = os.MkdirAll(i.Dir, 0700)
+                }
+                if err != nil {
+                        return err
+                }
 
                 log.Printf("[DEBUG] installing %s %s to %s from local cache %s", provider, version, targetPath, cached)
 
@@ -280,7 +368,6 @@ func (i *ProviderInstaller) install(provider string, version Version, url string
                         return err
                 }
         }
-
         return nil
 }
 
@@ -316,182 +403,222 @@ func (i *ProviderInstaller) PurgeUnused(used map[string]PluginMeta) (PluginMetaS
         return removed, errs
 }
 
-// Plugins are referred to by the short name, but all URLs and files will use
-// the full name prefixed with terraform-<plugin_type>-
-func (i *ProviderInstaller) providerName(name string) string {
-        return "terraform-provider-" + name
-}
+func (i *ProviderInstaller) getProviderChecksum(resp *response.TerraformProviderPlatformLocation) (string, error) {
+        // Get SHA256SUMS file.
+        shasums, err := getFile(resp.ShasumsURL)
+        if err != nil {
+                log.Printf("[ERROR] error fetching checksums from %q: %s", resp.ShasumsURL, err)
+                return "", ErrorMissingChecksumVerification
+        }
 
-func (i *ProviderInstaller) providerFileName(name, version string) string {
-        os := i.OS
-        arch := i.Arch
-        if os == "" {
-                os = runtime.GOOS
+        // Get SHA256SUMS.sig file.
+        signature, err := getFile(resp.ShasumsSignatureURL)
+        if err != nil {
+                log.Printf("[ERROR] error fetching checksums signature from %q: %s", resp.ShasumsSignatureURL, err)
+                return "", ErrorSignatureVerification
         }
-        if arch == "" {
-                arch = runtime.GOARCH
+
+        // Verify the GPG signature returned from the Registry.
+        asciiArmor := resp.SigningKeys.GPGASCIIArmor()
+        signer, err := verifySig(shasums, signature, asciiArmor)
+        if err != nil {
+                log.Printf("[ERROR] error verifying signature: %s", err)
+                return "", ErrorSignatureVerification
         }
-        return fmt.Sprintf("%s_%s_%s_%s.zip", i.providerName(name), version, os, arch)
-}
 
-// providerVersionsURL returns the path to the released versions directory for the provider:
-// https://releases.hashicorp.com/terraform-provider-name/
-func (i *ProviderInstaller) providerVersionsURL(name string) string {
-        return releaseHost + "/" + i.providerName(name) + "/"
-}
+        // Also verify the GPG signature against the HashiCorp public key. This is
+        // a temporary additional check until a more robust key verification
+        // process is added in a future release.
+        _, err = verifySig(shasums, signature, HashicorpPublicKey)
+        if err != nil {
+                log.Printf("[ERROR] error verifying signature against HashiCorp public key: %s", err)
+                return "", ErrorSignatureVerification
+        }
 
-// providerURL returns the full path to the provider file, using the current OS
-// and ARCH:
-// .../terraform-provider-name_<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
-func (i *ProviderInstaller) providerURL(name, version string) string {
-        return fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, i.providerFileName(name, version))
-}
+        // Display identity for GPG key which succeeded verifying the signature.
+        // This could also be used to display to the user with i.Ui.Info().
+        identities := []string{}
+        for k := range signer.Identities {
+                identities = append(identities, k)
+        }
+        identity := strings.Join(identities, ", ")
+        log.Printf("[DEBUG] verified GPG signature with key from %s", identity)
+
+        // Extract checksum for this os/arch platform binary and verify against Registry
+        checksum := checksumForFile(shasums, resp.Filename)
+        if checksum == "" {
+                log.Printf("[ERROR] missing checksum for %s from source %s", resp.Filename, resp.ShasumsURL)
+                return "", ErrorMissingChecksumVerification
+        } else if checksum != resp.Shasum {
+                log.Printf("[ERROR] unexpected checksum for %s from source %q", resp.Filename, resp.ShasumsURL)
+                return "", ErrorChecksumVerification
+        }
 
-func (i *ProviderInstaller) providerChecksumURL(name, version string) string {
-        fileName := fmt.Sprintf("%s_%s_SHA256SUMS", i.providerName(name), version)
-        u := fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, fileName)
-        return u
+        return checksum, nil
 }
 
-func (i *ProviderInstaller) getProviderChecksum(name, version string) (string, error) {
-        checksums, err := getPluginSHA256SUMs(i.providerChecksumURL(name, version))
+func (i *ProviderInstaller) hostname() (string, error) {
+        provider := regsrc.NewTerraformProvider("", i.OS, i.Arch)
+        svchost, err := provider.SvcHost()
         if err != nil {
                 return "", err
         }
 
-        return checksumForFile(checksums, i.providerFileName(name, version)), nil
+        return svchost.ForDisplay(), nil
 }
 
-// Return the plugin version by making a HEAD request to the provided url.
-// If the header is not present, we assume the latest version will be
-// compatible, and leave the check for discovery or execution.
-func checkPlugin(url string, pluginProtocolVersion uint) bool {
-        resp, err := httpClient.Head(url)
-        if err != nil {
-                log.Printf("[ERROR] error fetching plugin headers: %s", err)
-                return false
-        }
+// list all versions available for the named provider
+func (i *ProviderInstaller) listProviderVersions(name string) (*response.TerraformProviderVersions, error) {
+        provider := regsrc.NewTerraformProvider(name, i.OS, i.Arch)
+        versions, err := i.registry.TerraformProviderVersions(provider)
+        return versions, err
+}
 
-        if resp.StatusCode != http.StatusOK {
-                log.Println("[ERROR] non-200 status fetching plugin headers:", resp.Status)
-                return false
+func (i *ProviderInstaller) listProviderDownloadURLs(name, version string) (*response.TerraformProviderPlatformLocation, error) {
+        urls, err := i.registry.TerraformProviderLocation(regsrc.NewTerraformProvider(name, i.OS, i.Arch), version)
+        if urls == nil {
+                return nil, fmt.Errorf("No download urls found for provider %s", name)
         }
+        return urls, err
+}
+
+// findClosestProtocolCompatibleVersion searches for the provider version with the closest protocol match.
+// Prerelease versions are filtered.
+func (i *ProviderInstaller) findClosestProtocolCompatibleVersion(versions []*response.TerraformProviderVersion) (*response.TerraformProviderVersion, error) {
+        // Loop through all the provider versions to find the earliest and latest
+        // versions that match the installer protocol to then select the closest of the two
+        var latest, earliest *response.TerraformProviderVersion
+        for _, version := range versions {
+                // Prereleases are filtered and will not be suggested
+                v, err := VersionStr(version.Version).Parse()
+                if err != nil || v.IsPrerelease() {
+                        continue
+                }
 
-        proto := resp.Header.Get(protocolVersionHeader)
-        if proto == "" {
-                // The header isn't present, but we don't make this error fatal since
-                // the latest version will probably work.
-                log.Printf("[WARN] missing %s from: %s", protocolVersionHeader, url)
-                return true
+                if err := i.checkPluginProtocol(version); err == nil {
+                        if earliest == nil {
+                                // Found the first provider version with compatible protocol
+                                earliest = version
+                        }
+                        // Update the latest protocol compatible version
+                        latest = version
+                }
+        }
+        if earliest == nil {
+                // No compatible protocol was found for any version
+                return nil, ErrorNoVersionCompatible
         }
 
-        protoVersion, err := strconv.Atoi(proto)
+        // Convert protocols to comparable types
+        protoString := strconv.Itoa(int(i.PluginProtocolVersion))
+        protocolVersion, err := VersionStr(protoString).Parse()
         if err != nil {
-                log.Printf("[ERROR] invalid ProtocolVersion: %s", proto)
-                return false
+                return nil, fmt.Errorf("invalid plugin protocol version: %q", i.PluginProtocolVersion)
         }
 
-        return protoVersion == int(pluginProtocolVersion)
-}
-
-// list the version available for the named plugin
-func (i *ProviderInstaller) listProviderVersions(name string) ([]Version, error) {
-        versions, err := listPluginVersions(i.providerVersionsURL(name))
+        earliestVersionProtocol, err := VersionStr(earliest.Protocols[0]).Parse()
         if err != nil {
-                // listPluginVersions returns a verbose error message indicating
-                // what was being accessed and what failed
                 return nil, err
         }
-        return versions, nil
-}
-
-var errVersionNotFound = errors.New("version not found")
 
-// take the list of available versions for a plugin, and filter out those that
-// don't fit the constraints.
-func allowedVersions(available []Version, required Constraints) []Version {
-        var allowed []Version
-
-        for _, v := range available {
-                if required.Allows(v) {
-                        allowed = append(allowed, v)
-                }
+        // Compare installer protocol version with the first protocol listed of the earliest match
+        // [A, B] where A is assumed the earliest compatible major version of the protocol pair
+        if protocolVersion.NewerThan(earliestVersionProtocol) {
+                // Provider protocols are too old, the closest version is the earliest compatible version
+                return earliest, nil
         }
 
-        return allowed
+        // Provider protocols are too new, the closest version is the latest compatible version
+        return latest, nil
 }
 
-// return a list of the plugin versions at the given URL
-func listPluginVersions(url string) ([]Version, error) {
-        resp, err := httpClient.Get(url)
+func (i *ProviderInstaller) checkPluginProtocol(versionMeta *response.TerraformProviderVersion) error {
+        // TODO: should this be a different error? We should probably differentiate between
+        // no compatible versions and no protocol versions listed at all
+        if len(versionMeta.Protocols) == 0 {
+                return fmt.Errorf("no plugin protocol versions listed")
+        }
+
+        protoString := strconv.Itoa(int(i.PluginProtocolVersion))
+        protocolVersion, err := VersionStr(protoString).Parse()
         if err != nil {
-                // http library produces a verbose error message that includes the
-                // URL being accessed, etc.
-                return nil, err
+                return fmt.Errorf("invalid plugin protocol version: %q", i.PluginProtocolVersion)
+        }
+        protocolConstraint, err := protocolVersion.MinorUpgradeConstraintStr().Parse()
+        if err != nil {
+                // This should not fail if the preceding function succeeded.
+                return fmt.Errorf("invalid plugin protocol version: %q", protocolVersion.String())
         }
-        defer resp.Body.Close()
 
-        if resp.StatusCode != http.StatusOK {
-                body, _ := ioutil.ReadAll(resp.Body)
-                log.Printf("[ERROR] failed to fetch plugin versions from %s\n%s\n%s", url, resp.Status, body)
-
-                switch resp.StatusCode {
-                case http.StatusNotFound, http.StatusForbidden:
-                        // These are treated as indicative of the given name not being
-                        // a valid provider name at all.
-                        return nil, ErrorNoSuchProvider
-
-                default:
-                        // All other errors are assumed to be operational problems.
-                        return nil, fmt.Errorf("error accessing %s: %s", url, resp.Status)
+        for _, p := range versionMeta.Protocols {
+                proPro, err := VersionStr(p).Parse()
+                if err != nil {
+                        // invalid protocol reported by the registry. Move along.
+                        log.Printf("[WARN] invalid provider protocol version %q found in the registry", versionMeta.Version)
+                        continue
+                }
+                // success!
+                if protocolConstraint.Allows(proPro) {
+                        return nil
                 }
-
         }
 
-        body, err := html.Parse(resp.Body)
-        if err != nil {
-                log.Fatal(err)
+        return ErrorNoVersionCompatible
+}
+
+// REVIEWER QUESTION (again): this ends up swallowing a bunch of errors from
+// checkPluginProtocol. Do they need to be percolated up better, or would
+// debug messages would suffice in these situations?
+func (i *ProviderInstaller) findPlatformCompatibleVersion(versions []*response.TerraformProviderVersion) (*response.TerraformProviderVersion, error) {
+        for _, version := range versions {
+                if err := i.checkPlatformCompatibility(version); err == nil {
+                        return version, nil
+                }
         }
 
-        names := []string{}
+        return nil, ErrorNoVersionCompatibleWithPlatform
+}
 
-        // all we need to do is list links on the directory listing page that look like plugins
-        var f func(*html.Node)
-        f = func(n *html.Node) {
-                if n.Type == html.ElementNode && n.Data == "a" {
-                        c := n.FirstChild
-                        if c != nil && c.Type == html.TextNode && strings.HasPrefix(c.Data, "terraform-") {
-                                names = append(names, c.Data)
-                                return
-                        }
-                }
-                for c := n.FirstChild; c != nil; c = c.NextSibling {
-                        f(c)
+// platformCompatibleVersions returns a list of provider versions that are
+// compatible with the requested platform.
+func (i *ProviderInstaller) platformCompatibleVersions(versions []*response.TerraformProviderVersion) []*response.TerraformProviderVersion {
+        var v []*response.TerraformProviderVersion
+        for _, version := range versions {
+                if err := i.checkPlatformCompatibility(version); err == nil {
+                        v = append(v, version)
                 }
         }
-        f(body)
+        return v
+}
 
-        return versionsFromNames(names), nil
+func (i *ProviderInstaller) checkPlatformCompatibility(versionMeta *response.TerraformProviderVersion) error {
+        if len(versionMeta.Platforms) == 0 {
+                return fmt.Errorf("no supported provider platforms listed")
+        }
+        for _, p := range versionMeta.Platforms {
+                if p.Arch == i.Arch && p.OS == i.OS {
+                        return nil
+                }
+        }
+        return fmt.Errorf("version %s does not support the requested platform %s_%s", versionMeta.Version, i.OS, i.Arch)
 }
 
-// parse the list of directory names into a sorted list of available versions
-func versionsFromNames(names []string) []Version {
-        var versions []Version
-        for _, name := range names {
-                parts := strings.SplitN(name, "_", 2)
-                if len(parts) == 2 && parts[1] != "" {
-                        v, err := VersionStr(parts[1]).Parse()
-                        if err != nil {
-                                // filter invalid versions scraped from the page
-                                log.Printf("[WARN] invalid version found for %q: %s", name, err)
-                                continue
-                        }
+// take the list of available versions for a plugin, and filter out those that
+// don't fit the constraints.
+func allowedVersions(available *response.TerraformProviderVersions, required Constraints) []*response.TerraformProviderVersion {
+        var allowed []*response.TerraformProviderVersion
 
-                        versions = append(versions, v)
+        for _, v := range available.Versions {
+                version, err := VersionStr(v.Version).Parse()
+                if err != nil {
+                        log.Printf("[WARN] invalid version found for %q: %s", available.ID, err)
+                        continue
+                }
+                if required.Allows(version) {
+                        allowed = append(allowed, v)
                 }
         }
-
-        return versions
+        return allowed
 }
 
 func checksumForFile(sums []byte, name string) string {
@@ -504,27 +631,6 @@ func checksumForFile(sums []byte, name string) string {
         return ""
 }
 
-// fetch the SHA256SUMS file provided, and verify its signature.
-func getPluginSHA256SUMs(sumsURL string) ([]byte, error) {
-        sigURL := sumsURL + ".sig"
-
-        sums, err := getFile(sumsURL)
-        if err != nil {
-                return nil, fmt.Errorf("error fetching checksums: %s", err)
-        }
-
-        sig, err := getFile(sigURL)
-        if err != nil {
-                return nil, fmt.Errorf("error fetching checksums signature: %s", err)
-        }
-
-        if err := verifySig(sums, sig); err != nil {
-                return nil, err
-        }
-
-        return sums, nil
-}
-
 func getFile(url string) ([]byte, error) {
         resp, err := httpClient.Get(url)
         if err != nil {
@@ -543,6 +649,41 @@ func getFile(url string) ([]byte, error) {
         return data, nil
 }
 
-func GetReleaseHost() string {
-        return releaseHost
-}
+// providerProtocolTooOld is a message sent to the CLI UI if the provider's
+// supported protocol versions are too old for the user's version of terraform,
+// but an older version of the provider is compatible.
+const providerProtocolTooOld = `
+[reset][bold][red]Provider %q v%s is not compatible with Terraform %s.[reset][red]
+
+Provider version %s is the earliest compatible version. Select it with 
+the following version constraint:
+
+        version = %q
+
+Terraform checked all of the plugin versions matching the given constraint:
+    %s
+
+Consult the documentation for this provider for more information on
+compatibility between provider and Terraform versions.
+`
+
+// providerProtocolTooNew is a message sent to the CLI UI if the provider's
+// supported protocol versions are too new for the user's version of terraform,
+// and the user could either upgrade terraform or choose an older version of the
+// provider
+const providerProtocolTooNew = `
+[reset][bold][red]Provider %q v%s is not compatible with Terraform %s.[reset][red]
+
+Provider version %s is the latest compatible version. Select it with 
+the following constraint:
+
+    version = %q
+
+Terraform checked all of the plugin versions matching the given constraint:
+    %s
+
+Consult the documentation for this provider for more information on
+compatibility between provider and Terraform versions.
+
+Alternatively, upgrade to the latest version of Terraform for compatibility with newer provider releases.
+`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/hashicorp.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/hashicorp.go
new file mode 100644
index 0000000..4622ca0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/hashicorp.go
@@ -0,0 +1,34 @@
+package discovery
+
+// HashicorpPublicKey is the HashiCorp public key, also available at
+// https://www.hashicorp.com/security
+const HashicorpPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f
+W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq
+fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA
+3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca
+KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k
+SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1
+cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n
+Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i
+SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi
+psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w
+sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO
+klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW
+WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9
+wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j
+2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM
+skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo
+mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y
+0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA
+CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc
+z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP
+0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG
+unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ
+EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ
+oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C
+=LYpS
+-----END PGP PUBLIC KEY BLOCK-----`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
index 181ea1f..3a99289 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
@@ -63,7 +63,7 @@ func (s PluginMetaSet) WithName(name string) PluginMetaSet {
 // WithVersion returns the subset of metas that have the given version.
 //
 // This should be used only with the "valid" result from ValidateVersions;
-// it will ignore any plugin metas that have a invalid version strings.
+// it will ignore any plugin metas that have invalid version strings.
 func (s PluginMetaSet) WithVersion(version Version) PluginMetaSet {
         ns := make(PluginMetaSet)
         for p := range s {
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
index 75430fd..0466ab2 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
@@ -4,6 +4,12 @@ import (
         "bytes"
 )
 
+// PluginInstallProtocolVersion is the protocol version TF-core
+// supports to communicate with servers, and is used to resolve
+// plugin discovery with terraform registry, in addition to
+// any specified plugin version constraints
+const PluginInstallProtocolVersion = 5
+
 // PluginRequirements describes a set of plugins (assumed to be of a consistent
 // kind) that are required to exist and have versions within the given
 // corresponding sets.
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
index b6686a5..7bbae50 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
@@ -2,7 +2,6 @@ package discovery
 
 import (
         "bytes"
-        "log"
         "strings"
 
         "golang.org/x/crypto/openpgp"
@@ -10,44 +9,11 @@ import (
 
 // Verify the data using the provided openpgp detached signature and the
 // embedded hashicorp public key.
-func verifySig(data, sig []byte) error {
-        el, err := openpgp.ReadArmoredKeyRing(strings.NewReader(hashiPublicKey))
+func verifySig(data, sig []byte, armor string) (*openpgp.Entity, error) {
+        el, err := openpgp.ReadArmoredKeyRing(strings.NewReader(armor))
         if err != nil {
-                log.Fatal(err)
+                return nil, err
         }
 
-        _, err = openpgp.CheckDetachedSignature(el, bytes.NewReader(data), bytes.NewReader(sig))
-        return err
+        return openpgp.CheckDetachedSignature(el, bytes.NewReader(data), bytes.NewReader(sig))
 }
-
-// this is the public key that signs the checksums file for releases.
-const hashiPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1
-
-mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f
-W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq
-fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA
-3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca
-KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k
-SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1
-cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG
-CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n
-Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i
-SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi
-psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w
-sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO
-klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW
-WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9
-wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j
-2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM
-skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo
-mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y
-0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA
-CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc
-z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP
-0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG
-unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ
-EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ
-oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C
-=LYpS
------END PGP PUBLIC KEY BLOCK-----`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
index 8fad58d..4311d51 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
@@ -55,6 +55,11 @@ func (v Version) Equal(other Version) bool {
         return v.raw.Equal(other.raw)
 }
 
+// IsPrerelease determines if version is a prerelease
+func (v Version) IsPrerelease() bool {
+        return v.raw.Prerelease() != ""
+}
+
 // MinorUpgradeConstraintStr returns a ConstraintStr that would permit
 // minor upgrades relative to the receiving version.
 func (v Version) MinorUpgradeConstraintStr() ConstraintStr {
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
index 0aefd75..de02f5e 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
@@ -36,6 +36,11 @@ type Constraints struct {
         raw version.Constraints
 }
 
+// NewConstraints creates a Constraints based on a version.Constraints.
+func NewConstraints(c version.Constraints) Constraints {
+        return Constraints{c}
+}
+
 // AllVersions is a Constraints containing all versions
 var AllVersions Constraints
 
diff --git a/vendor/github.com/hashicorp/terraform/plugin/grpc_provider.go b/vendor/github.com/hashicorp/terraform/plugin/grpc_provider.go
new file mode 100644
index 0000000..ae9a400
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/grpc_provider.go
@@ -0,0 +1,562 @@
+package plugin
+
+import (
+        "context"
+        "errors"
+        "log"
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+
+        plugin "github.com/hashicorp/go-plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/version"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        "google.golang.org/grpc"
+)
+
+// GRPCProviderPlugin implements plugin.GRPCPlugin for the go-plugin package.
+type GRPCProviderPlugin struct {
+        plugin.Plugin
+        GRPCProvider func() proto.ProviderServer
+}
+
+func (p *GRPCProviderPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
+        return &GRPCProvider{
+                client: proto.NewProviderClient(c),
+                ctx:    ctx,
+        }, nil
+}
+
+func (p *GRPCProviderPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
+        proto.RegisterProviderServer(s, p.GRPCProvider())
+        return nil
+}
+
+// GRPCProvider handles the client, or core side of the plugin rpc connection.
+// The GRPCProvider methods are mostly a translation layer between the
+// terraform provioders types and the grpc proto types, directly converting
+// between the two.
+type GRPCProvider struct {
+        // PluginClient provides a reference to the plugin.Client which controls the plugin process.
+        // This allows the GRPCProvider a way to shutdown the plugin process.
+        PluginClient *plugin.Client
+
+        // TestServer contains a grpc.Server to close when the GRPCProvider is being
+        // used in an end to end test of a provider.
+        TestServer *grpc.Server
+
+        // Proto client use to make the grpc service calls.
+        client proto.ProviderClient
+
+        // this context is created by the plugin package, and is canceled when the
+        // plugin process ends.
+        ctx context.Context
+
+        // schema stores the schema for this provider. This is used to properly
+        // serialize the state for requests.
+        mu      sync.Mutex
+        schemas providers.GetSchemaResponse
+}
+
+// getSchema is used internally to get the saved provider schema.  The schema
+// should have already been fetched from the provider, but we have to
+// synchronize access to avoid being called concurrently with GetSchema.
+func (p *GRPCProvider) getSchema() providers.GetSchemaResponse {
+        p.mu.Lock()
+        // unlock inline in case GetSchema needs to be called
+        if p.schemas.Provider.Block != nil {
+                p.mu.Unlock()
+                return p.schemas
+        }
+        p.mu.Unlock()
+
+        // the schema should have been fetched already, but give it another shot
+        // just in case things are being called out of order. This may happen for
+        // tests.
+        schemas := p.GetSchema()
+        if schemas.Diagnostics.HasErrors() {
+                panic(schemas.Diagnostics.Err())
+        }
+
+        return schemas
+}
+
+// getResourceSchema is a helper to extract the schema for a resource, and
+// panics if the schema is not available.
+func (p *GRPCProvider) getResourceSchema(name string) providers.Schema {
+        schema := p.getSchema()
+        resSchema, ok := schema.ResourceTypes[name]
+        if !ok {
+                panic("unknown resource type " + name)
+        }
+        return resSchema
+}
+
+// gettDatasourceSchema is a helper to extract the schema for a datasource, and
+// panics if that schema is not available.
+func (p *GRPCProvider) getDatasourceSchema(name string) providers.Schema {
+        schema := p.getSchema()
+        dataSchema, ok := schema.DataSources[name]
+        if !ok {
+                panic("unknown data source " + name)
+        }
+        return dataSchema
+}
+
+func (p *GRPCProvider) GetSchema() (resp providers.GetSchemaResponse) {
+        log.Printf("[TRACE] GRPCProvider: GetSchema")
+        p.mu.Lock()
+        defer p.mu.Unlock()
+
+        if p.schemas.Provider.Block != nil {
+                return p.schemas
+        }
+
+        resp.ResourceTypes = make(map[string]providers.Schema)
+        resp.DataSources = make(map[string]providers.Schema)
+
+        // Some providers may generate quite large schemas, and the internal default
+        // grpc response size limit is 4MB. 64MB should cover most any use case, and
+        // if we get providers nearing that we may want to consider a finer-grained
+        // API to fetch individual resource schemas.
+        // Note: this option is marked as EXPERIMENTAL in the grpc API.
+        const maxRecvSize = 64 << 20
+        protoResp, err := p.client.GetSchema(p.ctx, new(proto.GetProviderSchema_Request), grpc.MaxRecvMsgSizeCallOption{MaxRecvMsgSize: maxRecvSize})
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        if protoResp.Provider == nil {
+                resp.Diagnostics = resp.Diagnostics.Append(errors.New("missing provider schema"))
+                return resp
+        }
+
+        resp.Provider = convert.ProtoToProviderSchema(protoResp.Provider)
+
+        for name, res := range protoResp.ResourceSchemas {
+                resp.ResourceTypes[name] = convert.ProtoToProviderSchema(res)
+        }
+
+        for name, data := range protoResp.DataSourceSchemas {
+                resp.DataSources[name] = convert.ProtoToProviderSchema(data)
+        }
+
+        p.schemas = resp
+
+        return resp
+}
+
+func (p *GRPCProvider) PrepareProviderConfig(r providers.PrepareProviderConfigRequest) (resp providers.PrepareProviderConfigResponse) {
+        log.Printf("[TRACE] GRPCProvider: PrepareProviderConfig")
+
+        schema := p.getSchema()
+        ty := schema.Provider.Block.ImpliedType()
+
+        mp, err := msgpack.Marshal(r.Config, ty)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.PrepareProviderConfig_Request{
+                Config: &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.PrepareProviderConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        config := cty.NullVal(ty)
+        if protoResp.PreparedConfig != nil {
+                config, err = msgpack.Unmarshal(protoResp.PreparedConfig.Msgpack, ty)
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.PreparedConfig = config
+
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) ValidateResourceTypeConfig(r providers.ValidateResourceTypeConfigRequest) (resp providers.ValidateResourceTypeConfigResponse) {
+        log.Printf("[TRACE] GRPCProvider: ValidateResourceTypeConfig")
+        resourceSchema := p.getResourceSchema(r.TypeName)
+
+        mp, err := msgpack.Marshal(r.Config, resourceSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ValidateResourceTypeConfig_Request{
+                TypeName: r.TypeName,
+                Config:   &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.ValidateResourceTypeConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) ValidateDataSourceConfig(r providers.ValidateDataSourceConfigRequest) (resp providers.ValidateDataSourceConfigResponse) {
+        log.Printf("[TRACE] GRPCProvider: ValidateDataSourceConfig")
+
+        dataSchema := p.getDatasourceSchema(r.TypeName)
+
+        mp, err := msgpack.Marshal(r.Config, dataSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ValidateDataSourceConfig_Request{
+                TypeName: r.TypeName,
+                Config:   &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.ValidateDataSourceConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) UpgradeResourceState(r providers.UpgradeResourceStateRequest) (resp providers.UpgradeResourceStateResponse) {
+        log.Printf("[TRACE] GRPCProvider: UpgradeResourceState")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        protoReq := &proto.UpgradeResourceState_Request{
+                TypeName: r.TypeName,
+                Version:  int64(r.Version),
+                RawState: &proto.RawState{
+                        Json:    r.RawStateJSON,
+                        Flatmap: r.RawStateFlatmap,
+                },
+        }
+
+        protoResp, err := p.client.UpgradeResourceState(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.UpgradedState != nil {
+                state, err = msgpack.Unmarshal(protoResp.UpgradedState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+
+        resp.UpgradedState = state
+        return resp
+}
+
+func (p *GRPCProvider) Configure(r providers.ConfigureRequest) (resp providers.ConfigureResponse) {
+        log.Printf("[TRACE] GRPCProvider: Configure")
+
+        schema := p.getSchema()
+
+        var mp []byte
+
+        // we don't have anything to marshal if there's no config
+        mp, err := msgpack.Marshal(r.Config, schema.Provider.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.Configure_Request{
+                TerraformVersion: version.Version,
+                Config: &proto.DynamicValue{
+                        Msgpack: mp,
+                },
+        }
+
+        protoResp, err := p.client.Configure(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) Stop() error {
+        log.Printf("[TRACE] GRPCProvider: Stop")
+
+        resp, err := p.client.Stop(p.ctx, new(proto.Stop_Request))
+        if err != nil {
+                return err
+        }
+
+        if resp.Error != "" {
+                return errors.New(resp.Error)
+        }
+        return nil
+}
+
+func (p *GRPCProvider) ReadResource(r providers.ReadResourceRequest) (resp providers.ReadResourceResponse) {
+        log.Printf("[TRACE] GRPCProvider: ReadResource")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        mp, err := msgpack.Marshal(r.PriorState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ReadResource_Request{
+                TypeName:     r.TypeName,
+                CurrentState: &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.ReadResource(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.NewState != nil {
+                state, err = msgpack.Unmarshal(protoResp.NewState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.NewState = state
+
+        return resp
+}
+
+func (p *GRPCProvider) PlanResourceChange(r providers.PlanResourceChangeRequest) (resp providers.PlanResourceChangeResponse) {
+        log.Printf("[TRACE] GRPCProvider: PlanResourceChange")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        priorMP, err := msgpack.Marshal(r.PriorState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        configMP, err := msgpack.Marshal(r.Config, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        propMP, err := msgpack.Marshal(r.ProposedNewState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.PlanResourceChange_Request{
+                TypeName:         r.TypeName,
+                PriorState:       &proto.DynamicValue{Msgpack: priorMP},
+                Config:           &proto.DynamicValue{Msgpack: configMP},
+                ProposedNewState: &proto.DynamicValue{Msgpack: propMP},
+                PriorPrivate:     r.PriorPrivate,
+        }
+
+        protoResp, err := p.client.PlanResourceChange(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.PlannedState != nil {
+                state, err = msgpack.Unmarshal(protoResp.PlannedState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.PlannedState = state
+
+        for _, p := range protoResp.RequiresReplace {
+                resp.RequiresReplace = append(resp.RequiresReplace, convert.AttributePathToPath(p))
+        }
+
+        resp.PlannedPrivate = protoResp.PlannedPrivate
+
+        resp.LegacyTypeSystem = protoResp.LegacyTypeSystem
+
+        return resp
+}
+
+func (p *GRPCProvider) ApplyResourceChange(r providers.ApplyResourceChangeRequest) (resp providers.ApplyResourceChangeResponse) {
+        log.Printf("[TRACE] GRPCProvider: ApplyResourceChange")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        priorMP, err := msgpack.Marshal(r.PriorState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        plannedMP, err := msgpack.Marshal(r.PlannedState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        configMP, err := msgpack.Marshal(r.Config, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ApplyResourceChange_Request{
+                TypeName:       r.TypeName,
+                PriorState:     &proto.DynamicValue{Msgpack: priorMP},
+                PlannedState:   &proto.DynamicValue{Msgpack: plannedMP},
+                Config:         &proto.DynamicValue{Msgpack: configMP},
+                PlannedPrivate: r.PlannedPrivate,
+        }
+
+        protoResp, err := p.client.ApplyResourceChange(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        resp.Private = protoResp.Private
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.NewState != nil {
+                state, err = msgpack.Unmarshal(protoResp.NewState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.NewState = state
+
+        resp.LegacyTypeSystem = protoResp.LegacyTypeSystem
+
+        return resp
+}
+
+func (p *GRPCProvider) ImportResourceState(r providers.ImportResourceStateRequest) (resp providers.ImportResourceStateResponse) {
+        log.Printf("[TRACE] GRPCProvider: ImportResourceState")
+
+        protoReq := &proto.ImportResourceState_Request{
+                TypeName: r.TypeName,
+                Id:       r.ID,
+        }
+
+        protoResp, err := p.client.ImportResourceState(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        for _, imported := range protoResp.ImportedResources {
+                resource := providers.ImportedResource{
+                        TypeName: imported.TypeName,
+                        Private:  imported.Private,
+                }
+
+                resSchema := p.getResourceSchema(resource.TypeName)
+                state := cty.NullVal(resSchema.Block.ImpliedType())
+                if imported.State != nil {
+                        state, err = msgpack.Unmarshal(imported.State.Msgpack, resSchema.Block.ImpliedType())
+                        if err != nil {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                                return resp
+                        }
+                }
+                resource.State = state
+                resp.ImportedResources = append(resp.ImportedResources, resource)
+        }
+
+        return resp
+}
+
+func (p *GRPCProvider) ReadDataSource(r providers.ReadDataSourceRequest) (resp providers.ReadDataSourceResponse) {
+        log.Printf("[TRACE] GRPCProvider: ReadDataSource")
+
+        dataSchema := p.getDatasourceSchema(r.TypeName)
+
+        config, err := msgpack.Marshal(r.Config, dataSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ReadDataSource_Request{
+                TypeName: r.TypeName,
+                Config: &proto.DynamicValue{
+                        Msgpack: config,
+                },
+        }
+
+        protoResp, err := p.client.ReadDataSource(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(dataSchema.Block.ImpliedType())
+        if protoResp.State != nil {
+                state, err = msgpack.Unmarshal(protoResp.State.Msgpack, dataSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.State = state
+
+        return resp
+}
+
+// closing the grpc connection is final, and terraform will call it at the end of every phase.
+func (p *GRPCProvider) Close() error {
+        log.Printf("[TRACE] GRPCProvider: Close")
+
+        // Make sure to stop the server if we're not running within go-plugin.
+        if p.TestServer != nil {
+                p.TestServer.Stop()
+        }
+
+        // Check this since it's not automatically inserted during plugin creation.
+        // It's currently only inserted by the command package, because that is
+        // where the factory is built and is the only point with access to the
+        // plugin.Client.
+        if p.PluginClient == nil {
+                log.Println("[DEBUG] provider has no plugin.Client")
+                return nil
+        }
+
+        p.PluginClient.Kill()
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/grpc_provisioner.go b/vendor/github.com/hashicorp/terraform/plugin/grpc_provisioner.go
new file mode 100644
index 0000000..136c88d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/grpc_provisioner.go
@@ -0,0 +1,178 @@
+package plugin
+
+import (
+        "context"
+        "errors"
+        "io"
+        "log"
+        "sync"
+
+        plugin "github.com/hashicorp/go-plugin"
+        "github.com/hashicorp/terraform/configs/configschema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        "google.golang.org/grpc"
+)
+
+// GRPCProvisionerPlugin is the plugin.GRPCPlugin implementation.
+type GRPCProvisionerPlugin struct {
+        plugin.Plugin
+        GRPCProvisioner func() proto.ProvisionerServer
+}
+
+func (p *GRPCProvisionerPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
+        return &GRPCProvisioner{
+                client: proto.NewProvisionerClient(c),
+                ctx:    ctx,
+        }, nil
+}
+
+func (p *GRPCProvisionerPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
+        proto.RegisterProvisionerServer(s, p.GRPCProvisioner())
+        return nil
+}
+
+// provisioners.Interface grpc implementation
+type GRPCProvisioner struct {
+        // PluginClient provides a reference to the plugin.Client which controls the plugin process.
+        // This allows the GRPCProvider a way to shutdown the plugin process.
+        PluginClient *plugin.Client
+
+        client proto.ProvisionerClient
+        ctx    context.Context
+
+        // Cache the schema since we need it for serialization in each method call.
+        mu     sync.Mutex
+        schema *configschema.Block
+}
+
+func (p *GRPCProvisioner) GetSchema() (resp provisioners.GetSchemaResponse) {
+        p.mu.Lock()
+        defer p.mu.Unlock()
+
+        if p.schema != nil {
+                return provisioners.GetSchemaResponse{
+                        Provisioner: p.schema,
+                }
+        }
+
+        protoResp, err := p.client.GetSchema(p.ctx, new(proto.GetProvisionerSchema_Request))
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        if protoResp.Provisioner == nil {
+                resp.Diagnostics = resp.Diagnostics.Append(errors.New("missing provisioner schema"))
+                return resp
+        }
+
+        resp.Provisioner = convert.ProtoToConfigSchema(protoResp.Provisioner.Block)
+
+        p.schema = resp.Provisioner
+
+        return resp
+}
+
+func (p *GRPCProvisioner) ValidateProvisionerConfig(r provisioners.ValidateProvisionerConfigRequest) (resp provisioners.ValidateProvisionerConfigResponse) {
+        schema := p.GetSchema()
+        if schema.Diagnostics.HasErrors() {
+                resp.Diagnostics = resp.Diagnostics.Append(schema.Diagnostics)
+                return resp
+        }
+
+        mp, err := msgpack.Marshal(r.Config, schema.Provisioner.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ValidateProvisionerConfig_Request{
+                Config: &proto.DynamicValue{Msgpack: mp},
+        }
+        protoResp, err := p.client.ValidateProvisionerConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvisioner) ProvisionResource(r provisioners.ProvisionResourceRequest) (resp provisioners.ProvisionResourceResponse) {
+        schema := p.GetSchema()
+        if schema.Diagnostics.HasErrors() {
+                resp.Diagnostics = resp.Diagnostics.Append(schema.Diagnostics)
+                return resp
+        }
+
+        mp, err := msgpack.Marshal(r.Config, schema.Provisioner.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        // connection is always assumed to be a simple string map
+        connMP, err := msgpack.Marshal(r.Connection, cty.Map(cty.String))
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ProvisionResource_Request{
+                Config:     &proto.DynamicValue{Msgpack: mp},
+                Connection: &proto.DynamicValue{Msgpack: connMP},
+        }
+
+        outputClient, err := p.client.ProvisionResource(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        for {
+                rcv, err := outputClient.Recv()
+                if rcv != nil {
+                        r.UIOutput.Output(rcv.Output)
+                }
+                if err != nil {
+                        if err != io.EOF {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                        }
+                        break
+                }
+
+                if len(rcv.Diagnostics) > 0 {
+                        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(rcv.Diagnostics))
+                        break
+                }
+        }
+
+        return resp
+}
+
+func (p *GRPCProvisioner) Stop() error {
+        protoResp, err := p.client.Stop(p.ctx, &proto.Stop_Request{})
+        if err != nil {
+                return err
+        }
+        if protoResp.Error != "" {
+                return errors.New(protoResp.Error)
+        }
+        return nil
+}
+
+func (p *GRPCProvisioner) Close() error {
+        // check this since it's not automatically inserted during plugin creation
+        if p.PluginClient == nil {
+                log.Println("[DEBUG] provider has no plugin.Client")
+                return nil
+        }
+
+        p.PluginClient.Kill()
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/plugin.go b/vendor/github.com/hashicorp/terraform/plugin/plugin.go
index 00fa7b2..e4fb577 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/plugin.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/plugin.go
@@ -6,8 +6,9 @@ import (
 
 // See serve.go for serving plugins
 
-// PluginMap should be used by clients for the map of plugins.
-var PluginMap = map[string]plugin.Plugin{
-        "provider":    &ResourceProviderPlugin{},
-        "provisioner": &ResourceProvisionerPlugin{},
+var VersionedPlugins = map[int]plugin.PluginSet{
+        5: {
+                "provider":    &GRPCProviderPlugin{},
+                "provisioner": &GRPCProvisionerPlugin{},
+        },
 }
diff --git a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
index d6a433c..459661a 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
@@ -9,11 +9,14 @@ import (
 
 // ResourceProviderPlugin is the plugin.Plugin implementation.
 type ResourceProviderPlugin struct {
-        F func() terraform.ResourceProvider
+        ResourceProvider func() terraform.ResourceProvider
 }
 
 func (p *ResourceProviderPlugin) Server(b *plugin.MuxBroker) (interface{}, error) {
-        return &ResourceProviderServer{Broker: b, Provider: p.F()}, nil
+        return &ResourceProviderServer{
+                Broker:   b,
+                Provider: p.ResourceProvider(),
+        }, nil
 }
 
 func (p *ResourceProviderPlugin) Client(
diff --git a/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go b/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go
index 8fce9d8..f0cc341 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go
@@ -4,16 +4,20 @@ import (
         "net/rpc"
 
         "github.com/hashicorp/go-plugin"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
 // ResourceProvisionerPlugin is the plugin.Plugin implementation.
 type ResourceProvisionerPlugin struct {
-        F func() terraform.ResourceProvisioner
+        ResourceProvisioner func() terraform.ResourceProvisioner
 }
 
 func (p *ResourceProvisionerPlugin) Server(b *plugin.MuxBroker) (interface{}, error) {
-        return &ResourceProvisionerServer{Broker: b, Provisioner: p.F()}, nil
+        return &ResourceProvisionerServer{
+                Broker:      b,
+                Provisioner: p.ResourceProvisioner(),
+        }, nil
 }
 
 func (p *ResourceProvisionerPlugin) Client(
@@ -28,6 +32,11 @@ type ResourceProvisioner struct {
         Client *rpc.Client
 }
 
+func (p *ResourceProvisioner) GetConfigSchema() (*configschema.Block, error) {
+        panic("not implemented")
+        return nil, nil
+}
+
 func (p *ResourceProvisioner) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         var resp ResourceProvisionerValidateResponse
         args := ResourceProvisionerValidateArgs{
diff --git a/vendor/github.com/hashicorp/terraform/plugin/serve.go b/vendor/github.com/hashicorp/terraform/plugin/serve.go
index 2028a61..8d056c5 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/serve.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/serve.go
@@ -2,14 +2,23 @@ package plugin
 
 import (
         "github.com/hashicorp/go-plugin"
+        grpcplugin "github.com/hashicorp/terraform/helper/plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
         "github.com/hashicorp/terraform/terraform"
 )
 
-// The constants below are the names of the plugins that can be dispensed
-// from the plugin server.
 const (
+        // The constants below are the names of the plugins that can be dispensed
+        // from the plugin server.
         ProviderPluginName    = "provider"
         ProvisionerPluginName = "provisioner"
+
+        // DefaultProtocolVersion is the protocol version assumed for legacy clients that don't specify
+        // a particular version during their handshake. This is the version used when Terraform 0.10
+        // and 0.11 launch plugins that were built with support for both versions 4 and 5, and must
+        // stay unchanged at 4 until we intentionally build plugins that are not compatible with 0.10 and
+        // 0.11.
+        DefaultProtocolVersion = 4
 )
 
 // Handshake is the HandshakeConfig used to configure clients and servers.
@@ -19,7 +28,7 @@ var Handshake = plugin.HandshakeConfig{
         // one or the other that makes it so that they can't safely communicate.
         // This could be adding a new interface value, it could be how
         // helper/schema computes diffs, etc.
-        ProtocolVersion: 4,
+        ProtocolVersion: DefaultProtocolVersion,
 
         // The magic cookie values should NEVER be changed.
         MagicCookieKey:   "TF_PLUGIN_MAGIC_COOKIE",
@@ -28,27 +37,85 @@ var Handshake = plugin.HandshakeConfig{
 
 type ProviderFunc func() terraform.ResourceProvider
 type ProvisionerFunc func() terraform.ResourceProvisioner
+type GRPCProviderFunc func() proto.ProviderServer
+type GRPCProvisionerFunc func() proto.ProvisionerServer
 
 // ServeOpts are the configurations to serve a plugin.
 type ServeOpts struct {
         ProviderFunc    ProviderFunc
         ProvisionerFunc ProvisionerFunc
+
+        // Wrapped versions of the above plugins will automatically shimmed and
+        // added to the GRPC functions when possible.
+        GRPCProviderFunc    GRPCProviderFunc
+        GRPCProvisionerFunc GRPCProvisionerFunc
 }
 
 // Serve serves a plugin. This function never returns and should be the final
 // function called in the main function of the plugin.
 func Serve(opts *ServeOpts) {
+        // since the plugins may not yet be aware of the new protocol, we
+        // automatically wrap the plugins in the grpc shims.
+        if opts.GRPCProviderFunc == nil && opts.ProviderFunc != nil {
+                provider := grpcplugin.NewGRPCProviderServerShim(opts.ProviderFunc())
+                // this is almost always going to be a *schema.Provider, but check that
+                // we got back a valid provider just in case.
+                if provider != nil {
+                        opts.GRPCProviderFunc = func() proto.ProviderServer {
+                                return provider
+                        }
+                }
+        }
+        if opts.GRPCProvisionerFunc == nil && opts.ProvisionerFunc != nil {
+                provisioner := grpcplugin.NewGRPCProvisionerServerShim(opts.ProvisionerFunc())
+                if provisioner != nil {
+                        opts.GRPCProvisionerFunc = func() proto.ProvisionerServer {
+                                return provisioner
+                        }
+                }
+        }
+
         plugin.Serve(&plugin.ServeConfig{
-                HandshakeConfig: Handshake,
-                Plugins:         pluginMap(opts),
+                HandshakeConfig:  Handshake,
+                VersionedPlugins: pluginSet(opts),
+                GRPCServer:       plugin.DefaultGRPCServer,
         })
 }
 
-// pluginMap returns the map[string]plugin.Plugin to use for configuring a plugin
-// server or client.
-func pluginMap(opts *ServeOpts) map[string]plugin.Plugin {
+// pluginMap returns the legacy map[string]plugin.Plugin to use for configuring
+// a plugin server or client.
+func legacyPluginMap(opts *ServeOpts) map[string]plugin.Plugin {
         return map[string]plugin.Plugin{
-                "provider":    &ResourceProviderPlugin{F: opts.ProviderFunc},
-                "provisioner": &ResourceProvisionerPlugin{F: opts.ProvisionerFunc},
+                "provider": &ResourceProviderPlugin{
+                        ResourceProvider: opts.ProviderFunc,
+                },
+                "provisioner": &ResourceProvisionerPlugin{
+                        ResourceProvisioner: opts.ProvisionerFunc,
+                },
+        }
+}
+
+func pluginSet(opts *ServeOpts) map[int]plugin.PluginSet {
+        // Set the legacy netrpc plugins at version 4.
+        // The oldest version is returned in when executed by a legacy go-plugin
+        // client.
+        plugins := map[int]plugin.PluginSet{
+                4: legacyPluginMap(opts),
+        }
+
+        // add the new protocol versions if they're configured
+        if opts.GRPCProviderFunc != nil || opts.GRPCProvisionerFunc != nil {
+                plugins[5] = plugin.PluginSet{}
+                if opts.GRPCProviderFunc != nil {
+                        plugins[5]["provider"] = &GRPCProviderPlugin{
+                                GRPCProvider: opts.GRPCProviderFunc,
+                        }
+                }
+                if opts.GRPCProvisionerFunc != nil {
+                        plugins[5]["provisioner"] = &GRPCProvisionerPlugin{
+                                GRPCProvisioner: opts.GRPCProvisionerFunc,
+                        }
+                }
         }
+        return plugins
 }
diff --git a/vendor/github.com/hashicorp/terraform/plugin/ui_input.go b/vendor/github.com/hashicorp/terraform/plugin/ui_input.go
index 493efc0..3469e6a 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/ui_input.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/ui_input.go
@@ -1,19 +1,20 @@
 package plugin
 
 import (
+        "context"
         "net/rpc"
 
         "github.com/hashicorp/go-plugin"
         "github.com/hashicorp/terraform/terraform"
 )
 
-// UIInput is an implementatin of terraform.UIInput that communicates
+// UIInput is an implementation of terraform.UIInput that communicates
 // over RPC.
 type UIInput struct {
         Client *rpc.Client
 }
 
-func (i *UIInput) Input(opts *terraform.InputOpts) (string, error) {
+func (i *UIInput) Input(ctx context.Context, opts *terraform.InputOpts) (string, error) {
         var resp UIInputInputResponse
         err := i.Client.Call("Plugin.Input", opts, &resp)
         if err != nil {
@@ -41,7 +42,7 @@ type UIInputServer struct {
 func (s *UIInputServer) Input(
         opts *terraform.InputOpts,
         reply *UIInputInputResponse) error {
-        value, err := s.UIInput.Input(opts)
+        value, err := s.UIInput.Input(context.Background(), opts)
         *reply = UIInputInputResponse{
                 Value: value,
                 Error: plugin.NewBasicError(err),
diff --git a/vendor/github.com/hashicorp/terraform/providers/addressed_types.go b/vendor/github.com/hashicorp/terraform/providers/addressed_types.go
new file mode 100644
index 0000000..7ed523f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/addressed_types.go
@@ -0,0 +1,47 @@
+package providers
+
+import (
+        "sort"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// AddressedTypes is a helper that extracts all of the distinct provider
+// types from the given list of relative provider configuration addresses.
+func AddressedTypes(providerAddrs []addrs.ProviderConfig) []string {
+        if len(providerAddrs) == 0 {
+                return nil
+        }
+        m := map[string]struct{}{}
+        for _, addr := range providerAddrs {
+                m[addr.Type] = struct{}{}
+        }
+
+        names := make([]string, 0, len(m))
+        for typeName := range m {
+                names = append(names, typeName)
+        }
+
+        sort.Strings(names) // Stable result for tests
+        return names
+}
+
+// AddressedTypesAbs is a helper that extracts all of the distinct provider
+// types from the given list of absolute provider configuration addresses.
+func AddressedTypesAbs(providerAddrs []addrs.AbsProviderConfig) []string {
+        if len(providerAddrs) == 0 {
+                return nil
+        }
+        m := map[string]struct{}{}
+        for _, addr := range providerAddrs {
+                m[addr.ProviderConfig.Type] = struct{}{}
+        }
+
+        names := make([]string, 0, len(m))
+        for typeName := range m {
+                names = append(names, typeName)
+        }
+
+        sort.Strings(names) // Stable result for tests
+        return names
+}
diff --git a/vendor/github.com/hashicorp/terraform/providers/doc.go b/vendor/github.com/hashicorp/terraform/providers/doc.go
new file mode 100644
index 0000000..39aa1de
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/doc.go
@@ -0,0 +1,3 @@
+// Package providers contains the interface and primary types required to
+// implement a Terraform resource provider.
+package providers
diff --git a/vendor/github.com/hashicorp/terraform/providers/provider.go b/vendor/github.com/hashicorp/terraform/providers/provider.go
new file mode 100644
index 0000000..1aa08c2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/provider.go
@@ -0,0 +1,351 @@
+package providers
+
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Interface represents the set of methods required for a complete resource
+// provider plugin.
+type Interface interface {
+        // GetSchema returns the complete schema for the provider.
+        GetSchema() GetSchemaResponse
+
+        // PrepareProviderConfig allows the provider to validate the configuration
+        // values, and set or override any values with defaults.
+        PrepareProviderConfig(PrepareProviderConfigRequest) PrepareProviderConfigResponse
+
+        // ValidateResourceTypeConfig allows the provider to validate the resource
+        // configuration values.
+        ValidateResourceTypeConfig(ValidateResourceTypeConfigRequest) ValidateResourceTypeConfigResponse
+
+        // ValidateDataSource allows the provider to validate the data source
+        // configuration values.
+        ValidateDataSourceConfig(ValidateDataSourceConfigRequest) ValidateDataSourceConfigResponse
+
+        // UpgradeResourceState is called when the state loader encounters an
+        // instance state whose schema version is less than the one reported by the
+        // currently-used version of the corresponding provider, and the upgraded
+        // result is used for any further processing.
+        UpgradeResourceState(UpgradeResourceStateRequest) UpgradeResourceStateResponse
+
+        // Configure configures and initialized the provider.
+        Configure(ConfigureRequest) ConfigureResponse
+
+        // Stop is called when the provider should halt any in-flight actions.
+        //
+        // Stop should not block waiting for in-flight actions to complete. It
+        // should take any action it wants and return immediately acknowledging it
+        // has received the stop request. Terraform will not make any further API
+        // calls to the provider after Stop is called.
+        //
+        // The error returned, if non-nil, is assumed to mean that signaling the
+        // stop somehow failed and that the user should expect potentially waiting
+        // a longer period of time.
+        Stop() error
+
+        // ReadResource refreshes a resource and returns its current state.
+        ReadResource(ReadResourceRequest) ReadResourceResponse
+
+        // PlanResourceChange takes the current state and proposed state of a
+        // resource, and returns the planned final state.
+        PlanResourceChange(PlanResourceChangeRequest) PlanResourceChangeResponse
+
+        // ApplyResourceChange takes the planned state for a resource, which may
+        // yet contain unknown computed values, and applies the changes returning
+        // the final state.
+        ApplyResourceChange(ApplyResourceChangeRequest) ApplyResourceChangeResponse
+
+        // ImportResourceState requests that the given resource be imported.
+        ImportResourceState(ImportResourceStateRequest) ImportResourceStateResponse
+
+        // ReadDataSource returns the data source's current state.
+        ReadDataSource(ReadDataSourceRequest) ReadDataSourceResponse
+
+        // Close shuts down the plugin process if applicable.
+        Close() error
+}
+
+type GetSchemaResponse struct {
+        // Provider is the schema for the provider itself.
+        Provider Schema
+
+        // ResourceTypes map the resource type name to that type's schema.
+        ResourceTypes map[string]Schema
+
+        // DataSources maps the data source name to that data source's schema.
+        DataSources map[string]Schema
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+// Schema pairs a provider or resource schema with that schema's version.
+// This is used to be able to upgrade the schema in UpgradeResourceState.
+type Schema struct {
+        Version int64
+        Block   *configschema.Block
+}
+
+type PrepareProviderConfigRequest struct {
+        // Config is the raw configuration value for the provider.
+        Config cty.Value
+}
+
+type PrepareProviderConfigResponse struct {
+        // PreparedConfig is the configuration as prepared by the provider.
+        PreparedConfig cty.Value
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ValidateResourceTypeConfigRequest struct {
+        // TypeName is the name of the resource type to validate.
+        TypeName string
+
+        // Config is the configuration value to validate, which may contain unknown
+        // values.
+        Config cty.Value
+}
+
+type ValidateResourceTypeConfigResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ValidateDataSourceConfigRequest struct {
+        // TypeName is the name of the data source type to validate.
+        TypeName string
+
+        // Config is the configuration value to validate, which may contain unknown
+        // values.
+        Config cty.Value
+}
+
+type ValidateDataSourceConfigResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type UpgradeResourceStateRequest struct {
+        // TypeName is the name of the resource type being upgraded
+        TypeName string
+
+        // Version is version of the schema that created the current state.
+        Version int64
+
+        // RawStateJSON and RawStateFlatmap contiain the state that needs to be
+        // upgraded to match the current schema version. Because the schema is
+        // unknown, this contains only the raw data as stored in the state.
+        // RawStateJSON is the current json state encoding.
+        // RawStateFlatmap is the legacy flatmap encoding.
+        // Only on of these fields may be set for the upgrade request.
+        RawStateJSON    []byte
+        RawStateFlatmap map[string]string
+}
+
+type UpgradeResourceStateResponse struct {
+        // UpgradedState is the newly upgraded resource state.
+        UpgradedState cty.Value
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ConfigureRequest struct {
+        // Terraform version is the version string from the running instance of
+        // terraform. Providers can use TerraformVersion to verify compatibility,
+        // and to store for informational purposes.
+        TerraformVersion string
+
+        // Config is the complete configuration value for the provider.
+        Config cty.Value
+}
+
+type ConfigureResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ReadResourceRequest struct {
+        // TypeName is the name of the resource type being read.
+        TypeName string
+
+        // PriorState contains the previously saved state value for this resource.
+        PriorState cty.Value
+}
+
+type ReadResourceResponse struct {
+        // NewState contains the current state of the resource.
+        NewState cty.Value
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type PlanResourceChangeRequest struct {
+        // TypeName is the name of the resource type to plan.
+        TypeName string
+
+        // PriorState is the previously saved state value for this resource.
+        PriorState cty.Value
+
+        // ProposedNewState is the expected state after the new configuration is
+        // applied. This is created by directly applying the configuration to the
+        // PriorState. The provider is then responsible for applying any further
+        // changes required to create the proposed final state.
+        ProposedNewState cty.Value
+
+        // Config is the resource configuration, before being merged with the
+        // PriorState. Any value not explicitly set in the configuration will be
+        // null. Config is supplied for reference, but Provider implementations
+        // should prefer the ProposedNewState in most circumstances.
+        Config cty.Value
+
+        // PriorPrivate is the previously saved private data returned from the
+        // provider during the last apply.
+        PriorPrivate []byte
+}
+
+type PlanResourceChangeResponse struct {
+        // PlannedState is the expected state of the resource once the current
+        // configuration is applied.
+        PlannedState cty.Value
+
+        // RequiresReplace is the list of thee attributes that are requiring
+        // resource replacement.
+        RequiresReplace []cty.Path
+
+        // PlannedPrivate is an opaque blob that is not interpreted by terraform
+        // core. This will be saved and relayed back to the provider during
+        // ApplyResourceChange.
+        PlannedPrivate []byte
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+
+        // LegacyTypeSystem is set only if the provider is using the legacy SDK
+        // whose type system cannot be precisely mapped into the Terraform type
+        // system. We use this to bypass certain consistency checks that would
+        // otherwise fail due to this imprecise mapping. No other provider or SDK
+        // implementation is permitted to set this.
+        LegacyTypeSystem bool
+}
+
+type ApplyResourceChangeRequest struct {
+        // TypeName is the name of the resource type being applied.
+        TypeName string
+
+        // PriorState is the current state of resource.
+        PriorState cty.Value
+
+        // Planned state is the state returned from PlanResourceChange, and should
+        // represent the new state, minus any remaining computed attributes.
+        PlannedState cty.Value
+
+        // Config is the resource configuration, before being merged with the
+        // PriorState. Any value not explicitly set in the configuration will be
+        // null. Config is supplied for reference, but Provider implementations
+        // should prefer the PlannedState in most circumstances.
+        Config cty.Value
+
+        // PlannedPrivate is the same value as returned by PlanResourceChange.
+        PlannedPrivate []byte
+}
+
+type ApplyResourceChangeResponse struct {
+        // NewState is the new complete state after applying the planned change.
+        // In the event of an error, NewState should represent the most recent
+        // known state of the resource, if it exists.
+        NewState cty.Value
+
+        // Private is an opaque blob that will be stored in state along with the
+        // resource. It is intended only for interpretation by the provider itself.
+        Private []byte
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+
+        // LegacyTypeSystem is set only if the provider is using the legacy SDK
+        // whose type system cannot be precisely mapped into the Terraform type
+        // system. We use this to bypass certain consistency checks that would
+        // otherwise fail due to this imprecise mapping. No other provider or SDK
+        // implementation is permitted to set this.
+        LegacyTypeSystem bool
+}
+
+type ImportResourceStateRequest struct {
+        // TypeName is the name of the resource type to be imported.
+        TypeName string
+
+        // ID is a string with which the provider can identify the resource to be
+        // imported.
+        ID string
+}
+
+type ImportResourceStateResponse struct {
+        // ImportedResources contains one or more state values related to the
+        // imported resource. It is not required that these be complete, only that
+        // there is enough identifying information for the provider to successfully
+        // update the states in ReadResource.
+        ImportedResources []ImportedResource
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+// ImportedResource represents an object being imported into Terraform with the
+// help of a provider. An ImportedObject is a RemoteObject that has been read
+// by the provider's import handler but hasn't yet been committed to state.
+type ImportedResource struct {
+        // TypeName is the name of the resource type associated with the
+        // returned state. It's possible for providers to import multiple related
+        // types with a single import request.
+        TypeName string
+
+        // State is the state of the remote object being imported. This may not be
+        // complete, but must contain enough information to uniquely identify the
+        // resource.
+        State cty.Value
+
+        // Private is an opaque blob that will be stored in state along with the
+        // resource. It is intended only for interpretation by the provider itself.
+        Private []byte
+}
+
+// AsInstanceObject converts the receiving ImportedObject into a
+// ResourceInstanceObject that has status ObjectReady.
+//
+// The returned object does not know its own resource type, so the caller must
+// retain the ResourceType value from the source object if this information is
+// needed.
+//
+// The returned object also has no dependency addresses, but the caller may
+// freely modify the direct fields of the returned object without affecting
+// the receiver.
+func (ir ImportedResource) AsInstanceObject() *states.ResourceInstanceObject {
+        return &states.ResourceInstanceObject{
+                Status:  states.ObjectReady,
+                Value:   ir.State,
+                Private: ir.Private,
+        }
+}
+
+type ReadDataSourceRequest struct {
+        // TypeName is the name of the data source type to Read.
+        TypeName string
+
+        // Config is the complete configuration for the requested data source.
+        Config cty.Value
+}
+
+type ReadDataSourceResponse struct {
+        // State is the current state of the requested data source.
+        State cty.Value
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
diff --git a/vendor/github.com/hashicorp/terraform/providers/resolver.go b/vendor/github.com/hashicorp/terraform/providers/resolver.go
new file mode 100644
index 0000000..4de8e0a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/resolver.go
@@ -0,0 +1,112 @@
+package providers
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/plugin/discovery"
+)
+
+// Resolver is an interface implemented by objects that are able to resolve
+// a given set of resource provider version constraints into Factory
+// callbacks.
+type Resolver interface {
+        // Given a constraint map, return a Factory for each requested provider.
+        // If some or all of the constraints cannot be satisfied, return a non-nil
+        // slice of errors describing the problems.
+        ResolveProviders(reqd discovery.PluginRequirements) (map[string]Factory, []error)
+}
+
+// ResolverFunc wraps a callback function and turns it into a Resolver
+// implementation, for convenience in situations where a function and its
+// associated closure are sufficient as a resolver implementation.
+type ResolverFunc func(reqd discovery.PluginRequirements) (map[string]Factory, []error)
+
+// ResolveProviders implements Resolver by calling the
+// wrapped function.
+func (f ResolverFunc) ResolveProviders(reqd discovery.PluginRequirements) (map[string]Factory, []error) {
+        return f(reqd)
+}
+
+// ResolverFixed returns a Resolver that has a fixed set of provider factories
+// provided by the caller. The returned resolver ignores version constraints
+// entirely and just returns the given factory for each requested provider
+// name.
+//
+// This function is primarily used in tests, to provide mock providers or
+// in-process providers under test.
+func ResolverFixed(factories map[string]Factory) Resolver {
+        return ResolverFunc(func(reqd discovery.PluginRequirements) (map[string]Factory, []error) {
+                ret := make(map[string]Factory, len(reqd))
+                var errs []error
+                for name := range reqd {
+                        if factory, exists := factories[name]; exists {
+                                ret[name] = factory
+                        } else {
+                                errs = append(errs, fmt.Errorf("provider %q is not available", name))
+                        }
+                }
+                return ret, errs
+        })
+}
+
+// Factory is a function type that creates a new instance of a resource
+// provider, or returns an error if that is impossible.
+type Factory func() (Interface, error)
+
+// FactoryFixed is a helper that creates a Factory that just returns some given
+// single provider.
+//
+// Unlike usual factories, the exact same instance is returned for each call
+// to the factory and so this must be used in only specialized situations where
+// the caller can take care to either not mutate the given provider at all
+// or to mutate it in ways that will not cause unexpected behavior for others
+// holding the same reference.
+func FactoryFixed(p Interface) Factory {
+        return func() (Interface, error) {
+                return p, nil
+        }
+}
+
+// ProviderHasResource is a helper that requests schema from the given provider
+// and checks if it has a resource type of the given name.
+//
+// This function is more expensive than it may first appear since it must
+// retrieve the entire schema from the underlying provider, and so it should
+// be used sparingly and especially not in tight loops.
+//
+// Since retrieving the provider may fail (e.g. if the provider is accessed
+// over an RPC channel that has operational problems), this function will
+// return false if the schema cannot be retrieved, under the assumption that
+// a subsequent call to do anything with the resource type would fail
+// anyway.
+func ProviderHasResource(provider Interface, typeName string) bool {
+        resp := provider.GetSchema()
+        if resp.Diagnostics.HasErrors() {
+                return false
+        }
+
+        _, exists := resp.ResourceTypes[typeName]
+        return exists
+}
+
+// ProviderHasDataSource is a helper that requests schema from the given
+// provider and checks if it has a data source of the given name.
+//
+// This function is more expensive than it may first appear since it must
+// retrieve the entire schema from the underlying provider, and so it should
+// be used sparingly and especially not in tight loops.
+//
+// Since retrieving the provider may fail (e.g. if the provider is accessed
+// over an RPC channel that has operational problems), this function will
+// return false if the schema cannot be retrieved, under the assumption that
+// a subsequent call to do anything with the data source would fail
+// anyway.
+func ProviderHasDataSource(provider Interface, dataSourceName string) bool {
+        resp := provider.GetSchema()
+        if resp.Diagnostics.HasErrors() {
+                return false
+        }
+
+        _, exists := resp.DataSources[dataSourceName]
+        return exists
+}
diff --git a/vendor/github.com/hashicorp/terraform/provisioners/doc.go b/vendor/github.com/hashicorp/terraform/provisioners/doc.go
new file mode 100644
index 0000000..b03ba9a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/provisioners/doc.go
@@ -0,0 +1,3 @@
+// Package provisioners contains the interface and primary types to implement a
+// Terraform resource provisioner.
+package provisioners
diff --git a/vendor/github.com/hashicorp/terraform/provisioners/factory.go b/vendor/github.com/hashicorp/terraform/provisioners/factory.go
new file mode 100644
index 0000000..590b97a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/provisioners/factory.go
@@ -0,0 +1,19 @@
+package provisioners
+
+// Factory is a function type that creates a new instance of a resource
+// provisioner, or returns an error if that is impossible.
+type Factory func() (Interface, error)
+
+// FactoryFixed is a helper that creates a Factory that just returns some given
+// single provisioner.
+//
+// Unlike usual factories, the exact same instance is returned for each call
+// to the factory and so this must be used in only specialized situations where
+// the caller can take care to either not mutate the given provider at all
+// or to mutate it in ways that will not cause unexpected behavior for others
+// holding the same reference.
+func FactoryFixed(p Interface) Factory {
+        return func() (Interface, error) {
+                return p, nil
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/provisioners/provisioner.go b/vendor/github.com/hashicorp/terraform/provisioners/provisioner.go
new file mode 100644
index 0000000..e53c884
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/provisioners/provisioner.go
@@ -0,0 +1,82 @@
+package provisioners
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Interface is the set of methods required for a resource provisioner plugin.
+type Interface interface {
+        // GetSchema returns the schema for the provisioner configuration.
+        GetSchema() GetSchemaResponse
+
+        // ValidateProvisionerConfig allows the provisioner to validate the
+        // configuration values.
+        ValidateProvisionerConfig(ValidateProvisionerConfigRequest) ValidateProvisionerConfigResponse
+
+        // ProvisionResource runs the provisioner with provided configuration.
+        // ProvisionResource blocks until the execution is complete.
+        // If the returned diagnostics contain any errors, the resource will be
+        // left in a tainted state.
+        ProvisionResource(ProvisionResourceRequest) ProvisionResourceResponse
+
+        // Stop is called to interrupt the provisioner.
+        //
+        // Stop should not block waiting for in-flight actions to complete. It
+        // should take any action it wants and return immediately acknowledging it
+        // has received the stop request. Terraform will not make any further API
+        // calls to the provisioner after Stop is called.
+        //
+        // The error returned, if non-nil, is assumed to mean that signaling the
+        // stop somehow failed and that the user should expect potentially waiting
+        // a longer period of time.
+        Stop() error
+
+        // Close shuts down the plugin process if applicable.
+        Close() error
+}
+
+type GetSchemaResponse struct {
+        // Provisioner contains the schema for this provisioner.
+        Provisioner *configschema.Block
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+// UIOutput provides the Output method for resource provisioner
+// plugins to write any output to the UI.
+//
+// Provisioners may call the Output method multiple times while Apply is in
+// progress. It is invalid to call Output after Apply returns.
+type UIOutput interface {
+        Output(string)
+}
+
+type ValidateProvisionerConfigRequest struct {
+        // Config is the complete configuration to be used for the provisioner.
+        Config cty.Value
+}
+
+type ValidateProvisionerConfigResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ProvisionResourceRequest struct {
+        // Config is the complete provisioner configuration.
+        Config cty.Value
+
+        // Connection contains any information required to access the resource
+        // instance.
+        Connection cty.Value
+
+        // UIOutput is used to return output during the Apply operation.
+        UIOutput UIOutput
+}
+
+type ProvisionResourceResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/client.go b/vendor/github.com/hashicorp/terraform/registry/client.go
index a18e6b8..93424d1 100644
--- a/vendor/github.com/hashicorp/terraform/registry/client.go
+++ b/vendor/github.com/hashicorp/terraform/registry/client.go
@@ -20,10 +20,11 @@ import (
 )
 
 const (
-        xTerraformGet     = "X-Terraform-Get"
-        xTerraformVersion = "X-Terraform-Version"
-        requestTimeout    = 10 * time.Second
-        serviceID         = "modules.v1"
+        xTerraformGet      = "X-Terraform-Get"
+        xTerraformVersion  = "X-Terraform-Version"
+        requestTimeout     = 10 * time.Second
+        modulesServiceID   = "modules.v1"
+        providersServiceID = "providers.v1"
 )
 
 var tfVersion = version.String()
@@ -58,10 +59,10 @@ func NewClient(services *disco.Disco, client *http.Client) *Client {
 }
 
 // Discover queries the host, and returns the url for the registry.
-func (c *Client) Discover(host svchost.Hostname) (*url.URL, error) {
+func (c *Client) Discover(host svchost.Hostname, serviceID string) (*url.URL, error) {
         service, err := c.services.DiscoverServiceURL(host, serviceID)
         if err != nil {
-                return nil, err
+                return nil, &ServiceUnreachableError{err}
         }
         if !strings.HasSuffix(service.Path, "/") {
                 service.Path += "/"
@@ -69,14 +70,14 @@ func (c *Client) Discover(host svchost.Hostname) (*url.URL, error) {
         return service, nil
 }
 
-// Versions queries the registry for a module, and returns the available versions.
-func (c *Client) Versions(module *regsrc.Module) (*response.ModuleVersions, error) {
+// ModuleVersions queries the registry for a module, and returns the available versions.
+func (c *Client) ModuleVersions(module *regsrc.Module) (*response.ModuleVersions, error) {
         host, err := module.SvcHost()
         if err != nil {
                 return nil, err
         }
 
-        service, err := c.Discover(host)
+        service, err := c.Discover(host, modulesServiceID)
         if err != nil {
                 return nil, err
         }
@@ -141,15 +142,15 @@ func (c *Client) addRequestCreds(host svchost.Hostname, req *http.Request) {
         }
 }
 
-// Location find the download location for a specific version module.
+// ModuleLocation find the download location for a specific version module.
 // This returns a string, because the final location may contain special go-getter syntax.
-func (c *Client) Location(module *regsrc.Module, version string) (string, error) {
+func (c *Client) ModuleLocation(module *regsrc.Module, version string) (string, error) {
         host, err := module.SvcHost()
         if err != nil {
                 return "", err
         }
 
-        service, err := c.Discover(host)
+        service, err := c.Discover(host, modulesServiceID)
         if err != nil {
                 return "", err
         }
@@ -225,3 +226,118 @@ func (c *Client) Location(module *regsrc.Module, version string) (string, error)
 
         return location, nil
 }
+
+// TerraformProviderVersions queries the registry for a provider, and returns the available versions.
+func (c *Client) TerraformProviderVersions(provider *regsrc.TerraformProvider) (*response.TerraformProviderVersions, error) {
+        host, err := provider.SvcHost()
+        if err != nil {
+                return nil, err
+        }
+
+        service, err := c.Discover(host, providersServiceID)
+        if err != nil {
+                return nil, err
+        }
+
+        p, err := url.Parse(path.Join(provider.TerraformProvider(), "versions"))
+        if err != nil {
+                return nil, err
+        }
+
+        service = service.ResolveReference(p)
+
+        log.Printf("[DEBUG] fetching provider versions from %q", service)
+
+        req, err := http.NewRequest("GET", service.String(), nil)
+        if err != nil {
+                return nil, err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        switch resp.StatusCode {
+        case http.StatusOK:
+                // OK
+        case http.StatusNotFound:
+                return nil, &errProviderNotFound{addr: provider}
+        default:
+                return nil, fmt.Errorf("error looking up provider versions: %s", resp.Status)
+        }
+
+        var versions response.TerraformProviderVersions
+
+        dec := json.NewDecoder(resp.Body)
+        if err := dec.Decode(&versions); err != nil {
+                return nil, err
+        }
+
+        return &versions, nil
+}
+
+// TerraformProviderLocation queries the registry for a provider download metadata
+func (c *Client) TerraformProviderLocation(provider *regsrc.TerraformProvider, version string) (*response.TerraformProviderPlatformLocation, error) {
+        host, err := provider.SvcHost()
+        if err != nil {
+                return nil, err
+        }
+
+        service, err := c.Discover(host, providersServiceID)
+        if err != nil {
+                return nil, err
+        }
+
+        p, err := url.Parse(path.Join(
+                provider.TerraformProvider(),
+                version,
+                "download",
+                provider.OS,
+                provider.Arch,
+        ))
+        if err != nil {
+                return nil, err
+        }
+
+        service = service.ResolveReference(p)
+
+        log.Printf("[DEBUG] fetching provider location from %q", service)
+
+        req, err := http.NewRequest("GET", service.String(), nil)
+        if err != nil {
+                return nil, err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        var loc response.TerraformProviderPlatformLocation
+
+        dec := json.NewDecoder(resp.Body)
+        if err := dec.Decode(&loc); err != nil {
+                return nil, err
+        }
+
+        switch resp.StatusCode {
+        case http.StatusOK, http.StatusNoContent:
+                // OK
+        case http.StatusNotFound:
+                return nil, fmt.Errorf("provider %q version %q not found", provider.TerraformProvider(), version)
+        default:
+                // anything else is an error:
+                return nil, fmt.Errorf("error getting download location for %q: %s", provider.TerraformProvider(), resp.Status)
+        }
+
+        return &loc, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/errors.go b/vendor/github.com/hashicorp/terraform/registry/errors.go
index b8dcd31..5a6a31b 100644
--- a/vendor/github.com/hashicorp/terraform/registry/errors.go
+++ b/vendor/github.com/hashicorp/terraform/registry/errors.go
@@ -4,6 +4,7 @@ import (
         "fmt"
 
         "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/svchost/disco"
 )
 
 type errModuleNotFound struct {
@@ -21,3 +22,42 @@ func IsModuleNotFound(err error) bool {
         _, ok := err.(*errModuleNotFound)
         return ok
 }
+
+type errProviderNotFound struct {
+        addr *regsrc.TerraformProvider
+}
+
+func (e *errProviderNotFound) Error() string {
+        return fmt.Sprintf("provider %s not found", e.addr)
+}
+
+// IsProviderNotFound returns true only if the given error is a "provider not found"
+// error. This allows callers to recognize this particular error condition
+// as distinct from operational errors such as poor network connectivity.
+func IsProviderNotFound(err error) bool {
+        _, ok := err.(*errProviderNotFound)
+        return ok
+}
+
+// IsServiceNotProvided returns true only if the given error is a "service not provided"
+// error. This allows callers to recognize this particular error condition
+// as distinct from operational errors such as poor network connectivity.
+func IsServiceNotProvided(err error) bool {
+        _, ok := err.(*disco.ErrServiceNotProvided)
+        return ok
+}
+
+// ServiceUnreachableError Registry service is unreachable
+type ServiceUnreachableError struct {
+        err error
+}
+
+func (e *ServiceUnreachableError) Error() string {
+        return e.err.Error()
+}
+
+// IsServiceUnreachable returns true if the registry/discovery service was unreachable
+func IsServiceUnreachable(err error) bool {
+        _, ok := err.(*ServiceUnreachableError)
+        return ok
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/regsrc/terraform_provider.go b/vendor/github.com/hashicorp/terraform/registry/regsrc/terraform_provider.go
new file mode 100644
index 0000000..58dedee
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/regsrc/terraform_provider.go
@@ -0,0 +1,60 @@
+package regsrc
+
+import (
+        "fmt"
+        "runtime"
+        "strings"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+var (
+        // DefaultProviderNamespace represents the namespace for canonical
+        // HashiCorp-controlled providers.
+        DefaultProviderNamespace = "-"
+)
+
+// TerraformProvider describes a Terraform Registry Provider source.
+type TerraformProvider struct {
+        RawHost      *FriendlyHost
+        RawNamespace string
+        RawName      string
+        OS           string
+        Arch         string
+}
+
+// NewTerraformProvider constructs a new provider source.
+func NewTerraformProvider(name, os, arch string) *TerraformProvider {
+        if os == "" {
+                os = runtime.GOOS
+        }
+        if arch == "" {
+                arch = runtime.GOARCH
+        }
+
+        // separate namespace if included
+        namespace := DefaultProviderNamespace
+        if names := strings.SplitN(name, "/", 2); len(names) == 2 {
+                namespace, name = names[0], names[1]
+        }
+        p := &TerraformProvider{
+                RawHost:      PublicRegistryHost,
+                RawNamespace: namespace,
+                RawName:      name,
+                OS:           os,
+                Arch:         arch,
+        }
+
+        return p
+}
+
+// Provider returns just the registry ID of the provider
+func (p *TerraformProvider) TerraformProvider() string {
+        return fmt.Sprintf("%s/%s", p.RawNamespace, p.RawName)
+}
+
+// SvcHost returns the svchost.Hostname for this provider. The
+// default PublicRegistryHost is returned.
+func (p *TerraformProvider) SvcHost() (svchost.Hostname, error) {
+        return svchost.ForComparison(PublicRegistryHost.Raw)
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/provider.go b/vendor/github.com/hashicorp/terraform/registry/response/provider.go
new file mode 100644
index 0000000..5e8bae3
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/provider.go
@@ -0,0 +1,36 @@
+package response
+
+import (
+        "time"
+)
+
+// Provider is the response structure with the data for a single provider
+// version. This is just the metadata. A full provider response will be
+// ProviderDetail.
+type Provider struct {
+        ID string `json:"id"`
+
+        //---------------------------------------------------------------
+        // Metadata about the overall provider.
+
+        Owner       string    `json:"owner"`
+        Namespace   string    `json:"namespace"`
+        Name        string    `json:"name"`
+        Version     string    `json:"version"`
+        Description string    `json:"description"`
+        Source      string    `json:"source"`
+        PublishedAt time.Time `json:"published_at"`
+        Downloads   int       `json:"downloads"`
+}
+
+// ProviderDetail represents a Provider with full detail.
+type ProviderDetail struct {
+        Provider
+
+        //---------------------------------------------------------------
+        // The fields below are only set when requesting this specific
+        // module. They are available to easily know all available versions
+        // without multiple API calls.
+
+        Versions []string `json:"versions"` // All versions
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/provider_list.go b/vendor/github.com/hashicorp/terraform/registry/response/provider_list.go
new file mode 100644
index 0000000..1dc7d23
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/provider_list.go
@@ -0,0 +1,7 @@
+package response
+
+// ProviderList is the response structure for a pageable list of providers.
+type ProviderList struct {
+        Meta      PaginationMeta `json:"meta"`
+        Providers []*Provider    `json:"providers"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/terraform_provider.go b/vendor/github.com/hashicorp/terraform/registry/response/terraform_provider.go
new file mode 100644
index 0000000..64e454a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/terraform_provider.go
@@ -0,0 +1,96 @@
+package response
+
+import (
+        "sort"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+)
+
+// TerraformProvider is the response structure for all required information for
+// Terraform to choose a download URL. It must include all versions and all
+// platforms for Terraform to perform version and os/arch constraint matching
+// locally.
+type TerraformProvider struct {
+        ID       string `json:"id"`
+        Verified bool   `json:"verified"`
+
+        Versions []*TerraformProviderVersion `json:"versions"`
+}
+
+// TerraformProviderVersion is the Terraform-specific response structure for a
+// provider version.
+type TerraformProviderVersion struct {
+        Version   string   `json:"version"`
+        Protocols []string `json:"protocols"`
+
+        Platforms []*TerraformProviderPlatform `json:"platforms"`
+}
+
+// TerraformProviderVersions is the Terraform-specific response structure for an
+// array of provider versions
+type TerraformProviderVersions struct {
+        ID       string                      `json:"id"`
+        Versions []*TerraformProviderVersion `json:"versions"`
+        Warnings []string                    `json:"warnings"`
+}
+
+// TerraformProviderPlatform is the Terraform-specific response structure for a
+// provider platform.
+type TerraformProviderPlatform struct {
+        OS   string `json:"os"`
+        Arch string `json:"arch"`
+}
+
+// TerraformProviderPlatformLocation is the Terraform-specific response
+// structure for a provider platform with all details required to perform a
+// download.
+type TerraformProviderPlatformLocation struct {
+        Protocols           []string `json:"protocols"`
+        OS                  string   `json:"os"`
+        Arch                string   `json:"arch"`
+        Filename            string   `json:"filename"`
+        DownloadURL         string   `json:"download_url"`
+        ShasumsURL          string   `json:"shasums_url"`
+        ShasumsSignatureURL string   `json:"shasums_signature_url"`
+        Shasum              string   `json:"shasum"`
+
+        SigningKeys SigningKeyList `json:"signing_keys"`
+}
+
+// SigningKeyList is the response structure for a list of signing keys.
+type SigningKeyList struct {
+        GPGKeys []*GPGKey `json:"gpg_public_keys"`
+}
+
+// GPGKey is the response structure for a GPG key.
+type GPGKey struct {
+        ASCIIArmor string  `json:"ascii_armor"`
+        Source     string  `json:"source"`
+        SourceURL  *string `json:"source_url"`
+}
+
+// Collection type for TerraformProviderVersion
+type ProviderVersionCollection []*TerraformProviderVersion
+
+// GPGASCIIArmor returns an ASCII-armor-formatted string for all of the gpg
+// keys in the response.
+func (signingKeys *SigningKeyList) GPGASCIIArmor() string {
+        keys := []string{}
+
+        for _, gpgKey := range signingKeys.GPGKeys {
+                keys = append(keys, gpgKey.ASCIIArmor)
+        }
+
+        return strings.Join(keys, "\n")
+}
+
+// Sort sorts versions from newest to oldest.
+func (v ProviderVersionCollection) Sort() {
+        sort.Slice(v, func(i, j int) bool {
+                versionA, _ := version.NewVersion(v[i].Version)
+                versionB, _ := version.NewVersion(v[j].Version)
+
+                return versionA.GreaterThan(versionB)
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/doc.go b/vendor/github.com/hashicorp/terraform/states/doc.go
new file mode 100644
index 0000000..7dd74ac
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/doc.go
@@ -0,0 +1,3 @@
+// Package states contains the types that are used to represent Terraform
+// states.
+package states
diff --git a/vendor/github.com/hashicorp/terraform/states/eachmode_string.go b/vendor/github.com/hashicorp/terraform/states/eachmode_string.go
new file mode 100644
index 0000000..0dc7349
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/eachmode_string.go
@@ -0,0 +1,35 @@
+// Code generated by "stringer -type EachMode"; DO NOT EDIT.
+
+package states
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[NoEach-0]
+        _ = x[EachList-76]
+        _ = x[EachMap-77]
+}
+
+const (
+        _EachMode_name_0 = "NoEach"
+        _EachMode_name_1 = "EachListEachMap"
+)
+
+var (
+        _EachMode_index_1 = [...]uint8{0, 8, 15}
+)
+
+func (i EachMode) String() string {
+        switch {
+        case i == 0:
+                return _EachMode_name_0
+        case 76 <= i && i <= 77:
+                i -= 76
+                return _EachMode_name_1[_EachMode_index_1[i]:_EachMode_index_1[i+1]]
+        default:
+                return "EachMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_generation.go b/vendor/github.com/hashicorp/terraform/states/instance_generation.go
new file mode 100644
index 0000000..617ad4e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_generation.go
@@ -0,0 +1,24 @@
+package states
+
+// Generation is used to represent multiple objects in a succession of objects
+// represented by a single resource instance address. A resource instance can
+// have multiple generations over its lifetime due to object replacement
+// (when a change can't be applied without destroying and re-creating), and
+// multiple generations can exist at the same time when create_before_destroy
+// is used.
+//
+// A Generation value can either be the value of the variable "CurrentGen" or
+// a value of type DeposedKey. Generation values can be compared for equality
+// using "==" and used as map keys. The zero value of Generation (nil) is not
+// a valid generation and must not be used.
+type Generation interface {
+        generation()
+}
+
+// CurrentGen is the Generation representing the currently-active object for
+// a resource instance.
+var CurrentGen Generation
+
+type currentGen struct{}
+
+func (g currentGen) generation() {}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_object.go b/vendor/github.com/hashicorp/terraform/states/instance_object.go
new file mode 100644
index 0000000..1374c59
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_object.go
@@ -0,0 +1,120 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// ResourceInstanceObject is the local representation of a specific remote
+// object associated with a resource instance. In practice not all remote
+// objects are actually remote in the sense of being accessed over the network,
+// but this is the most common case.
+//
+// It is not valid to mutate a ResourceInstanceObject once it has been created.
+// Instead, create a new object and replace the existing one.
+type ResourceInstanceObject struct {
+        // Value is the object-typed value representing the remote object within
+        // Terraform.
+        Value cty.Value
+
+        // Private is an opaque value set by the provider when this object was
+        // last created or updated. Terraform Core does not use this value in
+        // any way and it is not exposed anywhere in the user interface, so
+        // a provider can use it for retaining any necessary private state.
+        Private []byte
+
+        // Status represents the "readiness" of the object as of the last time
+        // it was updated.
+        Status ObjectStatus
+
+        // Dependencies is a set of other addresses in the same module which
+        // this instance depended on when the given attributes were evaluated.
+        // This is used to construct the dependency relationships for an object
+        // whose configuration is no longer available, such as if it has been
+        // removed from configuration altogether, or is now deposed.
+        Dependencies []addrs.Referenceable
+}
+
+// ObjectStatus represents the status of a RemoteObject.
+type ObjectStatus rune
+
+//go:generate stringer -type ObjectStatus
+
+const (
+        // ObjectReady is an object status for an object that is ready to use.
+        ObjectReady ObjectStatus = 'R'
+
+        // ObjectTainted is an object status representing an object that is in
+        // an unrecoverable bad state due to a partial failure during a create,
+        // update, or delete operation. Since it cannot be moved into the
+        // ObjectRead state, a tainted object must be replaced.
+        ObjectTainted ObjectStatus = 'T'
+
+        // ObjectPlanned is a special object status used only for the transient
+        // placeholder objects we place into state during the refresh and plan
+        // walks to stand in for objects that will be created during apply.
+        //
+        // Any object of this status must have a corresponding change recorded
+        // in the current plan, whose value must then be used in preference to
+        // the value stored in state when evaluating expressions. A planned
+        // object stored in state will be incomplete if any of its attributes are
+        // not yet known, and the plan must be consulted in order to "see" those
+        // unknown values, because the state is not able to represent them.
+        ObjectPlanned ObjectStatus = 'P'
+)
+
+// Encode marshals the value within the receiver to produce a
+// ResourceInstanceObjectSrc ready to be written to a state file.
+//
+// The given type must be the implied type of the resource type schema, and
+// the given value must conform to it. It is important to pass the schema
+// type and not the object's own type so that dynamically-typed attributes
+// will be stored correctly. The caller must also provide the version number
+// of the schema that the given type was derived from, which will be recorded
+// in the source object so it can be used to detect when schema migration is
+// required on read.
+//
+// The returned object may share internal references with the receiver and
+// so the caller must not mutate the receiver any further once once this
+// method is called.
+func (o *ResourceInstanceObject) Encode(ty cty.Type, schemaVersion uint64) (*ResourceInstanceObjectSrc, error) {
+        // Our state serialization can't represent unknown values, so we convert
+        // them to nulls here. This is lossy, but nobody should be writing unknown
+        // values here and expecting to get them out again later.
+        //
+        // We get unknown values here while we're building out a "planned state"
+        // during the plan phase, but the value stored in the plan takes precedence
+        // for expression evaluation. The apply step should never produce unknown
+        // values, but if it does it's the responsibility of the caller to detect
+        // and raise an error about that.
+        val := cty.UnknownAsNull(o.Value)
+
+        src, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return &ResourceInstanceObjectSrc{
+                SchemaVersion: schemaVersion,
+                AttrsJSON:     src,
+                Private:       o.Private,
+                Status:        o.Status,
+                Dependencies:  o.Dependencies,
+        }, nil
+}
+
+// AsTainted returns a deep copy of the receiver with the status updated to
+// ObjectTainted.
+func (o *ResourceInstanceObject) AsTainted() *ResourceInstanceObject {
+        if o == nil {
+                // A nil object can't be tainted, but we'll allow this anyway to
+                // avoid a crash, since we presumably intend to eventually record
+                // the object has having been deleted anyway.
+                return nil
+        }
+        ret := o.DeepCopy()
+        ret.Status = ObjectTainted
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_object_src.go b/vendor/github.com/hashicorp/terraform/states/instance_object_src.go
new file mode 100644
index 0000000..6cb3c27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_object_src.go
@@ -0,0 +1,113 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+)
+
+// ResourceInstanceObjectSrc is a not-fully-decoded version of
+// ResourceInstanceObject. Decoding of it can be completed by first handling
+// any schema migration steps to get to the latest schema version and then
+// calling method Decode with the implied type of the latest schema.
+type ResourceInstanceObjectSrc struct {
+        // SchemaVersion is the resource-type-specific schema version number that
+        // was current when either AttrsJSON or AttrsFlat was encoded. Migration
+        // steps are required if this is less than the current version number
+        // reported by the corresponding provider.
+        SchemaVersion uint64
+
+        // AttrsJSON is a JSON-encoded representation of the object attributes,
+        // encoding the value (of the object type implied by the associated resource
+        // type schema) that represents this remote object in Terraform Language
+        // expressions, and is compared with configuration when producing a diff.
+        //
+        // This is retained in JSON format here because it may require preprocessing
+        // before decoding if, for example, the stored attributes are for an older
+        // schema version which the provider must upgrade before use. If the
+        // version is current, it is valid to simply decode this using the
+        // type implied by the current schema, without the need for the provider
+        // to perform an upgrade first.
+        //
+        // When writing a ResourceInstanceObject into the state, AttrsJSON should
+        // always be conformant to the current schema version and the current
+        // schema version should be recorded in the SchemaVersion field.
+        AttrsJSON []byte
+
+        // AttrsFlat is a legacy form of attributes used in older state file
+        // formats, and in the new state format for objects that haven't yet been
+        // upgraded. This attribute is mutually exclusive with Attrs: for any
+        // ResourceInstanceObject, only one of these attributes may be populated
+        // and the other must be nil.
+        //
+        // An instance object with this field populated should be upgraded to use
+        // Attrs at the earliest opportunity, since this legacy flatmap-based
+        // format will be phased out over time. AttrsFlat should not be used when
+        // writing new or updated objects to state; instead, callers must follow
+        // the recommendations in the AttrsJSON documentation above.
+        AttrsFlat map[string]string
+
+        // These fields all correspond to the fields of the same name on
+        // ResourceInstanceObject.
+        Private      []byte
+        Status       ObjectStatus
+        Dependencies []addrs.Referenceable
+}
+
+// Decode unmarshals the raw representation of the object attributes. Pass the
+// implied type of the corresponding resource type schema for correct operation.
+//
+// Before calling Decode, the caller must check that the SchemaVersion field
+// exactly equals the version number of the schema whose implied type is being
+// passed, or else the result is undefined.
+//
+// The returned object may share internal references with the receiver and
+// so the caller must not mutate the receiver any further once once this
+// method is called.
+func (os *ResourceInstanceObjectSrc) Decode(ty cty.Type) (*ResourceInstanceObject, error) {
+        var val cty.Value
+        var err error
+        if os.AttrsFlat != nil {
+                // Legacy mode. We'll do our best to unpick this from the flatmap.
+                val, err = hcl2shim.HCL2ValueFromFlatmap(os.AttrsFlat, ty)
+                if err != nil {
+                        return nil, err
+                }
+        } else {
+                val, err = ctyjson.Unmarshal(os.AttrsJSON, ty)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        return &ResourceInstanceObject{
+                Value:        val,
+                Status:       os.Status,
+                Dependencies: os.Dependencies,
+                Private:      os.Private,
+        }, nil
+}
+
+// CompleteUpgrade creates a new ResourceInstanceObjectSrc by copying the
+// metadata from the receiver and writing in the given new schema version
+// and attribute value that are presumed to have resulted from upgrading
+// from an older schema version.
+func (os *ResourceInstanceObjectSrc) CompleteUpgrade(newAttrs cty.Value, newType cty.Type, newSchemaVersion uint64) (*ResourceInstanceObjectSrc, error) {
+        new := os.DeepCopy()
+        new.AttrsFlat = nil // We always use JSON after an upgrade, even if the source used flatmap
+
+        // This is the same principle as ResourceInstanceObject.Encode, but
+        // avoiding a decode/re-encode cycle because we don't have type info
+        // available for the "old" attributes.
+        newAttrs = cty.UnknownAsNull(newAttrs)
+        src, err := ctyjson.Marshal(newAttrs, newType)
+        if err != nil {
+                return nil, err
+        }
+
+        new.AttrsJSON = src
+        new.SchemaVersion = newSchemaVersion
+        return new, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/module.go b/vendor/github.com/hashicorp/terraform/states/module.go
new file mode 100644
index 0000000..d89e787
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/module.go
@@ -0,0 +1,285 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Module is a container for the states of objects within a particular module.
+type Module struct {
+        Addr addrs.ModuleInstance
+
+        // Resources contains the state for each resource. The keys in this map are
+        // an implementation detail and must not be used by outside callers.
+        Resources map[string]*Resource
+
+        // OutputValues contains the state for each output value. The keys in this
+        // map are output value names.
+        OutputValues map[string]*OutputValue
+
+        // LocalValues contains the value for each named output value. The keys
+        // in this map are local value names.
+        LocalValues map[string]cty.Value
+}
+
+// NewModule constructs an empty module state for the given module address.
+func NewModule(addr addrs.ModuleInstance) *Module {
+        return &Module{
+                Addr:         addr,
+                Resources:    map[string]*Resource{},
+                OutputValues: map[string]*OutputValue{},
+                LocalValues:  map[string]cty.Value{},
+        }
+}
+
+// Resource returns the state for the resource with the given address within
+// the receiving module state, or nil if the requested resource is not tracked
+// in the state.
+func (ms *Module) Resource(addr addrs.Resource) *Resource {
+        return ms.Resources[addr.String()]
+}
+
+// ResourceInstance returns the state for the resource instance with the given
+// address within the receiving module state, or nil if the requested instance
+// is not tracked in the state.
+func (ms *Module) ResourceInstance(addr addrs.ResourceInstance) *ResourceInstance {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return nil
+        }
+        return rs.Instance(addr.Key)
+}
+
+// SetResourceMeta updates the resource-level metadata for the resource
+// with the given address, creating the resource state for it if it doesn't
+// already exist.
+func (ms *Module) SetResourceMeta(addr addrs.Resource, eachMode EachMode, provider addrs.AbsProviderConfig) {
+        rs := ms.Resource(addr)
+        if rs == nil {
+                rs = &Resource{
+                        Addr:      addr,
+                        Instances: map[addrs.InstanceKey]*ResourceInstance{},
+                }
+                ms.Resources[addr.String()] = rs
+        }
+
+        rs.EachMode = eachMode
+        rs.ProviderConfig = provider
+}
+
+// RemoveResource removes the entire state for the given resource, taking with
+// it any instances associated with the resource. This should generally be
+// called only for resource objects whose instances have all been destroyed.
+func (ms *Module) RemoveResource(addr addrs.Resource) {
+        delete(ms.Resources, addr.String())
+}
+
+// SetResourceInstanceCurrent saves the given instance object as the current
+// generation of the resource instance with the given address, simulataneously
+// updating the recorded provider configuration address, dependencies, and
+// resource EachMode.
+//
+// Any existing current instance object for the given resource is overwritten.
+// Set obj to nil to remove the primary generation object altogether. If there
+// are no deposed objects then the instance will be removed altogether.
+//
+// The provider address and "each mode" are resource-wide settings and so they
+// are updated for all other instances of the same resource as a side-effect of
+// this call.
+func (ms *Module) SetResourceInstanceCurrent(addr addrs.ResourceInstance, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        ms.SetResourceMeta(addr.Resource, eachModeForInstanceKey(addr.Key), provider)
+
+        rs := ms.Resource(addr.Resource)
+        is := rs.EnsureInstance(addr.Key)
+
+        is.Current = obj
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// SetResourceInstanceDeposed saves the given instance object as a deposed
+// generation of the resource instance with the given address and deposed key.
+//
+// Call this method only for pre-existing deposed objects that already have
+// a known DeposedKey. For example, this method is useful if reloading objects
+// that were persisted to a state file. To mark the current object as deposed,
+// use DeposeResourceInstanceObject instead.
+//
+// The resource that contains the given instance must already exist in the
+// state, or this method will panic. Use Resource to check first if its
+// presence is not already guaranteed.
+//
+// Any existing current instance object for the given resource and deposed key
+// is overwritten. Set obj to nil to remove the deposed object altogether. If
+// the instance is left with no objects after this operation then it will
+// be removed from its containing resource altogether.
+func (ms *Module) SetResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        ms.SetResourceMeta(addr.Resource, eachModeForInstanceKey(addr.Key), provider)
+
+        rs := ms.Resource(addr.Resource)
+        is := rs.EnsureInstance(addr.Key)
+        if obj != nil {
+                is.Deposed[key] = obj
+        } else {
+                delete(is.Deposed, key)
+        }
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// ForgetResourceInstanceAll removes the record of all objects associated with
+// the specified resource instance, if present. If not present, this is a no-op.
+func (ms *Module) ForgetResourceInstanceAll(addr addrs.ResourceInstance) {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return
+        }
+        delete(rs.Instances, addr.Key)
+
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// ForgetResourceInstanceDeposed removes the record of the deposed object with
+// the given address and key, if present. If not present, this is a no-op.
+func (ms *Module) ForgetResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey) {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return
+        }
+        is := rs.Instance(addr.Key)
+        if is == nil {
+                return
+        }
+        delete(is.Deposed, key)
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// deposeResourceInstanceObject is the real implementation of
+// SyncState.DeposeResourceInstanceObject.
+func (ms *Module) deposeResourceInstanceObject(addr addrs.ResourceInstance, forceKey DeposedKey) DeposedKey {
+        is := ms.ResourceInstance(addr)
+        if is == nil {
+                return NotDeposed
+        }
+        return is.deposeCurrentObject(forceKey)
+}
+
+// maybeRestoreResourceInstanceDeposed is the real implementation of
+// SyncState.MaybeRestoreResourceInstanceDeposed.
+func (ms *Module) maybeRestoreResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey) bool {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return false
+        }
+        is := rs.Instance(addr.Key)
+        if is == nil {
+                return false
+        }
+        if is.Current != nil {
+                return false
+        }
+        if len(is.Deposed) == 0 {
+                return false
+        }
+        is.Current = is.Deposed[key]
+        delete(is.Deposed, key)
+        return true
+}
+
+// SetOutputValue writes an output value into the state, overwriting any
+// existing value of the same name.
+func (ms *Module) SetOutputValue(name string, value cty.Value, sensitive bool) *OutputValue {
+        os := &OutputValue{
+                Value:     value,
+                Sensitive: sensitive,
+        }
+        ms.OutputValues[name] = os
+        return os
+}
+
+// RemoveOutputValue removes the output value of the given name from the state,
+// if it exists. This method is a no-op if there is no value of the given
+// name.
+func (ms *Module) RemoveOutputValue(name string) {
+        delete(ms.OutputValues, name)
+}
+
+// SetLocalValue writes a local value into the state, overwriting any
+// existing value of the same name.
+func (ms *Module) SetLocalValue(name string, value cty.Value) {
+        ms.LocalValues[name] = value
+}
+
+// RemoveLocalValue removes the local value of the given name from the state,
+// if it exists. This method is a no-op if there is no value of the given
+// name.
+func (ms *Module) RemoveLocalValue(name string) {
+        delete(ms.LocalValues, name)
+}
+
+// PruneResourceHusks is a specialized method that will remove any Resource
+// objects that do not contain any instances, even if they have an EachMode.
+//
+// You probably shouldn't call this! See the method of the same name on
+// type State for more information on what this is for and the rare situations
+// where it is safe to use.
+func (ms *Module) PruneResourceHusks() {
+        for _, rs := range ms.Resources {
+                if len(rs.Instances) == 0 {
+                        ms.RemoveResource(rs.Addr)
+                }
+        }
+}
+
+// empty returns true if the receving module state is contributing nothing
+// to the state. In other words, it returns true if the module could be
+// removed from the state altogether without changing the meaning of the state.
+//
+// In practice a module containing no objects is the same as a non-existent
+// module, and so we can opportunistically clean up once a module becomes
+// empty on the assumption that it will be re-added if needed later.
+func (ms *Module) empty() bool {
+        if ms == nil {
+                return true
+        }
+
+        // This must be updated to cover any new collections added to Module
+        // in future.
+        return (len(ms.Resources) == 0 &&
+                len(ms.OutputValues) == 0 &&
+                len(ms.LocalValues) == 0)
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go b/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go
new file mode 100644
index 0000000..96a6db2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go
@@ -0,0 +1,33 @@
+// Code generated by "stringer -type ObjectStatus"; DO NOT EDIT.
+
+package states
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ObjectReady-82]
+        _ = x[ObjectTainted-84]
+        _ = x[ObjectPlanned-80]
+}
+
+const (
+        _ObjectStatus_name_0 = "ObjectPlanned"
+        _ObjectStatus_name_1 = "ObjectReady"
+        _ObjectStatus_name_2 = "ObjectTainted"
+)
+
+func (i ObjectStatus) String() string {
+        switch {
+        case i == 80:
+                return _ObjectStatus_name_0
+        case i == 82:
+                return _ObjectStatus_name_1
+        case i == 84:
+                return _ObjectStatus_name_2
+        default:
+                return "ObjectStatus(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/output_value.go b/vendor/github.com/hashicorp/terraform/states/output_value.go
new file mode 100644
index 0000000..d232b76
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/output_value.go
@@ -0,0 +1,14 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// OutputValue represents the state of a particular output value.
+//
+// It is not valid to mutate an OutputValue object once it has been created.
+// Instead, create an entirely new OutputValue to replace the previous one.
+type OutputValue struct {
+        Value     cty.Value
+        Sensitive bool
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/resource.go b/vendor/github.com/hashicorp/terraform/states/resource.go
new file mode 100644
index 0000000..e2a2b85
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/resource.go
@@ -0,0 +1,239 @@
+package states
+
+import (
+        "fmt"
+        "math/rand"
+        "time"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Resource represents the state of a resource.
+type Resource struct {
+        // Addr is the module-relative address for the resource this state object
+        // belongs to.
+        Addr addrs.Resource
+
+        // EachMode is the multi-instance mode currently in use for this resource,
+        // or NoEach if this is a single-instance resource. This dictates what
+        // type of value is returned when accessing this resource via expressions
+        // in the Terraform language.
+        EachMode EachMode
+
+        // Instances contains the potentially-multiple instances associated with
+        // this resource. This map can contain a mixture of different key types,
+        // but only the ones of InstanceKeyType are considered current.
+        Instances map[addrs.InstanceKey]*ResourceInstance
+
+        // ProviderConfig is the absolute address for the provider configuration that
+        // most recently managed this resource. This is used to connect a resource
+        // with a provider configuration when the resource configuration block is
+        // not available, such as if it has been removed from configuration
+        // altogether.
+        ProviderConfig addrs.AbsProviderConfig
+}
+
+// Instance returns the state for the instance with the given key, or nil
+// if no such instance is tracked within the state.
+func (rs *Resource) Instance(key addrs.InstanceKey) *ResourceInstance {
+        return rs.Instances[key]
+}
+
+// EnsureInstance returns the state for the instance with the given key,
+// creating a new empty state for it if one doesn't already exist.
+//
+// Because this may create and save a new state, it is considered to be
+// a write operation.
+func (rs *Resource) EnsureInstance(key addrs.InstanceKey) *ResourceInstance {
+        ret := rs.Instance(key)
+        if ret == nil {
+                ret = NewResourceInstance()
+                rs.Instances[key] = ret
+        }
+        return ret
+}
+
+// ResourceInstance represents the state of a particular instance of a resource.
+type ResourceInstance struct {
+        // Current, if non-nil, is the remote object that is currently represented
+        // by the corresponding resource instance.
+        Current *ResourceInstanceObjectSrc
+
+        // Deposed, if len > 0, contains any remote objects that were previously
+        // represented by the corresponding resource instance but have been
+        // replaced and are pending destruction due to the create_before_destroy
+        // lifecycle mode.
+        Deposed map[DeposedKey]*ResourceInstanceObjectSrc
+}
+
+// NewResourceInstance constructs and returns a new ResourceInstance, ready to
+// use.
+func NewResourceInstance() *ResourceInstance {
+        return &ResourceInstance{
+                Deposed: map[DeposedKey]*ResourceInstanceObjectSrc{},
+        }
+}
+
+// HasCurrent returns true if this resource instance has a "current"-generation
+// object. Most instances do, but this can briefly be false during a
+// create-before-destroy replace operation when the current has been deposed
+// but its replacement has not yet been created.
+func (i *ResourceInstance) HasCurrent() bool {
+        return i != nil && i.Current != nil
+}
+
+// HasDeposed returns true if this resource instance has a deposed object
+// with the given key.
+func (i *ResourceInstance) HasDeposed(key DeposedKey) bool {
+        return i != nil && i.Deposed[key] != nil
+}
+
+// HasAnyDeposed returns true if this resource instance has one or more
+// deposed objects.
+func (i *ResourceInstance) HasAnyDeposed() bool {
+        return i != nil && len(i.Deposed) > 0
+}
+
+// HasObjects returns true if this resource has any objects at all, whether
+// current or deposed.
+func (i *ResourceInstance) HasObjects() bool {
+        return i.Current != nil || len(i.Deposed) != 0
+}
+
+// deposeCurrentObject is part of the real implementation of
+// SyncState.DeposeResourceInstanceObject. The exported method uses a lock
+// to ensure that we can safely allocate an unused deposed key without
+// collision.
+func (i *ResourceInstance) deposeCurrentObject(forceKey DeposedKey) DeposedKey {
+        if !i.HasCurrent() {
+                return NotDeposed
+        }
+
+        key := forceKey
+        if key == NotDeposed {
+                key = i.findUnusedDeposedKey()
+        } else {
+                if _, exists := i.Deposed[key]; exists {
+                        panic(fmt.Sprintf("forced key %s is already in use", forceKey))
+                }
+        }
+        i.Deposed[key] = i.Current
+        i.Current = nil
+        return key
+}
+
+// GetGeneration retrieves the object of the given generation from the
+// ResourceInstance, or returns nil if there is no such object.
+//
+// If the given generation is nil or invalid, this method will panic.
+func (i *ResourceInstance) GetGeneration(gen Generation) *ResourceInstanceObjectSrc {
+        if gen == CurrentGen {
+                return i.Current
+        }
+        if dk, ok := gen.(DeposedKey); ok {
+                return i.Deposed[dk]
+        }
+        if gen == nil {
+                panic(fmt.Sprintf("get with nil Generation"))
+        }
+        // Should never fall out here, since the above covers all possible
+        // Generation values.
+        panic(fmt.Sprintf("get invalid Generation %#v", gen))
+}
+
+// FindUnusedDeposedKey generates a unique DeposedKey that is guaranteed not to
+// already be in use for this instance at the time of the call.
+//
+// Note that the validity of this result may change if new deposed keys are
+// allocated before it is used. To avoid this risk, instead use the
+// DeposeResourceInstanceObject method on the SyncState wrapper type, which
+// allocates a key and uses it atomically.
+func (i *ResourceInstance) FindUnusedDeposedKey() DeposedKey {
+        return i.findUnusedDeposedKey()
+}
+
+// findUnusedDeposedKey generates a unique DeposedKey that is guaranteed not to
+// already be in use for this instance.
+func (i *ResourceInstance) findUnusedDeposedKey() DeposedKey {
+        for {
+                key := NewDeposedKey()
+                if _, exists := i.Deposed[key]; !exists {
+                        return key
+                }
+                // Spin until we find a unique one. This shouldn't take long, because
+                // we have a 32-bit keyspace and there's rarely more than one deposed
+                // instance.
+        }
+}
+
+// EachMode specifies the multi-instance mode for a resource.
+type EachMode rune
+
+const (
+        NoEach   EachMode = 0
+        EachList EachMode = 'L'
+        EachMap  EachMode = 'M'
+)
+
+//go:generate stringer -type EachMode
+
+func eachModeForInstanceKey(key addrs.InstanceKey) EachMode {
+        switch key.(type) {
+        case addrs.IntKey:
+                return EachList
+        case addrs.StringKey:
+                return EachMap
+        default:
+                if key == addrs.NoKey {
+                        return NoEach
+                }
+                panic(fmt.Sprintf("don't know an each mode for instance key %#v", key))
+        }
+}
+
+// DeposedKey is a 8-character hex string used to uniquely identify deposed
+// instance objects in the state.
+type DeposedKey string
+
+// NotDeposed is a special invalid value of DeposedKey that is used to represent
+// the absense of a deposed key. It must not be used as an actual deposed key.
+const NotDeposed = DeposedKey("")
+
+var deposedKeyRand = rand.New(rand.NewSource(time.Now().UnixNano()))
+
+// NewDeposedKey generates a pseudo-random deposed key. Because of the short
+// length of these keys, uniqueness is not a natural consequence and so the
+// caller should test to see if the generated key is already in use and generate
+// another if so, until a unique key is found.
+func NewDeposedKey() DeposedKey {
+        v := deposedKeyRand.Uint32()
+        return DeposedKey(fmt.Sprintf("%08x", v))
+}
+
+func (k DeposedKey) String() string {
+        return string(k)
+}
+
+func (k DeposedKey) GoString() string {
+        ks := string(k)
+        switch {
+        case ks == "":
+                return "states.NotDeposed"
+        default:
+                return fmt.Sprintf("states.DeposedKey(%s)", ks)
+        }
+}
+
+// Generation is a helper method to convert a DeposedKey into a Generation.
+// If the reciever is anything other than NotDeposed then the result is
+// just the same value as a Generation. If the receiver is NotDeposed then
+// the result is CurrentGen.
+func (k DeposedKey) Generation() Generation {
+        if k == NotDeposed {
+                return CurrentGen
+        }
+        return k
+}
+
+// generation is an implementation of Generation.
+func (k DeposedKey) generation() {}
diff --git a/vendor/github.com/hashicorp/terraform/states/state.go b/vendor/github.com/hashicorp/terraform/states/state.go
new file mode 100644
index 0000000..1f84235
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state.go
@@ -0,0 +1,229 @@
+package states
+
+import (
+        "sort"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// State is the top-level type of a Terraform state.
+//
+// A state should be mutated only via its accessor methods, to ensure that
+// invariants are preserved.
+//
+// Access to State and the nested values within it is not concurrency-safe,
+// so when accessing a State object concurrently it is the caller's
+// responsibility to ensure that only one write is in progress at a time
+// and that reads only occur when no write is in progress. The most common
+// way to acheive this is to wrap the State in a SyncState and use the
+// higher-level atomic operations supported by that type.
+type State struct {
+        // Modules contains the state for each module. The keys in this map are
+        // an implementation detail and must not be used by outside callers.
+        Modules map[string]*Module
+}
+
+// NewState constructs a minimal empty state, containing an empty root module.
+func NewState() *State {
+        modules := map[string]*Module{}
+        modules[addrs.RootModuleInstance.String()] = NewModule(addrs.RootModuleInstance)
+        return &State{
+                Modules: modules,
+        }
+}
+
+// BuildState is a helper -- primarily intended for tests -- to build a state
+// using imperative code against the StateSync type while still acting as
+// an expression of type *State to assign into a containing struct.
+func BuildState(cb func(*SyncState)) *State {
+        s := NewState()
+        cb(s.SyncWrapper())
+        return s
+}
+
+// Empty returns true if there are no resources or populated output values
+// in the receiver. In other words, if this state could be safely replaced
+// with the return value of NewState and be functionally equivalent.
+func (s *State) Empty() bool {
+        if s == nil {
+                return true
+        }
+        for _, ms := range s.Modules {
+                if len(ms.Resources) != 0 {
+                        return false
+                }
+                if len(ms.OutputValues) != 0 {
+                        return false
+                }
+        }
+        return true
+}
+
+// Module returns the state for the module with the given address, or nil if
+// the requested module is not tracked in the state.
+func (s *State) Module(addr addrs.ModuleInstance) *Module {
+        if s == nil {
+                panic("State.Module on nil *State")
+        }
+        return s.Modules[addr.String()]
+}
+
+// RemoveModule removes the module with the given address from the state,
+// unless it is the root module. The root module cannot be deleted, and so
+// this method will panic if that is attempted.
+//
+// Removing a module implicitly discards all of the resources, outputs and
+// local values within it, and so this should usually be done only for empty
+// modules. For callers accessing the state through a SyncState wrapper, modules
+// are automatically pruned if they are empty after one of their contained
+// elements is removed.
+func (s *State) RemoveModule(addr addrs.ModuleInstance) {
+        if addr.IsRoot() {
+                panic("attempted to remove root module")
+        }
+
+        delete(s.Modules, addr.String())
+}
+
+// RootModule is a convenient alias for Module(addrs.RootModuleInstance).
+func (s *State) RootModule() *Module {
+        if s == nil {
+                panic("RootModule called on nil State")
+        }
+        return s.Modules[addrs.RootModuleInstance.String()]
+}
+
+// EnsureModule returns the state for the module with the given address,
+// creating and adding a new one if necessary.
+//
+// Since this might modify the state to add a new instance, it is considered
+// to be a write operation.
+func (s *State) EnsureModule(addr addrs.ModuleInstance) *Module {
+        ms := s.Module(addr)
+        if ms == nil {
+                ms = NewModule(addr)
+                s.Modules[addr.String()] = ms
+        }
+        return ms
+}
+
+// HasResources returns true if there is at least one resource (of any mode)
+// present in the receiving state.
+func (s *State) HasResources() bool {
+        if s == nil {
+                return false
+        }
+        for _, ms := range s.Modules {
+                if len(ms.Resources) > 0 {
+                        return true
+                }
+        }
+        return false
+}
+
+// Resource returns the state for the resource with the given address, or nil
+// if no such resource is tracked in the state.
+func (s *State) Resource(addr addrs.AbsResource) *Resource {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.Resource(addr.Resource)
+}
+
+// ResourceInstance returns the state for the resource instance with the given
+// address, or nil if no such resource is tracked in the state.
+func (s *State) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstance {
+        if s == nil {
+                panic("State.ResourceInstance on nil *State")
+        }
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.ResourceInstance(addr.Resource)
+}
+
+// OutputValue returns the state for the output value with the given address,
+// or nil if no such output value is tracked in the state.
+func (s *State) OutputValue(addr addrs.AbsOutputValue) *OutputValue {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.OutputValues[addr.OutputValue.Name]
+}
+
+// LocalValue returns the value of the named local value with the given address,
+// or cty.NilVal if no such value is tracked in the state.
+func (s *State) LocalValue(addr addrs.AbsLocalValue) cty.Value {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return cty.NilVal
+        }
+        return ms.LocalValues[addr.LocalValue.Name]
+}
+
+// ProviderAddrs returns a list of all of the provider configuration addresses
+// referenced throughout the receiving state.
+//
+// The result is de-duplicated so that each distinct address appears only once.
+func (s *State) ProviderAddrs() []addrs.AbsProviderConfig {
+        if s == nil {
+                return nil
+        }
+
+        m := map[string]addrs.AbsProviderConfig{}
+        for _, ms := range s.Modules {
+                for _, rc := range ms.Resources {
+                        m[rc.ProviderConfig.String()] = rc.ProviderConfig
+                }
+        }
+        if len(m) == 0 {
+                return nil
+        }
+
+        // This is mainly just so we'll get stable results for testing purposes.
+        keys := make([]string, 0, len(m))
+        for k := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        ret := make([]addrs.AbsProviderConfig, len(keys))
+        for i, key := range keys {
+                ret[i] = m[key]
+        }
+
+        return ret
+}
+
+// PruneResourceHusks is a specialized method that will remove any Resource
+// objects that do not contain any instances, even if they have an EachMode.
+//
+// This should generally be used only after a "terraform destroy" operation,
+// to finalize the cleanup of the state. It is not correct to use this after
+// other operations because if a resource has "count = 0" or "for_each" over
+// an empty collection then we want to retain it in the state so that references
+// to it, particularly in "strange" contexts like "terraform console", can be
+// properly resolved.
+//
+// This method MUST NOT be called concurrently with other readers and writers
+// of the receiving state.
+func (s *State) PruneResourceHusks() {
+        for _, m := range s.Modules {
+                m.PruneResourceHusks()
+                if len(m.Resources) == 0 && !m.Addr.IsRoot() {
+                        s.RemoveModule(m.Addr)
+                }
+        }
+}
+
+// SyncWrapper returns a SyncState object wrapping the receiver.
+func (s *State) SyncWrapper() *SyncState {
+        return &SyncState{
+                state: s,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go b/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go
new file mode 100644
index 0000000..ea717d0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go
@@ -0,0 +1,218 @@
+package states
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Taking deep copies of states is an important operation because state is
+// otherwise a mutable data structure that is challenging to share across
+// many separate callers. It is important that the DeepCopy implementations
+// in this file comprehensively copy all parts of the state data structure
+// that could be mutated via pointers.
+
+// DeepCopy returns a new state that contains equivalent data to the reciever
+// but shares no backing memory in common.
+//
+// As with all methods on State, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (s *State) DeepCopy() *State {
+        if s == nil {
+                return nil
+        }
+
+        modules := make(map[string]*Module, len(s.Modules))
+        for k, m := range s.Modules {
+                modules[k] = m.DeepCopy()
+        }
+        return &State{
+                Modules: modules,
+        }
+}
+
+// DeepCopy returns a new module state that contains equivalent data to the
+// receiver but shares no backing memory in common.
+//
+// As with all methods on Module, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (ms *Module) DeepCopy() *Module {
+        if ms == nil {
+                return nil
+        }
+
+        resources := make(map[string]*Resource, len(ms.Resources))
+        for k, r := range ms.Resources {
+                resources[k] = r.DeepCopy()
+        }
+        outputValues := make(map[string]*OutputValue, len(ms.OutputValues))
+        for k, v := range ms.OutputValues {
+                outputValues[k] = v.DeepCopy()
+        }
+        localValues := make(map[string]cty.Value, len(ms.LocalValues))
+        for k, v := range ms.LocalValues {
+                // cty.Value is immutable, so we don't need to copy these.
+                localValues[k] = v
+        }
+
+        return &Module{
+                Addr:         ms.Addr, // technically mutable, but immutable by convention
+                Resources:    resources,
+                OutputValues: outputValues,
+                LocalValues:  localValues,
+        }
+}
+
+// DeepCopy returns a new resource state that contains equivalent data to the
+// receiver but shares no backing memory in common.
+//
+// As with all methods on Resource, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (rs *Resource) DeepCopy() *Resource {
+        if rs == nil {
+                return nil
+        }
+
+        instances := make(map[addrs.InstanceKey]*ResourceInstance, len(rs.Instances))
+        for k, i := range rs.Instances {
+                instances[k] = i.DeepCopy()
+        }
+
+        return &Resource{
+                Addr:           rs.Addr,
+                EachMode:       rs.EachMode,
+                Instances:      instances,
+                ProviderConfig: rs.ProviderConfig, // technically mutable, but immutable by convention
+        }
+}
+
+// DeepCopy returns a new resource instance state that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstance, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (is *ResourceInstance) DeepCopy() *ResourceInstance {
+        if is == nil {
+                return nil
+        }
+
+        deposed := make(map[DeposedKey]*ResourceInstanceObjectSrc, len(is.Deposed))
+        for k, obj := range is.Deposed {
+                deposed[k] = obj.DeepCopy()
+        }
+
+        return &ResourceInstance{
+                Current: is.Current.DeepCopy(),
+                Deposed: deposed,
+        }
+}
+
+// DeepCopy returns a new resource instance object that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstanceObjectSrc, this method is not safe to
+// use concurrently with writing to any portion of the recieving data structure.
+// It is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (obj *ResourceInstanceObjectSrc) DeepCopy() *ResourceInstanceObjectSrc {
+        if obj == nil {
+                return nil
+        }
+
+        var attrsFlat map[string]string
+        if obj.AttrsFlat != nil {
+                attrsFlat = make(map[string]string, len(obj.AttrsFlat))
+                for k, v := range obj.AttrsFlat {
+                        attrsFlat[k] = v
+                }
+        }
+
+        var attrsJSON []byte
+        if obj.AttrsJSON != nil {
+                attrsJSON = make([]byte, len(obj.AttrsJSON))
+                copy(attrsJSON, obj.AttrsJSON)
+        }
+
+        var private []byte
+        if obj.Private != nil {
+                private := make([]byte, len(obj.Private))
+                copy(private, obj.Private)
+        }
+
+        // Some addrs.Referencable implementations are technically mutable, but
+        // we treat them as immutable by convention and so we don't deep-copy here.
+        dependencies := make([]addrs.Referenceable, len(obj.Dependencies))
+        copy(dependencies, obj.Dependencies)
+
+        return &ResourceInstanceObjectSrc{
+                Status:        obj.Status,
+                SchemaVersion: obj.SchemaVersion,
+                Private:       private,
+                AttrsFlat:     attrsFlat,
+                AttrsJSON:     attrsJSON,
+                Dependencies:  dependencies,
+        }
+}
+
+// DeepCopy returns a new resource instance object that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstanceObject, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (obj *ResourceInstanceObject) DeepCopy() *ResourceInstanceObject {
+        if obj == nil {
+                return nil
+        }
+
+        var private []byte
+        if obj.Private != nil {
+                private := make([]byte, len(obj.Private))
+                copy(private, obj.Private)
+        }
+
+        // Some addrs.Referencable implementations are technically mutable, but
+        // we treat them as immutable by convention and so we don't deep-copy here.
+        dependencies := make([]addrs.Referenceable, len(obj.Dependencies))
+        copy(dependencies, obj.Dependencies)
+
+        return &ResourceInstanceObject{
+                Value:        obj.Value,
+                Status:       obj.Status,
+                Private:      private,
+                Dependencies: dependencies,
+        }
+}
+
+// DeepCopy returns a new output value state that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on OutputValue, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (os *OutputValue) DeepCopy() *OutputValue {
+        if os == nil {
+                return nil
+        }
+
+        return &OutputValue{
+                Value:     os.Value,
+                Sensitive: os.Sensitive,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_equal.go b/vendor/github.com/hashicorp/terraform/states/state_equal.go
new file mode 100644
index 0000000..ea20967
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_equal.go
@@ -0,0 +1,18 @@
+package states
+
+import (
+        "reflect"
+)
+
+// Equal returns true if the receiver is functionally equivalent to other,
+// including any ephemeral portions of the state that would not be included
+// if the state were saved to files.
+//
+// To test only the persistent portions of two states for equality, instead
+// use statefile.StatesMarshalEqual.
+func (s *State) Equal(other *State) bool {
+        // For the moment this is sufficient, but we may need to do something
+        // more elaborate in future if we have any portions of state that require
+        // more sophisticated comparisons.
+        return reflect.DeepEqual(s, other)
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_string.go b/vendor/github.com/hashicorp/terraform/states/state_string.go
new file mode 100644
index 0000000..bca4581
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_string.go
@@ -0,0 +1,279 @@
+package states
+
+import (
+        "bufio"
+        "bytes"
+        "encoding/json"
+        "fmt"
+        "sort"
+        "strings"
+
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+)
+
+// String returns a rather-odd string representation of the entire state.
+//
+// This is intended to match the behavior of the older terraform.State.String
+// method that is used in lots of existing tests. It should not be used in
+// new tests: instead, use "cmp" to directly compare the state data structures
+// and print out a diff if they do not match.
+//
+// This method should never be used in non-test code, whether directly by call
+// or indirectly via a %s or %q verb in package fmt.
+func (s *State) String() string {
+        if s == nil {
+                return "<nil>"
+        }
+
+        // sort the modules by name for consistent output
+        modules := make([]string, 0, len(s.Modules))
+        for m := range s.Modules {
+                modules = append(modules, m)
+        }
+        sort.Strings(modules)
+
+        var buf bytes.Buffer
+        for _, name := range modules {
+                m := s.Modules[name]
+                mStr := m.testString()
+
+                // If we're the root module, we just write the output directly.
+                if m.Addr.IsRoot() {
+                        buf.WriteString(mStr + "\n")
+                        continue
+                }
+
+                // We need to build out a string that resembles the not-quite-standard
+                // format that terraform.State.String used to use, where there's a
+                // "module." prefix but then just a chain of all of the module names
+                // without any further "module." portions.
+                buf.WriteString("module")
+                for _, step := range m.Addr {
+                        buf.WriteByte('.')
+                        buf.WriteString(step.Name)
+                        if step.InstanceKey != addrs.NoKey {
+                                buf.WriteByte('[')
+                                buf.WriteString(step.InstanceKey.String())
+                                buf.WriteByte(']')
+                        }
+                }
+                buf.WriteString(":\n")
+
+                s := bufio.NewScanner(strings.NewReader(mStr))
+                for s.Scan() {
+                        text := s.Text()
+                        if text != "" {
+                                text = "  " + text
+                        }
+
+                        buf.WriteString(fmt.Sprintf("%s\n", text))
+                }
+        }
+
+        return strings.TrimSpace(buf.String())
+}
+
+// testString is used to produce part of the output of State.String. It should
+// never be used directly.
+func (m *Module) testString() string {
+        var buf bytes.Buffer
+
+        if len(m.Resources) == 0 {
+                buf.WriteString("<no state>")
+        }
+
+        // We use AbsResourceInstance here, even though everything belongs to
+        // the same module, just because we have a sorting behavior defined
+        // for those but not for just ResourceInstance.
+        addrsOrder := make([]addrs.AbsResourceInstance, 0, len(m.Resources))
+        for _, rs := range m.Resources {
+                for ik := range rs.Instances {
+                        addrsOrder = append(addrsOrder, rs.Addr.Instance(ik).Absolute(addrs.RootModuleInstance))
+                }
+        }
+
+        sort.Slice(addrsOrder, func(i, j int) bool {
+                return addrsOrder[i].Less(addrsOrder[j])
+        })
+
+        for _, fakeAbsAddr := range addrsOrder {
+                addr := fakeAbsAddr.Resource
+                rs := m.Resource(addr.ContainingResource())
+                is := m.ResourceInstance(addr)
+
+                // Here we need to fake up a legacy-style address as the old state
+                // types would've used, since that's what our tests against those
+                // old types expect. The significant difference is that instancekey
+                // is dot-separated rather than using index brackets.
+                k := addr.ContainingResource().String()
+                if addr.Key != addrs.NoKey {
+                        switch tk := addr.Key.(type) {
+                        case addrs.IntKey:
+                                k = fmt.Sprintf("%s.%d", k, tk)
+                        default:
+                                // No other key types existed for the legacy types, so we
+                                // can do whatever we want here. We'll just use our standard
+                                // syntax for these.
+                                k = k + tk.String()
+                        }
+                }
+
+                id := LegacyInstanceObjectID(is.Current)
+
+                taintStr := ""
+                if is.Current != nil && is.Current.Status == ObjectTainted {
+                        taintStr = " (tainted)"
+                }
+
+                deposedStr := ""
+                if len(is.Deposed) > 0 {
+                        deposedStr = fmt.Sprintf(" (%d deposed)", len(is.Deposed))
+                }
+
+                buf.WriteString(fmt.Sprintf("%s:%s%s\n", k, taintStr, deposedStr))
+                buf.WriteString(fmt.Sprintf("  ID = %s\n", id))
+                buf.WriteString(fmt.Sprintf("  provider = %s\n", rs.ProviderConfig.String()))
+
+                // Attributes were a flatmap before, but are not anymore. To preserve
+                // our old output as closely as possible we need to do a conversion
+                // to flatmap. Normally we'd want to do this with schema for
+                // accuracy, but for our purposes here it only needs to be approximate.
+                // This should produce an identical result for most cases, though
+                // in particular will differ in a few cases:
+                //  - The keys used for elements in a set will be different
+                //  - Values for attributes of type cty.DynamicPseudoType will be
+                //    misinterpreted (but these weren't possible in old world anyway)
+                var attributes map[string]string
+                if obj := is.Current; obj != nil {
+                        switch {
+                        case obj.AttrsFlat != nil:
+                                // Easy (but increasingly unlikely) case: the state hasn't
+                                // actually been upgraded to the new form yet.
+                                attributes = obj.AttrsFlat
+                        case obj.AttrsJSON != nil:
+                                ty, err := ctyjson.ImpliedType(obj.AttrsJSON)
+                                if err == nil {
+                                        val, err := ctyjson.Unmarshal(obj.AttrsJSON, ty)
+                                        if err == nil {
+                                                attributes = hcl2shim.FlatmapValueFromHCL2(val)
+                                        }
+                                }
+                        }
+                }
+                attrKeys := make([]string, 0, len(attributes))
+                for ak, val := range attributes {
+                        if ak == "id" {
+                                continue
+                        }
+
+                        // don't show empty containers in the output
+                        if val == "0" && (strings.HasSuffix(ak, ".#") || strings.HasSuffix(ak, ".%")) {
+                                continue
+                        }
+
+                        attrKeys = append(attrKeys, ak)
+                }
+
+                sort.Strings(attrKeys)
+
+                for _, ak := range attrKeys {
+                        av := attributes[ak]
+                        buf.WriteString(fmt.Sprintf("  %s = %s\n", ak, av))
+                }
+
+                // CAUTION: Since deposed keys are now random strings instead of
+                // incrementing integers, this result will not be deterministic
+                // if there is more than one deposed object.
+                i := 1
+                for _, t := range is.Deposed {
+                        id := LegacyInstanceObjectID(t)
+                        taintStr := ""
+                        if t.Status == ObjectTainted {
+                                taintStr = " (tainted)"
+                        }
+                        buf.WriteString(fmt.Sprintf("  Deposed ID %d = %s%s\n", i, id, taintStr))
+                        i++
+                }
+
+                if obj := is.Current; obj != nil && len(obj.Dependencies) > 0 {
+                        buf.WriteString(fmt.Sprintf("\n  Dependencies:\n"))
+                        for _, dep := range obj.Dependencies {
+                                buf.WriteString(fmt.Sprintf("    %s\n", dep.String()))
+                        }
+                }
+        }
+
+        if len(m.OutputValues) > 0 {
+                buf.WriteString("\nOutputs:\n\n")
+
+                ks := make([]string, 0, len(m.OutputValues))
+                for k := range m.OutputValues {
+                        ks = append(ks, k)
+                }
+                sort.Strings(ks)
+
+                for _, k := range ks {
+                        v := m.OutputValues[k]
+                        lv := hcl2shim.ConfigValueFromHCL2(v.Value)
+                        switch vTyped := lv.(type) {
+                        case string:
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, vTyped))
+                        case []interface{}:
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, vTyped))
+                        case map[string]interface{}:
+                                var mapKeys []string
+                                for key := range vTyped {
+                                        mapKeys = append(mapKeys, key)
+                                }
+                                sort.Strings(mapKeys)
+
+                                var mapBuf bytes.Buffer
+                                mapBuf.WriteString("{")
+                                for _, key := range mapKeys {
+                                        mapBuf.WriteString(fmt.Sprintf("%s:%s ", key, vTyped[key]))
+                                }
+                                mapBuf.WriteString("}")
+
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, mapBuf.String()))
+                        default:
+                                buf.WriteString(fmt.Sprintf("%s = %#v\n", k, lv))
+                        }
+                }
+        }
+
+        return buf.String()
+}
+
+// LegacyInstanceObjectID is a helper for extracting an object id value from
+// an instance object in a way that approximates how we used to do this
+// for the old state types. ID is no longer first-class, so this is preserved
+// only for compatibility with old tests that include the id as part of their
+// expected value.
+func LegacyInstanceObjectID(obj *ResourceInstanceObjectSrc) string {
+        if obj == nil {
+                return "<not created>"
+        }
+
+        if obj.AttrsJSON != nil {
+                type WithID struct {
+                        ID string `json:"id"`
+                }
+                var withID WithID
+                err := json.Unmarshal(obj.AttrsJSON, &withID)
+                if err == nil {
+                        return withID.ID
+                }
+        } else if obj.AttrsFlat != nil {
+                if flatID, exists := obj.AttrsFlat["id"]; exists {
+                        return flatID
+                }
+        }
+
+        // For resource types created after we removed id as special there may
+        // not actually be one at all. This is okay because older tests won't
+        // encounter this, and new tests shouldn't be using ids.
+        return "<none>"
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go b/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go
new file mode 100644
index 0000000..a6d88ec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go
@@ -0,0 +1,62 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+const invalidFormat = "Invalid state file format"
+
+// jsonUnmarshalDiags is a helper that translates errors returned from
+// json.Unmarshal into hopefully-more-helpful diagnostics messages.
+func jsonUnmarshalDiags(err error) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        if err == nil {
+                return diags
+        }
+
+        switch tErr := err.(type) {
+        case *json.SyntaxError:
+                // We've usually already successfully parsed a source file as JSON at
+                // least once before we'd use jsonUnmarshalDiags with it (to sniff
+                // the version number) so this particular error should not appear much
+                // in practice.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        invalidFormat,
+                        fmt.Sprintf("The state file could not be parsed as JSON: syntax error at byte offset %d.", tErr.Offset),
+                ))
+        case *json.UnmarshalTypeError:
+                // This is likely to be the most common area, describing a
+                // non-conformance between the file and the expected file format
+                // at a semantic level.
+                if tErr.Field != "" {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                invalidFormat,
+                                fmt.Sprintf("The state file field %q has invalid value %s", tErr.Field, tErr.Value),
+                        ))
+                        break
+                } else {
+                        // Without a field name, we can't really say anything helpful.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                invalidFormat,
+                                "The state file does not conform to the expected JSON data structure.",
+                        ))
+                }
+        default:
+                // Fallback for all other types of errors. This can happen only for
+                // custom UnmarshalJSON implementations, so should be encountered
+                // only rarely.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        invalidFormat,
+                        fmt.Sprintf("The state file does not conform to the expected JSON data structure: %s.", err.Error()),
+                ))
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/doc.go b/vendor/github.com/hashicorp/terraform/states/statefile/doc.go
new file mode 100644
index 0000000..625d0cf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/doc.go
@@ -0,0 +1,3 @@
+// Package statefile deals with the file format used to serialize states for
+// persistent storage and then deserialize them into memory again later.
+package statefile
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/file.go b/vendor/github.com/hashicorp/terraform/states/statefile/file.go
new file mode 100644
index 0000000..6e20240
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/file.go
@@ -0,0 +1,62 @@
+package statefile
+
+import (
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/states"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// File is the in-memory representation of a state file. It includes the state
+// itself along with various metadata used to track changing state files for
+// the same configuration over time.
+type File struct {
+        // TerraformVersion is the version of Terraform that wrote this state file.
+        TerraformVersion *version.Version
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial uint64
+
+        // Lineage is set when a new, blank state file is created and then
+        // never updated. This allows us to determine whether the serials
+        // of two states can be meaningfully compared.
+        // Apart from the guarantee that collisions between two lineages
+        // are very unlikely, this value is opaque and external callers
+        // should only compare lineage strings byte-for-byte for equality.
+        Lineage string
+
+        // State is the actual state represented by this file.
+        State *states.State
+}
+
+func New(state *states.State, lineage string, serial uint64) *File {
+        // To make life easier on callers, we'll accept a nil state here and just
+        // allocate an empty one, which is required for this file to be successfully
+        // written out.
+        if state == nil {
+                state = states.NewState()
+        }
+
+        return &File{
+                TerraformVersion: tfversion.SemVer,
+                State:            state,
+                Lineage:          lineage,
+                Serial:           serial,
+        }
+}
+
+// DeepCopy is a convenience method to create a new File object whose state
+// is a deep copy of the receiver's, as implemented by states.State.DeepCopy.
+func (f *File) DeepCopy() *File {
+        if f == nil {
+                return nil
+        }
+        return &File{
+                TerraformVersion: f.TerraformVersion,
+                Serial:           f.Serial,
+                Lineage:          f.Lineage,
+                State:            f.State.DeepCopy(),
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go b/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go
new file mode 100644
index 0000000..4948b39
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go
@@ -0,0 +1,40 @@
+package statefile
+
+import (
+        "bytes"
+
+        "github.com/hashicorp/terraform/states"
+)
+
+// StatesMarshalEqual returns true if and only if the two given states have
+// an identical (byte-for-byte) statefile representation.
+//
+// This function compares only the portions of the state that are persisted
+// in state files, so for example it will not return false if the only
+// differences between the two states are local values or descendent module
+// outputs.
+func StatesMarshalEqual(a, b *states.State) bool {
+        var aBuf bytes.Buffer
+        var bBuf bytes.Buffer
+
+        // nil states are not valid states, and so they can never martial equal.
+        if a == nil || b == nil {
+                return false
+        }
+
+        // We write here some temporary files that have no header information
+        // populated, thus ensuring that we're only comparing the state itself
+        // and not any metadata.
+        err := Write(&File{State: a}, &aBuf)
+        if err != nil {
+                // Should never happen, because we're writing to an in-memory buffer
+                panic(err)
+        }
+        err = Write(&File{State: b}, &bBuf)
+        if err != nil {
+                // Should never happen, because we're writing to an in-memory buffer
+                panic(err)
+        }
+
+        return bytes.Equal(aBuf.Bytes(), bBuf.Bytes())
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/read.go b/vendor/github.com/hashicorp/terraform/states/statefile/read.go
new file mode 100644
index 0000000..d691c02
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/read.go
@@ -0,0 +1,209 @@
+package statefile
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "os"
+
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// ErrNoState is returned by ReadState when the state file is empty.
+var ErrNoState = errors.New("no state")
+
+// Read reads a state from the given reader.
+//
+// Legacy state format versions 1 through 3 are supported, but the result will
+// contain object attributes in the deprecated "flatmap" format and so must
+// be upgraded by the caller before use.
+//
+// If the state file is empty, the special error value ErrNoState is returned.
+// Otherwise, the returned error might be a wrapper around tfdiags.Diagnostics
+// potentially describing multiple errors.
+func Read(r io.Reader) (*File, error) {
+        // Some callers provide us a "typed nil" *os.File here, which would
+        // cause us to panic below if we tried to use it.
+        if f, ok := r.(*os.File); ok && f == nil {
+                return nil, ErrNoState
+        }
+
+        var diags tfdiags.Diagnostics
+
+        // We actually just buffer the whole thing in memory, because states are
+        // generally not huge and we need to do be able to sniff for a version
+        // number before full parsing.
+        src, err := ioutil.ReadAll(r)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read state file",
+                        fmt.Sprintf("The state file could not be read: %s", err),
+                ))
+                return nil, diags.Err()
+        }
+
+        if len(src) == 0 {
+                return nil, ErrNoState
+        }
+
+        state, diags := readState(src)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if state == nil {
+                // Should never happen
+                panic("readState returned nil state with no errors")
+        }
+
+        if state.TerraformVersion != nil && state.TerraformVersion.GreaterThan(tfversion.SemVer) {
+                return state, fmt.Errorf(
+                        "state snapshot was created by Terraform v%s, which is newer than current v%s; upgrade to Terraform v%s or greater to work with this state",
+                        state.TerraformVersion,
+                        tfversion.SemVer,
+                        state.TerraformVersion,
+                )
+        }
+
+        return state, diags.Err()
+}
+
+func readState(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if looksLikeVersion0(src) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state is stored in a legacy binary format that is not supported since Terraform v0.7. To continue, first upgrade the state using Terraform 0.6.16 or earlier.",
+                ))
+                return nil, diags
+        }
+
+        version, versionDiags := sniffJSONStateVersion(src)
+        diags = diags.Append(versionDiags)
+        if versionDiags.HasErrors() {
+                return nil, diags
+        }
+
+        switch version {
+        case 0:
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state file uses JSON syntax but has a version number of zero. There was never a JSON-based state format zero, so this state file is invalid and cannot be processed.",
+                ))
+                return nil, diags
+        case 1:
+                return readStateV1(src)
+        case 2:
+                return readStateV2(src)
+        case 3:
+                return readStateV3(src)
+        case 4:
+                return readStateV4(src)
+        default:
+                thisVersion := tfversion.SemVer.String()
+                creatingVersion := sniffJSONStateTerraformVersion(src)
+                switch {
+                case creatingVersion != "":
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file uses format version %d, which is not supported by Terraform %s. This state file was created by Terraform %s.", version, thisVersion, creatingVersion),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file uses format version %d, which is not supported by Terraform %s. This state file may have been created by a newer version of Terraform.", version, thisVersion),
+                        ))
+                }
+                return nil, diags
+        }
+}
+
+func sniffJSONStateVersion(src []byte) (uint64, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        type VersionSniff struct {
+                Version *uint64 `json:"version"`
+        }
+        var sniff VersionSniff
+        err := json.Unmarshal(src, &sniff)
+        if err != nil {
+                switch tErr := err.(type) {
+                case *json.SyntaxError:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file could not be parsed as JSON: syntax error at byte offset %d.", tErr.Offset),
+                        ))
+                case *json.UnmarshalTypeError:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The version in the state file is %s. A positive whole number is required.", tErr.Value),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                "The state file could not be parsed as JSON.",
+                        ))
+                }
+        }
+
+        if sniff.Version == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state file does not have a \"version\" attribute, which is required to identify the format version.",
+                ))
+                return 0, diags
+        }
+
+        return *sniff.Version, diags
+}
+
+// sniffJSONStateTerraformVersion attempts to sniff the Terraform version
+// specification from the given state file source code. The result is either
+// a version string or an empty string if no version number could be extracted.
+//
+// This is a best-effort function intended to produce nicer error messages. It
+// should not be used for any real processing.
+func sniffJSONStateTerraformVersion(src []byte) string {
+        type VersionSniff struct {
+                Version string `json:"terraform_version"`
+        }
+        var sniff VersionSniff
+
+        err := json.Unmarshal(src, &sniff)
+        if err != nil {
+                return ""
+        }
+
+        // Attempt to parse the string as a version so we won't report garbage
+        // as a version number.
+        _, err = version.NewVersion(sniff.Version)
+        if err != nil {
+                return ""
+        }
+
+        return sniff.Version
+}
+
+// unsupportedFormat is a diagnostic summary message for when the state file
+// seems to not be a state file at all, or is not a supported version.
+//
+// Use invalidFormat instead for the subtly-different case of "this looks like
+// it's intended to be a state file but it's not structured correctly".
+const unsupportedFormat = "Unsupported state file format"
+
+const upgradeFailed = "State format upgrade failed"
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version0.go b/vendor/github.com/hashicorp/terraform/states/statefile/version0.go
new file mode 100644
index 0000000..9b53331
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version0.go
@@ -0,0 +1,23 @@
+package statefile
+
+// looksLikeVersion0 sniffs for the signature indicating a version 0 state
+// file.
+//
+// Version 0 was the number retroactively assigned to Terraform's initial
+// (unversioned) binary state file format, which was later superseded by the
+// version 1 format in JSON.
+//
+// Version 0 is no longer supported, so this is used only to detect it and
+// return a nice error to the user.
+func looksLikeVersion0(src []byte) bool {
+        // Version 0 files begin with the magic prefix "tfstate".
+        const magic = "tfstate"
+        if len(src) < len(magic) {
+                // Not even long enough to have the magic prefix
+                return false
+        }
+        if string(src[0:len(magic)]) == magic {
+                return true
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version1.go b/vendor/github.com/hashicorp/terraform/states/statefile/version1.go
new file mode 100644
index 0000000..80d711b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version1.go
@@ -0,0 +1,174 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV1(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV1 := &stateV1{}
+        err := json.Unmarshal(src, sV1)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV1(sV1)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV1(sV1 *stateV1) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV2, err := upgradeStateV1ToV2(sV1)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 1 to version 2: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV2(sV2)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV1 is a representation of the legacy JSON state format version 1.
+//
+// It is only used to read version 1 JSON files prior to upgrading them to
+// the current format.
+type stateV1 struct {
+        // Version is the protocol version. "1" for a StateV1.
+        Version int `json:"version"`
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial int64 `json:"serial"`
+
+        // Remote is used to track the metadata required to
+        // pull and push state files from a remote storage endpoint.
+        Remote *remoteStateV1 `json:"remote,omitempty"`
+
+        // Modules contains all the modules in a breadth-first order
+        Modules []*moduleStateV1 `json:"modules"`
+}
+
+type remoteStateV1 struct {
+        // Type controls the client we use for the remote state
+        Type string `json:"type"`
+
+        // Config is used to store arbitrary configuration that
+        // is type specific
+        Config map[string]string `json:"config"`
+}
+
+type moduleStateV1 struct {
+        // Path is the import path from the root module. Modules imports are
+        // always disjoint, so the path represents amodule tree
+        Path []string `json:"path"`
+
+        // Outputs declared by the module and maintained for each module
+        // even though only the root module technically needs to be kept.
+        // This allows operators to inspect values at the boundaries.
+        Outputs map[string]string `json:"outputs"`
+
+        // Resources is a mapping of the logically named resource to
+        // the state of the resource. Each resource may actually have
+        // N instances underneath, although a user only needs to think
+        // about the 1:1 case.
+        Resources map[string]*resourceStateV1 `json:"resources"`
+
+        // Dependencies are a list of things that this module relies on
+        // existing to remain intact. For example: an module may depend
+        // on a VPC ID given by an aws_vpc resource.
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a module that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on,omitempty"`
+}
+
+type resourceStateV1 struct {
+        // This is filled in and managed by Terraform, and is the resource
+        // type itself such as "mycloud_instance". If a resource provider sets
+        // this value, it won't be persisted.
+        Type string `json:"type"`
+
+        // Dependencies are a list of things that this resource relies on
+        // existing to remain intact. For example: an AWS instance might
+        // depend on a subnet (which itself might depend on a VPC, and so
+        // on).
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a resource that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on,omitempty"`
+
+        // Primary is the current active instance for this resource.
+        // It can be replaced but only after a successful creation.
+        // This is the instances on which providers will act.
+        Primary *instanceStateV1 `json:"primary"`
+
+        // Tainted is used to track any underlying instances that
+        // have been created but are in a bad or unknown state and
+        // need to be cleaned up subsequently.  In the
+        // standard case, there is only at most a single instance.
+        // However, in pathological cases, it is possible for the number
+        // of instances to accumulate.
+        Tainted []*instanceStateV1 `json:"tainted,omitempty"`
+
+        // Deposed is used in the mechanics of CreateBeforeDestroy: the existing
+        // Primary is Deposed to get it out of the way for the replacement Primary to
+        // be created by Apply. If the replacement Primary creates successfully, the
+        // Deposed instance is cleaned up. If there were problems creating the
+        // replacement, the instance remains in the Deposed list so it can be
+        // destroyed in a future run. Functionally, Deposed instances are very
+        // similar to Tainted instances in that Terraform is only tracking them in
+        // order to remember to destroy them.
+        Deposed []*instanceStateV1 `json:"deposed,omitempty"`
+
+        // Provider is used when a resource is connected to a provider with an alias.
+        // If this string is empty, the resource is connected to the default provider,
+        // e.g. "aws_instance" goes with the "aws" provider.
+        // If the resource block contained a "provider" key, that value will be set here.
+        Provider string `json:"provider,omitempty"`
+}
+
+type instanceStateV1 struct {
+        // A unique ID for this resource. This is opaque to Terraform
+        // and is only meant as a lookup mechanism for the providers.
+        ID string `json:"id"`
+
+        // Attributes are basic information about the resource. Any keys here
+        // are accessible in variable format within Terraform configurations:
+        // ${resourcetype.name.attribute}.
+        Attributes map[string]string `json:"attributes,omitempty"`
+
+        // Meta is a simple K/V map that is persisted to the State but otherwise
+        // ignored by Terraform core. It's meant to be used for accounting by
+        // external client code.
+        Meta map[string]string `json:"meta,omitempty"`
+}
+
+type ephemeralStateV1 struct {
+        // ConnInfo is used for the providers to export information which is
+        // used to connect to the resource for provisioning. For example,
+        // this could contain SSH or WinRM credentials.
+        ConnInfo map[string]string `json:"-"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go
new file mode 100644
index 0000000..0b417e1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go
@@ -0,0 +1,172 @@
+package statefile
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/mitchellh/copystructure"
+)
+
+// upgradeStateV1ToV2 is used to upgrade a V1 state representation
+// into a V2 state representation
+func upgradeStateV1ToV2(old *stateV1) (*stateV2, error) {
+        log.Printf("[TRACE] statefile.Read: upgrading format from v1 to v2")
+        if old == nil {
+                return nil, nil
+        }
+
+        remote, err := old.Remote.upgradeToV2()
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading State V1: %v", err)
+        }
+
+        modules := make([]*moduleStateV2, len(old.Modules))
+        for i, module := range old.Modules {
+                upgraded, err := module.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading State V1: %v", err)
+                }
+                modules[i] = upgraded
+        }
+        if len(modules) == 0 {
+                modules = nil
+        }
+
+        newState := &stateV2{
+                Version: 2,
+                Serial:  old.Serial,
+                Remote:  remote,
+                Modules: modules,
+        }
+
+        return newState, nil
+}
+
+func (old *remoteStateV1) upgradeToV2() (*remoteStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        config, err := copystructure.Copy(old.Config)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading RemoteState V1: %v", err)
+        }
+
+        return &remoteStateV2{
+                Type:   old.Type,
+                Config: config.(map[string]string),
+        }, nil
+}
+
+func (old *moduleStateV1) upgradeToV2() (*moduleStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        pathRaw, err := copystructure.Copy(old.Path)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+        }
+        path, ok := pathRaw.([]string)
+        if !ok {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: path is not a list of strings")
+        }
+        if len(path) == 0 {
+                // We found some V1 states with a nil path. Assume root.
+                path = []string{"root"}
+        }
+
+        // Outputs needs upgrading to use the new structure
+        outputs := make(map[string]*outputStateV2)
+        for key, output := range old.Outputs {
+                outputs[key] = &outputStateV2{
+                        Type:      "string",
+                        Value:     output,
+                        Sensitive: false,
+                }
+        }
+
+        resources := make(map[string]*resourceStateV2)
+        for key, oldResource := range old.Resources {
+                upgraded, err := oldResource.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+                }
+                resources[key] = upgraded
+        }
+
+        dependencies, err := copystructure.Copy(old.Dependencies)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+        }
+
+        return &moduleStateV2{
+                Path:         path,
+                Outputs:      outputs,
+                Resources:    resources,
+                Dependencies: dependencies.([]string),
+        }, nil
+}
+
+func (old *resourceStateV1) upgradeToV2() (*resourceStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        dependencies, err := copystructure.Copy(old.Dependencies)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+        }
+
+        primary, err := old.Primary.upgradeToV2()
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+        }
+
+        deposed := make([]*instanceStateV2, len(old.Deposed))
+        for i, v := range old.Deposed {
+                upgraded, err := v.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+                }
+                deposed[i] = upgraded
+        }
+        if len(deposed) == 0 {
+                deposed = nil
+        }
+
+        return &resourceStateV2{
+                Type:         old.Type,
+                Dependencies: dependencies.([]string),
+                Primary:      primary,
+                Deposed:      deposed,
+                Provider:     old.Provider,
+        }, nil
+}
+
+func (old *instanceStateV1) upgradeToV2() (*instanceStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        attributes, err := copystructure.Copy(old.Attributes)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading InstanceState V1: %v", err)
+        }
+
+        meta, err := copystructure.Copy(old.Meta)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading InstanceState V1: %v", err)
+        }
+
+        newMeta := make(map[string]interface{})
+        for k, v := range meta.(map[string]string) {
+                newMeta[k] = v
+        }
+
+        return &instanceStateV2{
+                ID:         old.ID,
+                Attributes: attributes.(map[string]string),
+                Meta:       newMeta,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version2.go b/vendor/github.com/hashicorp/terraform/states/statefile/version2.go
new file mode 100644
index 0000000..6fe2ab8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version2.go
@@ -0,0 +1,209 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "sync"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV2(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV2 := &stateV2{}
+        err := json.Unmarshal(src, sV2)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV2(sV2)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV2(sV2 *stateV2) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV3, err := upgradeStateV2ToV3(sV2)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 2 to version 3: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV3(sV3)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV2 is a representation of the legacy JSON state format version 2.
+//
+// It is only used to read version 2 JSON files prior to upgrading them to
+// the current format.
+type stateV2 struct {
+        // Version is the state file protocol version.
+        Version int `json:"version"`
+
+        // TFVersion is the version of Terraform that wrote this state.
+        TFVersion string `json:"terraform_version,omitempty"`
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial int64 `json:"serial"`
+
+        // Lineage is set when a new, blank state is created and then
+        // never updated. This allows us to determine whether the serials
+        // of two states can be meaningfully compared.
+        // Apart from the guarantee that collisions between two lineages
+        // are very unlikely, this value is opaque and external callers
+        // should only compare lineage strings byte-for-byte for equality.
+        Lineage string `json:"lineage"`
+
+        // Remote is used to track the metadata required to
+        // pull and push state files from a remote storage endpoint.
+        Remote *remoteStateV2 `json:"remote,omitempty"`
+
+        // Backend tracks the configuration for the backend in use with
+        // this state. This is used to track any changes in the backend
+        // configuration.
+        Backend *backendStateV2 `json:"backend,omitempty"`
+
+        // Modules contains all the modules in a breadth-first order
+        Modules []*moduleStateV2 `json:"modules"`
+}
+
+type remoteStateV2 struct {
+        // Type controls the client we use for the remote state
+        Type string `json:"type"`
+
+        // Config is used to store arbitrary configuration that
+        // is type specific
+        Config map[string]string `json:"config"`
+}
+
+type outputStateV2 struct {
+        // Sensitive describes whether the output is considered sensitive,
+        // which may lead to masking the value on screen in some cases.
+        Sensitive bool `json:"sensitive"`
+        // Type describes the structure of Value. Valid values are "string",
+        // "map" and "list"
+        Type string `json:"type"`
+        // Value contains the value of the output, in the structure described
+        // by the Type field.
+        Value interface{} `json:"value"`
+
+        mu sync.Mutex
+}
+
+type moduleStateV2 struct {
+        // Path is the import path from the root module. Modules imports are
+        // always disjoint, so the path represents amodule tree
+        Path []string `json:"path"`
+
+        // Locals are kept only transiently in-memory, because we can always
+        // re-compute them.
+        Locals map[string]interface{} `json:"-"`
+
+        // Outputs declared by the module and maintained for each module
+        // even though only the root module technically needs to be kept.
+        // This allows operators to inspect values at the boundaries.
+        Outputs map[string]*outputStateV2 `json:"outputs"`
+
+        // Resources is a mapping of the logically named resource to
+        // the state of the resource. Each resource may actually have
+        // N instances underneath, although a user only needs to think
+        // about the 1:1 case.
+        Resources map[string]*resourceStateV2 `json:"resources"`
+
+        // Dependencies are a list of things that this module relies on
+        // existing to remain intact. For example: an module may depend
+        // on a VPC ID given by an aws_vpc resource.
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a module that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on"`
+}
+
+type resourceStateV2 struct {
+        // This is filled in and managed by Terraform, and is the resource
+        // type itself such as "mycloud_instance". If a resource provider sets
+        // this value, it won't be persisted.
+        Type string `json:"type"`
+
+        // Dependencies are a list of things that this resource relies on
+        // existing to remain intact. For example: an AWS instance might
+        // depend on a subnet (which itself might depend on a VPC, and so
+        // on).
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a resource that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on"`
+
+        // Primary is the current active instance for this resource.
+        // It can be replaced but only after a successful creation.
+        // This is the instances on which providers will act.
+        Primary *instanceStateV2 `json:"primary"`
+
+        // Deposed is used in the mechanics of CreateBeforeDestroy: the existing
+        // Primary is Deposed to get it out of the way for the replacement Primary to
+        // be created by Apply. If the replacement Primary creates successfully, the
+        // Deposed instance is cleaned up.
+        //
+        // If there were problems creating the replacement Primary, the Deposed
+        // instance and the (now tainted) replacement Primary will be swapped so the
+        // tainted replacement will be cleaned up instead.
+        //
+        // An instance will remain in the Deposed list until it is successfully
+        // destroyed and purged.
+        Deposed []*instanceStateV2 `json:"deposed"`
+
+        // Provider is used when a resource is connected to a provider with an alias.
+        // If this string is empty, the resource is connected to the default provider,
+        // e.g. "aws_instance" goes with the "aws" provider.
+        // If the resource block contained a "provider" key, that value will be set here.
+        Provider string `json:"provider"`
+
+        mu sync.Mutex
+}
+
+type instanceStateV2 struct {
+        // A unique ID for this resource. This is opaque to Terraform
+        // and is only meant as a lookup mechanism for the providers.
+        ID string `json:"id"`
+
+        // Attributes are basic information about the resource. Any keys here
+        // are accessible in variable format within Terraform configurations:
+        // ${resourcetype.name.attribute}.
+        Attributes map[string]string `json:"attributes"`
+
+        // Meta is a simple K/V map that is persisted to the State but otherwise
+        // ignored by Terraform core. It's meant to be used for accounting by
+        // external client code. The value here must only contain Go primitives
+        // and collections.
+        Meta map[string]interface{} `json:"meta"`
+
+        // Tainted is used to mark a resource for recreation.
+        Tainted bool `json:"tainted"`
+}
+
+type backendStateV2 struct {
+        Type      string          `json:"type"`   // Backend type
+        ConfigRaw json.RawMessage `json:"config"` // Backend raw config
+        Hash      int             `json:"hash"`   // Hash of portion of configuration from config files
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go
new file mode 100644
index 0000000..2d03c07
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go
@@ -0,0 +1,145 @@
+package statefile
+
+import (
+        "fmt"
+        "log"
+        "regexp"
+        "sort"
+        "strconv"
+        "strings"
+
+        "github.com/mitchellh/copystructure"
+)
+
+func upgradeStateV2ToV3(old *stateV2) (*stateV3, error) {
+        if old == nil {
+                return (*stateV3)(nil), nil
+        }
+
+        var new *stateV3
+        {
+                copy, err := copystructure.Config{Lock: true}.Copy(old)
+                if err != nil {
+                        panic(err)
+                }
+                newWrongType := copy.(*stateV2)
+                newRightType := (stateV3)(*newWrongType)
+                new = &newRightType
+        }
+
+        // Set the new version number
+        new.Version = 3
+
+        // Change the counts for things which look like maps to use the %
+        // syntax. Remove counts for empty collections - they will be added
+        // back in later.
+        for _, module := range new.Modules {
+                for _, resource := range module.Resources {
+                        // Upgrade Primary
+                        if resource.Primary != nil {
+                                upgradeAttributesV2ToV3(resource.Primary)
+                        }
+
+                        // Upgrade Deposed
+                        for _, deposed := range resource.Deposed {
+                                upgradeAttributesV2ToV3(deposed)
+                        }
+                }
+        }
+
+        return new, nil
+}
+
+func upgradeAttributesV2ToV3(instanceState *instanceStateV2) error {
+        collectionKeyRegexp := regexp.MustCompile(`^(.*\.)#$`)
+        collectionSubkeyRegexp := regexp.MustCompile(`^([^\.]+)\..*`)
+
+        // Identify the key prefix of anything which is a collection
+        var collectionKeyPrefixes []string
+        for key := range instanceState.Attributes {
+                if submatches := collectionKeyRegexp.FindAllStringSubmatch(key, -1); len(submatches) > 0 {
+                        collectionKeyPrefixes = append(collectionKeyPrefixes, submatches[0][1])
+                }
+        }
+        sort.Strings(collectionKeyPrefixes)
+
+        log.Printf("[STATE UPGRADE] Detected the following collections in state: %v", collectionKeyPrefixes)
+
+        // This could be rolled into fewer loops, but it is somewhat clearer this way, and will not
+        // run very often.
+        for _, prefix := range collectionKeyPrefixes {
+                // First get the actual keys that belong to this prefix
+                var potentialKeysMatching []string
+                for key := range instanceState.Attributes {
+                        if strings.HasPrefix(key, prefix) {
+                                potentialKeysMatching = append(potentialKeysMatching, strings.TrimPrefix(key, prefix))
+                        }
+                }
+                sort.Strings(potentialKeysMatching)
+
+                var actualKeysMatching []string
+                for _, key := range potentialKeysMatching {
+                        if submatches := collectionSubkeyRegexp.FindAllStringSubmatch(key, -1); len(submatches) > 0 {
+                                actualKeysMatching = append(actualKeysMatching, submatches[0][1])
+                        } else {
+                                if key != "#" {
+                                        actualKeysMatching = append(actualKeysMatching, key)
+                                }
+                        }
+                }
+                actualKeysMatching = uniqueSortedStrings(actualKeysMatching)
+
+                // Now inspect the keys in order to determine whether this is most likely to be
+                // a map, list or set. There is room for error here, so we log in each case. If
+                // there is no method of telling, we remove the key from the InstanceState in
+                // order that it will be recreated. Again, this could be rolled into fewer loops
+                // but we prefer clarity.
+
+                oldCountKey := fmt.Sprintf("%s#", prefix)
+
+                // First, detect "obvious" maps - which have non-numeric keys (mostly).
+                hasNonNumericKeys := false
+                for _, key := range actualKeysMatching {
+                        if _, err := strconv.Atoi(key); err != nil {
+                                hasNonNumericKeys = true
+                        }
+                }
+                if hasNonNumericKeys {
+                        newCountKey := fmt.Sprintf("%s%%", prefix)
+
+                        instanceState.Attributes[newCountKey] = instanceState.Attributes[oldCountKey]
+                        delete(instanceState.Attributes, oldCountKey)
+                        log.Printf("[STATE UPGRADE] Detected %s as a map. Replaced count = %s",
+                                strings.TrimSuffix(prefix, "."), instanceState.Attributes[newCountKey])
+                }
+
+                // Now detect empty collections and remove them from state.
+                if len(actualKeysMatching) == 0 {
+                        delete(instanceState.Attributes, oldCountKey)
+                        log.Printf("[STATE UPGRADE] Detected %s as an empty collection. Removed from state.",
+                                strings.TrimSuffix(prefix, "."))
+                }
+        }
+
+        return nil
+}
+
+// uniqueSortedStrings removes duplicates from a slice of strings and returns
+// a sorted slice of the unique strings.
+func uniqueSortedStrings(input []string) []string {
+        uniquemap := make(map[string]struct{})
+        for _, str := range input {
+                uniquemap[str] = struct{}{}
+        }
+
+        output := make([]string, len(uniquemap))
+
+        i := 0
+        for key := range uniquemap {
+                output[i] = key
+                i = i + 1
+        }
+
+        sort.Strings(output)
+        return output
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version3.go b/vendor/github.com/hashicorp/terraform/states/statefile/version3.go
new file mode 100644
index 0000000..ab6414b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version3.go
@@ -0,0 +1,50 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV3(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV3 := &stateV3{}
+        err := json.Unmarshal(src, sV3)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV3(sV3)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV3(sV3 *stateV3) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV4, err := upgradeStateV3ToV4(sV3)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 3 to version 4: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV4(sV4)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV2 is a representation of the legacy JSON state format version 3.
+//
+// It is only used to read version 3 JSON files prior to upgrading them to
+// the current format.
+//
+// The differences between version 2 and version 3 are only in the data and
+// not in the structure, so stateV3 actually shares the same structs as
+// stateV2. Type stateV3 represents that the data within is formatted as
+// expected by the V3 format, rather than the V2 format.
+type stateV3 stateV2
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go
new file mode 100644
index 0000000..2cbe8a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go
@@ -0,0 +1,431 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func upgradeStateV3ToV4(old *stateV3) (*stateV4, error) {
+
+        if old.Serial < 0 {
+                // The new format is using uint64 here, which should be fine for any
+                // real state (we only used positive integers in practice) but we'll
+                // catch this explicitly here to avoid weird behavior if a state file
+                // has been tampered with in some way.
+                return nil, fmt.Errorf("state has serial less than zero, which is invalid")
+        }
+
+        new := &stateV4{
+                TerraformVersion: old.TFVersion,
+                Serial:           uint64(old.Serial),
+                Lineage:          old.Lineage,
+                RootOutputs:      map[string]outputStateV4{},
+                Resources:        []resourceStateV4{},
+        }
+
+        if new.TerraformVersion == "" {
+                // Older formats considered this to be optional, but now it's required
+                // and so we'll stub it out with something that's definitely older
+                // than the version that really created this state.
+                new.TerraformVersion = "0.0.0"
+        }
+
+        for _, msOld := range old.Modules {
+                if len(msOld.Path) < 1 || msOld.Path[0] != "root" {
+                        return nil, fmt.Errorf("state contains invalid module path %#v", msOld.Path)
+                }
+
+                // Convert legacy-style module address into our newer address type.
+                // Since these old formats are only generated by versions of Terraform
+                // that don't support count and for_each on modules, we can just assume
+                // all of the modules are unkeyed.
+                moduleAddr := make(addrs.ModuleInstance, len(msOld.Path)-1)
+                for i, name := range msOld.Path[1:] {
+                        moduleAddr[i] = addrs.ModuleInstanceStep{
+                                Name:        name,
+                                InstanceKey: addrs.NoKey,
+                        }
+                }
+
+                // In a v3 state file, a "resource state" is actually an instance
+                // state, so we need to fill in a missing level of heirarchy here
+                // by lazily creating resource states as we encounter them.
+                // We'll track them in here, keyed on the string representation of
+                // the resource address.
+                resourceStates := map[string]*resourceStateV4{}
+
+                for legacyAddr, rsOld := range msOld.Resources {
+                        instAddr, err := parseLegacyResourceAddress(legacyAddr)
+                        if err != nil {
+                                return nil, err
+                        }
+
+                        resAddr := instAddr.Resource
+                        rs, exists := resourceStates[resAddr.String()]
+                        if !exists {
+                                var modeStr string
+                                switch resAddr.Mode {
+                                case addrs.ManagedResourceMode:
+                                        modeStr = "managed"
+                                case addrs.DataResourceMode:
+                                        modeStr = "data"
+                                default:
+                                        return nil, fmt.Errorf("state contains resource %s with an unsupported resource mode", resAddr)
+                                }
+
+                                // In state versions prior to 4 we allowed each instance of a
+                                // resource to have its own provider configuration address,
+                                // which makes no real sense in practice because providers
+                                // are associated with resources in the configuration. We
+                                // elevate that to the resource level during this upgrade,
+                                // implicitly taking the provider address of the first instance
+                                // we encounter for each resource. While this is lossy in
+                                // theory, in practice there is no reason for these values to
+                                // differ between instances.
+                                var providerAddr addrs.AbsProviderConfig
+                                oldProviderAddr := rsOld.Provider
+                                if strings.Contains(oldProviderAddr, "provider.") {
+                                        // Smells like a new-style provider address, but we'll test it.
+                                        var diags tfdiags.Diagnostics
+                                        providerAddr, diags = addrs.ParseAbsProviderConfigStr(oldProviderAddr)
+                                        if diags.HasErrors() {
+                                                return nil, diags.Err()
+                                        }
+                                } else {
+                                        // Smells like an old-style module-local provider address,
+                                        // which we'll need to migrate. We'll assume it's referring
+                                        // to the same module the resource is in, which might be
+                                        // incorrect but it'll get fixed up next time any updates
+                                        // are made to an instance.
+                                        if oldProviderAddr != "" {
+                                                localAddr, diags := addrs.ParseProviderConfigCompactStr(oldProviderAddr)
+                                                if diags.HasErrors() {
+                                                        return nil, diags.Err()
+                                                }
+                                                providerAddr = localAddr.Absolute(moduleAddr)
+                                        } else {
+                                                providerAddr = resAddr.DefaultProviderConfig().Absolute(moduleAddr)
+                                        }
+                                }
+
+                                rs = &resourceStateV4{
+                                        Module:         moduleAddr.String(),
+                                        Mode:           modeStr,
+                                        Type:           resAddr.Type,
+                                        Name:           resAddr.Name,
+                                        Instances:      []instanceObjectStateV4{},
+                                        ProviderConfig: providerAddr.String(),
+                                }
+                                resourceStates[resAddr.String()] = rs
+                        }
+
+                        // Now we'll deal with the instance itself, which may either be
+                        // the first instance in a resource we just created or an additional
+                        // instance for a resource added on a prior loop.
+                        instKey := instAddr.Key
+                        if isOld := rsOld.Primary; isOld != nil {
+                                isNew, err := upgradeInstanceObjectV3ToV4(rsOld, isOld, instKey, states.NotDeposed)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to migrate primary generation of %s: %s", instAddr, err)
+                                }
+                                rs.Instances = append(rs.Instances, *isNew)
+                        }
+                        for i, isOld := range rsOld.Deposed {
+                                // When we migrate old instances we'll use sequential deposed
+                                // keys just so that the upgrade result is deterministic. New
+                                // deposed keys allocated moving forward will be pseudorandomly
+                                // selected, but we check for collisions and so these
+                                // non-random ones won't hurt.
+                                deposedKey := states.DeposedKey(fmt.Sprintf("%08x", i+1))
+                                isNew, err := upgradeInstanceObjectV3ToV4(rsOld, isOld, instKey, deposedKey)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to migrate deposed generation index %d of %s: %s", i, instAddr, err)
+                                }
+                                rs.Instances = append(rs.Instances, *isNew)
+                        }
+
+                        if instKey != addrs.NoKey && rs.EachMode == "" {
+                                rs.EachMode = "list"
+                        }
+                }
+
+                for _, rs := range resourceStates {
+                        new.Resources = append(new.Resources, *rs)
+                }
+
+                if len(msOld.Path) == 1 && msOld.Path[0] == "root" {
+                        // We'll migrate the outputs for this module too, then.
+                        for name, oldOS := range msOld.Outputs {
+                                newOS := outputStateV4{
+                                        Sensitive: oldOS.Sensitive,
+                                }
+
+                                valRaw := oldOS.Value
+                                valSrc, err := json.Marshal(valRaw)
+                                if err != nil {
+                                        // Should never happen, because this value came from JSON
+                                        // in the first place and so we're just round-tripping here.
+                                        return nil, fmt.Errorf("failed to serialize output %q value as JSON: %s", name, err)
+                                }
+
+                                // The "type" field in state V2 wasn't really that useful
+                                // since it was only able to capture string vs. list vs. map.
+                                // For this reason, during upgrade we'll just discard it
+                                // altogether and use cty's idea of the implied type of
+                                // turning our old value into JSON.
+                                ty, err := ctyjson.ImpliedType(valSrc)
+                                if err != nil {
+                                        // REALLY should never happen, because we literally just
+                                        // encoded this as JSON above!
+                                        return nil, fmt.Errorf("failed to parse output %q value from JSON: %s", name, err)
+                                }
+
+                                // ImpliedType tends to produce structural types, but since older
+                                // version of Terraform didn't support those a collection type
+                                // is probably what was intended, so we'll see if we can
+                                // interpret our value as one.
+                                ty = simplifyImpliedValueType(ty)
+
+                                tySrc, err := ctyjson.MarshalType(ty)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to serialize output %q type as JSON: %s", name, err)
+                                }
+
+                                newOS.ValueRaw = json.RawMessage(valSrc)
+                                newOS.ValueTypeRaw = json.RawMessage(tySrc)
+
+                                new.RootOutputs[name] = newOS
+                        }
+                }
+        }
+
+        new.normalize()
+
+        return new, nil
+}
+
+func upgradeInstanceObjectV3ToV4(rsOld *resourceStateV2, isOld *instanceStateV2, instKey addrs.InstanceKey, deposedKey states.DeposedKey) (*instanceObjectStateV4, error) {
+
+        // Schema versions were, in prior formats, a private concern of the provider
+        // SDK, and not a first-class concept in the state format. Here we're
+        // sniffing for the pre-0.12 SDK's way of representing schema versions
+        // and promoting it to our first-class field if we find it. We'll ignore
+        // it if it doesn't look like what the SDK would've written. If this
+        // sniffing fails then we'll assume schema version 0.
+        var schemaVersion uint64
+        migratedSchemaVersion := false
+        if raw, exists := isOld.Meta["schema_version"]; exists {
+                switch tv := raw.(type) {
+                case string:
+                        v, err := strconv.ParseUint(tv, 10, 64)
+                        if err == nil {
+                                schemaVersion = v
+                                migratedSchemaVersion = true
+                        }
+                case int:
+                        schemaVersion = uint64(tv)
+                        migratedSchemaVersion = true
+                case float64:
+                        schemaVersion = uint64(tv)
+                        migratedSchemaVersion = true
+                }
+        }
+
+        private := map[string]interface{}{}
+        for k, v := range isOld.Meta {
+                if k == "schema_version" && migratedSchemaVersion {
+                        // We're gonna promote this into our first-class schema version field
+                        continue
+                }
+                private[k] = v
+        }
+        var privateJSON []byte
+        if len(private) != 0 {
+                var err error
+                privateJSON, err = json.Marshal(private)
+                if err != nil {
+                        // This shouldn't happen, because the Meta values all came from JSON
+                        // originally anyway.
+                        return nil, fmt.Errorf("cannot serialize private instance object data: %s", err)
+                }
+        }
+
+        var status string
+        if isOld.Tainted {
+                status = "tainted"
+        }
+
+        var instKeyRaw interface{}
+        switch tk := instKey.(type) {
+        case addrs.IntKey:
+                instKeyRaw = int(tk)
+        case addrs.StringKey:
+                instKeyRaw = string(tk)
+        default:
+                if instKeyRaw != nil {
+                        return nil, fmt.Errorf("insupported instance key: %#v", instKey)
+                }
+        }
+
+        var attributes map[string]string
+        if isOld.Attributes != nil {
+                attributes = make(map[string]string, len(isOld.Attributes))
+                for k, v := range isOld.Attributes {
+                        attributes[k] = v
+                }
+        }
+        if isOld.ID != "" {
+                // As a special case, if we don't already have an "id" attribute and
+                // yet there's a non-empty first-class ID on the old object then we'll
+                // create a synthetic id attribute to avoid losing that first-class id.
+                // In practice this generally arises only in tests where state literals
+                // are hand-written in a non-standard way; real code prior to 0.12
+                // would always force the first-class ID to be copied into the
+                // id attribute before storing.
+                if attributes == nil {
+                        attributes = make(map[string]string, len(isOld.Attributes))
+                }
+                if idVal := attributes["id"]; idVal == "" {
+                        attributes["id"] = isOld.ID
+                }
+        }
+
+        dependencies := make([]string, len(rsOld.Dependencies))
+        for i, v := range rsOld.Dependencies {
+                dependencies[i] = parseLegacyDependency(v)
+        }
+
+        return &instanceObjectStateV4{
+                IndexKey:       instKeyRaw,
+                Status:         status,
+                Deposed:        string(deposedKey),
+                AttributesFlat: attributes,
+                Dependencies:   dependencies,
+                SchemaVersion:  schemaVersion,
+                PrivateRaw:     privateJSON,
+        }, nil
+}
+
+// parseLegacyResourceAddress parses the different identifier format used
+// state formats before version 4, like "instance.name.0".
+func parseLegacyResourceAddress(s string) (addrs.ResourceInstance, error) {
+        var ret addrs.ResourceInstance
+
+        // Split based on ".". Every resource address should have at least two
+        // elements (type and name).
+        parts := strings.Split(s, ".")
+        if len(parts) < 2 || len(parts) > 4 {
+                return ret, fmt.Errorf("invalid internal resource address format: %s", s)
+        }
+
+        // Data resource if we have at least 3 parts and the first one is data
+        ret.Resource.Mode = addrs.ManagedResourceMode
+        if len(parts) > 2 && parts[0] == "data" {
+                ret.Resource.Mode = addrs.DataResourceMode
+                parts = parts[1:]
+        }
+
+        // If we're not a data resource and we have more than 3, then it is an error
+        if len(parts) > 3 && ret.Resource.Mode != addrs.DataResourceMode {
+                return ret, fmt.Errorf("invalid internal resource address format: %s", s)
+        }
+
+        // Build the parts of the resource address that are guaranteed to exist
+        ret.Resource.Type = parts[0]
+        ret.Resource.Name = parts[1]
+        ret.Key = addrs.NoKey
+
+        // If we have more parts, then we have an index. Parse that.
+        if len(parts) > 2 {
+                idx, err := strconv.ParseInt(parts[2], 0, 0)
+                if err != nil {
+                        return ret, fmt.Errorf("error parsing resource address %q: %s", s, err)
+                }
+
+                ret.Key = addrs.IntKey(idx)
+        }
+
+        return ret, nil
+}
+
+// simplifyImpliedValueType attempts to heuristically simplify a value type
+// derived from a legacy stored output value into something simpler that
+// is closer to what would've fitted into the pre-v0.12 value type system.
+func simplifyImpliedValueType(ty cty.Type) cty.Type {
+        switch {
+        case ty.IsTupleType():
+                // If all of the element types are the same then we'll make this
+                // a list instead. This is very likely to be true, since prior versions
+                // of Terraform did not officially support mixed-type collections.
+
+                if ty.Equals(cty.EmptyTuple) {
+                        // Don't know what the element type would be, then.
+                        return ty
+                }
+
+                etys := ty.TupleElementTypes()
+                ety := etys[0]
+                for _, other := range etys[1:] {
+                        if !other.Equals(ety) {
+                                // inconsistent types
+                                return ty
+                        }
+                }
+                ety = simplifyImpliedValueType(ety)
+                return cty.List(ety)
+
+        case ty.IsObjectType():
+                // If all of the attribute types are the same then we'll make this
+                // a map instead. This is very likely to be true, since prior versions
+                // of Terraform did not officially support mixed-type collections.
+
+                if ty.Equals(cty.EmptyObject) {
+                        // Don't know what the element type would be, then.
+                        return ty
+                }
+
+                atys := ty.AttributeTypes()
+                var ety cty.Type
+                for _, other := range atys {
+                        if ety == cty.NilType {
+                                ety = other
+                                continue
+                        }
+                        if !other.Equals(ety) {
+                                // inconsistent types
+                                return ty
+                        }
+                }
+                ety = simplifyImpliedValueType(ety)
+                return cty.Map(ety)
+
+        default:
+                // No other normalizations are possible
+                return ty
+        }
+}
+
+func parseLegacyDependency(s string) string {
+        parts := strings.Split(s, ".")
+        ret := parts[0]
+        for _, part := range parts[1:] {
+                if part == "*" {
+                        break
+                }
+                if i, err := strconv.Atoi(part); err == nil {
+                        ret = ret + fmt.Sprintf("[%d]", i)
+                        break
+                }
+                ret = ret + "." + part
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version4.go b/vendor/github.com/hashicorp/terraform/states/statefile/version4.go
new file mode 100644
index 0000000..ee8b652
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version4.go
@@ -0,0 +1,604 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "io"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV4(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV4 := &stateV4{}
+        err := json.Unmarshal(src, sV4)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV4(sV4)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV4(sV4 *stateV4) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var tfVersion *version.Version
+        if sV4.TerraformVersion != "" {
+                var err error
+                tfVersion, err = version.NewVersion(sV4.TerraformVersion)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid Terraform version string",
+                                fmt.Sprintf("State file claims to have been written by Terraform version %q, which is not a valid version string.", sV4.TerraformVersion),
+                        ))
+                }
+        }
+
+        file := &File{
+                TerraformVersion: tfVersion,
+                Serial:           sV4.Serial,
+                Lineage:          sV4.Lineage,
+        }
+
+        state := states.NewState()
+
+        for _, rsV4 := range sV4.Resources {
+                rAddr := addrs.Resource{
+                        Type: rsV4.Type,
+                        Name: rsV4.Name,
+                }
+                switch rsV4.Mode {
+                case "managed":
+                        rAddr.Mode = addrs.ManagedResourceMode
+                case "data":
+                        rAddr.Mode = addrs.DataResourceMode
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource mode in state",
+                                fmt.Sprintf("State contains a resource with mode %q (%q %q) which is not supported.", rsV4.Mode, rAddr.Type, rAddr.Name),
+                        ))
+                        continue
+                }
+
+                moduleAddr := addrs.RootModuleInstance
+                if rsV4.Module != "" {
+                        var addrDiags tfdiags.Diagnostics
+                        moduleAddr, addrDiags = addrs.ParseModuleInstanceStr(rsV4.Module)
+                        diags = diags.Append(addrDiags)
+                        if addrDiags.HasErrors() {
+                                continue
+                        }
+                }
+
+                providerAddr, addrDiags := addrs.ParseAbsProviderConfigStr(rsV4.ProviderConfig)
+                diags.Append(addrDiags)
+                if addrDiags.HasErrors() {
+                        continue
+                }
+
+                var eachMode states.EachMode
+                switch rsV4.EachMode {
+                case "":
+                        eachMode = states.NoEach
+                case "list":
+                        eachMode = states.EachList
+                case "map":
+                        eachMode = states.EachMap
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource metadata in state",
+                                fmt.Sprintf("Resource %s has invalid \"each\" value %q in state.", rAddr.Absolute(moduleAddr), eachMode),
+                        ))
+                        continue
+                }
+
+                ms := state.EnsureModule(moduleAddr)
+
+                // Ensure the resource container object is present in the state.
+                ms.SetResourceMeta(rAddr, eachMode, providerAddr)
+
+                for _, isV4 := range rsV4.Instances {
+                        keyRaw := isV4.IndexKey
+                        var key addrs.InstanceKey
+                        switch tk := keyRaw.(type) {
+                        case int:
+                                key = addrs.IntKey(tk)
+                        case float64:
+                                // Since JSON only has one number type, reading from encoding/json
+                                // gives us a float64 here even if the number is whole.
+                                // float64 has a smaller integer range than int, but in practice
+                                // we rarely have more than a few tens of instances and so
+                                // it's unlikely that we'll exhaust the 52 bits in a float64.
+                                key = addrs.IntKey(int(tk))
+                        case string:
+                                key = addrs.StringKey(tk)
+                        default:
+                                if keyRaw != nil {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Resource %s has an instance with the invalid instance key %#v.", rAddr.Absolute(moduleAddr), keyRaw),
+                                        ))
+                                        continue
+                                }
+                                key = addrs.NoKey
+                        }
+
+                        instAddr := rAddr.Instance(key)
+
+                        obj := &states.ResourceInstanceObjectSrc{
+                                SchemaVersion: isV4.SchemaVersion,
+                        }
+
+                        {
+                                // Instance attributes
+                                switch {
+                                case isV4.AttributesRaw != nil:
+                                        obj.AttrsJSON = isV4.AttributesRaw
+                                case isV4.AttributesFlat != nil:
+                                        obj.AttrsFlat = isV4.AttributesFlat
+                                default:
+                                        // This is odd, but we'll accept it and just treat the
+                                        // object has being empty. In practice this should arise
+                                        // only from the contrived sort of state objects we tend
+                                        // to hand-write inline in tests.
+                                        obj.AttrsJSON = []byte{'{', '}'}
+                                }
+                        }
+
+                        {
+                                // Status
+                                raw := isV4.Status
+                                switch raw {
+                                case "":
+                                        obj.Status = states.ObjectReady
+                                case "tainted":
+                                        obj.Status = states.ObjectTainted
+                                default:
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Instance %s has invalid status %q.", instAddr.Absolute(moduleAddr), raw),
+                                        ))
+                                        continue
+                                }
+                        }
+
+                        if raw := isV4.PrivateRaw; len(raw) > 0 {
+                                obj.Private = raw
+                        }
+
+                        {
+                                depsRaw := isV4.Dependencies
+                                deps := make([]addrs.Referenceable, 0, len(depsRaw))
+                                for _, depRaw := range depsRaw {
+                                        ref, refDiags := addrs.ParseRefStr(depRaw)
+                                        diags = diags.Append(refDiags)
+                                        if refDiags.HasErrors() {
+                                                continue
+                                        }
+                                        if len(ref.Remaining) != 0 {
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Invalid resource instance metadata in state",
+                                                        fmt.Sprintf("Instance %s declares dependency on %q, which is not a reference to a dependable object.", instAddr.Absolute(moduleAddr), depRaw),
+                                                ))
+                                        }
+                                        if ref.Subject == nil {
+                                                // Should never happen
+                                                panic(fmt.Sprintf("parsing dependency %q for instance %s returned a nil address", depRaw, instAddr.Absolute(moduleAddr)))
+                                        }
+                                        deps = append(deps, ref.Subject)
+                                }
+                                obj.Dependencies = deps
+                        }
+
+                        switch {
+                        case isV4.Deposed != "":
+                                dk := states.DeposedKey(isV4.Deposed)
+                                if len(dk) != 8 {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Instance %s has an object with deposed key %q, which is not correctly formatted.", instAddr.Absolute(moduleAddr), isV4.Deposed),
+                                        ))
+                                        continue
+                                }
+                                is := ms.ResourceInstance(instAddr)
+                                if is.HasDeposed(dk) {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Duplicate resource instance in state",
+                                                fmt.Sprintf("Instance %s deposed object %q appears multiple times in the state file.", instAddr.Absolute(moduleAddr), dk),
+                                        ))
+                                        continue
+                                }
+
+                                ms.SetResourceInstanceDeposed(instAddr, dk, obj, providerAddr)
+                        default:
+                                is := ms.ResourceInstance(instAddr)
+                                if is.HasCurrent() {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Duplicate resource instance in state",
+                                                fmt.Sprintf("Instance %s appears multiple times in the state file.", instAddr.Absolute(moduleAddr)),
+                                        ))
+                                        continue
+                                }
+
+                                ms.SetResourceInstanceCurrent(instAddr, obj, providerAddr)
+                        }
+                }
+
+                // We repeat this after creating the instances because
+                // SetResourceInstanceCurrent automatically resets this metadata based
+                // on the incoming objects. That behavior is useful when we're making
+                // piecemeal updates to the state during an apply, but when we're
+                // reading the state file we want to reflect its contents exactly.
+                ms.SetResourceMeta(rAddr, eachMode, providerAddr)
+        }
+
+        // The root module is special in that we persist its attributes and thus
+        // need to reload them now. (For descendent modules we just re-calculate
+        // them based on the latest configuration on each run.)
+        {
+                rootModule := state.RootModule()
+                for name, fos := range sV4.RootOutputs {
+                        os := &states.OutputValue{}
+                        os.Sensitive = fos.Sensitive
+
+                        ty, err := ctyjson.UnmarshalType([]byte(fos.ValueTypeRaw))
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid output value type in state",
+                                        fmt.Sprintf("The state file has an invalid type specification for output %q: %s.", name, err),
+                                ))
+                                continue
+                        }
+
+                        val, err := ctyjson.Unmarshal([]byte(fos.ValueRaw), ty)
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid output value saved in state",
+                                        fmt.Sprintf("The state file has an invalid value for output %q: %s.", name, err),
+                                ))
+                                continue
+                        }
+
+                        os.Value = val
+                        rootModule.OutputValues[name] = os
+                }
+        }
+
+        file.State = state
+        return file, diags
+}
+
+func writeStateV4(file *File, w io.Writer) tfdiags.Diagnostics {
+        // Here we'll convert back from the "File" representation to our
+        // stateV4 struct representation and write that.
+        //
+        // While we support legacy state formats for reading, we only support the
+        // latest for writing and so if a V5 is added in future then this function
+        // should be deleted and replaced with a writeStateV5, even though the
+        // read/prepare V4 functions above would stick around.
+
+        var diags tfdiags.Diagnostics
+        if file == nil || file.State == nil {
+                panic("attempt to write nil state to file")
+        }
+
+        var terraformVersion string
+        if file.TerraformVersion != nil {
+                terraformVersion = file.TerraformVersion.String()
+        }
+
+        sV4 := &stateV4{
+                TerraformVersion: terraformVersion,
+                Serial:           file.Serial,
+                Lineage:          file.Lineage,
+                RootOutputs:      map[string]outputStateV4{},
+                Resources:        []resourceStateV4{},
+        }
+
+        for name, os := range file.State.RootModule().OutputValues {
+                src, err := ctyjson.Marshal(os.Value, os.Value.Type())
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize output value in state",
+                                fmt.Sprintf("An error occured while serializing output value %q: %s.", name, err),
+                        ))
+                        continue
+                }
+
+                typeSrc, err := ctyjson.MarshalType(os.Value.Type())
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize output value in state",
+                                fmt.Sprintf("An error occured while serializing the type of output value %q: %s.", name, err),
+                        ))
+                        continue
+                }
+
+                sV4.RootOutputs[name] = outputStateV4{
+                        Sensitive:    os.Sensitive,
+                        ValueRaw:     json.RawMessage(src),
+                        ValueTypeRaw: json.RawMessage(typeSrc),
+                }
+        }
+
+        for _, ms := range file.State.Modules {
+                moduleAddr := ms.Addr
+                for _, rs := range ms.Resources {
+                        resourceAddr := rs.Addr
+
+                        var mode string
+                        switch resourceAddr.Mode {
+                        case addrs.ManagedResourceMode:
+                                mode = "managed"
+                        case addrs.DataResourceMode:
+                                mode = "data"
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to serialize resource in state",
+                                        fmt.Sprintf("Resource %s has mode %s, which cannot be serialized in state", resourceAddr.Absolute(moduleAddr), resourceAddr.Mode),
+                                ))
+                                continue
+                        }
+
+                        var eachMode string
+                        switch rs.EachMode {
+                        case states.NoEach:
+                                eachMode = ""
+                        case states.EachList:
+                                eachMode = "list"
+                        case states.EachMap:
+                                eachMode = "map"
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to serialize resource in state",
+                                        fmt.Sprintf("Resource %s has \"each\" mode %s, which cannot be serialized in state", resourceAddr.Absolute(moduleAddr), rs.EachMode),
+                                ))
+                                continue
+                        }
+
+                        sV4.Resources = append(sV4.Resources, resourceStateV4{
+                                Module:         moduleAddr.String(),
+                                Mode:           mode,
+                                Type:           resourceAddr.Type,
+                                Name:           resourceAddr.Name,
+                                EachMode:       eachMode,
+                                ProviderConfig: rs.ProviderConfig.String(),
+                                Instances:      []instanceObjectStateV4{},
+                        })
+                        rsV4 := &(sV4.Resources[len(sV4.Resources)-1])
+
+                        for key, is := range rs.Instances {
+                                if is.HasCurrent() {
+                                        var objDiags tfdiags.Diagnostics
+                                        rsV4.Instances, objDiags = appendInstanceObjectStateV4(
+                                                rs, is, key, is.Current, states.NotDeposed,
+                                                rsV4.Instances,
+                                        )
+                                        diags = diags.Append(objDiags)
+                                }
+                                for dk, obj := range is.Deposed {
+                                        var objDiags tfdiags.Diagnostics
+                                        rsV4.Instances, objDiags = appendInstanceObjectStateV4(
+                                                rs, is, key, obj, dk,
+                                                rsV4.Instances,
+                                        )
+                                        diags = diags.Append(objDiags)
+                                }
+                        }
+                }
+        }
+
+        sV4.normalize()
+
+        src, err := json.MarshalIndent(sV4, "", "  ")
+        if err != nil {
+                // Shouldn't happen if we do our conversion to *stateV4 correctly above.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to serialize state",
+                        fmt.Sprintf("An error occured while serializing the state to save it. This is a bug in Terraform and should be reported: %s.", err),
+                ))
+                return diags
+        }
+        src = append(src, '\n')
+
+        _, err = w.Write(src)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to write state",
+                        fmt.Sprintf("An error occured while writing the serialized state: %s.", err),
+                ))
+                return diags
+        }
+
+        return diags
+}
+
+func appendInstanceObjectStateV4(rs *states.Resource, is *states.ResourceInstance, key addrs.InstanceKey, obj *states.ResourceInstanceObjectSrc, deposed states.DeposedKey, isV4s []instanceObjectStateV4) ([]instanceObjectStateV4, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var status string
+        switch obj.Status {
+        case states.ObjectReady:
+                status = ""
+        case states.ObjectTainted:
+                status = "tainted"
+        default:
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to serialize resource instance in state",
+                        fmt.Sprintf("Instance %s has status %s, which cannot be saved in state.", rs.Addr.Instance(key), obj.Status),
+                ))
+        }
+
+        var privateRaw []byte
+        if len(obj.Private) > 0 {
+                privateRaw = obj.Private
+        }
+
+        deps := make([]string, len(obj.Dependencies))
+        for i, depAddr := range obj.Dependencies {
+                deps[i] = depAddr.String()
+        }
+
+        var rawKey interface{}
+        switch tk := key.(type) {
+        case addrs.IntKey:
+                rawKey = int(tk)
+        case addrs.StringKey:
+                rawKey = string(tk)
+        default:
+                if key != addrs.NoKey {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize resource instance in state",
+                                fmt.Sprintf("Instance %s has an unsupported instance key: %#v.", rs.Addr.Instance(key), key),
+                        ))
+                }
+        }
+
+        return append(isV4s, instanceObjectStateV4{
+                IndexKey:       rawKey,
+                Deposed:        string(deposed),
+                Status:         status,
+                SchemaVersion:  obj.SchemaVersion,
+                AttributesFlat: obj.AttrsFlat,
+                AttributesRaw:  obj.AttrsJSON,
+                PrivateRaw:     privateRaw,
+                Dependencies:   deps,
+        }), diags
+}
+
+type stateV4 struct {
+        Version          stateVersionV4           `json:"version"`
+        TerraformVersion string                   `json:"terraform_version"`
+        Serial           uint64                   `json:"serial"`
+        Lineage          string                   `json:"lineage"`
+        RootOutputs      map[string]outputStateV4 `json:"outputs"`
+        Resources        []resourceStateV4        `json:"resources"`
+}
+
+// normalize makes some in-place changes to normalize the way items are
+// stored to ensure that two functionally-equivalent states will be stored
+// identically.
+func (s *stateV4) normalize() {
+        sort.Stable(sortResourcesV4(s.Resources))
+        for _, rs := range s.Resources {
+                sort.Stable(sortInstancesV4(rs.Instances))
+        }
+}
+
+type outputStateV4 struct {
+        ValueRaw     json.RawMessage `json:"value"`
+        ValueTypeRaw json.RawMessage `json:"type"`
+        Sensitive    bool            `json:"sensitive,omitempty"`
+}
+
+type resourceStateV4 struct {
+        Module         string                  `json:"module,omitempty"`
+        Mode           string                  `json:"mode"`
+        Type           string                  `json:"type"`
+        Name           string                  `json:"name"`
+        EachMode       string                  `json:"each,omitempty"`
+        ProviderConfig string                  `json:"provider"`
+        Instances      []instanceObjectStateV4 `json:"instances"`
+}
+
+type instanceObjectStateV4 struct {
+        IndexKey interface{} `json:"index_key,omitempty"`
+        Status   string      `json:"status,omitempty"`
+        Deposed  string      `json:"deposed,omitempty"`
+
+        SchemaVersion  uint64            `json:"schema_version"`
+        AttributesRaw  json.RawMessage   `json:"attributes,omitempty"`
+        AttributesFlat map[string]string `json:"attributes_flat,omitempty"`
+
+        PrivateRaw []byte `json:"private,omitempty"`
+
+        Dependencies []string `json:"depends_on,omitempty"`
+}
+
+// stateVersionV4 is a weird special type we use to produce our hard-coded
+// "version": 4 in the JSON serialization.
+type stateVersionV4 struct{}
+
+func (sv stateVersionV4) MarshalJSON() ([]byte, error) {
+        return []byte{'4'}, nil
+}
+
+func (sv stateVersionV4) UnmarshalJSON([]byte) error {
+        // Nothing to do: we already know we're version 4
+        return nil
+}
+
+type sortResourcesV4 []resourceStateV4
+
+func (sr sortResourcesV4) Len() int      { return len(sr) }
+func (sr sortResourcesV4) Swap(i, j int) { sr[i], sr[j] = sr[j], sr[i] }
+func (sr sortResourcesV4) Less(i, j int) bool {
+        switch {
+        case sr[i].Mode != sr[j].Mode:
+                return sr[i].Mode < sr[j].Mode
+        case sr[i].Type != sr[j].Type:
+                return sr[i].Type < sr[j].Type
+        case sr[i].Name != sr[j].Name:
+                return sr[i].Name < sr[j].Name
+        default:
+                return false
+        }
+}
+
+type sortInstancesV4 []instanceObjectStateV4
+
+func (si sortInstancesV4) Len() int      { return len(si) }
+func (si sortInstancesV4) Swap(i, j int) { si[i], si[j] = si[j], si[i] }
+func (si sortInstancesV4) Less(i, j int) bool {
+        ki := si[i].IndexKey
+        kj := si[j].IndexKey
+        if ki != kj {
+                if (ki == nil) != (kj == nil) {
+                        return ki == nil
+                }
+                if kii, isInt := ki.(int); isInt {
+                        if kji, isInt := kj.(int); isInt {
+                                return kii < kji
+                        }
+                        return true
+                }
+                if kis, isStr := ki.(string); isStr {
+                        if kjs, isStr := kj.(string); isStr {
+                                return kis < kjs
+                        }
+                        return true
+                }
+        }
+        if si[i].Deposed != si[j].Deposed {
+                return si[i].Deposed < si[j].Deposed
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/write.go b/vendor/github.com/hashicorp/terraform/states/statefile/write.go
new file mode 100644
index 0000000..548ba8a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/write.go
@@ -0,0 +1,17 @@
+package statefile
+
+import (
+        "io"
+
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// Write writes the given state to the given writer in the current state
+// serialization format.
+func Write(s *File, w io.Writer) error {
+        // Always record the current terraform version in the state.
+        s.TerraformVersion = tfversion.SemVer
+
+        diags := writeStateV4(s, w)
+        return diags.Err()
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/sync.go b/vendor/github.com/hashicorp/terraform/states/sync.go
new file mode 100644
index 0000000..a377446
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/sync.go
@@ -0,0 +1,537 @@
+package states
+
+import (
+        "log"
+        "sync"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SyncState is a wrapper around State that provides concurrency-safe access to
+// various common operations that occur during a Terraform graph walk, or other
+// similar concurrent contexts.
+//
+// When a SyncState wrapper is in use, no concurrent direct access to the
+// underlying objects is permitted unless the caller first acquires an explicit
+// lock, using the Lock and Unlock methods. Most callers should _not_
+// explicitly lock, and should instead use the other methods of this type that
+// handle locking automatically.
+//
+// Since SyncState is able to safely consolidate multiple updates into a single
+// atomic operation, many of its methods are at a higher level than those
+// of the underlying types, and operate on the state as a whole rather than
+// on individual sub-structures of the state.
+//
+// SyncState can only protect against races within its own methods. It cannot
+// provide any guarantees about the order in which concurrent operations will
+// be processed, so callers may still need to employ higher-level techniques
+// for ensuring correct operation sequencing, such as building and walking
+// a dependency graph.
+type SyncState struct {
+        state *State
+        lock  sync.RWMutex
+}
+
+// Module returns a snapshot of the state of the module instance with the given
+// address, or nil if no such module is tracked.
+//
+// The return value is a pointer to a copy of the module state, which the
+// caller may then freely access and mutate. However, since the module state
+// tends to be a large data structure with many child objects, where possible
+// callers should prefer to use a more granular accessor to access a child
+// module directly, and thus reduce the amount of copying required.
+func (s *SyncState) Module(addr addrs.ModuleInstance) *Module {
+        s.lock.RLock()
+        ret := s.state.Module(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// RemoveModule removes the entire state for the given module, taking with
+// it any resources associated with the module. This should generally be
+// called only for modules whose resources have all been destroyed, but
+// that is not enforced by this method.
+func (s *SyncState) RemoveModule(addr addrs.ModuleInstance) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        s.state.RemoveModule(addr)
+}
+
+// OutputValue returns a snapshot of the state of the output value with the
+// given address, or nil if no such output value is tracked.
+//
+// The return value is a pointer to a copy of the output value state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) OutputValue(addr addrs.AbsOutputValue) *OutputValue {
+        s.lock.RLock()
+        ret := s.state.OutputValue(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// SetOutputValue writes a given output value into the state, overwriting
+// any existing value of the same name.
+//
+// If the module containing the output is not yet tracked in state then it
+// be added as a side-effect.
+func (s *SyncState) SetOutputValue(addr addrs.AbsOutputValue, value cty.Value, sensitive bool) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetOutputValue(addr.OutputValue.Name, value, sensitive)
+}
+
+// RemoveOutputValue removes the stored value for the output value with the
+// given address.
+//
+// If this results in its containing module being empty, the module will be
+// pruned from the state as a side-effect.
+func (s *SyncState) RemoveOutputValue(addr addrs.AbsOutputValue) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.RemoveOutputValue(addr.OutputValue.Name)
+        s.maybePruneModule(addr.Module)
+}
+
+// LocalValue returns the current value associated with the given local value
+// address.
+func (s *SyncState) LocalValue(addr addrs.AbsLocalValue) cty.Value {
+        s.lock.RLock()
+        // cty.Value is immutable, so we don't need any extra copying here.
+        ret := s.state.LocalValue(addr)
+        s.lock.RUnlock()
+        return ret
+}
+
+// SetLocalValue writes a given output value into the state, overwriting
+// any existing value of the same name.
+//
+// If the module containing the local value is not yet tracked in state then it
+// will be added as a side-effect.
+func (s *SyncState) SetLocalValue(addr addrs.AbsLocalValue, value cty.Value) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetLocalValue(addr.LocalValue.Name, value)
+}
+
+// RemoveLocalValue removes the stored value for the local value with the
+// given address.
+//
+// If this results in its containing module being empty, the module will be
+// pruned from the state as a side-effect.
+func (s *SyncState) RemoveLocalValue(addr addrs.AbsLocalValue) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.RemoveLocalValue(addr.LocalValue.Name)
+        s.maybePruneModule(addr.Module)
+}
+
+// Resource returns a snapshot of the state of the resource with the given
+// address, or nil if no such resource is tracked.
+//
+// The return value is a pointer to a copy of the resource state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) Resource(addr addrs.AbsResource) *Resource {
+        s.lock.RLock()
+        ret := s.state.Resource(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// ResourceInstance returns a snapshot of the state the resource instance with
+// the given address, or nil if no such instance is tracked.
+//
+// The return value is a pointer to a copy of the instance state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstance {
+        s.lock.RLock()
+        ret := s.state.ResourceInstance(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// ResourceInstanceObject returns a snapshot of the current instance object
+// of the given generation belonging to the instance with the given address,
+// or nil if no such object is tracked..
+//
+// The return value is a pointer to a copy of the object, which the caller may
+// then freely access and mutate.
+func (s *SyncState) ResourceInstanceObject(addr addrs.AbsResourceInstance, gen Generation) *ResourceInstanceObjectSrc {
+        s.lock.RLock()
+        defer s.lock.RUnlock()
+
+        inst := s.state.ResourceInstance(addr)
+        if inst == nil {
+                return nil
+        }
+        return inst.GetGeneration(gen).DeepCopy()
+}
+
+// SetResourceMeta updates the resource-level metadata for the resource at
+// the given address, creating the containing module state and resource state
+// as a side-effect if not already present.
+func (s *SyncState) SetResourceMeta(addr addrs.AbsResource, eachMode EachMode, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceMeta(addr.Resource, eachMode, provider)
+}
+
+// RemoveResource removes the entire state for the given resource, taking with
+// it any instances associated with the resource. This should generally be
+// called only for resource objects whose instances have all been destroyed,
+// but that is not enforced by this method. (Use RemoveResourceIfEmpty instead
+// to safely check first.)
+func (s *SyncState) RemoveResource(addr addrs.AbsResource) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.RemoveResource(addr.Resource)
+        s.maybePruneModule(addr.Module)
+}
+
+// RemoveResourceIfEmpty is similar to RemoveResource but first checks to
+// make sure there are no instances or objects left in the resource.
+//
+// Returns true if the resource was removed, or false if remaining child
+// objects prevented its removal. Returns true also if the resource was
+// already absent, and thus no action needed to be taken.
+func (s *SyncState) RemoveResourceIfEmpty(addr addrs.AbsResource) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return true // nothing to do
+        }
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return true // nothing to do
+        }
+        if len(rs.Instances) != 0 {
+                // We don't check here for the possibility of instances that exist
+                // but don't have any objects because it's the responsibility of the
+                // instance-mutation methods to prune those away automatically.
+                return false
+        }
+        ms.RemoveResource(addr.Resource)
+        s.maybePruneModule(addr.Module)
+        return true
+}
+
+// MaybeFixUpResourceInstanceAddressForCount deals with the situation where a
+// resource has changed from having "count" set to not set, or vice-versa, and
+// so we need to rename the zeroth instance key to no key at all, or vice-versa.
+//
+// Set countEnabled to true if the resource has count set in its new
+// configuration, or false if it does not.
+//
+// The state is modified in-place if necessary, moving a resource instance
+// between the two addresses. The return value is true if a change was made,
+// and false otherwise.
+func (s *SyncState) MaybeFixUpResourceInstanceAddressForCount(addr addrs.AbsResource, countEnabled bool) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return false
+        }
+
+        relAddr := addr.Resource
+        rs := ms.Resource(relAddr)
+        if rs == nil {
+                return false
+        }
+        huntKey := addrs.NoKey
+        replaceKey := addrs.InstanceKey(addrs.IntKey(0))
+        if !countEnabled {
+                huntKey, replaceKey = replaceKey, huntKey
+        }
+
+        is, exists := rs.Instances[huntKey]
+        if !exists {
+                return false
+        }
+
+        if _, exists := rs.Instances[replaceKey]; exists {
+                // If the replacement key also exists then we'll do nothing and keep both.
+                return false
+        }
+
+        // If we get here then we need to "rename" from hunt to replace
+        rs.Instances[replaceKey] = is
+        delete(rs.Instances, huntKey)
+        return true
+}
+
+// SetResourceInstanceCurrent saves the given instance object as the current
+// generation of the resource instance with the given address, simulataneously
+// updating the recorded provider configuration address, dependencies, and
+// resource EachMode.
+//
+// Any existing current instance object for the given resource is overwritten.
+// Set obj to nil to remove the primary generation object altogether. If there
+// are no deposed objects then the instance as a whole will be removed, which
+// may in turn also remove the containing module if it becomes empty.
+//
+// The caller must ensure that the given ResourceInstanceObject is not
+// concurrently mutated during this call, but may be freely used again once
+// this function returns.
+//
+// The provider address and "each mode" are resource-wide settings and so they
+// are updated for all other instances of the same resource as a side-effect of
+// this call.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then they will be added as a side-effect.
+func (s *SyncState) SetResourceInstanceCurrent(addr addrs.AbsResourceInstance, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceInstanceCurrent(addr.Resource, obj.DeepCopy(), provider)
+        s.maybePruneModule(addr.Module)
+}
+
+// SetResourceInstanceDeposed saves the given instance object as a deposed
+// generation of the resource instance with the given address and deposed key.
+//
+// Call this method only for pre-existing deposed objects that already have
+// a known DeposedKey. For example, this method is useful if reloading objects
+// that were persisted to a state file. To mark the current object as deposed,
+// use DeposeResourceInstanceObject instead.
+//
+// The caller must ensure that the given ResourceInstanceObject is not
+// concurrently mutated during this call, but may be freely used again once
+// this function returns.
+//
+// The resource that contains the given instance must already exist in the
+// state, or this method will panic. Use Resource to check first if its
+// presence is not already guaranteed.
+//
+// Any existing current instance object for the given resource and deposed key
+// is overwritten. Set obj to nil to remove the deposed object altogether. If
+// the instance is left with no objects after this operation then it will
+// be removed from its containing resource altogether.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then they will be added as a side-effect.
+func (s *SyncState) SetResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceInstanceDeposed(addr.Resource, key, obj.DeepCopy(), provider)
+        s.maybePruneModule(addr.Module)
+}
+
+// DeposeResourceInstanceObject moves the current instance object for the
+// given resource instance address into the deposed set, leaving the instance
+// without a current object.
+//
+// The return value is the newly-allocated deposed key, or NotDeposed if the
+// given instance is already lacking a current object.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then there cannot be a current object for the
+// given instance, and so NotDeposed will be returned without modifying the
+// state at all.
+func (s *SyncState) DeposeResourceInstanceObject(addr addrs.AbsResourceInstance) DeposedKey {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return NotDeposed
+        }
+
+        return ms.deposeResourceInstanceObject(addr.Resource, NotDeposed)
+}
+
+// DeposeResourceInstanceObjectForceKey is like DeposeResourceInstanceObject
+// but uses a pre-allocated key. It's the caller's responsibility to ensure
+// that there aren't any races to use a particular key; this method will panic
+// if the given key is already in use.
+func (s *SyncState) DeposeResourceInstanceObjectForceKey(addr addrs.AbsResourceInstance, forcedKey DeposedKey) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        if forcedKey == NotDeposed {
+                // Usage error: should use DeposeResourceInstanceObject in this case
+                panic("DeposeResourceInstanceObjectForceKey called without forced key")
+        }
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return // Nothing to do, since there can't be any current object either.
+        }
+
+        ms.deposeResourceInstanceObject(addr.Resource, forcedKey)
+}
+
+// ForgetResourceInstanceAll removes the record of all objects associated with
+// the specified resource instance, if present. If not present, this is a no-op.
+func (s *SyncState) ForgetResourceInstanceAll(addr addrs.AbsResourceInstance) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.ForgetResourceInstanceAll(addr.Resource)
+        s.maybePruneModule(addr.Module)
+}
+
+// ForgetResourceInstanceDeposed removes the record of the deposed object with
+// the given address and key, if present. If not present, this is a no-op.
+func (s *SyncState) ForgetResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.ForgetResourceInstanceDeposed(addr.Resource, key)
+        s.maybePruneModule(addr.Module)
+}
+
+// MaybeRestoreResourceInstanceDeposed will restore the deposed object with the
+// given key on the specified resource as the current object for that instance
+// if and only if that would not cause us to forget an existing current
+// object for that instance.
+//
+// Returns true if the object was restored to current, or false if no change
+// was made at all.
+func (s *SyncState) MaybeRestoreResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        if key == NotDeposed {
+                panic("MaybeRestoreResourceInstanceDeposed called without DeposedKey")
+        }
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                // Nothing to do, since the specified deposed object cannot exist.
+                return false
+        }
+
+        return ms.maybeRestoreResourceInstanceDeposed(addr.Resource, key)
+}
+
+// RemovePlannedResourceInstanceObjects removes from the state any resource
+// instance objects that have the status ObjectPlanned, indiciating that they
+// are just transient placeholders created during planning.
+//
+// Note that this does not restore any "ready" or "tainted" object that might
+// have been present before the planned object was written. The only real use
+// for this method is in preparing the state created during a refresh walk,
+// where we run the planning step for certain instances just to create enough
+// information to allow correct expression evaluation within provider and
+// data resource blocks. Discarding planned instances in that case is okay
+// because the refresh phase only creates planned objects to stand in for
+// objects that don't exist yet, and thus the planned object must have been
+// absent before by definition.
+func (s *SyncState) RemovePlannedResourceInstanceObjects() {
+        // TODO: Merge together the refresh and plan phases into a single walk,
+        // so we can remove the need to create this "partial plan" during refresh
+        // that we then need to clean up before proceeding.
+
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        for _, ms := range s.state.Modules {
+                moduleAddr := ms.Addr
+
+                for _, rs := range ms.Resources {
+                        resAddr := rs.Addr
+
+                        for ik, is := range rs.Instances {
+                                instAddr := resAddr.Instance(ik)
+
+                                if is.Current != nil && is.Current.Status == ObjectPlanned {
+                                        // Setting the current instance to nil removes it from the
+                                        // state altogether if there are not also deposed instances.
+                                        ms.SetResourceInstanceCurrent(instAddr, nil, rs.ProviderConfig)
+                                }
+
+                                for dk, obj := range is.Deposed {
+                                        // Deposed objects should never be "planned", but we'll
+                                        // do this anyway for the sake of completeness.
+                                        if obj.Status == ObjectPlanned {
+                                                ms.ForgetResourceInstanceDeposed(instAddr, dk)
+                                        }
+                                }
+                        }
+                }
+
+                // We may have deleted some objects, which means that we may have
+                // left a module empty, and so we must prune to preserve the invariant
+                // that only the root module is allowed to be empty.
+                s.maybePruneModule(moduleAddr)
+        }
+}
+
+// Lock acquires an explicit lock on the state, allowing direct read and write
+// access to the returned state object. The caller must call Unlock once
+// access is no longer needed, and then immediately discard the state pointer
+// pointer.
+//
+// Most callers should not use this. Instead, use the concurrency-safe
+// accessors and mutators provided directly on SyncState.
+func (s *SyncState) Lock() *State {
+        s.lock.Lock()
+        return s.state
+}
+
+// Unlock releases a lock previously acquired by Lock, at which point the
+// caller must cease all use of the state pointer that was returned.
+//
+// Do not call this method except to end an explicit lock acquired by
+// Lock. If a caller calls Unlock without first holding the lock, behavior
+// is undefined.
+func (s *SyncState) Unlock() {
+        s.lock.Unlock()
+}
+
+// maybePruneModule will remove a module from the state altogether if it is
+// empty, unless it's the root module which must always be present.
+//
+// This helper method is not concurrency-safe on its own, so must only be
+// called while the caller is already holding the lock for writing.
+func (s *SyncState) maybePruneModule(addr addrs.ModuleInstance) {
+        if addr.IsRoot() {
+                // We never prune the root.
+                return
+        }
+
+        ms := s.state.Module(addr)
+        if ms == nil {
+                return
+        }
+
+        if ms.empty() {
+                log.Printf("[TRACE] states.SyncState: pruning %s because it is empty", addr)
+                s.state.RemoveModule(addr)
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context.go b/vendor/github.com/hashicorp/terraform/terraform/context.go
index f133cc2..afdba99 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context.go
@@ -1,20 +1,26 @@
 package terraform
 
 import (
+        "bytes"
         "context"
         "fmt"
         "log"
-        "sort"
         "strings"
         "sync"
 
-        "github.com/hashicorp/terraform/tfdiags"
-
-        "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/version"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/states/statefile"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // InputMode defines what sort of input will be asked for when Input
@@ -51,19 +57,18 @@ var (
 // ContextOpts are the user-configurable options to create a context with
 // NewContext.
 type ContextOpts struct {
-        Meta               *ContextMeta
-        Destroy            bool
-        Diff               *Diff
-        Hooks              []Hook
-        Module             *module.Tree
-        Parallelism        int
-        State              *State
-        StateFutureAllowed bool
-        ProviderResolver   ResourceProviderResolver
-        Provisioners       map[string]ResourceProvisionerFactory
-        Shadow             bool
-        Targets            []string
-        Variables          map[string]interface{}
+        Config    *configs.Config
+        Changes   *plans.Changes
+        State     *states.State
+        Targets   []addrs.Targetable
+        Variables InputValues
+        Meta      *ContextMeta
+        Destroy   bool
+
+        Hooks            []Hook
+        Parallelism      int
+        ProviderResolver providers.Resolver
+        Provisioners     map[string]ProvisionerFactory
 
         // If non-nil, will apply as additional constraints on the provider
         // plugins that will be requested from the provider resolver.
@@ -83,32 +88,25 @@ type ContextMeta struct {
 
 // Context represents all the context that Terraform needs in order to
 // perform operations on infrastructure. This structure is built using
-// NewContext. See the documentation for that.
-//
-// Extra functions on Context can be found in context_*.go files.
+// NewContext.
 type Context struct {
-        // Maintainer note: Anytime this struct is changed, please verify
-        // that newShadowContext still does the right thing. Tests should
-        // fail regardless but putting this note here as well.
+        config    *configs.Config
+        changes   *plans.Changes
+        state     *states.State
+        targets   []addrs.Targetable
+        variables InputValues
+        meta      *ContextMeta
+        destroy   bool
 
-        components contextComponentFactory
-        destroy    bool
-        diff       *Diff
-        diffLock   sync.RWMutex
         hooks      []Hook
-        meta       *ContextMeta
-        module     *module.Tree
+        components contextComponentFactory
+        schemas    *Schemas
         sh         *stopHook
-        shadow     bool
-        state      *State
-        stateLock  sync.RWMutex
-        targets    []string
         uiInput    UIInput
-        variables  map[string]interface{}
 
         l                   sync.Mutex // Lock acquired during any task
         parallelSem         Semaphore
-        providerInputConfig map[string]map[string]interface{}
+        providerInputConfig map[string]map[string]cty.Value
         providerSHA256s     map[string][]byte
         runLock             sync.Mutex
         runCond             *sync.Cond
@@ -117,17 +115,23 @@ type Context struct {
         shadowErr           error
 }
 
+// (additional methods on Context can be found in context_*.go files.)
+
 // NewContext creates a new Context structure.
 //
-// Once a Context is creator, the pointer values within ContextOpts
-// should not be mutated in any way, since the pointers are copied, not
-// the values themselves.
-func NewContext(opts *ContextOpts) (*Context, error) {
-        // Validate the version requirement if it is given
-        if opts.Module != nil {
-                if err := CheckRequiredVersion(opts.Module); err != nil {
-                        return nil, err
-                }
+// Once a Context is created, the caller must not access or mutate any of
+// the objects referenced (directly or indirectly) by the ContextOpts fields.
+//
+// If the returned diagnostics contains errors then the resulting context is
+// invalid and must not be used.
+func NewContext(opts *ContextOpts) (*Context, tfdiags.Diagnostics) {
+        log.Printf("[TRACE] terraform.NewContext: starting")
+        diags := CheckCoreVersionRequirements(opts.Config)
+        // If version constraints are not met then we'll bail early since otherwise
+        // we're likely to just see a bunch of other errors related to
+        // incompatibilities, which could be overwhelming for the user.
+        if diags.HasErrors() {
+                return nil, diags
         }
 
         // Copy all the hooks and add our stop hook. We don't append directly
@@ -139,21 +143,9 @@ func NewContext(opts *ContextOpts) (*Context, error) {
 
         state := opts.State
         if state == nil {
-                state = new(State)
-                state.init()
-        }
-
-        // If our state is from the future, then error. Callers can avoid
-        // this error by explicitly setting `StateFutureAllowed`.
-        if err := CheckStateVersion(state); err != nil && !opts.StateFutureAllowed {
-                return nil, err
+                state = states.NewState()
         }
 
-        // Explicitly reset our state version to our current version so that
-        // any operations we do will write out that our latest version
-        // has run.
-        state.TFVersion = version.Version
-
         // Determine parallelism, default to 10. We do this both to limit
         // CPU pressure but also to have an extra guard against rate throttling
         // from providers.
@@ -168,60 +160,84 @@ func NewContext(opts *ContextOpts) (*Context, error) {
         //    2 - Take values specified in -var flags, overriding values
         //        set by environment variables if necessary. This includes
         //        values taken from -var-file in addition.
-        variables := make(map[string]interface{})
-        if opts.Module != nil {
-                var err error
-                variables, err = Variables(opts.Module, opts.Variables)
-                if err != nil {
-                        return nil, err
-                }
+        var variables InputValues
+        if opts.Config != nil {
+                // Default variables from the configuration seed our map.
+                variables = DefaultVariableValues(opts.Config.Module.Variables)
         }
+        // Variables provided by the caller (from CLI, environment, etc) can
+        // override the defaults.
+        variables = variables.Override(opts.Variables)
 
         // Bind available provider plugins to the constraints in config
-        var providers map[string]ResourceProviderFactory
+        var providerFactories map[string]providers.Factory
         if opts.ProviderResolver != nil {
-                var err error
-                deps := ModuleTreeDependencies(opts.Module, state)
+                deps := ConfigTreeDependencies(opts.Config, state)
                 reqd := deps.AllPluginRequirements()
                 if opts.ProviderSHA256s != nil && !opts.SkipProviderVerify {
                         reqd.LockExecutables(opts.ProviderSHA256s)
                 }
-                providers, err = resourceProviderFactories(opts.ProviderResolver, reqd)
-                if err != nil {
-                        return nil, err
+                log.Printf("[TRACE] terraform.NewContext: resolving provider version selections")
+
+                var providerDiags tfdiags.Diagnostics
+                providerFactories, providerDiags = resourceProviderFactories(opts.ProviderResolver, reqd)
+                diags = diags.Append(providerDiags)
+
+                if diags.HasErrors() {
+                        return nil, diags
                 }
         } else {
-                providers = make(map[string]ResourceProviderFactory)
+                providerFactories = make(map[string]providers.Factory)
         }
 
-        diff := opts.Diff
-        if diff == nil {
-                diff = &Diff{}
+        components := &basicComponentFactory{
+                providers:    providerFactories,
+                provisioners: opts.Provisioners,
         }
 
+        log.Printf("[TRACE] terraform.NewContext: loading provider schemas")
+        schemas, err := LoadSchemas(opts.Config, opts.State, components)
+        if err != nil {
+                diags = diags.Append(err)
+                return nil, diags
+        }
+
+        changes := opts.Changes
+        if changes == nil {
+                changes = plans.NewChanges()
+        }
+
+        config := opts.Config
+        if config == nil {
+                config = configs.NewEmptyConfig()
+        }
+
+        log.Printf("[TRACE] terraform.NewContext: complete")
+
         return &Context{
-                components: &basicComponentFactory{
-                        providers:    providers,
-                        provisioners: opts.Provisioners,
-                },
-                destroy:   opts.Destroy,
-                diff:      diff,
-                hooks:     hooks,
-                meta:      opts.Meta,
-                module:    opts.Module,
-                shadow:    opts.Shadow,
-                state:     state,
-                targets:   opts.Targets,
-                uiInput:   opts.UIInput,
-                variables: variables,
+                components: components,
+                schemas:    schemas,
+                destroy:    opts.Destroy,
+                changes:    changes,
+                hooks:      hooks,
+                meta:       opts.Meta,
+                config:     config,
+                state:      state,
+                targets:    opts.Targets,
+                uiInput:    opts.UIInput,
+                variables:  variables,
 
                 parallelSem:         NewSemaphore(par),
-                providerInputConfig: make(map[string]map[string]interface{}),
+                providerInputConfig: make(map[string]map[string]cty.Value),
                 providerSHA256s:     opts.ProviderSHA256s,
                 sh:                  sh,
         }, nil
 }
 
+func (c *Context) Schemas() *Schemas {
+        return c.schemas
+}
+
 type ContextGraphOpts struct {
         // If true, validates the graph structure (checks for cycles).
         Validate bool
@@ -233,7 +249,7 @@ type ContextGraphOpts struct {
 // Graph returns the graph used for the given operation type.
 //
 // The most extensive or complex graph type is GraphTypePlan.
-func (c *Context) Graph(typ GraphType, opts *ContextGraphOpts) (*Graph, error) {
+func (c *Context) Graph(typ GraphType, opts *ContextGraphOpts) (*Graph, tfdiags.Diagnostics) {
         if opts == nil {
                 opts = &ContextGraphOpts{Validate: true}
         }
@@ -242,65 +258,71 @@ func (c *Context) Graph(typ GraphType, opts *ContextGraphOpts) (*Graph, error) {
         switch typ {
         case GraphTypeApply:
                 return (&ApplyGraphBuilder{
-                        Module:       c.module,
-                        Diff:         c.diff,
-                        State:        c.state,
-                        Providers:    c.components.ResourceProviders(),
-                        Provisioners: c.components.ResourceProvisioners(),
-                        Targets:      c.targets,
-                        Destroy:      c.destroy,
-                        Validate:     opts.Validate,
-                }).Build(RootModulePath)
-
-        case GraphTypeInput:
-                // The input graph is just a slightly modified plan graph
-                fallthrough
+                        Config:     c.config,
+                        Changes:    c.changes,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Destroy:    c.destroy,
+                        Validate:   opts.Validate,
+                }).Build(addrs.RootModuleInstance)
+
         case GraphTypeValidate:
                 // The validate graph is just a slightly modified plan graph
                 fallthrough
         case GraphTypePlan:
                 // Create the plan graph builder
                 p := &PlanGraphBuilder{
-                        Module:    c.module,
-                        State:     c.state,
-                        Providers: c.components.ResourceProviders(),
-                        Targets:   c.targets,
-                        Validate:  opts.Validate,
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Validate:   opts.Validate,
                 }
 
                 // Some special cases for other graph types shared with plan currently
                 var b GraphBuilder = p
                 switch typ {
-                case GraphTypeInput:
-                        b = InputGraphBuilder(p)
                 case GraphTypeValidate:
-                        // We need to set the provisioners so those can be validated
-                        p.Provisioners = c.components.ResourceProvisioners()
-
                         b = ValidateGraphBuilder(p)
                 }
 
-                return b.Build(RootModulePath)
+                return b.Build(addrs.RootModuleInstance)
 
         case GraphTypePlanDestroy:
                 return (&DestroyPlanGraphBuilder{
-                        Module:   c.module,
-                        State:    c.state,
-                        Targets:  c.targets,
-                        Validate: opts.Validate,
-                }).Build(RootModulePath)
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Validate:   opts.Validate,
+                }).Build(addrs.RootModuleInstance)
 
         case GraphTypeRefresh:
                 return (&RefreshGraphBuilder{
-                        Module:    c.module,
-                        State:     c.state,
-                        Providers: c.components.ResourceProviders(),
-                        Targets:   c.targets,
-                        Validate:  opts.Validate,
-                }).Build(RootModulePath)
-        }
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Validate:   opts.Validate,
+                }).Build(addrs.RootModuleInstance)
+
+        case GraphTypeEval:
+                return (&EvalGraphBuilder{
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                }).Build(addrs.RootModuleInstance)
 
-        return nil, fmt.Errorf("unknown graph type: %s", typ)
+        default:
+                // Should never happen, because the above is exhaustive for all graph types.
+                panic(fmt.Errorf("unsupported graph type %s", typ))
+        }
 }
 
 // ShadowError returns any errors caught during a shadow operation.
@@ -333,141 +355,72 @@ func (c *Context) ShadowError() error {
 // State returns a copy of the current state associated with this context.
 //
 // This cannot safely be called in parallel with any other Context function.
-func (c *Context) State() *State {
+func (c *Context) State() *states.State {
         return c.state.DeepCopy()
 }
 
-// Interpolater returns an Interpolater built on a copy of the state
-// that can be used to test interpolation values.
-func (c *Context) Interpolater() *Interpolater {
-        var varLock sync.Mutex
-        var stateLock sync.RWMutex
-        return &Interpolater{
-                Operation:          walkApply,
-                Meta:               c.meta,
-                Module:             c.module,
-                State:              c.state.DeepCopy(),
-                StateLock:          &stateLock,
-                VariableValues:     c.variables,
-                VariableValuesLock: &varLock,
-        }
-}
-
-// Input asks for input to fill variables and provider configurations.
-// This modifies the configuration in-place, so asking for Input twice
-// may result in different UI output showing different current values.
-func (c *Context) Input(mode InputMode) error {
-        defer c.acquireRun("input")()
-
-        if mode&InputModeVar != 0 {
-                // Walk the variables first for the root module. We walk them in
-                // alphabetical order for UX reasons.
-                rootConf := c.module.Config()
-                names := make([]string, len(rootConf.Variables))
-                m := make(map[string]*config.Variable)
-                for i, v := range rootConf.Variables {
-                        names[i] = v.Name
-                        m[v.Name] = v
-                }
-                sort.Strings(names)
-                for _, n := range names {
-                        // If we only care about unset variables, then if the variable
-                        // is set, continue on.
-                        if mode&InputModeVarUnset != 0 {
-                                if _, ok := c.variables[n]; ok {
-                                        continue
-                                }
-                        }
-
-                        var valueType config.VariableType
-
-                        v := m[n]
-                        switch valueType = v.Type(); valueType {
-                        case config.VariableTypeUnknown:
-                                continue
-                        case config.VariableTypeMap:
-                                // OK
-                        case config.VariableTypeList:
-                                // OK
-                        case config.VariableTypeString:
-                                // OK
-                        default:
-                                panic(fmt.Sprintf("Unknown variable type: %#v", v.Type()))
-                        }
-
-                        // If the variable is not already set, and the variable defines a
-                        // default, use that for the value.
-                        if _, ok := c.variables[n]; !ok {
-                                if v.Default != nil {
-                                        c.variables[n] = v.Default.(string)
-                                        continue
-                                }
-                        }
-
-                        // this should only happen during tests
-                        if c.uiInput == nil {
-                                log.Println("[WARN] Content.uiInput is nil")
-                                continue
-                        }
-
-                        // Ask the user for a value for this variable
-                        var value string
-                        retry := 0
-                        for {
-                                var err error
-                                value, err = c.uiInput.Input(&InputOpts{
-                                        Id:          fmt.Sprintf("var.%s", n),
-                                        Query:       fmt.Sprintf("var.%s", n),
-                                        Description: v.Description,
-                                })
-                                if err != nil {
-                                        return fmt.Errorf(
-                                                "Error asking for %s: %s", n, err)
-                                }
-
-                                if value == "" && v.Required() {
-                                        // Redo if it is required, but abort if we keep getting
-                                        // blank entries
-                                        if retry > 2 {
-                                                return fmt.Errorf("missing required value for %q", n)
-                                        }
-                                        retry++
-                                        continue
-                                }
-
-                                break
-                        }
-
-                        // no value provided, so don't set the variable at all
-                        if value == "" {
-                                continue
-                        }
-
-                        decoded, err := parseVariableAsHCL(n, value, valueType)
-                        if err != nil {
-                                return err
-                        }
-
-                        if decoded != nil {
-                                c.variables[n] = decoded
-                        }
-                }
-        }
+// Eval produces a scope in which expressions can be evaluated for
+// the given module path.
+//
+// This method must first evaluate any ephemeral values (input variables, local
+// values, and output values) in the configuration. These ephemeral values are
+// not included in the persisted state, so they must be re-computed using other
+// values in the state before they can be properly evaluated. The updated
+// values are retained in the main state associated with the receiving context.
+//
+// This function takes no action against remote APIs but it does need access
+// to all provider and provisioner instances in order to obtain their schemas
+// for type checking.
+//
+// The result is an evaluation scope that can be used to resolve references
+// against the root module. If the returned diagnostics contains errors then
+// the returned scope may be nil. If it is not nil then it may still be used
+// to attempt expression evaluation or other analysis, but some expressions
+// may not behave as expected.
+func (c *Context) Eval(path addrs.ModuleInstance) (*lang.Scope, tfdiags.Diagnostics) {
+        // This is intended for external callers such as the "terraform console"
+        // command. Internally, we create an evaluator in c.walk before walking
+        // the graph, and create scopes in ContextGraphWalker.
 
-        if mode&InputModeProvider != 0 {
-                // Build the graph
-                graph, err := c.Graph(GraphTypeInput, nil)
-                if err != nil {
-                        return err
-                }
+        var diags tfdiags.Diagnostics
+        defer c.acquireRun("eval")()
 
-                // Do the walk
-                if _, err := c.walk(graph, walkInput); err != nil {
-                        return err
-                }
-        }
+        // Start with a copy of state so that we don't affect any instances
+        // that other methods may have already returned.
+        c.state = c.state.DeepCopy()
+        var walker *ContextGraphWalker
+
+        graph, graphDiags := c.Graph(GraphTypeEval, nil)
+        diags = diags.Append(graphDiags)
+        if !diags.HasErrors() {
+                var walkDiags tfdiags.Diagnostics
+                walker, walkDiags = c.walk(graph, walkEval)
+                diags = diags.Append(walker.NonFatalDiagnostics)
+                diags = diags.Append(walkDiags)
+        }
+
+        if walker == nil {
+                // If we skipped walking the graph (due to errors) then we'll just
+                // use a placeholder graph walker here, which'll refer to the
+                // unmodified state.
+                walker = c.graphWalker(walkEval)
+        }
+
+        // This is a bit weird since we don't normally evaluate outside of
+        // the context of a walk, but we'll "re-enter" our desired path here
+        // just to get hold of an EvalContext for it. GraphContextBuiltin
+        // caches its contexts, so we should get hold of the context that was
+        // previously used for evaluation here, unless we skipped walking.
+        evalCtx := walker.EnterPath(path)
+        return evalCtx.EvaluationScope(nil, EvalDataForNoInstanceKey), diags
+}
 
-        return nil
+// Interpolater is no longer used. Use Evaluator instead.
+//
+// The interpolator returned from this function will return an error on any use.
+func (c *Context) Interpolater() *Interpolater {
+        // FIXME: Remove this once all callers are updated to no longer use it.
+        return &Interpolater{}
 }
 
 // Apply applies the changes represented by this context and returns
@@ -484,23 +437,16 @@ func (c *Context) Input(mode InputMode) error {
 //       State() method. Currently the helper/resource testing framework relies
 //       on the absence of a returned state to determine if Destroy can be
 //       called, so that will need to be refactored before this can be changed.
-func (c *Context) Apply() (*State, error) {
+func (c *Context) Apply() (*states.State, tfdiags.Diagnostics) {
         defer c.acquireRun("apply")()
 
-        // Check there are no empty target parameter values
-        for _, target := range c.targets {
-                if target == "" {
-                        return nil, fmt.Errorf("Target parameter must not have empty value")
-                }
-        }
-
         // Copy our own state
         c.state = c.state.DeepCopy()
 
         // Build the graph.
-        graph, err := c.Graph(GraphTypeApply, nil)
-        if err != nil {
-                return nil, err
+        graph, diags := c.Graph(GraphTypeApply, nil)
+        if diags.HasErrors() {
+                return nil, diags
         }
 
         // Determine the operation
@@ -510,15 +456,30 @@ func (c *Context) Apply() (*State, error) {
         }
 
         // Walk the graph
-        walker, err := c.walk(graph, operation)
-        if len(walker.ValidationErrors) > 0 {
-                err = multierror.Append(err, walker.ValidationErrors...)
-        }
-
-        // Clean out any unused things
-        c.state.prune()
-
-        return c.state, err
+        walker, walkDiags := c.walk(graph, operation)
+        diags = diags.Append(walker.NonFatalDiagnostics)
+        diags = diags.Append(walkDiags)
+
+        if c.destroy && !diags.HasErrors() {
+                // If we know we were trying to destroy objects anyway, and we
+                // completed without any errors, then we'll also prune out any
+                // leftover empty resource husks (left after all of the instances
+                // of a resource with "count" or "for_each" are destroyed) to
+                // help ensure we end up with an _actually_ empty state, assuming
+                // we weren't destroying with -target here.
+                //
+                // (This doesn't actually take into account -target, but that should
+                // be okay because it doesn't throw away anything we can't recompute
+                // on a subsequent "terraform plan" run, if the resources are still
+                // present in the configuration. However, this _will_ cause "count = 0"
+                // resources to read as unknown during the next refresh walk, which
+                // may cause some additional churn if used in a data resource or
+                // provider block, until we remove refreshing as a separate walk and
+                // just do it as part of the plan walk.)
+                c.state.PruneResourceHusks()
+        }
+
+        return c.state, diags
 }
 
 // Plan generates an execution plan for the given context.
@@ -528,38 +489,45 @@ func (c *Context) Apply() (*State, error) {
 //
 // Plan also updates the diff of this context to be the diff generated
 // by the plan, so Apply can be called after.
-func (c *Context) Plan() (*Plan, error) {
+func (c *Context) Plan() (*plans.Plan, tfdiags.Diagnostics) {
         defer c.acquireRun("plan")()
+        c.changes = plans.NewChanges()
 
-        // Check there are no empty target parameter values
-        for _, target := range c.targets {
-                if target == "" {
-                        return nil, fmt.Errorf("Target parameter must not have empty value")
+        var diags tfdiags.Diagnostics
+
+        varVals := make(map[string]plans.DynamicValue, len(c.variables))
+        for k, iv := range c.variables {
+                // We use cty.DynamicPseudoType here so that we'll save both the
+                // value _and_ its dynamic type in the plan, so we can recover
+                // exactly the same value later.
+                dv, err := plans.NewDynamicValue(iv.Value, cty.DynamicPseudoType)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to prepare variable value for plan",
+                                fmt.Sprintf("The value for variable %q could not be serialized to store in the plan: %s.", k, err),
+                        ))
+                        continue
                 }
+                varVals[k] = dv
         }
 
-        p := &Plan{
-                Module:  c.module,
-                Vars:    c.variables,
-                State:   c.state,
-                Targets: c.targets,
-
-                TerraformVersion: version.String(),
-                ProviderSHA256s:  c.providerSHA256s,
+        p := &plans.Plan{
+                VariableValues:  varVals,
+                TargetAddrs:     c.targets,
+                ProviderSHA256s: c.providerSHA256s,
         }
 
         var operation walkOperation
         if c.destroy {
                 operation = walkPlanDestroy
-                p.Destroy = true
         } else {
                 // Set our state to be something temporary. We do this so that
                 // the plan can update a fake state so that variables work, then
                 // we replace it back with our old state.
                 old := c.state
                 if old == nil {
-                        c.state = &State{}
-                        c.state.init()
+                        c.state = states.NewState()
                 } else {
                         c.state = old.DeepCopy()
                 }
@@ -570,57 +538,27 @@ func (c *Context) Plan() (*Plan, error) {
                 operation = walkPlan
         }
 
-        // Setup our diff
-        c.diffLock.Lock()
-        c.diff = new(Diff)
-        c.diff.init()
-        c.diffLock.Unlock()
-
         // Build the graph.
         graphType := GraphTypePlan
         if c.destroy {
                 graphType = GraphTypePlanDestroy
         }
-        graph, err := c.Graph(graphType, nil)
-        if err != nil {
-                return nil, err
+        graph, graphDiags := c.Graph(graphType, nil)
+        diags = diags.Append(graphDiags)
+        if graphDiags.HasErrors() {
+                return nil, diags
         }
 
         // Do the walk
-        walker, err := c.walk(graph, operation)
-        if err != nil {
-                return nil, err
+        walker, walkDiags := c.walk(graph, operation)
+        diags = diags.Append(walker.NonFatalDiagnostics)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return nil, diags
         }
-        p.Diff = c.diff
-
-        // If this is true, it means we're running unit tests. In this case,
-        // we perform a deep copy just to ensure that all context tests also
-        // test that a diff is copy-able. This will panic if it fails. This
-        // is enabled during unit tests.
-        //
-        // This should never be true during production usage, but even if it is,
-        // it can't do any real harm.
-        if contextTestDeepCopyOnPlan {
-                p.Diff.DeepCopy()
-        }
-
-        /*
-                // We don't do the reverification during the new destroy plan because
-                // it will use a different apply process.
-                if X_legacyGraph {
-                        // Now that we have a diff, we can build the exact graph that Apply will use
-                        // and catch any possible cycles during the Plan phase.
-                        if _, err := c.Graph(GraphTypeLegacy, nil); err != nil {
-                                return nil, err
-                        }
-                }
-        */
+        p.Changes = c.changes
 
-        var errs error
-        if len(walker.ValidationErrors) > 0 {
-                errs = multierror.Append(errs, walker.ValidationErrors...)
-        }
-        return p, errs
+        return p, diags
 }
 
 // Refresh goes through all the resources in the state and refreshes them
@@ -629,27 +567,46 @@ func (c *Context) Plan() (*Plan, error) {
 //
 // Even in the case an error is returned, the state may be returned and
 // will potentially be partially updated.
-func (c *Context) Refresh() (*State, error) {
+func (c *Context) Refresh() (*states.State, tfdiags.Diagnostics) {
         defer c.acquireRun("refresh")()
 
         // Copy our own state
         c.state = c.state.DeepCopy()
 
+        // Refresh builds a partial changeset as part of its work because it must
+        // create placeholder stubs for any resource instances that'll be created
+        // in subsequent plan so that provider configurations and data resources
+        // can interpolate from them. This plan is always thrown away after
+        // the operation completes, restoring any existing changeset.
+        oldChanges := c.changes
+        defer func() { c.changes = oldChanges }()
+        c.changes = plans.NewChanges()
+
         // Build the graph.
-        graph, err := c.Graph(GraphTypeRefresh, nil)
-        if err != nil {
-                return nil, err
+        graph, diags := c.Graph(GraphTypeRefresh, nil)
+        if diags.HasErrors() {
+                return nil, diags
         }
 
         // Do the walk
-        if _, err := c.walk(graph, walkRefresh); err != nil {
-                return nil, err
-        }
-
-        // Clean out any unused things
-        c.state.prune()
-
-        return c.state, nil
+        _, walkDiags := c.walk(graph, walkRefresh)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return nil, diags
+        }
+
+        // During our walk we will have created planned object placeholders in
+        // state for resource instances that are in configuration but not yet
+        // created. These were created only to allow expression evaluation to
+        // work properly in provider and data blocks during the walk and must
+        // now be discarded, since a subsequent plan walk is responsible for
+        // creating these "for real".
+        // TODO: Consolidate refresh and plan into a single walk, so that the
+        // refresh walk doesn't need to emulate various aspects of the plan
+        // walk in order to properly evaluate provider and data blocks.
+        c.state.SyncWrapper().RemovePlannedResourceInstanceObjects()
+
+        return c.state, diags
 }
 
 // Stop stops the running task.
@@ -675,32 +632,33 @@ func (c *Context) Stop() {
 
         // Grab the condition var before we exit
         if cond := c.runCond; cond != nil {
+                log.Printf("[INFO] terraform: waiting for graceful stop to complete")
                 cond.Wait()
         }
 
         log.Printf("[WARN] terraform: stop complete")
 }
 
-// Validate validates the configuration and returns any warnings or errors.
+// Validate performs semantic validation of the configuration, and returning
+// any warnings or errors.
+//
+// Syntax and structural checks are performed by the configuration loader,
+// and so are not repeated here.
 func (c *Context) Validate() tfdiags.Diagnostics {
         defer c.acquireRun("validate")()
 
         var diags tfdiags.Diagnostics
 
-        // Validate the configuration itself
-        diags = diags.Append(c.module.Validate())
-
-        // This only needs to be done for the root module, since inter-module
-        // variables are validated in the module tree.
-        if config := c.module.Config(); config != nil {
-                // Validate the user variables
-                for _, err := range smcUserVariables(config, c.variables) {
-                        diags = diags.Append(err)
-                }
+        // Validate input variables. We do this only for the values supplied
+        // by the root module, since child module calls are validated when we
+        // visit their graph nodes.
+        if c.config != nil {
+                varDiags := checkInputVariables(c.config.Module.Variables, c.variables)
+                diags = diags.Append(varDiags)
         }
 
-        // If we have errors at this point, the graphing has no chance,
-        // so just bail early.
+        // If we have errors at this point then we probably won't be able to
+        // construct a graph without producing redundant errors, so we'll halt early.
         if diags.HasErrors() {
                 return diags
         }
@@ -709,48 +667,41 @@ func (c *Context) Validate() tfdiags.Diagnostics {
         // We also validate the graph generated here, but this graph doesn't
         // necessarily match the graph that Plan will generate, so we'll validate the
         // graph again later after Planning.
-        graph, err := c.Graph(GraphTypeValidate, nil)
-        if err != nil {
-                diags = diags.Append(err)
+        graph, graphDiags := c.Graph(GraphTypeValidate, nil)
+        diags = diags.Append(graphDiags)
+        if graphDiags.HasErrors() {
                 return diags
         }
 
         // Walk
-        walker, err := c.walk(graph, walkValidate)
-        if err != nil {
-                diags = diags.Append(err)
-        }
-
-        sort.Strings(walker.ValidationWarnings)
-        sort.Slice(walker.ValidationErrors, func(i, j int) bool {
-                return walker.ValidationErrors[i].Error() < walker.ValidationErrors[j].Error()
-        })
-
-        for _, warn := range walker.ValidationWarnings {
-                diags = diags.Append(tfdiags.SimpleWarning(warn))
-        }
-        for _, err := range walker.ValidationErrors {
-                diags = diags.Append(err)
+        walker, walkDiags := c.walk(graph, walkValidate)
+        diags = diags.Append(walker.NonFatalDiagnostics)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return diags
         }
 
         return diags
 }
 
-// Module returns the module tree associated with this context.
-func (c *Context) Module() *module.Tree {
-        return c.module
+// Config returns the configuration tree associated with this context.
+func (c *Context) Config() *configs.Config {
+        return c.config
 }
 
 // Variables will return the mapping of variables that were defined
 // for this Context. If Input was called, this mapping may be different
 // than what was given.
-func (c *Context) Variables() map[string]interface{} {
+func (c *Context) Variables() InputValues {
         return c.variables
 }
 
 // SetVariable sets a variable after a context has already been built.
-func (c *Context) SetVariable(k string, v interface{}) {
-        c.variables[k] = v
+func (c *Context) SetVariable(k string, v cty.Value) {
+        c.variables[k] = &InputValue{
+                Value:      v,
+                SourceType: ValueFromCaller,
+        }
 }
 
 func (c *Context) acquireRun(phase string) func() {
@@ -767,9 +718,6 @@ func (c *Context) acquireRun(phase string) func() {
         // Build our lock
         c.runCond = sync.NewCond(&c.l)
 
-        // Setup debugging
-        dbug.SetPhase(phase)
-
         // Create a new run context
         c.runContext, c.runContextCancel = context.WithCancel(context.Background())
 
@@ -787,11 +735,6 @@ func (c *Context) releaseRun() {
         c.l.Lock()
         defer c.l.Unlock()
 
-        // setting the phase to "INVALID" lets us easily detect if we have
-        // operations happening outside of a run, or we missed setting the proper
-        // phase
-        dbug.SetPhase("INVALID")
-
         // End our run. We check if runContext is non-nil because it can be
         // set to nil if it was cancelled via Stop()
         if c.runContextCancel != nil {
@@ -807,30 +750,33 @@ func (c *Context) releaseRun() {
         c.runContext = nil
 }
 
-func (c *Context) walk(graph *Graph, operation walkOperation) (*ContextGraphWalker, error) {
-        // Keep track of the "real" context which is the context that does
-        // the real work: talking to real providers, modifying real state, etc.
-        realCtx := c
-
+func (c *Context) walk(graph *Graph, operation walkOperation) (*ContextGraphWalker, tfdiags.Diagnostics) {
         log.Printf("[DEBUG] Starting graph walk: %s", operation.String())
 
-        walker := &ContextGraphWalker{
-                Context:     realCtx,
-                Operation:   operation,
-                StopContext: c.runContext,
-        }
+        walker := c.graphWalker(operation)
 
         // Watch for a stop so we can call the provider Stop() API.
         watchStop, watchWait := c.watchStop(walker)
 
         // Walk the real graph, this will block until it completes
-        realErr := graph.Walk(walker)
+        diags := graph.Walk(walker)
 
         // Close the channel so the watcher stops, and wait for it to return.
         close(watchStop)
         <-watchWait
 
-        return walker, realErr
+        return walker, diags
+}
+
+func (c *Context) graphWalker(operation walkOperation) *ContextGraphWalker {
+        return &ContextGraphWalker{
+                Context:            c,
+                State:              c.state.SyncWrapper(),
+                Changes:            c.changes.SyncWrapper(),
+                Operation:          operation,
+                StopContext:        c.runContext,
+                RootVariableValues: c.variables,
+        }
 }
 
 // watchStop immediately returns a `stop` and a `wait` chan after dispatching
@@ -863,12 +809,13 @@ func (c *Context) watchStop(walker *ContextGraphWalker) (chan struct{}, <-chan s
                 }
 
                 // If we're here, we're stopped, trigger the call.
+                log.Printf("[TRACE] Context: requesting providers and provisioners to gracefully stop")
 
                 {
                         // Copy the providers so that a misbehaved blocking Stop doesn't
                         // completely hang Terraform.
                         walker.providerLock.Lock()
-                        ps := make([]ResourceProvider, 0, len(walker.providerCache))
+                        ps := make([]providers.Interface, 0, len(walker.providerCache))
                         for _, p := range walker.providerCache {
                                 ps = append(ps, p)
                         }
@@ -885,7 +832,7 @@ func (c *Context) watchStop(walker *ContextGraphWalker) (chan struct{}, <-chan s
                 {
                         // Call stop on all the provisioners
                         walker.provisionerLock.Lock()
-                        ps := make([]ResourceProvisioner, 0, len(walker.provisionerCache))
+                        ps := make([]provisioners.Interface, 0, len(walker.provisionerCache))
                         for _, p := range walker.provisionerCache {
                                 ps = append(ps, p)
                         }
@@ -955,3 +902,37 @@ func parseVariableAsHCL(name string, input string, targetType config.VariableTyp
                 panic(fmt.Errorf("unknown type %s", targetType.Printable()))
         }
 }
+
+// ShimLegacyState is a helper that takes the legacy state type and
+// converts it to the new state type.
+//
+// This is implemented as a state file upgrade, so it will not preserve
+// parts of the state structure that are not included in a serialized state,
+// such as the resolved results of any local values, outputs in non-root
+// modules, etc.
+func ShimLegacyState(legacy *State) (*states.State, error) {
+        if legacy == nil {
+                return nil, nil
+        }
+        var buf bytes.Buffer
+        err := WriteState(legacy, &buf)
+        if err != nil {
+                return nil, err
+        }
+        f, err := statefile.Read(&buf)
+        if err != nil {
+                return nil, err
+        }
+        return f.State, err
+}
+
+// MustShimLegacyState is a wrapper around ShimLegacyState that panics if
+// the conversion does not succeed. This is primarily intended for tests where
+// the given legacy state is an object constructed within the test.
+func MustShimLegacyState(legacy *State) *states.State {
+        ret, err := ShimLegacyState(legacy)
+        if err != nil {
+                panic(err)
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_components.go b/vendor/github.com/hashicorp/terraform/terraform/context_components.go
index 6f50744..26ec995 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_components.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_components.go
@@ -2,6 +2,9 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
 )
 
 // contextComponentFactory is the interface that Context uses
@@ -12,25 +15,25 @@ type contextComponentFactory interface {
         // ResourceProvider creates a new ResourceProvider with the given
         // type. The "uid" is a unique identifier for this provider being
         // initialized that can be used for internal tracking.
-        ResourceProvider(typ, uid string) (ResourceProvider, error)
+        ResourceProvider(typ, uid string) (providers.Interface, error)
         ResourceProviders() []string
 
         // ResourceProvisioner creates a new ResourceProvisioner with the
         // given type. The "uid" is a unique identifier for this provisioner
         // being initialized that can be used for internal tracking.
-        ResourceProvisioner(typ, uid string) (ResourceProvisioner, error)
+        ResourceProvisioner(typ, uid string) (provisioners.Interface, error)
         ResourceProvisioners() []string
 }
 
 // basicComponentFactory just calls a factory from a map directly.
 type basicComponentFactory struct {
-        providers    map[string]ResourceProviderFactory
-        provisioners map[string]ResourceProvisionerFactory
+        providers    map[string]providers.Factory
+        provisioners map[string]ProvisionerFactory
 }
 
 func (c *basicComponentFactory) ResourceProviders() []string {
         result := make([]string, len(c.providers))
-        for k, _ := range c.providers {
+        for k := range c.providers {
                 result = append(result, k)
         }
 
@@ -39,14 +42,14 @@ func (c *basicComponentFactory) ResourceProviders() []string {
 
 func (c *basicComponentFactory) ResourceProvisioners() []string {
         result := make([]string, len(c.provisioners))
-        for k, _ := range c.provisioners {
+        for k := range c.provisioners {
                 result = append(result, k)
         }
 
         return result
 }
 
-func (c *basicComponentFactory) ResourceProvider(typ, uid string) (ResourceProvider, error) {
+func (c *basicComponentFactory) ResourceProvider(typ, uid string) (providers.Interface, error) {
         f, ok := c.providers[typ]
         if !ok {
                 return nil, fmt.Errorf("unknown provider %q", typ)
@@ -55,7 +58,7 @@ func (c *basicComponentFactory) ResourceProvider(typ, uid string) (ResourceProvi
         return f()
 }
 
-func (c *basicComponentFactory) ResourceProvisioner(typ, uid string) (ResourceProvisioner, error) {
+func (c *basicComponentFactory) ResourceProvisioner(typ, uid string) (provisioners.Interface, error) {
         f, ok := c.provisioners[typ]
         if !ok {
                 return nil, fmt.Errorf("unknown provisioner %q", typ)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go b/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go
index 084f010..0a424a0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go
@@ -14,8 +14,8 @@ const (
         GraphTypePlan
         GraphTypePlanDestroy
         GraphTypeApply
-        GraphTypeInput
         GraphTypeValidate
+        GraphTypeEval // only visits in-memory elements such as variables, locals, and outputs.
 )
 
 // GraphTypeMap is a mapping of human-readable string to GraphType. This
@@ -23,10 +23,10 @@ const (
 // graph types.
 var GraphTypeMap = map[string]GraphType{
         "apply":        GraphTypeApply,
-        "input":        GraphTypeInput,
         "plan":         GraphTypePlan,
         "plan-destroy": GraphTypePlanDestroy,
         "refresh":      GraphTypeRefresh,
         "legacy":       GraphTypeLegacy,
         "validate":     GraphTypeValidate,
+        "eval":         GraphTypeEval,
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_import.go b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
index e940143..313e909 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
@@ -1,7 +1,10 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportOpts are used as the configuration for Import.
@@ -9,23 +12,23 @@ type ImportOpts struct {
         // Targets are the targets to import
         Targets []*ImportTarget
 
-        // Module is optional, and specifies a config module that is loaded
-        // into the graph and evaluated. The use case for this is to provide
-        // provider configuration.
-        Module *module.Tree
+        // Config is optional, and specifies a config tree that will be loaded
+        // into the graph and evaluated. This is the source for provider
+        // configurations.
+        Config *configs.Config
 }
 
 // ImportTarget is a single resource to import.
 type ImportTarget struct {
-        // Addr is the full resource address of the resource to import.
-        // Example: "module.foo.aws_instance.bar"
-        Addr string
+        // Addr is the address for the resource instance that the new object should
+        // be imported into.
+        Addr addrs.AbsResourceInstance
 
         // ID is the ID of the resource to import. This is resource-specific.
         ID string
 
-        // Provider string
-        Provider string
+        // ProviderAddr is the address of the provider that should handle the import.
+        ProviderAddr addrs.AbsProviderConfig
 }
 
 // Import takes already-created external resources and brings them
@@ -38,7 +41,9 @@ type ImportTarget struct {
 // Further, this operation also gracefully handles partial state. If during
 // an import there is a failure, all previously imported resources remain
 // imported.
-func (c *Context) Import(opts *ImportOpts) (*State, error) {
+func (c *Context) Import(opts *ImportOpts) (*states.State, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
         // Hold a lock since we can modify our own state here
         defer c.acquireRun("import")()
 
@@ -47,31 +52,32 @@ func (c *Context) Import(opts *ImportOpts) (*State, error) {
 
         // If no module is given, default to the module configured with
         // the Context.
-        module := opts.Module
-        if module == nil {
-                module = c.module
+        config := opts.Config
+        if config == nil {
+                config = c.config
         }
 
         // Initialize our graph builder
         builder := &ImportGraphBuilder{
                 ImportTargets: opts.Targets,
-                Module:        module,
-                Providers:     c.components.ResourceProviders(),
+                Config:        config,
+                Components:    c.components,
+                Schemas:       c.schemas,
         }
 
         // Build the graph!
-        graph, err := builder.Build(RootModulePath)
-        if err != nil {
-                return c.state, err
+        graph, graphDiags := builder.Build(addrs.RootModuleInstance)
+        diags = diags.Append(graphDiags)
+        if graphDiags.HasErrors() {
+                return c.state, diags
         }
 
         // Walk it
-        if _, err := c.walk(graph, walkImport); err != nil {
-                return c.state, err
+        _, walkDiags := c.walk(graph, walkImport)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return c.state, diags
         }
 
-        // Clean the state
-        c.state.prune()
-
-        return c.state, nil
+        return c.state, diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_input.go b/vendor/github.com/hashicorp/terraform/terraform/context_input.go
new file mode 100644
index 0000000..6c7be88
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_input.go
@@ -0,0 +1,251 @@
+package terraform
+
+import (
+        "context"
+        "fmt"
+        "log"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Input asks for input to fill variables and provider configurations.
+// This modifies the configuration in-place, so asking for Input twice
+// may result in different UI output showing different current values.
+func (c *Context) Input(mode InputMode) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        defer c.acquireRun("input")()
+
+        if c.uiInput == nil {
+                log.Printf("[TRACE] Context.Input: uiInput is nil, so skipping")
+                return diags
+        }
+
+        ctx := context.Background()
+
+        if mode&InputModeVar != 0 {
+                log.Printf("[TRACE] Context.Input: Prompting for variables")
+
+                // Walk the variables first for the root module. We walk them in
+                // alphabetical order for UX reasons.
+                configs := c.config.Module.Variables
+                names := make([]string, 0, len(configs))
+                for name := range configs {
+                        names = append(names, name)
+                }
+                sort.Strings(names)
+        Variables:
+                for _, n := range names {
+                        v := configs[n]
+
+                        // If we only care about unset variables, then we should set any
+                        // variable that is already set.
+                        if mode&InputModeVarUnset != 0 {
+                                if _, isSet := c.variables[n]; isSet {
+                                        continue
+                                }
+                        }
+
+                        // this should only happen during tests
+                        if c.uiInput == nil {
+                                log.Println("[WARN] Context.uiInput is nil during input walk")
+                                continue
+                        }
+
+                        // Ask the user for a value for this variable
+                        var rawValue string
+                        retry := 0
+                        for {
+                                var err error
+                                rawValue, err = c.uiInput.Input(ctx, &InputOpts{
+                                        Id:          fmt.Sprintf("var.%s", n),
+                                        Query:       fmt.Sprintf("var.%s", n),
+                                        Description: v.Description,
+                                })
+                                if err != nil {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Failed to request interactive input",
+                                                fmt.Sprintf("Terraform attempted to request a value for var.%s interactively, but encountered an error: %s.", n, err),
+                                        ))
+                                        return diags
+                                }
+
+                                if rawValue == "" && v.Default == cty.NilVal {
+                                        // Redo if it is required, but abort if we keep getting
+                                        // blank entries
+                                        if retry > 2 {
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Required variable not assigned",
+                                                        fmt.Sprintf("The variable %q is required, so Terraform cannot proceed without a defined value for it.", n),
+                                                ))
+                                                continue Variables
+                                        }
+                                        retry++
+                                        continue
+                                }
+
+                                break
+                        }
+
+                        val, valDiags := v.ParsingMode.Parse(n, rawValue)
+                        diags = diags.Append(valDiags)
+                        if diags.HasErrors() {
+                                continue
+                        }
+
+                        c.variables[n] = &InputValue{
+                                Value:      val,
+                                SourceType: ValueFromInput,
+                        }
+                }
+        }
+
+        if mode&InputModeProvider != 0 {
+                log.Printf("[TRACE] Context.Input: Prompting for provider arguments")
+
+                // We prompt for input only for provider configurations defined in
+                // the root module. At the time of writing that is an arbitrary
+                // restriction, but we have future plans to support "count" and
+                // "for_each" on modules that will then prevent us from supporting
+                // input for child module configurations anyway (since we'd need to
+                // dynamic-expand first), and provider configurations in child modules
+                // are not recommended since v0.11 anyway, so this restriction allows
+                // us to keep this relatively simple without significant hardship.
+
+                pcs := make(map[string]*configs.Provider)
+                pas := make(map[string]addrs.ProviderConfig)
+                for _, pc := range c.config.Module.ProviderConfigs {
+                        addr := pc.Addr()
+                        pcs[addr.String()] = pc
+                        pas[addr.String()] = addr
+                        log.Printf("[TRACE] Context.Input: Provider %s declared at %s", addr, pc.DeclRange)
+                }
+                // We also need to detect _implied_ provider configs from resources.
+                // These won't have *configs.Provider objects, but they will still
+                // exist in the map and we'll just treat them as empty below.
+                for _, rc := range c.config.Module.ManagedResources {
+                        pa := rc.ProviderConfigAddr()
+                        if pa.Alias != "" {
+                                continue // alias configurations cannot be implied
+                        }
+                        if _, exists := pcs[pa.String()]; !exists {
+                                pcs[pa.String()] = nil
+                                pas[pa.String()] = pa
+                                log.Printf("[TRACE] Context.Input: Provider %s implied by resource block at %s", pa, rc.DeclRange)
+                        }
+                }
+                for _, rc := range c.config.Module.DataResources {
+                        pa := rc.ProviderConfigAddr()
+                        if pa.Alias != "" {
+                                continue // alias configurations cannot be implied
+                        }
+                        if _, exists := pcs[pa.String()]; !exists {
+                                pcs[pa.String()] = nil
+                                pas[pa.String()] = pa
+                                log.Printf("[TRACE] Context.Input: Provider %s implied by data block at %s", pa, rc.DeclRange)
+                        }
+                }
+
+                for pk, pa := range pas {
+                        pc := pcs[pk] // will be nil if this is an implied config
+
+                        // Wrap the input into a namespace
+                        input := &PrefixUIInput{
+                                IdPrefix:    pk,
+                                QueryPrefix: pk + ".",
+                                UIInput:     c.uiInput,
+                        }
+
+                        schema := c.schemas.ProviderConfig(pa.Type)
+                        if schema == nil {
+                                // Could either be an incorrect config or just an incomplete
+                                // mock in tests. We'll let a later pass decide, and just
+                                // ignore this for the purposes of gathering input.
+                                log.Printf("[TRACE] Context.Input: No schema available for provider type %q", pa.Type)
+                                continue
+                        }
+
+                        // For our purposes here we just want to detect if attrbutes are
+                        // set in config at all, so rather than doing a full decode
+                        // (which would require us to prepare an evalcontext, etc) we'll
+                        // use the low-level HCL API to process only the top-level
+                        // structure.
+                        var attrExprs hcl.Attributes // nil if there is no config
+                        if pc != nil && pc.Config != nil {
+                                lowLevelSchema := schemaForInputSniffing(hcldec.ImpliedSchema(schema.DecoderSpec()))
+                                content, _, diags := pc.Config.PartialContent(lowLevelSchema)
+                                if diags.HasErrors() {
+                                        log.Printf("[TRACE] Context.Input: %s has decode error, so ignoring: %s", pa, diags.Error())
+                                        continue
+                                }
+                                attrExprs = content.Attributes
+                        }
+
+                        keys := make([]string, 0, len(schema.Attributes))
+                        for key := range schema.Attributes {
+                                keys = append(keys, key)
+                        }
+                        sort.Strings(keys)
+
+                        vals := map[string]cty.Value{}
+                        for _, key := range keys {
+                                attrS := schema.Attributes[key]
+                                if attrS.Optional {
+                                        continue
+                                }
+                                if attrExprs != nil {
+                                        if _, exists := attrExprs[key]; exists {
+                                                continue
+                                        }
+                                }
+                                if !attrS.Type.Equals(cty.String) {
+                                        continue
+                                }
+
+                                log.Printf("[TRACE] Context.Input: Prompting for %s argument %s", pa, key)
+                                rawVal, err := input.Input(ctx, &InputOpts{
+                                        Id:          key,
+                                        Query:       key,
+                                        Description: attrS.Description,
+                                })
+                                if err != nil {
+                                        log.Printf("[TRACE] Context.Input: Failed to prompt for %s argument %s: %s", pa, key, err)
+                                        continue
+                                }
+
+                                vals[key] = cty.StringVal(rawVal)
+                        }
+
+                        c.providerInputConfig[pk] = vals
+                        log.Printf("[TRACE] Context.Input: Input for %s: %#v", pk, vals)
+                }
+        }
+
+        return diags
+}
+
+// schemaForInputSniffing returns a transformed version of a given schema
+// that marks all attributes as optional, which the Context.Input method can
+// use to detect whether a required argument is set without missing arguments
+// themselves generating errors.
+func schemaForInputSniffing(schema *hcl.BodySchema) *hcl.BodySchema {
+        ret := &hcl.BodySchema{
+                Attributes: make([]hcl.AttributeSchema, len(schema.Attributes)),
+                Blocks:     schema.Blocks,
+        }
+
+        for i, attrS := range schema.Attributes {
+                ret.Attributes[i] = attrS
+                ret.Attributes[i].Required = false
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/debug.go b/vendor/github.com/hashicorp/terraform/terraform/debug.go
deleted file mode 100644
index 265339f..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/debug.go
+++ /dev/null
@@ -1,523 +0,0 @@
-package terraform
-
-import (
-        "archive/tar"
-        "bytes"
-        "compress/gzip"
-        "encoding/json"
-        "fmt"
-        "io"
-        "os"
-        "path/filepath"
-        "sync"
-        "time"
-)
-
-// DebugInfo is the global handler for writing the debug archive. All methods
-// are safe to call concurrently. Setting DebugInfo to nil will disable writing
-// the debug archive. All methods are safe to call on the nil value.
-var dbug *debugInfo
-
-// SetDebugInfo initializes the debug handler with a backing file in the
-// provided directory. This must be called before any other terraform package
-// operations or not at all. Once his is called, CloseDebugInfo should be
-// called before program exit.
-func SetDebugInfo(path string) error {
-        if os.Getenv("TF_DEBUG") == "" {
-                return nil
-        }
-
-        di, err := newDebugInfoFile(path)
-        if err != nil {
-                return err
-        }
-
-        dbug = di
-        return nil
-}
-
-// CloseDebugInfo is the exported interface to Close the debug info handler.
-// The debug handler needs to be closed before program exit, so we export this
-// function to be deferred in the appropriate entrypoint for our executable.
-func CloseDebugInfo() error {
-        return dbug.Close()
-}
-
-// newDebugInfoFile initializes the global debug handler with a backing file in
-// the provided directory.
-func newDebugInfoFile(dir string) (*debugInfo, error) {
-        err := os.MkdirAll(dir, 0755)
-        if err != nil {
-                return nil, err
-        }
-
-        // FIXME: not guaranteed unique, but good enough for now
-        name := fmt.Sprintf("debug-%s", time.Now().Format("2006-01-02-15-04-05.999999999"))
-        archivePath := filepath.Join(dir, name+".tar.gz")
-
-        f, err := os.OpenFile(archivePath, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0666)
-        if err != nil {
-                return nil, err
-        }
-        return newDebugInfo(name, f)
-}
-
-// newDebugInfo initializes the global debug handler.
-func newDebugInfo(name string, w io.Writer) (*debugInfo, error) {
-        gz := gzip.NewWriter(w)
-
-        d := &debugInfo{
-                name: name,
-                w:    w,
-                gz:   gz,
-                tar:  tar.NewWriter(gz),
-        }
-
-        // create the subdirs we need
-        topHdr := &tar.Header{
-                Name:     name,
-                Typeflag: tar.TypeDir,
-                Mode:     0755,
-        }
-        graphsHdr := &tar.Header{
-                Name:     name + "/graphs",
-                Typeflag: tar.TypeDir,
-                Mode:     0755,
-        }
-        err := d.tar.WriteHeader(topHdr)
-        // if the first errors, the second will too
-        err = d.tar.WriteHeader(graphsHdr)
-        if err != nil {
-                return nil, err
-        }
-
-        return d, nil
-}
-
-// debugInfo provides various methods for writing debug information to a
-// central archive. The debugInfo struct should be initialized once before any
-// output is written, and Close should be called before program exit. All
-// exported methods on debugInfo will be safe for concurrent use. The exported
-// methods are also all safe to call on a nil pointer, so that there is no need
-// for conditional blocks before writing debug information.
-//
-// Each write operation done by the debugInfo will flush the gzip.Writer and
-// tar.Writer, and call Sync() or Flush() on the output writer as needed. This
-// ensures that as much data as possible is written to storage in the event of
-// a crash. The append format of the tar file, and the stream format of the
-// gzip writer allow easy recovery f the data in the event that the debugInfo
-// is not closed before program exit.
-type debugInfo struct {
-        sync.Mutex
-
-        // archive root directory name
-        name string
-
-        // current operation phase
-        phase string
-
-        // step is monotonic counter for for recording the order of operations
-        step int
-
-        // flag to protect Close()
-        closed bool
-
-        // the debug log output is in a tar.gz format, written to the io.Writer w
-        w   io.Writer
-        gz  *gzip.Writer
-        tar *tar.Writer
-}
-
-// Set the name of the current operational phase in the debug handler. Each file
-// in the archive will contain the name of the phase in which it was created,
-// i.e. "input", "apply", "plan", "refresh", "validate"
-func (d *debugInfo) SetPhase(phase string) {
-        if d == nil {
-                return
-        }
-        d.Lock()
-        defer d.Unlock()
-
-        d.phase = phase
-}
-
-// Close the debugInfo, finalizing the data in storage. This closes the
-// tar.Writer, the gzip.Wrtier, and if the output writer is an io.Closer, it is
-// also closed.
-func (d *debugInfo) Close() error {
-        if d == nil {
-                return nil
-        }
-
-        d.Lock()
-        defer d.Unlock()
-
-        if d.closed {
-                return nil
-        }
-        d.closed = true
-
-        d.tar.Close()
-        d.gz.Close()
-
-        if c, ok := d.w.(io.Closer); ok {
-                return c.Close()
-        }
-        return nil
-}
-
-// debug buffer is an io.WriteCloser that will write itself to the debug
-// archive when closed.
-type debugBuffer struct {
-        debugInfo *debugInfo
-        name      string
-        buf       bytes.Buffer
-}
-
-func (b *debugBuffer) Write(d []byte) (int, error) {
-        return b.buf.Write(d)
-}
-
-func (b *debugBuffer) Close() error {
-        return b.debugInfo.WriteFile(b.name, b.buf.Bytes())
-}
-
-// ioutils only has a noop ReadCloser
-type nopWriteCloser struct{}
-
-func (nopWriteCloser) Write([]byte) (int, error) { return 0, nil }
-func (nopWriteCloser) Close() error              { return nil }
-
-// NewFileWriter returns an io.WriteClose that will be buffered and written to
-// the debug archive when closed.
-func (d *debugInfo) NewFileWriter(name string) io.WriteCloser {
-        if d == nil {
-                return nopWriteCloser{}
-        }
-
-        return &debugBuffer{
-                debugInfo: d,
-                name:      name,
-        }
-}
-
-type syncer interface {
-        Sync() error
-}
-
-type flusher interface {
-        Flush() error
-}
-
-// Flush the tar.Writer and the gzip.Writer. Flush() or Sync() will be called
-// on the output writer if they are available.
-func (d *debugInfo) flush() {
-        d.tar.Flush()
-        d.gz.Flush()
-
-        if f, ok := d.w.(flusher); ok {
-                f.Flush()
-        }
-
-        if s, ok := d.w.(syncer); ok {
-                s.Sync()
-        }
-}
-
-// WriteFile writes data as a single file to the debug arhive.
-func (d *debugInfo) WriteFile(name string, data []byte) error {
-        if d == nil {
-                return nil
-        }
-
-        d.Lock()
-        defer d.Unlock()
-        return d.writeFile(name, data)
-}
-
-func (d *debugInfo) writeFile(name string, data []byte) error {
-        defer d.flush()
-        path := fmt.Sprintf("%s/%d-%s-%s", d.name, d.step, d.phase, name)
-        d.step++
-
-        hdr := &tar.Header{
-                Name: path,
-                Mode: 0644,
-                Size: int64(len(data)),
-        }
-        err := d.tar.WriteHeader(hdr)
-        if err != nil {
-                return err
-        }
-
-        _, err = d.tar.Write(data)
-        return err
-}
-
-// DebugHook implements all methods of the terraform.Hook interface, and writes
-// the arguments to a file in the archive. When a suitable format for the
-// argument isn't available, the argument is encoded using json.Marshal. If the
-// debug handler is nil, all DebugHook methods are noop, so no time is spent in
-// marshaling the data structures.
-type DebugHook struct{}
-
-func (*DebugHook) PreApply(ii *InstanceInfo, is *InstanceState, id *InstanceDiff) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String() + "\n")
-        }
-
-        idCopy, err := id.Copy()
-        if err != nil {
-                return HookActionContinue, err
-        }
-        js, err := json.MarshalIndent(idCopy, "", "  ")
-        if err != nil {
-                return HookActionContinue, err
-        }
-        buf.Write(js)
-
-        dbug.WriteFile("hook-PreApply", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostApply(ii *InstanceInfo, is *InstanceState, err error) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String() + "\n")
-        }
-
-        if err != nil {
-                buf.WriteString(err.Error())
-        }
-
-        dbug.WriteFile("hook-PostApply", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreDiff(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PreDiff", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostDiff(ii *InstanceInfo, id *InstanceDiff) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        idCopy, err := id.Copy()
-        if err != nil {
-                return HookActionContinue, err
-        }
-        js, err := json.MarshalIndent(idCopy, "", "  ")
-        if err != nil {
-                return HookActionContinue, err
-        }
-        buf.Write(js)
-
-        dbug.WriteFile("hook-PostDiff", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreProvisionResource(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PreProvisionResource", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostProvisionResource(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PostProvisionResource", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreProvision(ii *InstanceInfo, s string) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-        buf.WriteString(s + "\n")
-
-        dbug.WriteFile("hook-PreProvision", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostProvision(ii *InstanceInfo, s string, err error) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-        buf.WriteString(s + "\n")
-
-        dbug.WriteFile("hook-PostProvision", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) ProvisionOutput(ii *InstanceInfo, s1 string, s2 string) {
-        if dbug == nil {
-                return
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-        buf.WriteString(s1 + "\n")
-        buf.WriteString(s2 + "\n")
-
-        dbug.WriteFile("hook-ProvisionOutput", buf.Bytes())
-}
-
-func (*DebugHook) PreRefresh(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PreRefresh", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostRefresh(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PostRefresh", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreImportState(ii *InstanceInfo, s string) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-        buf.WriteString(s + "\n")
-
-        dbug.WriteFile("hook-PreImportState", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostImportState(ii *InstanceInfo, iss []*InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        for _, is := range iss {
-                if is != nil {
-                        buf.WriteString(is.String() + "\n")
-                }
-        }
-        dbug.WriteFile("hook-PostImportState", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-// skip logging this for now, since it could be huge
-func (*DebugHook) PostStateUpdate(*State) (HookAction, error) {
-        return HookActionContinue, nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/diff.go b/vendor/github.com/hashicorp/terraform/terraform/diff.go
index d6dc550..7a6ef3d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/diff.go
@@ -4,12 +4,20 @@ import (
         "bufio"
         "bytes"
         "fmt"
+        "log"
         "reflect"
         "regexp"
         "sort"
+        "strconv"
         "strings"
         "sync"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+
         "github.com/mitchellh/copystructure"
 )
 
@@ -69,8 +77,24 @@ func (d *Diff) Prune() {
 //
 // This should be the preferred method to add module diffs since it
 // allows us to optimize lookups later as well as control sorting.
-func (d *Diff) AddModule(path []string) *ModuleDiff {
-        m := &ModuleDiff{Path: path}
+func (d *Diff) AddModule(path addrs.ModuleInstance) *ModuleDiff {
+        // Lower the new-style address into a legacy-style address.
+        // This requires that none of the steps have instance keys, which is
+        // true for all addresses at the time of implementing this because
+        // "count" and "for_each" are not yet implemented for modules.
+        legacyPath := make([]string, len(path))
+        for i, step := range path {
+                if step.InstanceKey != addrs.NoKey {
+                        // FIXME: Once the rest of Terraform is ready to use count and
+                        // for_each, remove all of this and just write the addrs.ModuleInstance
+                        // value itself into the ModuleState.
+                        panic("diff cannot represent modules with count or for_each keys")
+                }
+
+                legacyPath[i] = step.Name
+        }
+
+        m := &ModuleDiff{Path: legacyPath}
         m.init()
         d.Modules = append(d.Modules, m)
         return m
@@ -79,7 +103,7 @@ func (d *Diff) AddModule(path []string) *ModuleDiff {
 // ModuleByPath is used to lookup the module diff for the given path.
 // This should be the preferred lookup mechanism as it allows for future
 // lookup optimizations.
-func (d *Diff) ModuleByPath(path []string) *ModuleDiff {
+func (d *Diff) ModuleByPath(path addrs.ModuleInstance) *ModuleDiff {
         if d == nil {
                 return nil
         }
@@ -87,7 +111,8 @@ func (d *Diff) ModuleByPath(path []string) *ModuleDiff {
                 if mod.Path == nil {
                         panic("missing module path")
                 }
-                if reflect.DeepEqual(mod.Path, path) {
+                modPath := normalizeModulePath(mod.Path)
+                if modPath.String() == path.String() {
                         return mod
                 }
         }
@@ -96,7 +121,7 @@ func (d *Diff) ModuleByPath(path []string) *ModuleDiff {
 
 // RootModule returns the ModuleState for the root module
 func (d *Diff) RootModule() *ModuleDiff {
-        root := d.ModuleByPath(rootModulePath)
+        root := d.ModuleByPath(addrs.RootModuleInstance)
         if root == nil {
                 panic("missing root module")
         }
@@ -166,7 +191,8 @@ func (d *Diff) String() string {
         keys := make([]string, 0, len(d.Modules))
         lookup := make(map[string]*ModuleDiff)
         for _, m := range d.Modules {
-                key := fmt.Sprintf("module.%s", strings.Join(m.Path[1:], "."))
+                addr := normalizeModulePath(m.Path)
+                key := addr.String()
                 keys = append(keys, key)
                 lookup[key] = m
         }
@@ -384,6 +410,541 @@ type InstanceDiff struct {
 func (d *InstanceDiff) Lock()   { d.mu.Lock() }
 func (d *InstanceDiff) Unlock() { d.mu.Unlock() }
 
+// ApplyToValue merges the receiver into the given base value, returning a
+// new value that incorporates the planned changes. The given value must
+// conform to the given schema, or this method will panic.
+//
+// This method is intended for shimming old subsystems that still use this
+// legacy diff type to work with the new-style types.
+func (d *InstanceDiff) ApplyToValue(base cty.Value, schema *configschema.Block) (cty.Value, error) {
+        // Create an InstanceState attributes from our existing state.
+        // We can use this to more easily apply the diff changes.
+        attrs := hcl2shim.FlatmapValueFromHCL2(base)
+        applied, err := d.Apply(attrs, schema)
+        if err != nil {
+                return base, err
+        }
+
+        val, err := hcl2shim.HCL2ValueFromFlatmap(applied, schema.ImpliedType())
+        if err != nil {
+                return base, err
+        }
+
+        return schema.CoerceValue(val)
+}
+
+// Apply applies the diff to the provided flatmapped attributes,
+// returning the new instance attributes.
+//
+// This method is intended for shimming old subsystems that still use this
+// legacy diff type to work with the new-style types.
+func (d *InstanceDiff) Apply(attrs map[string]string, schema *configschema.Block) (map[string]string, error) {
+        // We always build a new value here, even if the given diff is "empty",
+        // because we might be planning to create a new instance that happens
+        // to have no attributes set, and so we want to produce an empty object
+        // rather than just echoing back the null old value.
+        if attrs == nil {
+                attrs = map[string]string{}
+        }
+
+        // Rather applying the diff to mutate the attrs, we'll copy new values into
+        // here to avoid the possibility of leaving stale values.
+        result := map[string]string{}
+
+        if d.Destroy || d.DestroyDeposed || d.DestroyTainted {
+                return result, nil
+        }
+
+        return d.applyBlockDiff(nil, attrs, schema)
+}
+
+func (d *InstanceDiff) applyBlockDiff(path []string, attrs map[string]string, schema *configschema.Block) (map[string]string, error) {
+        result := map[string]string{}
+        name := ""
+        if len(path) > 0 {
+                name = path[len(path)-1]
+        }
+
+        // localPrefix is used to build the local result map
+        localPrefix := ""
+        if name != "" {
+                localPrefix = name + "."
+        }
+
+        // iterate over the schema rather than the attributes, so we can handle
+        // different block types separately from plain attributes
+        for n, attrSchema := range schema.Attributes {
+                var err error
+                newAttrs, err := d.applyAttrDiff(append(path, n), attrs, attrSchema)
+
+                if err != nil {
+                        return result, err
+                }
+
+                for k, v := range newAttrs {
+                        result[localPrefix+k] = v
+                }
+        }
+
+        blockPrefix := strings.Join(path, ".")
+        if blockPrefix != "" {
+                blockPrefix += "."
+        }
+        for n, block := range schema.BlockTypes {
+                // we need to find the set of all keys that traverse this block
+                candidateKeys := map[string]bool{}
+                blockKey := blockPrefix + n + "."
+                localBlockPrefix := localPrefix + n + "."
+
+                // we can only trust the diff for sets, since the path changes, so don't
+                // count existing values as candidate keys. If it turns out we're
+                // keeping the attributes, we will catch it down below with "keepBlock"
+                // after we check the set count.
+                if block.Nesting != configschema.NestingSet {
+                        for k := range attrs {
+                                if strings.HasPrefix(k, blockKey) {
+                                        nextDot := strings.Index(k[len(blockKey):], ".")
+                                        if nextDot < 0 {
+                                                continue
+                                        }
+                                        nextDot += len(blockKey)
+                                        candidateKeys[k[len(blockKey):nextDot]] = true
+                                }
+                        }
+                }
+
+                for k, diff := range d.Attributes {
+                        if strings.HasPrefix(k, blockKey) {
+                                nextDot := strings.Index(k[len(blockKey):], ".")
+                                if nextDot < 0 {
+                                        continue
+                                }
+
+                                if diff.NewRemoved {
+                                        continue
+                                }
+
+                                nextDot += len(blockKey)
+                                candidateKeys[k[len(blockKey):nextDot]] = true
+                        }
+                }
+
+                // check each set candidate to see if it was removed.
+                // we need to do this, because when entire sets are removed, they may
+                // have the wrong key, and ony show diffs going to ""
+                if block.Nesting == configschema.NestingSet {
+                        for k := range candidateKeys {
+                                indexPrefix := strings.Join(append(path, n, k), ".") + "."
+                                keep := false
+                                // now check each set element to see if it's a new diff, or one
+                                // that we're dropping. Since we're only applying the "New"
+                                // portion of the set, we can ignore diffs that only contain "Old"
+                                for attr, diff := range d.Attributes {
+                                        if !strings.HasPrefix(attr, indexPrefix) {
+                                                continue
+                                        }
+
+                                        // check for empty "count" keys
+                                        if (strings.HasSuffix(attr, ".#") || strings.HasSuffix(attr, ".%")) && diff.New == "0" {
+                                                continue
+                                        }
+
+                                        // removed items don't count either
+                                        if diff.NewRemoved {
+                                                continue
+                                        }
+
+                                        // this must be a diff to keep
+                                        keep = true
+                                        break
+                                }
+                                if !keep {
+                                        delete(candidateKeys, k)
+                                }
+                        }
+                }
+
+                for k := range candidateKeys {
+                        newAttrs, err := d.applyBlockDiff(append(path, n, k), attrs, &block.Block)
+                        if err != nil {
+                                return result, err
+                        }
+
+                        for attr, v := range newAttrs {
+                                result[localBlockPrefix+attr] = v
+                        }
+                }
+
+                keepBlock := true
+                // check this block's count diff directly first, since we may not
+                // have candidates because it was removed and only set to "0"
+                if diff, ok := d.Attributes[blockKey+"#"]; ok {
+                        if diff.New == "0" || diff.NewRemoved {
+                                keepBlock = false
+                        }
+                }
+
+                // if there was no diff at all, then we need to keep the block attributes
+                if len(candidateKeys) == 0 && keepBlock {
+                        for k, v := range attrs {
+                                if strings.HasPrefix(k, blockKey) {
+                                        // we need the key relative to this block, so remove the
+                                        // entire prefix, then re-insert the block name.
+                                        localKey := localBlockPrefix + k[len(blockKey):]
+                                        result[localKey] = v
+                                }
+                        }
+                }
+
+                countAddr := strings.Join(append(path, n, "#"), ".")
+                if countDiff, ok := d.Attributes[countAddr]; ok {
+                        if countDiff.NewComputed {
+                                result[localBlockPrefix+"#"] = hcl2shim.UnknownVariableValue
+                        } else {
+                                result[localBlockPrefix+"#"] = countDiff.New
+
+                                // While sets are complete, list are not, and we may not have all the
+                                // information to track removals. If the list was truncated, we need to
+                                // remove the extra items from the result.
+                                if block.Nesting == configschema.NestingList &&
+                                        countDiff.New != "" && countDiff.New != hcl2shim.UnknownVariableValue {
+                                        length, _ := strconv.Atoi(countDiff.New)
+                                        for k := range result {
+                                                if !strings.HasPrefix(k, localBlockPrefix) {
+                                                        continue
+                                                }
+
+                                                index := k[len(localBlockPrefix):]
+                                                nextDot := strings.Index(index, ".")
+                                                if nextDot < 1 {
+                                                        continue
+                                                }
+                                                index = index[:nextDot]
+                                                i, err := strconv.Atoi(index)
+                                                if err != nil {
+                                                        // this shouldn't happen since we added these
+                                                        // ourself, but make note of it just in case.
+                                                        log.Printf("[ERROR] bad list index in %q: %s", k, err)
+                                                        continue
+                                                }
+                                                if i >= length {
+                                                        delete(result, k)
+                                                }
+                                        }
+                                }
+                        }
+                } else if origCount, ok := attrs[countAddr]; ok && keepBlock {
+                        result[localBlockPrefix+"#"] = origCount
+                } else {
+                        result[localBlockPrefix+"#"] = countFlatmapContainerValues(localBlockPrefix+"#", result)
+                }
+        }
+
+        return result, nil
+}
+
+func (d *InstanceDiff) applyAttrDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        ty := attrSchema.Type
+        switch {
+        case ty.IsListType(), ty.IsTupleType(), ty.IsMapType():
+                return d.applyCollectionDiff(path, attrs, attrSchema)
+        case ty.IsSetType():
+                return d.applySetDiff(path, attrs, attrSchema)
+        default:
+                return d.applySingleAttrDiff(path, attrs, attrSchema)
+        }
+}
+
+func (d *InstanceDiff) applySingleAttrDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        currentKey := strings.Join(path, ".")
+
+        attr := path[len(path)-1]
+
+        result := map[string]string{}
+        diff := d.Attributes[currentKey]
+        old, exists := attrs[currentKey]
+
+        if diff != nil && diff.NewComputed {
+                result[attr] = config.UnknownVariableValue
+                return result, nil
+        }
+
+        // "id" must exist and not be an empty string, or it must be unknown.
+        // This only applied to top-level "id" fields.
+        if attr == "id" && len(path) == 1 {
+                if old == "" {
+                        result[attr] = config.UnknownVariableValue
+                } else {
+                        result[attr] = old
+                }
+                return result, nil
+        }
+
+        // attribute diffs are sometimes missed, so assume no diff means keep the
+        // old value
+        if diff == nil {
+                if exists {
+                        result[attr] = old
+                } else {
+                        // We need required values, so set those with an empty value. It
+                        // must be set in the config, since if it were missing it would have
+                        // failed validation.
+                        if attrSchema.Required {
+                                // we only set a missing string here, since bool or number types
+                                // would have distinct zero value which shouldn't have been
+                                // lost.
+                                if attrSchema.Type == cty.String {
+                                        result[attr] = ""
+                                }
+                        }
+                }
+                return result, nil
+        }
+
+        // check for missmatched diff values
+        if exists &&
+                old != diff.Old &&
+                old != config.UnknownVariableValue &&
+                diff.Old != config.UnknownVariableValue {
+                return result, fmt.Errorf("diff apply conflict for %s: diff expects %q, but prior value has %q", attr, diff.Old, old)
+        }
+
+        if diff.NewRemoved {
+                // don't set anything in the new value
+                return map[string]string{}, nil
+        }
+
+        if diff.Old == diff.New && diff.New == "" {
+                // this can only be a valid empty string
+                if attrSchema.Type == cty.String {
+                        result[attr] = ""
+                }
+                return result, nil
+        }
+
+        if attrSchema.Computed && diff.NewComputed {
+                result[attr] = config.UnknownVariableValue
+                return result, nil
+        }
+
+        result[attr] = diff.New
+
+        return result, nil
+}
+
+func (d *InstanceDiff) applyCollectionDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        result := map[string]string{}
+
+        prefix := ""
+        if len(path) > 1 {
+                prefix = strings.Join(path[:len(path)-1], ".") + "."
+        }
+
+        name := ""
+        if len(path) > 0 {
+                name = path[len(path)-1]
+        }
+
+        currentKey := prefix + name
+
+        // check the index first for special handling
+        for k, diff := range d.Attributes {
+                // check the index value, which can be set, and 0
+                if k == currentKey+".#" || k == currentKey+".%" || k == currentKey {
+                        if diff.NewRemoved {
+                                return result, nil
+                        }
+
+                        if diff.NewComputed {
+                                result[k[len(prefix):]] = config.UnknownVariableValue
+                                return result, nil
+                        }
+
+                        // do what the diff tells us to here, so that it's consistent with applies
+                        if diff.New == "0" {
+                                result[k[len(prefix):]] = "0"
+                                return result, nil
+                        }
+                }
+        }
+
+        // collect all the keys from the diff and the old state
+        noDiff := true
+        keys := map[string]bool{}
+        for k := range d.Attributes {
+                if !strings.HasPrefix(k, currentKey+".") {
+                        continue
+                }
+                noDiff = false
+                keys[k] = true
+        }
+
+        noAttrs := true
+        for k := range attrs {
+                if !strings.HasPrefix(k, currentKey+".") {
+                        continue
+                }
+                noAttrs = false
+                keys[k] = true
+        }
+
+        // If there's no diff and no attrs, then there's no value at all.
+        // This prevents an unexpected zero-count attribute in the attributes.
+        if noDiff && noAttrs {
+                return result, nil
+        }
+
+        idx := "#"
+        if attrSchema.Type.IsMapType() {
+                idx = "%"
+        }
+
+        for k := range keys {
+                // generate an schema placeholder for the values
+                elSchema := &configschema.Attribute{
+                        Type: attrSchema.Type.ElementType(),
+                }
+
+                res, err := d.applySingleAttrDiff(append(path, k[len(currentKey)+1:]), attrs, elSchema)
+                if err != nil {
+                        return result, err
+                }
+
+                for k, v := range res {
+                        result[name+"."+k] = v
+                }
+        }
+
+        // Just like in nested list blocks, for simple lists we may need to fill in
+        // missing empty strings.
+        countKey := name + "." + idx
+        count := result[countKey]
+        length, _ := strconv.Atoi(count)
+
+        if count != "" && count != hcl2shim.UnknownVariableValue &&
+                attrSchema.Type.Equals(cty.List(cty.String)) {
+                // insert empty strings into missing indexes
+                for i := 0; i < length; i++ {
+                        key := fmt.Sprintf("%s.%d", name, i)
+                        if _, ok := result[key]; !ok {
+                                result[key] = ""
+                        }
+                }
+        }
+
+        // now check for truncation in any type of list
+        if attrSchema.Type.IsListType() {
+                for key := range result {
+                        if key == countKey {
+                                continue
+                        }
+
+                        if len(key) <= len(name)+1 {
+                                // not sure what this is, but don't panic
+                                continue
+                        }
+
+                        index := key[len(name)+1:]
+
+                        // It is possible to have nested sets or maps, so look for another dot
+                        dot := strings.Index(index, ".")
+                        if dot > 0 {
+                                index = index[:dot]
+                        }
+
+                        // This shouldn't have any more dots, since the element type is only string.
+                        num, err := strconv.Atoi(index)
+                        if err != nil {
+                                log.Printf("[ERROR] bad list index in %q: %s", currentKey, err)
+                                continue
+                        }
+
+                        if num >= length {
+                                delete(result, key)
+                        }
+                }
+        }
+
+        // Fill in the count value if it wasn't present in the diff for some reason,
+        // or if there is no count at all.
+        _, countDiff := d.Attributes[countKey]
+        if result[countKey] == "" || (!countDiff && len(keys) != len(result)) {
+                result[countKey] = countFlatmapContainerValues(countKey, result)
+        }
+
+        return result, nil
+}
+
+func (d *InstanceDiff) applySetDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        // We only need this special behavior for sets of object.
+        if !attrSchema.Type.ElementType().IsObjectType() {
+                // The normal collection apply behavior will work okay for this one, then.
+                return d.applyCollectionDiff(path, attrs, attrSchema)
+        }
+
+        // When we're dealing with a set of an object type we actually want to
+        // use our normal _block type_ apply behaviors, so we'll construct ourselves
+        // a synthetic schema that treats the object type as a block type and
+        // then delegate to our block apply method.
+        synthSchema := &configschema.Block{
+                Attributes: make(map[string]*configschema.Attribute),
+        }
+
+        for name, ty := range attrSchema.Type.ElementType().AttributeTypes() {
+                // We can safely make everything into an attribute here because in the
+                // event that there are nested set attributes we'll end up back in
+                // here again recursively and can then deal with the next level of
+                // expansion.
+                synthSchema.Attributes[name] = &configschema.Attribute{
+                        Type:     ty,
+                        Optional: true,
+                }
+        }
+
+        parentPath := path[:len(path)-1]
+        childName := path[len(path)-1]
+        containerSchema := &configschema.Block{
+                BlockTypes: map[string]*configschema.NestedBlock{
+                        childName: {
+                                Nesting: configschema.NestingSet,
+                                Block:   *synthSchema,
+                        },
+                },
+        }
+
+        return d.applyBlockDiff(parentPath, attrs, containerSchema)
+}
+
+// countFlatmapContainerValues returns the number of values in the flatmapped container
+// (set, map, list) indexed by key. The key argument is expected to include the
+// trailing ".#", or ".%".
+func countFlatmapContainerValues(key string, attrs map[string]string) string {
+        if len(key) < 3 || !(strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%")) {
+                panic(fmt.Sprintf("invalid index value %q", key))
+        }
+
+        prefix := key[:len(key)-1]
+        items := map[string]int{}
+
+        for k := range attrs {
+                if k == key {
+                        continue
+                }
+                if !strings.HasPrefix(k, prefix) {
+                        continue
+                }
+
+                suffix := k[len(prefix):]
+                dot := strings.Index(suffix, ".")
+                if dot > 0 {
+                        suffix = suffix[:dot]
+                }
+
+                items[suffix]++
+        }
+        return strconv.Itoa(len(items))
+}
+
 // ResourceAttrDiff is the diff of a single attribute of a resource.
 type ResourceAttrDiff struct {
         Old         string      // Old Value
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval.go b/vendor/github.com/hashicorp/terraform/terraform/eval.go
index 10d9c22..48ed353 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval.go
@@ -2,7 +2,8 @@ package terraform
 
 import (
         "log"
-        "strings"
+
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalNode is the interface that must be implemented by graph nodes to
@@ -46,15 +47,21 @@ func Eval(n EvalNode, ctx EvalContext) (interface{}, error) {
 func EvalRaw(n EvalNode, ctx EvalContext) (interface{}, error) {
         path := "unknown"
         if ctx != nil {
-                path = strings.Join(ctx.Path(), ".")
+                path = ctx.Path().String()
+        }
+        if path == "" {
+                path = "<root>"
         }
 
         log.Printf("[TRACE] %s: eval: %T", path, n)
         output, err := n.Eval(ctx)
         if err != nil {
-                if _, ok := err.(EvalEarlyExitError); ok {
-                        log.Printf("[TRACE] %s: eval: %T, err: %s", path, n, err)
-                } else {
+                switch err.(type) {
+                case EvalEarlyExitError:
+                        log.Printf("[TRACE] %s: eval: %T, early exit err: %s", path, n, err)
+                case tfdiags.NonFatalError:
+                        log.Printf("[WARN] %s: eval: %T, non-fatal err: %s", path, n, err)
+                default:
                         log.Printf("[ERROR] %s: eval: %T, err: %s", path, n, err)
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
index b9b4806..09313f7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
@@ -3,119 +3,316 @@ package terraform
 import (
         "fmt"
         "log"
-        "strconv"
+        "strings"
 
         "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalApply is an EvalNode implementation that writes the diff to
 // the full diff.
 type EvalApply struct {
-        Info      *InstanceInfo
-        State     **InstanceState
-        Diff      **InstanceDiff
-        Provider  *ResourceProvider
-        Output    **InstanceState
-        CreateNew *bool
-        Error     *error
+        Addr           addrs.ResourceInstance
+        Config         *configs.Resource
+        Dependencies   []addrs.Referenceable
+        State          **states.ResourceInstanceObject
+        Change         **plans.ResourceInstanceChange
+        ProviderAddr   addrs.AbsProviderConfig
+        Provider       *providers.Interface
+        ProviderSchema **ProviderSchema
+        Output         **states.ResourceInstanceObject
+        CreateNew      *bool
+        Error          *error
 }
 
 // TODO: test
 func (n *EvalApply) Eval(ctx EvalContext) (interface{}, error) {
-        diff := *n.Diff
+        var diags tfdiags.Diagnostics
+
+        change := *n.Change
         provider := *n.Provider
         state := *n.State
+        absAddr := n.Addr.Absolute(ctx.Path())
 
-        // If we have no diff, we have nothing to do!
-        if diff.Empty() {
-                log.Printf(
-                        "[DEBUG] apply: %s: diff is empty, doing nothing.", n.Info.Id)
-                return nil, nil
+        if state == nil {
+                state = &states.ResourceInstanceObject{}
+        }
+
+        schema, _ := (*n.ProviderSchema).SchemaForResourceType(n.Addr.Resource.Mode, n.Addr.Resource.Type)
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
+
+        if n.CreateNew != nil {
+                *n.CreateNew = (change.Action == plans.Create || change.Action.IsReplace())
         }
 
-        // Remove any output values from the diff
-        for k, ad := range diff.CopyAttributes() {
-                if ad.Type == DiffAttrOutput {
-                        diff.DelAttribute(k)
+        configVal := cty.NullVal(cty.DynamicPseudoType)
+        if n.Config != nil {
+                var configDiags tfdiags.Diagnostics
+                keyData := EvalDataForInstanceKey(n.Addr.Key)
+                configVal, _, configDiags = ctx.EvaluateBlock(n.Config.Config, schema, nil, keyData)
+                diags = diags.Append(configDiags)
+                if configDiags.HasErrors() {
+                        return nil, diags.Err()
                 }
         }
 
-        // If the state is nil, make it non-nil
-        if state == nil {
-                state = new(InstanceState)
+        log.Printf("[DEBUG] %s: applying the planned %s change", n.Addr.Absolute(ctx.Path()), change.Action)
+        resp := provider.ApplyResourceChange(providers.ApplyResourceChangeRequest{
+                TypeName:       n.Addr.Resource.Type,
+                PriorState:     change.Before,
+                Config:         configVal,
+                PlannedState:   change.After,
+                PlannedPrivate: change.Private,
+        })
+        applyDiags := resp.Diagnostics
+        if n.Config != nil {
+                applyDiags = applyDiags.InConfigBody(n.Config.Config)
         }
-        state.init()
+        diags = diags.Append(applyDiags)
+
+        // Even if there are errors in the returned diagnostics, the provider may
+        // have returned a _partial_ state for an object that already exists but
+        // failed to fully configure, and so the remaining code must always run
+        // to completion but must be defensive against the new value being
+        // incomplete.
+        newVal := resp.NewState
+
+        if newVal == cty.NilVal {
+                // Providers are supposed to return a partial new value even when errors
+                // occur, but sometimes they don't and so in that case we'll patch that up
+                // by just using the prior state, so we'll at least keep track of the
+                // object for the user to retry.
+                newVal = change.Before
+
+                // As a special case, we'll set the new value to null if it looks like
+                // we were trying to execute a delete, because the provider in this case
+                // probably left the newVal unset intending it to be interpreted as "null".
+                if change.After.IsNull() {
+                        newVal = cty.NullVal(schema.ImpliedType())
+                }
 
-        // Flag if we're creating a new instance
-        if n.CreateNew != nil {
-                *n.CreateNew = state.ID == "" && !diff.GetDestroy() || diff.RequiresNew()
+                // Ideally we'd produce an error or warning here if newVal is nil and
+                // there are no errors in diags, because that indicates a buggy
+                // provider not properly reporting its result, but unfortunately many
+                // of our historical test mocks behave in this way and so producing
+                // a diagnostic here fails hundreds of tests. Instead, we must just
+                // silently retain the old value for now. Returning a nil value with
+                // no errors is still always considered a bug in the provider though,
+                // and should be fixed for any "real" providers that do it.
         }
 
-        // With the completed diff, apply!
-        log.Printf("[DEBUG] apply: %s: executing Apply", n.Info.Id)
-        state, err := provider.Apply(n.Info, state, diff)
-        if state == nil {
-                state = new(InstanceState)
+        var conformDiags tfdiags.Diagnostics
+        for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) {
+                conformDiags = conformDiags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q produced an invalid value after apply for %s. The result cannot not be saved in the Terraform state.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        diags = diags.Append(conformDiags)
+        if conformDiags.HasErrors() {
+                // Bail early in this particular case, because an object that doesn't
+                // conform to the schema can't be saved in the state anyway -- the
+                // serializer will reject it.
+                return nil, diags.Err()
+        }
+
+        // After this point we have a type-conforming result object and so we
+        // must always run to completion to ensure it can be saved. If n.Error
+        // is set then we must not return a non-nil error, in order to allow
+        // evaluation to continue to a later point where our state object will
+        // be saved.
+
+        // By this point there must not be any unknown values remaining in our
+        // object, because we've applied the change and we can't save unknowns
+        // in our persistent state. If any are present then we will indicate an
+        // error (which is always a bug in the provider) but we will also replace
+        // them with nulls so that we can successfully save the portions of the
+        // returned value that are known.
+        if !newVal.IsWhollyKnown() {
+                // To generate better error messages, we'll go for a walk through the
+                // value and make a separate diagnostic for each unknown value we
+                // find.
+                cty.Walk(newVal, func(path cty.Path, val cty.Value) (bool, error) {
+                        if !val.IsKnown() {
+                                pathStr := tfdiags.FormatCtyPath(path)
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider returned invalid result object after apply",
+                                        fmt.Sprintf(
+                                                "After the apply operation, the provider still indicated an unknown value for %s%s. All values must be known after apply, so this is always a bug in the provider and should be reported in the provider's own repository. Terraform will still save the other known object values in the state.",
+                                                n.Addr.Absolute(ctx.Path()), pathStr,
+                                        ),
+                                ))
+                        }
+                        return true, nil
+                })
+
+                // NOTE: This operation can potentially be lossy if there are multiple
+                // elements in a set that differ only by unknown values: after
+                // replacing with null these will be merged together into a single set
+                // element. Since we can only get here in the presence of a provider
+                // bug, we accept this because storing a result here is always a
+                // best-effort sort of thing.
+                newVal = cty.UnknownAsNull(newVal)
+        }
+
+        if change.Action != plans.Delete && !diags.HasErrors() {
+                // Only values that were marked as unknown in the planned value are allowed
+                // to change during the apply operation. (We do this after the unknown-ness
+                // check above so that we also catch anything that became unknown after
+                // being known during plan.)
+                //
+                // If we are returning other errors anyway then we'll give this
+                // a pass since the other errors are usually the explanation for
+                // this one and so it's more helpful to let the user focus on the
+                // root cause rather than distract with this extra problem.
+                if errs := objchange.AssertObjectCompatible(schema, change.After, newVal); len(errs) > 0 {
+                        if resp.LegacyTypeSystem {
+                                // The shimming of the old type system in the legacy SDK is not precise
+                                // enough to pass this consistency check, so we'll give it a pass here,
+                                // but we will generate a warning about it so that we are more likely
+                                // to notice in the logs if an inconsistency beyond the type system
+                                // leads to a downstream provider failure.
+                                var buf strings.Builder
+                                fmt.Fprintf(&buf, "[WARN] Provider %q produced an unexpected new value for %s, but we are tolerating it because it is using the legacy plugin SDK.\n    The following problems may be the cause of any confusing errors from downstream operations:", n.ProviderAddr.ProviderConfig.Type, absAddr)
+                                for _, err := range errs {
+                                        fmt.Fprintf(&buf, "\n      - %s", tfdiags.FormatError(err))
+                                }
+                                log.Print(buf.String())
+
+                                // The sort of inconsistency we won't catch here is if a known value
+                                // in the plan is changed during apply. That can cause downstream
+                                // problems because a dependent resource would make its own plan based
+                                // on the planned value, and thus get a different result during the
+                                // apply phase. This will usually lead to a "Provider produced invalid plan"
+                                // error that incorrectly blames the downstream resource for the change.
+
+                        } else {
+                                for _, err := range errs {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Provider produced inconsistent result after apply",
+                                                fmt.Sprintf(
+                                                        "When applying changes to %s, provider %q produced an unexpected new value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                                        absAddr, n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatError(err),
+                                                ),
+                                        ))
+                                }
+                        }
+                }
+        }
+
+        // If a provider returns a null or non-null object at the wrong time then
+        // we still want to save that but it often causes some confusing behaviors
+        // where it seems like Terraform is failing to take any action at all,
+        // so we'll generate some errors to draw attention to it.
+        if !diags.HasErrors() {
+                if change.Action == plans.Delete && !newVal.IsNull() {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider returned invalid result object after apply",
+                                fmt.Sprintf(
+                                        "After applying a %s plan, the provider returned a non-null object for %s. Destroying should always produce a null value, so this is always a bug in the provider and should be reported in the provider's own repository. Terraform will still save this errant object in the state for debugging and recovery.",
+                                        change.Action, n.Addr.Absolute(ctx.Path()),
+                                ),
+                        ))
+                }
+                if change.Action != plans.Delete && newVal.IsNull() {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider returned invalid result object after apply",
+                                fmt.Sprintf(
+                                        "After applying a %s plan, the provider returned a null object for %s. Only destroying should always produce a null value, so this is always a bug in the provider and should be reported in the provider's own repository.",
+                                        change.Action, n.Addr.Absolute(ctx.Path()),
+                                ),
+                        ))
+                }
         }
-        state.init()
 
-        // Force the "id" attribute to be our ID
-        if state.ID != "" {
-                state.Attributes["id"] = state.ID
+        // Sometimes providers return a null value when an operation fails for some
+        // reason, but we'd rather keep the prior state so that the error can be
+        // corrected on a subsequent run. We must only do this for null new value
+        // though, or else we may discard partial updates the provider was able to
+        // complete.
+        if diags.HasErrors() && newVal.IsNull() {
+                // Otherwise, we'll continue but using the prior state as the new value,
+                // making this effectively a no-op. If the item really _has_ been
+                // deleted then our next refresh will detect that and fix it up.
+                // If change.Action is Create then change.Before will also be null,
+                // which is fine.
+                newVal = change.Before
         }
 
-        // If the value is the unknown variable value, then it is an error.
-        // In this case we record the error and remove it from the state
-        for ak, av := range state.Attributes {
-                if av == config.UnknownVariableValue {
-                        err = multierror.Append(err, fmt.Errorf(
-                                "Attribute with unknown value: %s", ak))
-                        delete(state.Attributes, ak)
+        var newState *states.ResourceInstanceObject
+        if !newVal.IsNull() { // null value indicates that the object is deleted, so we won't set a new state in that case
+                newState = &states.ResourceInstanceObject{
+                        Status:       states.ObjectReady,
+                        Value:        newVal,
+                        Private:      resp.Private,
+                        Dependencies: n.Dependencies, // Should be populated by the caller from the StateDependencies method on the resource instance node
                 }
         }
 
         // Write the final state
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = newState
         }
 
-        // If there are no errors, then we append it to our output error
-        // if we have one, otherwise we just output it.
-        if err != nil {
+        if diags.HasErrors() {
+                // If the caller provided an error pointer then they are expected to
+                // handle the error some other way and we treat our own result as
+                // success.
                 if n.Error != nil {
-                        helpfulErr := fmt.Errorf("%s: %s", n.Info.Id, err.Error())
-                        *n.Error = multierror.Append(*n.Error, helpfulErr)
-                } else {
-                        return nil, err
+                        err := diags.Err()
+                        *n.Error = err
+                        log.Printf("[DEBUG] %s: apply errored, but we're indicating that via the Error pointer rather than returning it: %s", n.Addr.Absolute(ctx.Path()), err)
+                        return nil, nil
                 }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // EvalApplyPre is an EvalNode implementation that does the pre-Apply work
 type EvalApplyPre struct {
-        Info  *InstanceInfo
-        State **InstanceState
-        Diff  **InstanceDiff
+        Addr   addrs.ResourceInstance
+        Gen    states.Generation
+        State  **states.ResourceInstanceObject
+        Change **plans.ResourceInstanceChange
 }
 
 // TODO: test
 func (n *EvalApplyPre) Eval(ctx EvalContext) (interface{}, error) {
-        state := *n.State
-        diff := *n.Diff
+        change := *n.Change
+        absAddr := n.Addr.Absolute(ctx.Path())
 
-        // If the state is nil, make it non-nil
-        if state == nil {
-                state = new(InstanceState)
+        if change == nil {
+                panic(fmt.Sprintf("EvalApplyPre for %s called with nil Change", absAddr))
         }
-        state.init()
 
-        if resourceHasUserVisibleApply(n.Info) {
-                // Call post-apply hook
+        if resourceHasUserVisibleApply(n.Addr) {
+                priorState := change.Before
+                plannedNewState := change.After
+
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreApply(n.Info, state, diff)
+                        return h.PreApply(absAddr, n.Gen, change.Action, priorState, plannedNewState)
                 })
                 if err != nil {
                         return nil, err
@@ -127,8 +324,9 @@ func (n *EvalApplyPre) Eval(ctx EvalContext) (interface{}, error) {
 
 // EvalApplyPost is an EvalNode implementation that does the post-Apply work
 type EvalApplyPost struct {
-        Info  *InstanceInfo
-        State **InstanceState
+        Addr  addrs.ResourceInstance
+        Gen   states.Generation
+        State **states.ResourceInstanceObject
         Error *error
 }
 
@@ -136,33 +334,93 @@ type EvalApplyPost struct {
 func (n *EvalApplyPost) Eval(ctx EvalContext) (interface{}, error) {
         state := *n.State
 
-        if resourceHasUserVisibleApply(n.Info) {
-                // Call post-apply hook
-                err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostApply(n.Info, state, *n.Error)
+        if resourceHasUserVisibleApply(n.Addr) {
+                absAddr := n.Addr.Absolute(ctx.Path())
+                var newState cty.Value
+                if state != nil {
+                        newState = state.Value
+                } else {
+                        newState = cty.NullVal(cty.DynamicPseudoType)
+                }
+                var err error
+                if n.Error != nil {
+                        err = *n.Error
+                }
+
+                hookErr := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostApply(absAddr, n.Gen, newState, err)
                 })
-                if err != nil {
-                        return nil, err
+                if hookErr != nil {
+                        return nil, hookErr
                 }
         }
 
         return nil, *n.Error
 }
 
+// EvalMaybeTainted is an EvalNode that takes the planned change, new value,
+// and possible error from an apply operation and produces a new instance
+// object marked as tainted if it appears that a create operation has failed.
+//
+// This EvalNode never returns an error, to ensure that a subsequent EvalNode
+// can still record the possibly-tainted object in the state.
+type EvalMaybeTainted struct {
+        Addr   addrs.ResourceInstance
+        Gen    states.Generation
+        Change **plans.ResourceInstanceChange
+        State  **states.ResourceInstanceObject
+        Error  *error
+
+        // If StateOutput is not nil, its referent will be assigned either the same
+        // pointer as State or a new object with its status set as Tainted,
+        // depending on whether an error is given and if this was a create action.
+        StateOutput **states.ResourceInstanceObject
+}
+
+// TODO: test
+func (n *EvalMaybeTainted) Eval(ctx EvalContext) (interface{}, error) {
+        state := *n.State
+        change := *n.Change
+        err := *n.Error
+
+        if state != nil && state.Status == states.ObjectTainted {
+                log.Printf("[TRACE] EvalMaybeTainted: %s was already tainted, so nothing to do", n.Addr.Absolute(ctx.Path()))
+                return nil, nil
+        }
+
+        if n.StateOutput != nil {
+                if err != nil && change.Action == plans.Create {
+                        // If there are errors during a _create_ then the object is
+                        // in an undefined state, and so we'll mark it as tainted so
+                        // we can try again on the next run.
+                        //
+                        // We don't do this for other change actions because errors
+                        // during updates will often not change the remote object at all.
+                        // If there _were_ changes prior to the error, it's the provider's
+                        // responsibility to record the effect of those changes in the
+                        // object value it returned.
+                        log.Printf("[TRACE] EvalMaybeTainted: %s encountered an error during creation, so it is now marked as tainted", n.Addr.Absolute(ctx.Path()))
+                        *n.StateOutput = state.AsTainted()
+                } else {
+                        *n.StateOutput = state
+                }
+        }
+
+        return nil, nil
+}
+
 // resourceHasUserVisibleApply returns true if the given resource is one where
 // apply actions should be exposed to the user.
 //
 // Certain resources do apply actions only as an implementation detail, so
 // these should not be advertised to code outside of this package.
-func resourceHasUserVisibleApply(info *InstanceInfo) bool {
-        addr := info.ResourceAddress()
-
+func resourceHasUserVisibleApply(addr addrs.ResourceInstance) bool {
         // Only managed resources have user-visible apply actions.
         // In particular, this excludes data resources since we "apply" these
         // only as an implementation detail of removing them from state when
         // they are destroyed. (When reading, they don't get here at all because
         // we present them as "Refresh" actions.)
-        return addr.Mode == config.ManagedResourceMode
+        return addr.ContainingResource().Mode == addrs.ManagedResourceMode
 }
 
 // EvalApplyProvisioners is an EvalNode implementation that executes
@@ -171,23 +429,33 @@ func resourceHasUserVisibleApply(info *InstanceInfo) bool {
 // TODO(mitchellh): This should probably be split up into a more fine-grained
 // ApplyProvisioner (single) that is looped over.
 type EvalApplyProvisioners struct {
-        Info           *InstanceInfo
-        State          **InstanceState
-        Resource       *config.Resource
-        InterpResource *Resource
+        Addr           addrs.ResourceInstance
+        State          **states.ResourceInstanceObject
+        ResourceConfig *configs.Resource
         CreateNew      *bool
         Error          *error
 
         // When is the type of provisioner to run at this point
-        When config.ProvisionerWhen
+        When configs.ProvisionerWhen
 }
 
 // TODO: test
 func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
         state := *n.State
-
-        if n.CreateNew != nil && !*n.CreateNew {
+        if state == nil {
+                log.Printf("[TRACE] EvalApplyProvisioners: %s has no state, so skipping provisioners", n.Addr)
+                return nil, nil
+        }
+        if n.When == configs.ProvisionerWhenCreate && n.CreateNew != nil && !*n.CreateNew {
                 // If we're not creating a new resource, then don't run provisioners
+                log.Printf("[TRACE] EvalApplyProvisioners: %s is not freshly-created, so no provisioning is required", n.Addr)
+                return nil, nil
+        }
+        if state.Status == states.ObjectTainted {
+                // No point in provisioning an object that is already tainted, since
+                // it's going to get recreated on the next apply anyway.
+                log.Printf("[TRACE] EvalApplyProvisioners: %s is tainted, so skipping provisioning", n.Addr)
                 return nil, nil
         }
 
@@ -197,14 +465,7 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
                 return nil, nil
         }
 
-        // taint tells us whether to enable tainting.
-        taint := n.When == config.ProvisionerWhenCreate
-
         if n.Error != nil && *n.Error != nil {
-                if taint {
-                        state.Tainted = true
-                }
-
                 // We're already tainted, so just return out
                 return nil, nil
         }
@@ -212,7 +473,7 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
         {
                 // Call pre hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreProvisionResource(n.Info, state)
+                        return h.PreProvisionInstance(absAddr, state.Value)
                 })
                 if err != nil {
                         return nil, err
@@ -223,18 +484,19 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
         // if we have one, otherwise we just output it.
         err := n.apply(ctx, provs)
         if err != nil {
-                if taint {
-                        state.Tainted = true
-                }
-
                 *n.Error = multierror.Append(*n.Error, err)
-                return nil, err
+                if n.Error == nil {
+                        return nil, err
+                } else {
+                        log.Printf("[TRACE] EvalApplyProvisioners: %s provisioning failed, but we will continue anyway at the caller's request", absAddr)
+                        return nil, nil
+                }
         }
 
         {
                 // Call post hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostProvisionResource(n.Info, state)
+                        return h.PostProvisionInstance(absAddr, state.Value)
                 })
                 if err != nil {
                         return nil, err
@@ -246,18 +508,18 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
 
 // filterProvisioners filters the provisioners on the resource to only
 // the provisioners specified by the "when" option.
-func (n *EvalApplyProvisioners) filterProvisioners() []*config.Provisioner {
+func (n *EvalApplyProvisioners) filterProvisioners() []*configs.Provisioner {
         // Fast path the zero case
-        if n.Resource == nil {
+        if n.ResourceConfig == nil || n.ResourceConfig.Managed == nil {
                 return nil
         }
 
-        if len(n.Resource.Provisioners) == 0 {
+        if len(n.ResourceConfig.Managed.Provisioners) == 0 {
                 return nil
         }
 
-        result := make([]*config.Provisioner, 0, len(n.Resource.Provisioners))
-        for _, p := range n.Resource.Provisioners {
+        result := make([]*configs.Provisioner, 0, len(n.ResourceConfig.Managed.Provisioners))
+        for _, p := range n.ResourceConfig.Managed.Provisioners {
                 if p.When == n.When {
                         result = append(result, p)
                 }
@@ -266,64 +528,71 @@ func (n *EvalApplyProvisioners) filterProvisioners() []*config.Provisioner {
         return result
 }
 
-func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*config.Provisioner) error {
-        state := *n.State
-
-        // Store the original connection info, restore later
-        origConnInfo := state.Ephemeral.ConnInfo
-        defer func() {
-                state.Ephemeral.ConnInfo = origConnInfo
-        }()
+func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*configs.Provisioner) error {
+        var diags tfdiags.Diagnostics
+        instanceAddr := n.Addr
+        absAddr := instanceAddr.Absolute(ctx.Path())
+
+        // If there's a connection block defined directly inside the resource block
+        // then it'll serve as a base connection configuration for all of the
+        // provisioners.
+        var baseConn hcl.Body
+        if n.ResourceConfig.Managed != nil && n.ResourceConfig.Managed.Connection != nil {
+                baseConn = n.ResourceConfig.Managed.Connection.Config
+        }
 
         for _, prov := range provs {
+                log.Printf("[TRACE] EvalApplyProvisioners: provisioning %s with %q", absAddr, prov.Type)
+
                 // Get the provisioner
                 provisioner := ctx.Provisioner(prov.Type)
+                schema := ctx.ProvisionerSchema(prov.Type)
 
-                // Interpolate the provisioner config
-                provConfig, err := ctx.Interpolate(prov.RawConfig.Copy(), n.InterpResource)
-                if err != nil {
-                        return err
-                }
+                keyData := EvalDataForInstanceKey(instanceAddr.Key)
 
-                // Interpolate the conn info, since it may contain variables
-                connInfo, err := ctx.Interpolate(prov.ConnInfo.Copy(), n.InterpResource)
-                if err != nil {
-                        return err
+                // Evaluate the main provisioner configuration.
+                config, _, configDiags := ctx.EvaluateBlock(prov.Config, schema, instanceAddr, keyData)
+                diags = diags.Append(configDiags)
+
+                // If the provisioner block contains a connection block of its own then
+                // it can override the base connection configuration, if any.
+                var localConn hcl.Body
+                if prov.Connection != nil {
+                        localConn = prov.Connection.Config
                 }
 
-                // Merge the connection information
-                overlay := make(map[string]string)
-                if origConnInfo != nil {
-                        for k, v := range origConnInfo {
-                                overlay[k] = v
-                        }
+                var connBody hcl.Body
+                switch {
+                case baseConn != nil && localConn != nil:
+                        // Our standard merging logic applies here, similar to what we do
+                        // with _override.tf configuration files: arguments from the
+                        // base connection block will be masked by any arguments of the
+                        // same name in the local connection block.
+                        connBody = configs.MergeBodies(baseConn, localConn)
+                case baseConn != nil:
+                        connBody = baseConn
+                case localConn != nil:
+                        connBody = localConn
                 }
-                for k, v := range connInfo.Config {
-                        switch vt := v.(type) {
-                        case string:
-                                overlay[k] = vt
-                        case int64:
-                                overlay[k] = strconv.FormatInt(vt, 10)
-                        case int32:
-                                overlay[k] = strconv.FormatInt(int64(vt), 10)
-                        case int:
-                                overlay[k] = strconv.FormatInt(int64(vt), 10)
-                        case float32:
-                                overlay[k] = strconv.FormatFloat(float64(vt), 'f', 3, 32)
-                        case float64:
-                                overlay[k] = strconv.FormatFloat(vt, 'f', 3, 64)
-                        case bool:
-                                overlay[k] = strconv.FormatBool(vt)
-                        default:
-                                overlay[k] = fmt.Sprintf("%v", vt)
+
+                // start with an empty connInfo
+                connInfo := cty.NullVal(connectionBlockSupersetSchema.ImpliedType())
+
+                if connBody != nil {
+                        var connInfoDiags tfdiags.Diagnostics
+                        connInfo, _, connInfoDiags = ctx.EvaluateBlock(connBody, connectionBlockSupersetSchema, instanceAddr, keyData)
+                        diags = diags.Append(connInfoDiags)
+                        if diags.HasErrors() {
+                                // "on failure continue" setting only applies to failures of the
+                                // provisioner itself, not to invalid configuration.
+                                return diags.Err()
                         }
                 }
-                state.Ephemeral.ConnInfo = overlay
 
                 {
                         // Call pre hook
                         err := ctx.Hook(func(h Hook) (HookAction, error) {
-                                return h.PreProvision(n.Info, prov.Type)
+                                return h.PreProvisionInstanceStep(absAddr, prov.Type)
                         })
                         if err != nil {
                                 return err
@@ -333,31 +602,37 @@ func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*config.Provision
                 // The output function
                 outputFn := func(msg string) {
                         ctx.Hook(func(h Hook) (HookAction, error) {
-                                h.ProvisionOutput(n.Info, prov.Type, msg)
+                                h.ProvisionOutput(absAddr, prov.Type, msg)
                                 return HookActionContinue, nil
                         })
                 }
 
-                // Invoke the Provisioner
                 output := CallbackUIOutput{OutputFn: outputFn}
-                applyErr := provisioner.Apply(&output, state, provConfig)
+                resp := provisioner.ProvisionResource(provisioners.ProvisionResourceRequest{
+                        Config:     config,
+                        Connection: connInfo,
+                        UIOutput:   &output,
+                })
+                applyDiags := resp.Diagnostics.InConfigBody(prov.Config)
 
                 // Call post hook
                 hookErr := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostProvision(n.Info, prov.Type, applyErr)
+                        return h.PostProvisionInstanceStep(absAddr, prov.Type, applyDiags.Err())
                 })
 
-                // Handle the error before we deal with the hook
-                if applyErr != nil {
-                        // Determine failure behavior
-                        switch prov.OnFailure {
-                        case config.ProvisionerOnFailureContinue:
-                                log.Printf(
-                                        "[INFO] apply: %s [%s]: error during provision, continue requested",
-                                        n.Info.Id, prov.Type)
-
-                        case config.ProvisionerOnFailureFail:
-                                return applyErr
+                switch prov.OnFailure {
+                case configs.ProvisionerOnFailureContinue:
+                        if applyDiags.HasErrors() {
+                                log.Printf("[WARN] Errors while provisioning %s with %q, but continuing as requested in configuration", n.Addr, prov.Type)
+                        } else {
+                                // Maybe there are warnings that we still want to see
+                                diags = diags.Append(applyDiags)
+                        }
+                default:
+                        diags = diags.Append(applyDiags)
+                        if applyDiags.HasErrors() {
+                                log.Printf("[WARN] Errors while provisioning %s with %q, so aborting", n.Addr, prov.Type)
+                                return diags.Err()
                         }
                 }
 
@@ -367,6 +642,5 @@ func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*config.Provision
                 }
         }
 
-        return nil
-
+        return diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go
index 715e79e..4dff0c8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go
@@ -3,33 +3,44 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalPreventDestroy is an EvalNode implementation that returns an
 // error if a resource has PreventDestroy configured and the diff
 // would destroy the resource.
 type EvalCheckPreventDestroy struct {
-        Resource   *config.Resource
-        ResourceId string
-        Diff       **InstanceDiff
+        Addr   addrs.ResourceInstance
+        Config *configs.Resource
+        Change **plans.ResourceInstanceChange
 }
 
 func (n *EvalCheckPreventDestroy) Eval(ctx EvalContext) (interface{}, error) {
-        if n.Diff == nil || *n.Diff == nil || n.Resource == nil {
+        if n.Change == nil || *n.Change == nil || n.Config == nil || n.Config.Managed == nil {
                 return nil, nil
         }
 
-        diff := *n.Diff
-        preventDestroy := n.Resource.Lifecycle.PreventDestroy
-
-        if diff.GetDestroy() && preventDestroy {
-                resourceId := n.ResourceId
-                if resourceId == "" {
-                        resourceId = n.Resource.Id()
-                }
-
-                return nil, fmt.Errorf(preventDestroyErrStr, resourceId)
+        change := *n.Change
+        preventDestroy := n.Config.Managed.PreventDestroy
+
+        if (change.Action == plans.Delete || change.Action.IsReplace()) && preventDestroy {
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Instance cannot be destroyed",
+                        Detail: fmt.Sprintf(
+                                "Resource %s has lifecycle.prevent_destroy set, but the plan calls for this resource to be destroyed. To avoid this error and continue with the plan, either disable lifecycle.prevent_destroy or reduce the scope of the plan using the -target flag.",
+                                n.Addr.Absolute(ctx.Path()).String(),
+                        ),
+                        Subject: &n.Config.DeclRange,
+                })
+                return nil, diags.Err()
         }
 
         return nil, nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
index 86481de..08f3059 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
@@ -1,9 +1,16 @@
 package terraform
 
 import (
-        "sync"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // EvalContext is the interface that is given to eval nodes to execute.
@@ -13,7 +20,7 @@ type EvalContext interface {
         Stopped() <-chan struct{}
 
         // Path is the current module path.
-        Path() []string
+        Path() addrs.ModuleInstance
 
         // Hook is used to call hook methods. The callback is called for each
         // hook and should return the hook action to take and the error.
@@ -22,68 +29,105 @@ type EvalContext interface {
         // Input is the UIInput object for interacting with the UI.
         Input() UIInput
 
-        // InitProvider initializes the provider with the given type and name, and
+        // InitProvider initializes the provider with the given type and address, and
         // returns the implementation of the resource provider or an error.
         //
         // It is an error to initialize the same provider more than once.
-        InitProvider(typ string, name string) (ResourceProvider, error)
+        InitProvider(typ string, addr addrs.ProviderConfig) (providers.Interface, error)
 
-        // Provider gets the provider instance with the given name (already
+        // Provider gets the provider instance with the given address (already
         // initialized) or returns nil if the provider isn't initialized.
-        Provider(string) ResourceProvider
+        //
+        // This method expects an _absolute_ provider configuration address, since
+        // resources in one module are able to use providers from other modules.
+        // InitProvider must've been called on the EvalContext of the module
+        // that owns the given provider before calling this method.
+        Provider(addrs.AbsProviderConfig) providers.Interface
+
+        // ProviderSchema retrieves the schema for a particular provider, which
+        // must have already been initialized with InitProvider.
+        //
+        // This method expects an _absolute_ provider configuration address, since
+        // resources in one module are able to use providers from other modules.
+        ProviderSchema(addrs.AbsProviderConfig) *ProviderSchema
 
         // CloseProvider closes provider connections that aren't needed anymore.
-        CloseProvider(string) error
+        CloseProvider(addrs.ProviderConfig) error
 
         // ConfigureProvider configures the provider with the given
         // configuration. This is a separate context call because this call
         // is used to store the provider configuration for inheritance lookups
         // with ParentProviderConfig().
-        ConfigureProvider(string, *ResourceConfig) error
+        ConfigureProvider(addrs.ProviderConfig, cty.Value) tfdiags.Diagnostics
 
         // ProviderInput and SetProviderInput are used to configure providers
         // from user input.
-        ProviderInput(string) map[string]interface{}
-        SetProviderInput(string, map[string]interface{})
+        ProviderInput(addrs.ProviderConfig) map[string]cty.Value
+        SetProviderInput(addrs.ProviderConfig, map[string]cty.Value)
 
         // InitProvisioner initializes the provisioner with the given name and
         // returns the implementation of the resource provisioner or an error.
         //
         // It is an error to initialize the same provisioner more than once.
-        InitProvisioner(string) (ResourceProvisioner, error)
+        InitProvisioner(string) (provisioners.Interface, error)
 
         // Provisioner gets the provisioner instance with the given name (already
         // initialized) or returns nil if the provisioner isn't initialized.
-        Provisioner(string) ResourceProvisioner
+        Provisioner(string) provisioners.Interface
+
+        // ProvisionerSchema retrieves the main configuration schema for a
+        // particular provisioner, which must have already been initialized with
+        // InitProvisioner.
+        ProvisionerSchema(string) *configschema.Block
 
         // CloseProvisioner closes provisioner connections that aren't needed
         // anymore.
         CloseProvisioner(string) error
 
-        // Interpolate takes the given raw configuration and completes
-        // the interpolations, returning the processed ResourceConfig.
+        // EvaluateBlock takes the given raw configuration block and associated
+        // schema and evaluates it to produce a value of an object type that
+        // conforms to the implied type of the schema.
+        //
+        // The "self" argument is optional. If given, it is the referenceable
+        // address that the name "self" should behave as an alias for when
+        // evaluating. Set this to nil if the "self" object should not be available.
+        //
+        // The "key" argument is also optional. If given, it is the instance key
+        // of the current object within the multi-instance container it belongs
+        // to. For example, on a resource block with "count" set this should be
+        // set to a different addrs.IntKey for each instance created from that
+        // block. Set this to addrs.NoKey if not appropriate.
+        //
+        // The returned body is an expanded version of the given body, with any
+        // "dynamic" blocks replaced with zero or more static blocks. This can be
+        // used to extract correct source location information about attributes of
+        // the returned object value.
+        EvaluateBlock(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics)
+
+        // EvaluateExpr takes the given HCL expression and evaluates it to produce
+        // a value.
+        //
+        // The "self" argument is optional. If given, it is the referenceable
+        // address that the name "self" should behave as an alias for when
+        // evaluating. Set this to nil if the "self" object should not be available.
+        EvaluateExpr(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics)
+
+        // EvaluationScope returns a scope that can be used to evaluate reference
+        // addresses in this context.
+        EvaluationScope(self addrs.Referenceable, keyData InstanceKeyEvalData) *lang.Scope
+
+        // SetModuleCallArguments defines values for the variables of a particular
+        // child module call.
         //
-        // The resource argument is optional. If given, it is the resource
-        // that is currently being acted upon.
-        Interpolate(*config.RawConfig, *Resource) (*ResourceConfig, error)
-
-        // InterpolateProvider takes a ProviderConfig and interpolates it with the
-        // stored interpolation scope. Since provider configurations can be
-        // inherited, the interpolation scope may be different from the current
-        // context path. Interplation is otherwise executed the same as in the
-        // Interpolation method.
-        InterpolateProvider(*config.ProviderConfig, *Resource) (*ResourceConfig, error)
-
-        // SetVariables sets the variables for the module within
-        // this context with the name n. This function call is additive:
-        // the second parameter is merged with any previous call.
-        SetVariables(string, map[string]interface{})
-
-        // Diff returns the global diff as well as the lock that should
-        // be used to modify that diff.
-        Diff() (*Diff, *sync.RWMutex)
-
-        // State returns the global state as well as the lock that should
-        // be used to modify that state.
-        State() (*State, *sync.RWMutex)
+        // Calling this function multiple times has merging behavior, keeping any
+        // previously-set keys that are not present in the new map.
+        SetModuleCallArguments(addrs.ModuleCallInstance, map[string]cty.Value)
+
+        // Changes returns the writer object that can be used to write new proposed
+        // changes into the global changes set.
+        Changes() *plans.ChangesSync
+
+        // State returns a wrapper object that provides safe concurrent access to
+        // the global state.
+        State() *states.SyncState
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
index 1b6ee5a..20b3793 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
@@ -6,7 +6,20 @@ import (
         "log"
         "sync"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/version"
+
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // BuiltinEvalContext is an EvalContext implementation that is used by
@@ -16,35 +29,47 @@ type BuiltinEvalContext struct {
         StopContext context.Context
 
         // PathValue is the Path that this context is operating within.
-        PathValue []string
+        PathValue addrs.ModuleInstance
 
-        // Interpolater setting below affect the interpolation of variables.
+        // Evaluator is used for evaluating expressions within the scope of this
+        // eval context.
+        Evaluator *Evaluator
+
+        // Schemas is a repository of all of the schemas we should need to
+        // decode configuration blocks and expressions. This must be constructed by
+        // the caller to include schemas for all of the providers, resource types,
+        // data sources and provisioners used by the given configuration and
+        // state.
         //
-        // The InterpolaterVars are the exact value for ${var.foo} values.
-        // The map is shared between all contexts and is a mapping of
-        // PATH to KEY to VALUE. Because it is shared by all contexts as well
-        // as the Interpolater itself, it is protected by InterpolaterVarLock
-        // which must be locked during any access to the map.
-        Interpolater        *Interpolater
-        InterpolaterVars    map[string]map[string]interface{}
-        InterpolaterVarLock *sync.Mutex
+        // This must not be mutated during evaluation.
+        Schemas *Schemas
+
+        // VariableValues contains the variable values across all modules. This
+        // structure is shared across the entire containing context, and so it
+        // may be accessed only when holding VariableValuesLock.
+        // The keys of the first level of VariableValues are the string
+        // representations of addrs.ModuleInstance values. The second-level keys
+        // are variable names within each module instance.
+        VariableValues     map[string]map[string]cty.Value
+        VariableValuesLock *sync.Mutex
 
         Components          contextComponentFactory
         Hooks               []Hook
         InputValue          UIInput
-        ProviderCache       map[string]ResourceProvider
-        ProviderInputConfig map[string]map[string]interface{}
+        ProviderCache       map[string]providers.Interface
+        ProviderInputConfig map[string]map[string]cty.Value
         ProviderLock        *sync.Mutex
-        ProvisionerCache    map[string]ResourceProvisioner
+        ProvisionerCache    map[string]provisioners.Interface
         ProvisionerLock     *sync.Mutex
-        DiffValue           *Diff
-        DiffLock            *sync.RWMutex
-        StateValue          *State
-        StateLock           *sync.RWMutex
+        ChangesValue        *plans.ChangesSync
+        StateValue          *states.SyncState
 
         once sync.Once
 }
 
+// BuiltinEvalContext implements EvalContext
+var _ EvalContext = (*BuiltinEvalContext)(nil)
+
 func (ctx *BuiltinEvalContext) Stopped() <-chan struct{} {
         // This can happen during tests. During tests, we just block forever.
         if ctx.StopContext == nil {
@@ -78,12 +103,13 @@ func (ctx *BuiltinEvalContext) Input() UIInput {
         return ctx.InputValue
 }
 
-func (ctx *BuiltinEvalContext) InitProvider(typeName, name string) (ResourceProvider, error) {
+func (ctx *BuiltinEvalContext) InitProvider(typeName string, addr addrs.ProviderConfig) (providers.Interface, error) {
         ctx.once.Do(ctx.init)
+        absAddr := addr.Absolute(ctx.Path())
 
         // If we already initialized, it is an error
-        if p := ctx.Provider(name); p != nil {
-                return nil, fmt.Errorf("Provider '%s' already initialized", name)
+        if p := ctx.Provider(absAddr); p != nil {
+                return nil, fmt.Errorf("%s is already initialized", addr)
         }
 
         // Warning: make sure to acquire these locks AFTER the call to Provider
@@ -91,85 +117,102 @@ func (ctx *BuiltinEvalContext) InitProvider(typeName, name string) (ResourceProv
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        p, err := ctx.Components.ResourceProvider(typeName, name)
+        key := absAddr.String()
+
+        p, err := ctx.Components.ResourceProvider(typeName, key)
         if err != nil {
                 return nil, err
         }
 
-        ctx.ProviderCache[name] = p
+        log.Printf("[TRACE] BuiltinEvalContext: Initialized %q provider for %s", typeName, absAddr)
+        ctx.ProviderCache[key] = p
+
         return p, nil
 }
 
-func (ctx *BuiltinEvalContext) Provider(n string) ResourceProvider {
+func (ctx *BuiltinEvalContext) Provider(addr addrs.AbsProviderConfig) providers.Interface {
         ctx.once.Do(ctx.init)
 
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        return ctx.ProviderCache[n]
+        return ctx.ProviderCache[addr.String()]
+}
+
+func (ctx *BuiltinEvalContext) ProviderSchema(addr addrs.AbsProviderConfig) *ProviderSchema {
+        ctx.once.Do(ctx.init)
+
+        return ctx.Schemas.ProviderSchema(addr.ProviderConfig.Type)
 }
 
-func (ctx *BuiltinEvalContext) CloseProvider(n string) error {
+func (ctx *BuiltinEvalContext) CloseProvider(addr addrs.ProviderConfig) error {
         ctx.once.Do(ctx.init)
 
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        var provider interface{}
-        provider = ctx.ProviderCache[n]
+        key := addr.Absolute(ctx.Path()).String()
+        provider := ctx.ProviderCache[key]
         if provider != nil {
-                if p, ok := provider.(ResourceProviderCloser); ok {
-                        delete(ctx.ProviderCache, n)
-                        return p.Close()
-                }
+                delete(ctx.ProviderCache, key)
+                return provider.Close()
         }
 
         return nil
 }
 
-func (ctx *BuiltinEvalContext) ConfigureProvider(
-        n string, cfg *ResourceConfig) error {
-        p := ctx.Provider(n)
+func (ctx *BuiltinEvalContext) ConfigureProvider(addr addrs.ProviderConfig, cfg cty.Value) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        absAddr := addr.Absolute(ctx.Path())
+        p := ctx.Provider(absAddr)
         if p == nil {
-                return fmt.Errorf("Provider '%s' not initialized", n)
+                diags = diags.Append(fmt.Errorf("%s not initialized", addr))
+                return diags
         }
-        return p.Configure(cfg)
+
+        providerSchema := ctx.ProviderSchema(absAddr)
+        if providerSchema == nil {
+                diags = diags.Append(fmt.Errorf("schema for %s is not available", absAddr))
+                return diags
+        }
+
+        req := providers.ConfigureRequest{
+                TerraformVersion: version.String(),
+                Config:           cfg,
+        }
+
+        resp := p.Configure(req)
+        return resp.Diagnostics
 }
 
-func (ctx *BuiltinEvalContext) ProviderInput(n string) map[string]interface{} {
+func (ctx *BuiltinEvalContext) ProviderInput(pc addrs.ProviderConfig) map[string]cty.Value {
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        // Make a copy of the path so we can safely edit it
-        path := ctx.Path()
-        pathCopy := make([]string, len(path)+1)
-        copy(pathCopy, path)
-
-        // Go up the tree.
-        for i := len(path) - 1; i >= 0; i-- {
-                pathCopy[i+1] = n
-                k := PathCacheKey(pathCopy[:i+2])
-                if v, ok := ctx.ProviderInputConfig[k]; ok {
-                        return v
-                }
+        if !ctx.Path().IsRoot() {
+                // Only root module provider configurations can have input.
+                return nil
         }
 
-        return nil
+        return ctx.ProviderInputConfig[pc.String()]
 }
 
-func (ctx *BuiltinEvalContext) SetProviderInput(n string, c map[string]interface{}) {
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
+func (ctx *BuiltinEvalContext) SetProviderInput(pc addrs.ProviderConfig, c map[string]cty.Value) {
+        absProvider := pc.Absolute(ctx.Path())
+
+        if !ctx.Path().IsRoot() {
+                // Only root module provider configurations can have input.
+                log.Printf("[WARN] BuiltinEvalContext: attempt to SetProviderInput for non-root module")
+                return
+        }
 
         // Save the configuration
         ctx.ProviderLock.Lock()
-        ctx.ProviderInputConfig[PathCacheKey(providerPath)] = c
+        ctx.ProviderInputConfig[absProvider.String()] = c
         ctx.ProviderLock.Unlock()
 }
 
-func (ctx *BuiltinEvalContext) InitProvisioner(
-        n string) (ResourceProvisioner, error) {
+func (ctx *BuiltinEvalContext) InitProvisioner(n string) (provisioners.Interface, error) {
         ctx.once.Do(ctx.init)
 
         // If we already initialized, it is an error
@@ -182,10 +225,7 @@ func (ctx *BuiltinEvalContext) InitProvisioner(
         ctx.ProvisionerLock.Lock()
         defer ctx.ProvisionerLock.Unlock()
 
-        provPath := make([]string, len(ctx.Path())+1)
-        copy(provPath, ctx.Path())
-        provPath[len(provPath)-1] = n
-        key := PathCacheKey(provPath)
+        key := PathObjectCacheKey(ctx.Path(), n)
 
         p, err := ctx.Components.ResourceProvisioner(n, key)
         if err != nil {
@@ -193,20 +233,24 @@ func (ctx *BuiltinEvalContext) InitProvisioner(
         }
 
         ctx.ProvisionerCache[key] = p
+
         return p, nil
 }
 
-func (ctx *BuiltinEvalContext) Provisioner(n string) ResourceProvisioner {
+func (ctx *BuiltinEvalContext) Provisioner(n string) provisioners.Interface {
         ctx.once.Do(ctx.init)
 
         ctx.ProvisionerLock.Lock()
         defer ctx.ProvisionerLock.Unlock()
 
-        provPath := make([]string, len(ctx.Path())+1)
-        copy(provPath, ctx.Path())
-        provPath[len(provPath)-1] = n
+        key := PathObjectCacheKey(ctx.Path(), n)
+        return ctx.ProvisionerCache[key]
+}
+
+func (ctx *BuiltinEvalContext) ProvisionerSchema(n string) *configschema.Block {
+        ctx.once.Do(ctx.init)
 
-        return ctx.ProvisionerCache[PathCacheKey(provPath)]
+        return ctx.Schemas.ProvisionerConfig(n)
 }
 
 func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
@@ -215,106 +259,70 @@ func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
         ctx.ProvisionerLock.Lock()
         defer ctx.ProvisionerLock.Unlock()
 
-        provPath := make([]string, len(ctx.Path())+1)
-        copy(provPath, ctx.Path())
-        provPath[len(provPath)-1] = n
+        key := PathObjectCacheKey(ctx.Path(), n)
 
-        var prov interface{}
-        prov = ctx.ProvisionerCache[PathCacheKey(provPath)]
+        prov := ctx.ProvisionerCache[key]
         if prov != nil {
-                if p, ok := prov.(ResourceProvisionerCloser); ok {
-                        delete(ctx.ProvisionerCache, PathCacheKey(provPath))
-                        return p.Close()
-                }
+                return prov.Close()
         }
 
         return nil
 }
 
-func (ctx *BuiltinEvalContext) Interpolate(
-        cfg *config.RawConfig, r *Resource) (*ResourceConfig, error) {
-
-        if cfg != nil {
-                scope := &InterpolationScope{
-                        Path:     ctx.Path(),
-                        Resource: r,
-                }
-
-                vs, err := ctx.Interpolater.Values(scope, cfg.Variables)
-                if err != nil {
-                        return nil, err
-                }
-
-                // Do the interpolation
-                if err := cfg.Interpolate(vs); err != nil {
-                        return nil, err
-                }
-        }
-
-        result := NewResourceConfig(cfg)
-        result.interpolateForce()
-        return result, nil
+func (ctx *BuiltinEvalContext) EvaluateBlock(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        scope := ctx.EvaluationScope(self, keyData)
+        body, evalDiags := scope.ExpandBlock(body, schema)
+        diags = diags.Append(evalDiags)
+        val, evalDiags := scope.EvalBlock(body, schema)
+        diags = diags.Append(evalDiags)
+        return val, body, diags
 }
 
-func (ctx *BuiltinEvalContext) InterpolateProvider(
-        pc *config.ProviderConfig, r *Resource) (*ResourceConfig, error) {
-
-        var cfg *config.RawConfig
-
-        if pc != nil && pc.RawConfig != nil {
-                scope := &InterpolationScope{
-                        Path:     ctx.Path(),
-                        Resource: r,
-                }
-
-                cfg = pc.RawConfig
-
-                vs, err := ctx.Interpolater.Values(scope, cfg.Variables)
-                if err != nil {
-                        return nil, err
-                }
+func (ctx *BuiltinEvalContext) EvaluateExpr(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics) {
+        scope := ctx.EvaluationScope(self, EvalDataForNoInstanceKey)
+        return scope.EvalExpr(expr, wantType)
+}
 
-                // Do the interpolation
-                if err := cfg.Interpolate(vs); err != nil {
-                        return nil, err
-                }
+func (ctx *BuiltinEvalContext) EvaluationScope(self addrs.Referenceable, keyData InstanceKeyEvalData) *lang.Scope {
+        data := &evaluationStateData{
+                Evaluator:       ctx.Evaluator,
+                ModulePath:      ctx.PathValue,
+                InstanceKeyData: keyData,
+                Operation:       ctx.Evaluator.Operation,
         }
-
-        result := NewResourceConfig(cfg)
-        result.interpolateForce()
-        return result, nil
+        return ctx.Evaluator.Scope(data, self)
 }
 
-func (ctx *BuiltinEvalContext) Path() []string {
+func (ctx *BuiltinEvalContext) Path() addrs.ModuleInstance {
         return ctx.PathValue
 }
 
-func (ctx *BuiltinEvalContext) SetVariables(n string, vs map[string]interface{}) {
-        ctx.InterpolaterVarLock.Lock()
-        defer ctx.InterpolaterVarLock.Unlock()
+func (ctx *BuiltinEvalContext) SetModuleCallArguments(n addrs.ModuleCallInstance, vals map[string]cty.Value) {
+        ctx.VariableValuesLock.Lock()
+        defer ctx.VariableValuesLock.Unlock()
 
-        path := make([]string, len(ctx.Path())+1)
-        copy(path, ctx.Path())
-        path[len(path)-1] = n
-        key := PathCacheKey(path)
+        childPath := n.ModuleInstance(ctx.PathValue)
+        key := childPath.String()
 
-        vars := ctx.InterpolaterVars[key]
-        if vars == nil {
-                vars = make(map[string]interface{})
-                ctx.InterpolaterVars[key] = vars
+        args := ctx.VariableValues[key]
+        if args == nil {
+                args = make(map[string]cty.Value)
+                ctx.VariableValues[key] = vals
+                return
         }
 
-        for k, v := range vs {
-                vars[k] = v
+        for k, v := range vals {
+                args[k] = v
         }
 }
 
-func (ctx *BuiltinEvalContext) Diff() (*Diff, *sync.RWMutex) {
-        return ctx.DiffValue, ctx.DiffLock
+func (ctx *BuiltinEvalContext) Changes() *plans.ChangesSync {
+        return ctx.ChangesValue
 }
 
-func (ctx *BuiltinEvalContext) State() (*State, *sync.RWMutex) {
-        return ctx.StateValue, ctx.StateLock
+func (ctx *BuiltinEvalContext) State() *states.SyncState {
+        return ctx.StateValue
 }
 
 func (ctx *BuiltinEvalContext) init() {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
index 6464517..195ecc5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
@@ -1,9 +1,20 @@
 package terraform
 
 import (
-        "sync"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // MockEvalContext is a mock version of EvalContext that can be used
@@ -20,43 +31,84 @@ type MockEvalContext struct {
         InputInput  UIInput
 
         InitProviderCalled   bool
-        InitProviderName     string
-        InitProviderProvider ResourceProvider
+        InitProviderType     string
+        InitProviderAddr     addrs.ProviderConfig
+        InitProviderProvider providers.Interface
         InitProviderError    error
 
         ProviderCalled   bool
-        ProviderName     string
-        ProviderProvider ResourceProvider
+        ProviderAddr     addrs.AbsProviderConfig
+        ProviderProvider providers.Interface
+
+        ProviderSchemaCalled bool
+        ProviderSchemaAddr   addrs.AbsProviderConfig
+        ProviderSchemaSchema *ProviderSchema
 
         CloseProviderCalled   bool
-        CloseProviderName     string
-        CloseProviderProvider ResourceProvider
+        CloseProviderAddr     addrs.ProviderConfig
+        CloseProviderProvider providers.Interface
 
         ProviderInputCalled bool
-        ProviderInputName   string
-        ProviderInputConfig map[string]interface{}
+        ProviderInputAddr   addrs.ProviderConfig
+        ProviderInputValues map[string]cty.Value
 
         SetProviderInputCalled bool
-        SetProviderInputName   string
-        SetProviderInputConfig map[string]interface{}
+        SetProviderInputAddr   addrs.ProviderConfig
+        SetProviderInputValues map[string]cty.Value
 
         ConfigureProviderCalled bool
-        ConfigureProviderName   string
-        ConfigureProviderConfig *ResourceConfig
-        ConfigureProviderError  error
+        ConfigureProviderAddr   addrs.ProviderConfig
+        ConfigureProviderConfig cty.Value
+        ConfigureProviderDiags  tfdiags.Diagnostics
 
         InitProvisionerCalled      bool
         InitProvisionerName        string
-        InitProvisionerProvisioner ResourceProvisioner
+        InitProvisionerProvisioner provisioners.Interface
         InitProvisionerError       error
 
         ProvisionerCalled      bool
         ProvisionerName        string
-        ProvisionerProvisioner ResourceProvisioner
+        ProvisionerProvisioner provisioners.Interface
+
+        ProvisionerSchemaCalled bool
+        ProvisionerSchemaName   string
+        ProvisionerSchemaSchema *configschema.Block
 
         CloseProvisionerCalled      bool
         CloseProvisionerName        string
-        CloseProvisionerProvisioner ResourceProvisioner
+        CloseProvisionerProvisioner provisioners.Interface
+
+        EvaluateBlockCalled     bool
+        EvaluateBlockBody       hcl.Body
+        EvaluateBlockSchema     *configschema.Block
+        EvaluateBlockSelf       addrs.Referenceable
+        EvaluateBlockKeyData    InstanceKeyEvalData
+        EvaluateBlockResultFunc func(
+                body hcl.Body,
+                schema *configschema.Block,
+                self addrs.Referenceable,
+                keyData InstanceKeyEvalData,
+        ) (cty.Value, hcl.Body, tfdiags.Diagnostics) // overrides the other values below, if set
+        EvaluateBlockResult       cty.Value
+        EvaluateBlockExpandedBody hcl.Body
+        EvaluateBlockDiags        tfdiags.Diagnostics
+
+        EvaluateExprCalled     bool
+        EvaluateExprExpr       hcl.Expression
+        EvaluateExprWantType   cty.Type
+        EvaluateExprSelf       addrs.Referenceable
+        EvaluateExprResultFunc func(
+                expr hcl.Expression,
+                wantType cty.Type,
+                self addrs.Referenceable,
+        ) (cty.Value, tfdiags.Diagnostics) // overrides the other values below, if set
+        EvaluateExprResult cty.Value
+        EvaluateExprDiags  tfdiags.Diagnostics
+
+        EvaluationScopeCalled  bool
+        EvaluationScopeSelf    addrs.Referenceable
+        EvaluationScopeKeyData InstanceKeyEvalData
+        EvaluationScopeScope   *lang.Scope
 
         InterpolateCalled       bool
         InterpolateConfig       *config.RawConfig
@@ -71,21 +123,22 @@ type MockEvalContext struct {
         InterpolateProviderError        error
 
         PathCalled bool
-        PathPath   []string
+        PathPath   addrs.ModuleInstance
 
-        SetVariablesCalled    bool
-        SetVariablesModule    string
-        SetVariablesVariables map[string]interface{}
+        SetModuleCallArgumentsCalled bool
+        SetModuleCallArgumentsModule addrs.ModuleCallInstance
+        SetModuleCallArgumentsValues map[string]cty.Value
 
-        DiffCalled bool
-        DiffDiff   *Diff
-        DiffLock   *sync.RWMutex
+        ChangesCalled  bool
+        ChangesChanges *plans.ChangesSync
 
         StateCalled bool
-        StateState  *State
-        StateLock   *sync.RWMutex
+        StateState  *states.SyncState
 }
 
+// MockEvalContext implements EvalContext
+var _ EvalContext = (*MockEvalContext)(nil)
+
 func (c *MockEvalContext) Stopped() <-chan struct{} {
         c.StoppedCalled = true
         return c.StoppedValue
@@ -107,61 +160,157 @@ func (c *MockEvalContext) Input() UIInput {
         return c.InputInput
 }
 
-func (c *MockEvalContext) InitProvider(t, n string) (ResourceProvider, error) {
+func (c *MockEvalContext) InitProvider(t string, addr addrs.ProviderConfig) (providers.Interface, error) {
         c.InitProviderCalled = true
-        c.InitProviderName = n
+        c.InitProviderType = t
+        c.InitProviderAddr = addr
         return c.InitProviderProvider, c.InitProviderError
 }
 
-func (c *MockEvalContext) Provider(n string) ResourceProvider {
+func (c *MockEvalContext) Provider(addr addrs.AbsProviderConfig) providers.Interface {
         c.ProviderCalled = true
-        c.ProviderName = n
+        c.ProviderAddr = addr
         return c.ProviderProvider
 }
 
-func (c *MockEvalContext) CloseProvider(n string) error {
+func (c *MockEvalContext) ProviderSchema(addr addrs.AbsProviderConfig) *ProviderSchema {
+        c.ProviderSchemaCalled = true
+        c.ProviderSchemaAddr = addr
+        return c.ProviderSchemaSchema
+}
+
+func (c *MockEvalContext) CloseProvider(addr addrs.ProviderConfig) error {
         c.CloseProviderCalled = true
-        c.CloseProviderName = n
+        c.CloseProviderAddr = addr
         return nil
 }
 
-func (c *MockEvalContext) ConfigureProvider(n string, cfg *ResourceConfig) error {
+func (c *MockEvalContext) ConfigureProvider(addr addrs.ProviderConfig, cfg cty.Value) tfdiags.Diagnostics {
         c.ConfigureProviderCalled = true
-        c.ConfigureProviderName = n
+        c.ConfigureProviderAddr = addr
         c.ConfigureProviderConfig = cfg
-        return c.ConfigureProviderError
+        return c.ConfigureProviderDiags
 }
 
-func (c *MockEvalContext) ProviderInput(n string) map[string]interface{} {
+func (c *MockEvalContext) ProviderInput(addr addrs.ProviderConfig) map[string]cty.Value {
         c.ProviderInputCalled = true
-        c.ProviderInputName = n
-        return c.ProviderInputConfig
+        c.ProviderInputAddr = addr
+        return c.ProviderInputValues
 }
 
-func (c *MockEvalContext) SetProviderInput(n string, cfg map[string]interface{}) {
+func (c *MockEvalContext) SetProviderInput(addr addrs.ProviderConfig, vals map[string]cty.Value) {
         c.SetProviderInputCalled = true
-        c.SetProviderInputName = n
-        c.SetProviderInputConfig = cfg
+        c.SetProviderInputAddr = addr
+        c.SetProviderInputValues = vals
 }
 
-func (c *MockEvalContext) InitProvisioner(n string) (ResourceProvisioner, error) {
+func (c *MockEvalContext) InitProvisioner(n string) (provisioners.Interface, error) {
         c.InitProvisionerCalled = true
         c.InitProvisionerName = n
         return c.InitProvisionerProvisioner, c.InitProvisionerError
 }
 
-func (c *MockEvalContext) Provisioner(n string) ResourceProvisioner {
+func (c *MockEvalContext) Provisioner(n string) provisioners.Interface {
         c.ProvisionerCalled = true
         c.ProvisionerName = n
         return c.ProvisionerProvisioner
 }
 
+func (c *MockEvalContext) ProvisionerSchema(n string) *configschema.Block {
+        c.ProvisionerSchemaCalled = true
+        c.ProvisionerSchemaName = n
+        return c.ProvisionerSchemaSchema
+}
+
 func (c *MockEvalContext) CloseProvisioner(n string) error {
         c.CloseProvisionerCalled = true
         c.CloseProvisionerName = n
         return nil
 }
 
+func (c *MockEvalContext) EvaluateBlock(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+        c.EvaluateBlockCalled = true
+        c.EvaluateBlockBody = body
+        c.EvaluateBlockSchema = schema
+        c.EvaluateBlockSelf = self
+        c.EvaluateBlockKeyData = keyData
+        if c.EvaluateBlockResultFunc != nil {
+                return c.EvaluateBlockResultFunc(body, schema, self, keyData)
+        }
+        return c.EvaluateBlockResult, c.EvaluateBlockExpandedBody, c.EvaluateBlockDiags
+}
+
+func (c *MockEvalContext) EvaluateExpr(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics) {
+        c.EvaluateExprCalled = true
+        c.EvaluateExprExpr = expr
+        c.EvaluateExprWantType = wantType
+        c.EvaluateExprSelf = self
+        if c.EvaluateExprResultFunc != nil {
+                return c.EvaluateExprResultFunc(expr, wantType, self)
+        }
+        return c.EvaluateExprResult, c.EvaluateExprDiags
+}
+
+// installSimpleEval is a helper to install a simple mock implementation of
+// both EvaluateBlock and EvaluateExpr into the receiver.
+//
+// These default implementations will either evaluate the given input against
+// the scope in field EvaluationScopeScope or, if it is nil, with no eval
+// context at all so that only constant values may be used.
+//
+// This function overwrites any existing functions installed in fields
+// EvaluateBlockResultFunc and EvaluateExprResultFunc.
+func (c *MockEvalContext) installSimpleEval() {
+        c.EvaluateBlockResultFunc = func(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+                if scope := c.EvaluationScopeScope; scope != nil {
+                        // Fully-functional codepath.
+                        var diags tfdiags.Diagnostics
+                        body, diags = scope.ExpandBlock(body, schema)
+                        if diags.HasErrors() {
+                                return cty.DynamicVal, body, diags
+                        }
+                        val, evalDiags := c.EvaluationScopeScope.EvalBlock(body, schema)
+                        diags = diags.Append(evalDiags)
+                        if evalDiags.HasErrors() {
+                                return cty.DynamicVal, body, diags
+                        }
+                        return val, body, diags
+                }
+
+                // Fallback codepath supporting constant values only.
+                val, hclDiags := hcldec.Decode(body, schema.DecoderSpec(), nil)
+                return val, body, tfdiags.Diagnostics(nil).Append(hclDiags)
+        }
+        c.EvaluateExprResultFunc = func(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics) {
+                if scope := c.EvaluationScopeScope; scope != nil {
+                        // Fully-functional codepath.
+                        return scope.EvalExpr(expr, wantType)
+                }
+
+                // Fallback codepath supporting constant values only.
+                var diags tfdiags.Diagnostics
+                val, hclDiags := expr.Value(nil)
+                diags = diags.Append(hclDiags)
+                if hclDiags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+                var err error
+                val, err = convert.Convert(val, wantType)
+                if err != nil {
+                        diags = diags.Append(err)
+                        return cty.DynamicVal, diags
+                }
+                return val, diags
+        }
+}
+
+func (c *MockEvalContext) EvaluationScope(self addrs.Referenceable, keyData InstanceKeyEvalData) *lang.Scope {
+        c.EvaluationScopeCalled = true
+        c.EvaluationScopeSelf = self
+        c.EvaluationScopeKeyData = keyData
+        return c.EvaluationScopeScope
+}
+
 func (c *MockEvalContext) Interpolate(
         config *config.RawConfig, resource *Resource) (*ResourceConfig, error) {
         c.InterpolateCalled = true
@@ -178,23 +327,23 @@ func (c *MockEvalContext) InterpolateProvider(
         return c.InterpolateProviderConfigResult, c.InterpolateError
 }
 
-func (c *MockEvalContext) Path() []string {
+func (c *MockEvalContext) Path() addrs.ModuleInstance {
         c.PathCalled = true
         return c.PathPath
 }
 
-func (c *MockEvalContext) SetVariables(n string, vs map[string]interface{}) {
-        c.SetVariablesCalled = true
-        c.SetVariablesModule = n
-        c.SetVariablesVariables = vs
+func (c *MockEvalContext) SetModuleCallArguments(n addrs.ModuleCallInstance, values map[string]cty.Value) {
+        c.SetModuleCallArgumentsCalled = true
+        c.SetModuleCallArgumentsModule = n
+        c.SetModuleCallArgumentsValues = values
 }
 
-func (c *MockEvalContext) Diff() (*Diff, *sync.RWMutex) {
-        c.DiffCalled = true
-        return c.DiffDiff, c.DiffLock
+func (c *MockEvalContext) Changes() *plans.ChangesSync {
+        c.ChangesCalled = true
+        return c.ChangesChanges
 }
 
-func (c *MockEvalContext) State() (*State, *sync.RWMutex) {
+func (c *MockEvalContext) State() *states.SyncState {
         c.StateCalled = true
-        return c.StateState, c.StateLock
+        return c.StateState
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_count.go b/vendor/github.com/hashicorp/terraform/terraform/eval_count.go
index 2ae56a7..8083105 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_count.go
@@ -1,58 +1,120 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
 )
 
-// EvalCountFixZeroOneBoundary is an EvalNode that fixes up the state
-// when there is a resource count with zero/one boundary, i.e. fixing
-// a resource named "aws_instance.foo" to "aws_instance.foo.0" and vice-versa.
-type EvalCountFixZeroOneBoundary struct {
-        Resource *config.Resource
+// evaluateResourceCountExpression is our standard mechanism for interpreting an
+// expression given for a "count" argument on a resource. This should be called
+// from the DynamicExpand of a node representing a resource in order to
+// determine the final count value.
+//
+// If the result is zero or positive and no error diagnostics are returned, then
+// the result is the literal count value to use.
+//
+// If the result is -1, this indicates that the given expression is nil and so
+// the "count" behavior should not be enabled for this resource at all.
+//
+// If error diagnostics are returned then the result is always the meaningless
+// placeholder value -1.
+func evaluateResourceCountExpression(expr hcl.Expression, ctx EvalContext) (int, tfdiags.Diagnostics) {
+        count, known, diags := evaluateResourceCountExpressionKnown(expr, ctx)
+        if !known {
+                // Currently this is a rather bad outcome from a UX standpoint, since we have
+                // no real mechanism to deal with this situation and all we can do is produce
+                // an error message.
+                // FIXME: In future, implement a built-in mechanism for deferring changes that
+                // can't yet be predicted, and use it to guide the user through several
+                // plan/apply steps until the desired configuration is eventually reached.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The "count" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use the -target argument to first apply only the resources that the count depends on.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+        }
+        return count, diags
 }
 
-// TODO: test
-func (n *EvalCountFixZeroOneBoundary) Eval(ctx EvalContext) (interface{}, error) {
-        // Get the count, important for knowing whether we're supposed to
-        // be adding the zero, or trimming it.
-        count, err := n.Resource.Count()
-        if err != nil {
-                return nil, err
+// evaluateResourceCountExpressionKnown is like evaluateResourceCountExpression
+// except that it handles an unknown result by returning count = 0 and
+// a known = false, rather than by reporting the unknown value as an error
+// diagnostic.
+func evaluateResourceCountExpressionKnown(expr hcl.Expression, ctx EvalContext) (count int, known bool, diags tfdiags.Diagnostics) {
+        if expr == nil {
+                return -1, true, nil
         }
 
-        // Figure what to look for and what to replace it with
-        hunt := n.Resource.Id()
-        replace := hunt + ".0"
-        if count < 2 {
-                hunt, replace = replace, hunt
+        countVal, countDiags := ctx.EvaluateExpr(expr, cty.Number, nil)
+        diags = diags.Append(countDiags)
+        if diags.HasErrors() {
+                return -1, true, diags
         }
 
-        state, lock := ctx.State()
-
-        // Get a lock so we can access this instance and potentially make
-        // changes to it.
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
+        switch {
+        case countVal.IsNull():
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is null. An integer is required.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return -1, true, diags
+        case !countVal.IsKnown():
+                return 0, false, diags
         }
 
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs, ok := mod.Resources[hunt]
-        if !ok {
-                return nil, nil
+        err := gocty.FromCtyValue(countVal, &count)
+        if err != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   fmt.Sprintf(`The given "count" argument value is unsuitable: %s.`, err),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return -1, true, diags
         }
-
-        // If the replacement key exists, we just keep both
-        if _, ok := mod.Resources[replace]; ok {
-                return nil, nil
+        if count < 0 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is unsuitable: negative numbers are not supported.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return -1, true, diags
         }
 
-        mod.Resources[replace] = rs
-        delete(mod.Resources, hunt)
+        return count, true, diags
+}
 
-        return nil, nil
+// fixResourceCountSetTransition is a helper function to fix up the state when a
+// resource transitions its "count" from being set to unset or vice-versa,
+// treating a 0-key and a no-key instance as aliases for one another across
+// the transition.
+//
+// The correct time to call this function is in the DynamicExpand method for
+// a node representing a resource, just after evaluating the count with
+// evaluateResourceCountExpression, and before any other analysis of the
+// state such as orphan detection.
+//
+// This function calls methods on the given EvalContext to update the current
+// state in-place, if necessary. It is a no-op if there is no count transition
+// taking place.
+//
+// Since the state is modified in-place, this function must take a writer lock
+// on the state. The caller must therefore not also be holding a state lock,
+// or this function will block forever awaiting the lock.
+func fixResourceCountSetTransition(ctx EvalContext, addr addrs.AbsResource, countEnabled bool) {
+        state := ctx.State()
+        changed := state.MaybeFixUpResourceInstanceAddressForCount(addr, countEnabled)
+        if changed {
+                log.Printf("[TRACE] renamed first %s instance in transient state due to count argument change", addr)
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go b/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go
index 91e2b90..647c58d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go
@@ -1,7 +1,11 @@
 package terraform
 
 import (
+        "fmt"
         "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // EvalCountFixZeroOneBoundaryGlobal is an EvalNode that fixes up the state
@@ -9,22 +13,34 @@ import (
 // a resource named "aws_instance.foo" to "aws_instance.foo.0" and vice-versa.
 //
 // This works on the global state.
-type EvalCountFixZeroOneBoundaryGlobal struct{}
+type EvalCountFixZeroOneBoundaryGlobal struct {
+        Config *configs.Config
+}
 
 // TODO: test
 func (n *EvalCountFixZeroOneBoundaryGlobal) Eval(ctx EvalContext) (interface{}, error) {
-        // Get the state and lock it since we'll potentially modify it
-        state, lock := ctx.State()
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Prune the state since we require a clean state to work
-        state.prune()
-
-        // Go through each modules since the boundaries are restricted to a
-        // module scope.
+        // We'll temporarily lock the state to grab the modules, then work on each
+        // one separately while taking a lock again for each separate resource.
+        // This means that if another caller concurrently adds a module here while
+        // we're working then we won't update it, but that's no worse than the
+        // concurrent writer blocking for our entire fixup process and _then_
+        // adding a new module, and in practice the graph node associated with
+        // this eval depends on everything else in the graph anyway, so there
+        // should not be concurrent writers.
+        state := ctx.State().Lock()
+        moduleAddrs := make([]addrs.ModuleInstance, 0, len(state.Modules))
         for _, m := range state.Modules {
-                if err := n.fixModule(m); err != nil {
+                moduleAddrs = append(moduleAddrs, m.Addr)
+        }
+        ctx.State().Unlock()
+
+        for _, addr := range moduleAddrs {
+                cfg := n.Config.DescendentForInstance(addr)
+                if cfg == nil {
+                        log.Printf("[WARN] Not fixing up EachModes for %s because it has no config", addr)
+                        continue
+                }
+                if err := n.fixModule(ctx, addr); err != nil {
                         return nil, err
                 }
         }
@@ -32,46 +48,29 @@ func (n *EvalCountFixZeroOneBoundaryGlobal) Eval(ctx EvalContext) (interface{},
         return nil, nil
 }
 
-func (n *EvalCountFixZeroOneBoundaryGlobal) fixModule(m *ModuleState) error {
-        // Counts keeps track of keys and their counts
-        counts := make(map[string]int)
-        for k, _ := range m.Resources {
-                // Parse the key
-                key, err := ParseResourceStateKey(k)
-                if err != nil {
-                        return err
-                }
-
-                // Set the index to -1 so that we can keep count
-                key.Index = -1
-
-                // Increment
-                counts[key.String()]++
+func (n *EvalCountFixZeroOneBoundaryGlobal) fixModule(ctx EvalContext, moduleAddr addrs.ModuleInstance) error {
+        ms := ctx.State().Module(moduleAddr)
+        cfg := n.Config.DescendentForInstance(moduleAddr)
+        if ms == nil {
+                // Theoretically possible for a concurrent writer to delete a module
+                // while we're running, but in practice the graph node that called us
+                // depends on everything else in the graph and so there can never
+                // be a concurrent writer.
+                return fmt.Errorf("[WARN] no state found for %s while trying to fix up EachModes", moduleAddr)
+        }
+        if cfg == nil {
+                return fmt.Errorf("[WARN] no config found for %s while trying to fix up EachModes", moduleAddr)
         }
 
-        // Go through the counts and do the fixup for each resource
-        for raw, count := range counts {
-                // Search and replace this resource
-                search := raw
-                replace := raw + ".0"
-                if count < 2 {
-                        search, replace = replace, search
-                }
-                log.Printf("[TRACE] EvalCountFixZeroOneBoundaryGlobal: count %d, search %q, replace %q", count, search, replace)
-
-                // Look for the resource state. If we don't have one, then it is okay.
-                rs, ok := m.Resources[search]
-                if !ok {
-                        continue
-                }
-
-                // If the replacement key exists, we just keep both
-                if _, ok := m.Resources[replace]; ok {
+        for _, r := range ms.Resources {
+                addr := r.Addr.Absolute(moduleAddr)
+                rCfg := cfg.Module.ResourceByAddr(r.Addr)
+                if rCfg == nil {
+                        log.Printf("[WARN] Not fixing up EachModes for %s because it has no config", addr)
                         continue
                 }
-
-                m.Resources[replace] = rs
-                delete(m.Resources, search)
+                hasCount := rCfg.Count != nil
+                fixResourceCountSetTransition(ctx, addr, hasCount)
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
index 26205ce..b7acfb0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
@@ -1,92 +1,114 @@
 package terraform
 
 import (
+        "bytes"
         "fmt"
         "log"
+        "reflect"
         "strings"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalCompareDiff is an EvalNode implementation that compares two diffs
-// and errors if the diffs are not equal.
-type EvalCompareDiff struct {
-        Info     *InstanceInfo
-        One, Two **InstanceDiff
+// EvalCheckPlannedChange is an EvalNode implementation that produces errors
+// if the _actual_ expected value is not compatible with what was recorded
+// in the plan.
+//
+// Errors here are most often indicative of a bug in the provider, so our
+// error messages will report with that in mind. It's also possible that
+// there's a bug in Terraform's Core's own "proposed new value" code in
+// EvalDiff.
+type EvalCheckPlannedChange struct {
+        Addr           addrs.ResourceInstance
+        ProviderAddr   addrs.AbsProviderConfig
+        ProviderSchema **ProviderSchema
+
+        // We take ResourceInstanceChange objects here just because that's what's
+        // convenient to pass in from the evaltree implementation, but we really
+        // only look at the "After" value of each change.
+        Planned, Actual **plans.ResourceInstanceChange
 }
 
-// TODO: test
-func (n *EvalCompareDiff) Eval(ctx EvalContext) (interface{}, error) {
-        one, two := *n.One, *n.Two
-
-        // If either are nil, let them be empty
-        if one == nil {
-                one = new(InstanceDiff)
-                one.init()
-        }
-        if two == nil {
-                two = new(InstanceDiff)
-                two.init()
-        }
-        oneId, _ := one.GetAttribute("id")
-        twoId, _ := two.GetAttribute("id")
-        one.DelAttribute("id")
-        two.DelAttribute("id")
-        defer func() {
-                if oneId != nil {
-                        one.SetAttribute("id", oneId)
-                }
-                if twoId != nil {
-                        two.SetAttribute("id", twoId)
-                }
-        }()
-
-        if same, reason := one.Same(two); !same {
-                log.Printf("[ERROR] %s: diffs didn't match", n.Info.Id)
-                log.Printf("[ERROR] %s: reason: %s", n.Info.Id, reason)
-                log.Printf("[ERROR] %s: diff one: %#v", n.Info.Id, one)
-                log.Printf("[ERROR] %s: diff two: %#v", n.Info.Id, two)
-                return nil, fmt.Errorf(
-                        "%s: diffs didn't match during apply. This is a bug with "+
-                                "Terraform and should be reported as a GitHub Issue.\n"+
-                                "\n"+
-                                "Please include the following information in your report:\n"+
-                                "\n"+
-                                "    Terraform Version: %s\n"+
-                                "    Resource ID: %s\n"+
-                                "    Mismatch reason: %s\n"+
-                                "    Diff One (usually from plan): %#v\n"+
-                                "    Diff Two (usually from apply): %#v\n"+
-                                "\n"+
-                                "Also include as much context as you can about your config, state, "+
-                                "and the steps you performed to trigger this error.\n",
-                        n.Info.Id, version.Version, n.Info.Id, reason, one, two)
+func (n *EvalCheckPlannedChange) Eval(ctx EvalContext) (interface{}, error) {
+        providerSchema := *n.ProviderSchema
+        plannedChange := *n.Planned
+        actualChange := *n.Actual
+
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support %q", n.Addr.Resource.Type)
+        }
+
+        var diags tfdiags.Diagnostics
+        absAddr := n.Addr.Absolute(ctx.Path())
+
+        log.Printf("[TRACE] EvalCheckPlannedChange: Verifying that actual change (action %s) matches planned change (action %s)", actualChange.Action, plannedChange.Action)
+
+        if plannedChange.Action != actualChange.Action {
+                switch {
+                case plannedChange.Action == plans.Update && actualChange.Action == plans.NoOp:
+                        // It's okay for an update to become a NoOp once we've filled in
+                        // all of the unknown values, since the final values might actually
+                        // match what was there before after all.
+                        log.Printf("[DEBUG] After incorporating new values learned so far during apply, %s change has become NoOp", absAddr)
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider produced inconsistent final plan",
+                                fmt.Sprintf(
+                                        "When expanding the plan for %s to include new values learned so far during apply, provider %q changed the planned action from %s to %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                        absAddr, n.ProviderAddr.ProviderConfig.Type,
+                                        plannedChange.Action, actualChange.Action,
+                                ),
+                        ))
+                }
         }
 
-        return nil, nil
+        errs := objchange.AssertObjectCompatible(schema, plannedChange.After, actualChange.After)
+        for _, err := range errs {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced inconsistent final plan",
+                        fmt.Sprintf(
+                                "When expanding the plan for %s to include new values learned so far during apply, provider %q produced an invalid new value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                absAddr, n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatError(err),
+                        ),
+                ))
+        }
+        return nil, diags.Err()
 }
 
-// EvalDiff is an EvalNode implementation that does a refresh for
-// a resource.
+// EvalDiff is an EvalNode implementation that detects changes for a given
+// resource instance.
 type EvalDiff struct {
-        Name        string
-        Info        *InstanceInfo
-        Config      **ResourceConfig
-        Provider    *ResourceProvider
-        Diff        **InstanceDiff
-        State       **InstanceState
-        OutputDiff  **InstanceDiff
-        OutputState **InstanceState
-
-        // Resource is needed to fetch the ignore_changes list so we can
-        // filter user-requested ignored attributes from the diff.
-        Resource *config.Resource
-
-        // Stub is used to flag the generated InstanceDiff as a stub. This is used to
-        // ensure that the node exists to perform interpolations and generate
-        // computed paths off of, but not as an actual diff where resouces should be
-        // counted, and not as a diff that should be acted on.
+        Addr           addrs.ResourceInstance
+        Config         *configs.Resource
+        Provider       *providers.Interface
+        ProviderAddr   addrs.AbsProviderConfig
+        ProviderSchema **ProviderSchema
+        State          **states.ResourceInstanceObject
+        PreviousDiff   **plans.ResourceInstanceChange
+
+        // CreateBeforeDestroy is set if either the resource's own config sets
+        // create_before_destroy explicitly or if dependencies have forced the
+        // resource to be handled as create_before_destroy in order to avoid
+        // a dependency cycle.
+        CreateBeforeDestroy bool
+
+        OutputChange **plans.ResourceInstanceChange
+        OutputValue  *cty.Value
+        OutputState  **states.ResourceInstanceObject
+
         Stub bool
 }
 
@@ -95,81 +117,303 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
         state := *n.State
         config := *n.Config
         provider := *n.Provider
+        providerSchema := *n.ProviderSchema
+
+        if providerSchema == nil {
+                return nil, fmt.Errorf("provider schema is unavailable for %s", n.Addr)
+        }
+        if n.ProviderAddr.ProviderConfig.Type == "" {
+                panic(fmt.Sprintf("EvalDiff for %s does not have ProviderAddr set", n.Addr.Absolute(ctx.Path())))
+        }
+
+        var diags tfdiags.Diagnostics
+
+        // Evaluate the configuration
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
+        keyData := EvalDataForInstanceKey(n.Addr.Key)
+        configVal, _, configDiags := ctx.EvaluateBlock(config.Config, schema, nil, keyData)
+        diags = diags.Append(configDiags)
+        if configDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        absAddr := n.Addr.Absolute(ctx.Path())
+        var priorVal cty.Value
+        var priorValTainted cty.Value
+        var priorPrivate []byte
+        if state != nil {
+                if state.Status != states.ObjectTainted {
+                        priorVal = state.Value
+                        priorPrivate = state.Private
+                } else {
+                        // If the prior state is tainted then we'll proceed below like
+                        // we're creating an entirely new object, but then turn it into
+                        // a synthetic "Replace" change at the end, creating the same
+                        // result as if the provider had marked at least one argument
+                        // change as "requires replacement".
+                        priorValTainted = state.Value
+                        priorVal = cty.NullVal(schema.ImpliedType())
+                }
+        } else {
+                priorVal = cty.NullVal(schema.ImpliedType())
+        }
+
+        proposedNewVal := objchange.ProposedNewObject(schema, priorVal, configVal)
 
         // Call pre-diff hook
         if !n.Stub {
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreDiff(n.Info, state)
+                        return h.PreDiff(absAddr, states.CurrentGen, priorVal, proposedNewVal)
                 })
                 if err != nil {
                         return nil, err
                 }
         }
 
-        // The state for the diff must never be nil
-        diffState := state
-        if diffState == nil {
-                diffState = new(InstanceState)
+        // The provider gets an opportunity to customize the proposed new value,
+        // which in turn produces the _planned_ new value.
+        resp := provider.PlanResourceChange(providers.PlanResourceChangeRequest{
+                TypeName:         n.Addr.Resource.Type,
+                Config:           configVal,
+                PriorState:       priorVal,
+                ProposedNewState: proposedNewVal,
+                PriorPrivate:     priorPrivate,
+        })
+        diags = diags.Append(resp.Diagnostics.InConfigBody(config.Config))
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        plannedNewVal := resp.PlannedState
+        plannedPrivate := resp.PlannedPrivate
+
+        if plannedNewVal == cty.NilVal {
+                // Should never happen. Since real-world providers return via RPC a nil
+                // is always a bug in the client-side stub. This is more likely caused
+                // by an incompletely-configured mock provider in tests, though.
+                panic(fmt.Sprintf("PlanResourceChange of %s produced nil value", absAddr.String()))
+        }
+
+        // We allow the planned new value to disagree with configuration _values_
+        // here, since that allows the provider to do special logic like a
+        // DiffSuppressFunc, but we still require that the provider produces
+        // a value whose type conforms to the schema.
+        for _, err := range plannedNewVal.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid plan",
+                        fmt.Sprintf(
+                                "Provider %q planned an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if errs := objchange.AssertPlanValid(schema, priorVal, configVal, plannedNewVal); len(errs) > 0 {
+                if resp.LegacyTypeSystem {
+                        // The shimming of the old type system in the legacy SDK is not precise
+                        // enough to pass this consistency check, so we'll give it a pass here,
+                        // but we will generate a warning about it so that we are more likely
+                        // to notice in the logs if an inconsistency beyond the type system
+                        // leads to a downstream provider failure.
+                        var buf strings.Builder
+                        fmt.Fprintf(&buf, "[WARN] Provider %q produced an invalid plan for %s, but we are tolerating it because it is using the legacy plugin SDK.\n    The following problems may be the cause of any confusing errors from downstream operations:", n.ProviderAddr.ProviderConfig.Type, absAddr)
+                        for _, err := range errs {
+                                fmt.Fprintf(&buf, "\n      - %s", tfdiags.FormatError(err))
+                        }
+                        log.Print(buf.String())
+                } else {
+                        for _, err := range errs {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider produced invalid plan",
+                                        fmt.Sprintf(
+                                                "Provider %q planned an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                                        ),
+                                ))
+                        }
+                        return nil, diags.Err()
+                }
         }
-        diffState.init()
 
-        // Diff!
-        diff, err := provider.Diff(n.Info, diffState, config)
-        if err != nil {
-                return nil, err
-        }
-        if diff == nil {
-                diff = new(InstanceDiff)
+        {
+                var moreDiags tfdiags.Diagnostics
+                plannedNewVal, moreDiags = n.processIgnoreChanges(priorVal, plannedNewVal)
+                diags = diags.Append(moreDiags)
+                if moreDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
         }
 
-        // Set DestroyDeposed if we have deposed instances
-        _, err = readInstanceFromState(ctx, n.Name, nil, func(rs *ResourceState) (*InstanceState, error) {
-                if len(rs.Deposed) > 0 {
-                        diff.DestroyDeposed = true
-                }
+        // The provider produces a list of paths to attributes whose changes mean
+        // that we must replace rather than update an existing remote object.
+        // However, we only need to do that if the identified attributes _have_
+        // actually changed -- particularly after we may have undone some of the
+        // changes in processIgnoreChanges -- so now we'll filter that list to
+        // include only where changes are detected.
+        reqRep := cty.NewPathSet()
+        if len(resp.RequiresReplace) > 0 {
+                for _, path := range resp.RequiresReplace {
+                        if priorVal.IsNull() {
+                                // If prior is null then we don't expect any RequiresReplace at all,
+                                // because this is a Create action.
+                                continue
+                        }
 
-                return nil, nil
-        })
-        if err != nil {
-                return nil, err
-        }
+                        priorChangedVal, priorPathDiags := hcl.ApplyPath(priorVal, path, nil)
+                        plannedChangedVal, plannedPathDiags := hcl.ApplyPath(plannedNewVal, path, nil)
+                        if plannedPathDiags.HasErrors() && priorPathDiags.HasErrors() {
+                                // This means the path was invalid in both the prior and new
+                                // values, which is an error with the provider itself.
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider produced invalid plan",
+                                        fmt.Sprintf(
+                                                "Provider %q has indicated \"requires replacement\" on %s for a non-existent attribute path %#v.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                                n.ProviderAddr.ProviderConfig.Type, absAddr, path,
+                                        ),
+                                ))
+                                continue
+                        }
 
-        // Preserve the DestroyTainted flag
-        if n.Diff != nil {
-                diff.SetTainted((*n.Diff).GetDestroyTainted())
-        }
+                        // Make sure we have valid Values for both values.
+                        // Note: if the opposing value was of the type
+                        // cty.DynamicPseudoType, the type assigned here may not exactly
+                        // match the schema. This is fine here, since we're only going to
+                        // check for equality, but if the NullVal is to be used, we need to
+                        // check the schema for th true type.
+                        switch {
+                        case priorChangedVal == cty.NilVal && plannedChangedVal == cty.NilVal:
+                                // this should never happen without ApplyPath errors above
+                                panic("requires replace path returned 2 nil values")
+                        case priorChangedVal == cty.NilVal:
+                                priorChangedVal = cty.NullVal(plannedChangedVal.Type())
+                        case plannedChangedVal == cty.NilVal:
+                                plannedChangedVal = cty.NullVal(priorChangedVal.Type())
+                        }
 
-        // Require a destroy if there is an ID and it requires new.
-        if diff.RequiresNew() && state != nil && state.ID != "" {
-                diff.SetDestroy(true)
+                        eqV := plannedChangedVal.Equals(priorChangedVal)
+                        if !eqV.IsKnown() || eqV.False() {
+                                reqRep.Add(path)
+                        }
+                }
+                if diags.HasErrors() {
+                        return nil, diags.Err()
+                }
         }
 
-        // If we're creating a new resource, compute its ID
-        if diff.RequiresNew() || state == nil || state.ID == "" {
-                var oldID string
-                if state != nil {
-                        oldID = state.Attributes["id"]
+        eqV := plannedNewVal.Equals(priorVal)
+        eq := eqV.IsKnown() && eqV.True()
+
+        var action plans.Action
+        switch {
+        case priorVal.IsNull():
+                action = plans.Create
+        case eq:
+                action = plans.NoOp
+        case !reqRep.Empty():
+                // If there are any "requires replace" paths left _after our filtering
+                // above_ then this is a replace action.
+                if n.CreateBeforeDestroy {
+                        action = plans.CreateThenDelete
+                } else {
+                        action = plans.DeleteThenCreate
                 }
-
-                // Add diff to compute new ID
-                diff.init()
-                diff.SetAttribute("id", &ResourceAttrDiff{
-                        Old:         oldID,
-                        NewComputed: true,
-                        RequiresNew: true,
-                        Type:        DiffAttrOutput,
+        default:
+                action = plans.Update
+                // "Delete" is never chosen here, because deletion plans are always
+                // created more directly elsewhere, such as in "orphan" handling.
+        }
+
+        if action.IsReplace() {
+                // In this strange situation we want to produce a change object that
+                // shows our real prior object but has a _new_ object that is built
+                // from a null prior object, since we're going to delete the one
+                // that has all the computed values on it.
+                //
+                // Therefore we'll ask the provider to plan again here, giving it
+                // a null object for the prior, and then we'll meld that with the
+                // _actual_ prior state to produce a correctly-shaped replace change.
+                // The resulting change should show any computed attributes changing
+                // from known prior values to unknown values, unless the provider is
+                // able to predict new values for any of these computed attributes.
+                nullPriorVal := cty.NullVal(schema.ImpliedType())
+
+                // create a new proposed value from the null state and the config
+                proposedNewVal = objchange.ProposedNewObject(schema, nullPriorVal, configVal)
+
+                resp = provider.PlanResourceChange(providers.PlanResourceChangeRequest{
+                        TypeName:         n.Addr.Resource.Type,
+                        Config:           configVal,
+                        PriorState:       nullPriorVal,
+                        ProposedNewState: proposedNewVal,
+                        PriorPrivate:     plannedPrivate,
                 })
+                // We need to tread carefully here, since if there are any warnings
+                // in here they probably also came out of our previous call to
+                // PlanResourceChange above, and so we don't want to repeat them.
+                // Consequently, we break from the usual pattern here and only
+                // append these new diagnostics if there's at least one error inside.
+                if resp.Diagnostics.HasErrors() {
+                        diags = diags.Append(resp.Diagnostics.InConfigBody(config.Config))
+                        return nil, diags.Err()
+                }
+                plannedNewVal = resp.PlannedState
+                plannedPrivate = resp.PlannedPrivate
+                for _, err := range plannedNewVal.Type().TestConformance(schema.ImpliedType()) {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider produced invalid plan",
+                                fmt.Sprintf(
+                                        "Provider %q planned an invalid value for %s%s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                        n.ProviderAddr.ProviderConfig.Type, absAddr, tfdiags.FormatError(err),
+                                ),
+                        ))
+                }
+                if diags.HasErrors() {
+                        return nil, diags.Err()
+                }
         }
 
-        // filter out ignored resources
-        if err := n.processIgnoreChanges(diff); err != nil {
-                return nil, err
+        // If our prior value was tainted then we actually want this to appear
+        // as a replace change, even though so far we've been treating it as a
+        // create.
+        if action == plans.Create && priorValTainted != cty.NilVal {
+                if n.CreateBeforeDestroy {
+                        action = plans.CreateThenDelete
+                } else {
+                        action = plans.DeleteThenCreate
+                }
+                priorVal = priorValTainted
+        }
+
+        // As a special case, if we have a previous diff (presumably from the plan
+        // phases, whereas we're now in the apply phase) and it was for a replace,
+        // we've already deleted the original object from state by the time we
+        // get here and so we would've ended up with a _create_ action this time,
+        // which we now need to paper over to get a result consistent with what
+        // we originally intended.
+        if n.PreviousDiff != nil {
+                prevChange := *n.PreviousDiff
+                if prevChange.Action.IsReplace() && action == plans.Create {
+                        log.Printf("[TRACE] EvalDiff: %s treating Create change as %s change to match with earlier plan", absAddr, prevChange.Action)
+                        action = prevChange.Action
+                        priorVal = prevChange.Before
+                }
         }
 
         // Call post-refresh hook
         if !n.Stub {
-                err = ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostDiff(n.Info, diff)
+                err := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostDiff(absAddr, states.CurrentGen, action, priorVal, plannedNewVal)
                 })
                 if err != nil {
                         return nil, err
@@ -177,30 +421,135 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
         }
 
         // Update our output if we care
-        if n.OutputDiff != nil {
-                *n.OutputDiff = diff
+        if n.OutputChange != nil {
+                *n.OutputChange = &plans.ResourceInstanceChange{
+                        Addr:         absAddr,
+                        Private:      plannedPrivate,
+                        ProviderAddr: n.ProviderAddr,
+                        Change: plans.Change{
+                                Action: action,
+                                Before: priorVal,
+                                After:  plannedNewVal,
+                        },
+                        RequiredReplace: reqRep,
+                }
+        }
+
+        if n.OutputValue != nil {
+                *n.OutputValue = configVal
         }
 
         // Update the state if we care
         if n.OutputState != nil {
-                *n.OutputState = state
-
-                // Merge our state so that the state is updated with our plan
-                if !diff.Empty() && n.OutputState != nil {
-                        *n.OutputState = state.MergeDiff(diff)
+                *n.OutputState = &states.ResourceInstanceObject{
+                        // We use the special "planned" status here to note that this
+                        // object's value is not yet complete. Objects with this status
+                        // cannot be used during expression evaluation, so the caller
+                        // must _also_ record the returned change in the active plan,
+                        // which the expression evaluator will use in preference to this
+                        // incomplete value recorded in the state.
+                        Status: states.ObjectPlanned,
+                        Value:  plannedNewVal,
                 }
         }
 
         return nil, nil
 }
 
-func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
-        if diff == nil || n.Resource == nil || n.Resource.Id() == "" {
+func (n *EvalDiff) processIgnoreChanges(prior, proposed cty.Value) (cty.Value, tfdiags.Diagnostics) {
+        // ignore_changes only applies when an object already exists, since we
+        // can't ignore changes to a thing we've not created yet.
+        if prior.IsNull() {
+                return proposed, nil
+        }
+
+        ignoreChanges := n.Config.Managed.IgnoreChanges
+        ignoreAll := n.Config.Managed.IgnoreAllChanges
+
+        if len(ignoreChanges) == 0 && !ignoreAll {
+                return proposed, nil
+        }
+        if ignoreAll {
+                return prior, nil
+        }
+        if prior.IsNull() || proposed.IsNull() {
+                // Ignore changes doesn't apply when we're creating for the first time.
+                // Proposed should never be null here, but if it is then we'll just let it be.
+                return proposed, nil
+        }
+
+        return processIgnoreChangesIndividual(prior, proposed, ignoreChanges)
+}
+
+func processIgnoreChangesIndividual(prior, proposed cty.Value, ignoreChanges []hcl.Traversal) (cty.Value, tfdiags.Diagnostics) {
+        // When we walk below we will be using cty.Path values for comparison, so
+        // we'll convert our traversals here so we can compare more easily.
+        ignoreChangesPath := make([]cty.Path, len(ignoreChanges))
+        for i, traversal := range ignoreChanges {
+                path := make(cty.Path, len(traversal))
+                for si, step := range traversal {
+                        switch ts := step.(type) {
+                        case hcl.TraverseRoot:
+                                path[si] = cty.GetAttrStep{
+                                        Name: ts.Name,
+                                }
+                        case hcl.TraverseAttr:
+                                path[si] = cty.GetAttrStep{
+                                        Name: ts.Name,
+                                }
+                        case hcl.TraverseIndex:
+                                path[si] = cty.IndexStep{
+                                        Key: ts.Key,
+                                }
+                        default:
+                                panic(fmt.Sprintf("unsupported traversal step %#v", step))
+                        }
+                }
+                ignoreChangesPath[i] = path
+        }
+
+        var diags tfdiags.Diagnostics
+        ret, _ := cty.Transform(proposed, func(path cty.Path, v cty.Value) (cty.Value, error) {
+                // First we must see if this is a path that's being ignored at all.
+                // We're looking for an exact match here because this walk will visit
+                // leaf values first and then their containers, and we want to do
+                // the "ignore" transform once we reach the point indicated, throwing
+                // away any deeper values we already produced at that point.
+                var ignoreTraversal hcl.Traversal
+                for i, candidate := range ignoreChangesPath {
+                        if reflect.DeepEqual(path, candidate) {
+                                ignoreTraversal = ignoreChanges[i]
+                        }
+                }
+                if ignoreTraversal == nil {
+                        return v, nil
+                }
+
+                // If we're able to follow the same path through the prior value,
+                // we'll take the value there instead, effectively undoing the
+                // change that was planned.
+                priorV, diags := hcl.ApplyPath(prior, path, nil)
+                if diags.HasErrors() {
+                        // We just ignore the errors and move on here, since we assume it's
+                        // just because the prior value was a slightly-different shape.
+                        // It could potentially also be that the traversal doesn't match
+                        // the schema, but we should've caught that during the validate
+                        // walk if so.
+                        return v, nil
+                }
+                return priorV, nil
+        })
+        return ret, diags
+}
+
+func (n *EvalDiff) processIgnoreChangesOld(diff *InstanceDiff) error {
+        if diff == nil || n.Config == nil || n.Config.Managed == nil {
                 return nil
         }
-        ignoreChanges := n.Resource.Lifecycle.IgnoreChanges
+        ignoreChanges := n.Config.Managed.IgnoreChanges
+        ignoreAll := n.Config.Managed.IgnoreAllChanges
 
-        if len(ignoreChanges) == 0 {
+        if len(ignoreChanges) == 0 && !ignoreAll {
                 return nil
         }
 
@@ -220,9 +569,14 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
 
         // get the complete set of keys we want to ignore
         ignorableAttrKeys := make(map[string]bool)
-        for _, ignoredKey := range ignoreChanges {
-                for k := range attrs {
-                        if ignoredKey == "*" || strings.HasPrefix(k, ignoredKey) {
+        for k := range attrs {
+                if ignoreAll {
+                        ignorableAttrKeys[k] = true
+                        continue
+                }
+                for _, ignoredTraversal := range ignoreChanges {
+                        ignoredKey := legacyFlatmapKeyForTraversal(ignoredTraversal)
+                        if k == ignoredKey || strings.HasPrefix(k, ignoredKey+".") {
                                 ignorableAttrKeys[k] = true
                         }
                 }
@@ -285,14 +639,56 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
 
         // If we didn't hit any of our early exit conditions, we can filter the diff.
         for k := range ignorableAttrKeys {
-                log.Printf("[DEBUG] [EvalIgnoreChanges] %s - Ignoring diff attribute: %s",
-                        n.Resource.Id(), k)
+                log.Printf("[DEBUG] [EvalIgnoreChanges] %s: Ignoring diff attribute: %s", n.Addr.String(), k)
                 diff.DelAttribute(k)
         }
 
         return nil
 }
 
+// legacyFlagmapKeyForTraversal constructs a key string compatible with what
+// the flatmap package would generate for an attribute addressable by the given
+// traversal.
+//
+// This is used only to shim references to attributes within the diff and
+// state structures, which have not (at the time of writing) yet been updated
+// to use the newer HCL-based representations.
+func legacyFlatmapKeyForTraversal(traversal hcl.Traversal) string {
+        var buf bytes.Buffer
+        first := true
+        for _, step := range traversal {
+                if !first {
+                        buf.WriteByte('.')
+                }
+                switch ts := step.(type) {
+                case hcl.TraverseRoot:
+                        buf.WriteString(ts.Name)
+                case hcl.TraverseAttr:
+                        buf.WriteString(ts.Name)
+                case hcl.TraverseIndex:
+                        val := ts.Key
+                        switch val.Type() {
+                        case cty.Number:
+                                bf := val.AsBigFloat()
+                                buf.WriteString(bf.String())
+                        case cty.String:
+                                s := val.AsString()
+                                buf.WriteString(s)
+                        default:
+                                // should never happen, since no other types appear in
+                                // traversals in practice.
+                                buf.WriteByte('?')
+                        }
+                default:
+                        // should never happen, since we've covered all of the types
+                        // that show up in parsed traversals in practice.
+                        buf.WriteByte('?')
+                }
+                first = false
+        }
+        return buf.String()
+}
+
 // a group of key-*ResourceAttrDiff pairs from the same flatmapped container
 type flatAttrDiff map[string]*ResourceAttrDiff
 
@@ -343,159 +739,213 @@ func groupContainers(d *InstanceDiff) map[string]flatAttrDiff {
 // EvalDiffDestroy is an EvalNode implementation that returns a plain
 // destroy diff.
 type EvalDiffDestroy struct {
-        Info   *InstanceInfo
-        State  **InstanceState
-        Output **InstanceDiff
+        Addr         addrs.ResourceInstance
+        DeposedKey   states.DeposedKey
+        State        **states.ResourceInstanceObject
+        ProviderAddr addrs.AbsProviderConfig
+
+        Output      **plans.ResourceInstanceChange
+        OutputState **states.ResourceInstanceObject
 }
 
 // TODO: test
 func (n *EvalDiffDestroy) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
         state := *n.State
 
-        // If there is no state or we don't have an ID, we're already destroyed
-        if state == nil || state.ID == "" {
+        if n.ProviderAddr.ProviderConfig.Type == "" {
+                if n.DeposedKey == "" {
+                        panic(fmt.Sprintf("EvalDiffDestroy for %s does not have ProviderAddr set", absAddr))
+                } else {
+                        panic(fmt.Sprintf("EvalDiffDestroy for %s (deposed %s) does not have ProviderAddr set", absAddr, n.DeposedKey))
+                }
+        }
+
+        // If there is no state or our attributes object is null then we're already
+        // destroyed.
+        if state == nil || state.Value.IsNull() {
                 return nil, nil
         }
 
         // Call pre-diff hook
         err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreDiff(n.Info, state)
+                return h.PreDiff(
+                        absAddr, n.DeposedKey.Generation(),
+                        state.Value,
+                        cty.NullVal(cty.DynamicPseudoType),
+                )
         })
         if err != nil {
                 return nil, err
         }
 
-        // The diff
-        diff := &InstanceDiff{Destroy: true}
+        // Change is always the same for a destroy. We don't need the provider's
+        // help for this one.
+        // TODO: Should we give the provider an opportunity to veto this?
+        change := &plans.ResourceInstanceChange{
+                Addr:       absAddr,
+                DeposedKey: n.DeposedKey,
+                Change: plans.Change{
+                        Action: plans.Delete,
+                        Before: state.Value,
+                        After:  cty.NullVal(cty.DynamicPseudoType),
+                },
+                ProviderAddr: n.ProviderAddr,
+        }
 
         // Call post-diff hook
         err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostDiff(n.Info, diff)
+                return h.PostDiff(
+                        absAddr,
+                        n.DeposedKey.Generation(),
+                        change.Action,
+                        change.Before,
+                        change.After,
+                )
         })
         if err != nil {
                 return nil, err
         }
 
         // Update our output
-        *n.Output = diff
-
-        return nil, nil
-}
-
-// EvalDiffDestroyModule is an EvalNode implementation that writes the diff to
-// the full diff.
-type EvalDiffDestroyModule struct {
-        Path []string
-}
-
-// TODO: test
-func (n *EvalDiffDestroyModule) Eval(ctx EvalContext) (interface{}, error) {
-        diff, lock := ctx.Diff()
-
-        // Acquire the lock so that we can do this safely concurrently
-        lock.Lock()
-        defer lock.Unlock()
+        *n.Output = change
 
-        // Write the diff
-        modDiff := diff.ModuleByPath(n.Path)
-        if modDiff == nil {
-                modDiff = diff.AddModule(n.Path)
+        if n.OutputState != nil {
+                // Record our proposed new state, which is nil because we're destroying.
+                *n.OutputState = nil
         }
-        modDiff.Destroy = true
 
         return nil, nil
 }
 
-// EvalFilterDiff is an EvalNode implementation that filters the diff
-// according to some filter.
-type EvalFilterDiff struct {
-        // Input and output
-        Diff   **InstanceDiff
-        Output **InstanceDiff
-
-        // Destroy, if true, will only include a destroy diff if it is set.
-        Destroy bool
+// EvalReduceDiff is an EvalNode implementation that takes a planned resource
+// instance change as might be produced by EvalDiff or EvalDiffDestroy and
+// "simplifies" it to a single atomic action to be performed by a specific
+// graph node.
+//
+// Callers must specify whether they are a destroy node or a regular apply
+// node.  If the result is NoOp then the given change requires no action for
+// the specific graph node calling this and so evaluation of the that graph
+// node should exit early and take no action.
+//
+// The object written to OutChange may either be identical to InChange or
+// a new change object derived from InChange. Because of the former case, the
+// caller must not mutate the object returned in OutChange.
+type EvalReduceDiff struct {
+        Addr      addrs.ResourceInstance
+        InChange  **plans.ResourceInstanceChange
+        Destroy   bool
+        OutChange **plans.ResourceInstanceChange
 }
 
-func (n *EvalFilterDiff) Eval(ctx EvalContext) (interface{}, error) {
-        if *n.Diff == nil {
-                return nil, nil
-        }
-
-        input := *n.Diff
-        result := new(InstanceDiff)
-
-        if n.Destroy {
-                if input.GetDestroy() || input.RequiresNew() {
-                        result.SetDestroy(true)
+// TODO: test
+func (n *EvalReduceDiff) Eval(ctx EvalContext) (interface{}, error) {
+        in := *n.InChange
+        out := in.Simplify(n.Destroy)
+        if n.OutChange != nil {
+                *n.OutChange = out
+        }
+        if out.Action != in.Action {
+                if n.Destroy {
+                        log.Printf("[TRACE] EvalReduceDiff: %s change simplified from %s to %s for destroy node", n.Addr, in.Action, out.Action)
+                } else {
+                        log.Printf("[TRACE] EvalReduceDiff: %s change simplified from %s to %s for apply node", n.Addr, in.Action, out.Action)
                 }
         }
-
-        if n.Output != nil {
-                *n.Output = result
-        }
-
         return nil, nil
 }
 
-// EvalReadDiff is an EvalNode implementation that writes the diff to
-// the full diff.
+// EvalReadDiff is an EvalNode implementation that retrieves the planned
+// change for a particular resource instance object.
 type EvalReadDiff struct {
-        Name string
-        Diff **InstanceDiff
+        Addr           addrs.ResourceInstance
+        DeposedKey     states.DeposedKey
+        ProviderSchema **ProviderSchema
+        Change         **plans.ResourceInstanceChange
 }
 
 func (n *EvalReadDiff) Eval(ctx EvalContext) (interface{}, error) {
-        diff, lock := ctx.Diff()
+        providerSchema := *n.ProviderSchema
+        changes := ctx.Changes()
+        addr := n.Addr.Absolute(ctx.Path())
 
-        // Acquire the lock so that we can do this safely concurrently
-        lock.Lock()
-        defer lock.Unlock()
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
 
-        // Write the diff
-        modDiff := diff.ModuleByPath(ctx.Path())
-        if modDiff == nil {
+        gen := states.CurrentGen
+        if n.DeposedKey != states.NotDeposed {
+                gen = n.DeposedKey
+        }
+        csrc := changes.GetResourceInstanceChange(addr, gen)
+        if csrc == nil {
+                log.Printf("[TRACE] EvalReadDiff: No planned change recorded for %s", addr)
                 return nil, nil
         }
 
-        *n.Diff = modDiff.Resources[n.Name]
+        change, err := csrc.Decode(schema.ImpliedType())
+        if err != nil {
+                return nil, fmt.Errorf("failed to decode planned changes for %s: %s", addr, err)
+        }
+        if n.Change != nil {
+                *n.Change = change
+        }
+
+        log.Printf("[TRACE] EvalReadDiff: Read %s change from plan for %s", change.Action, addr)
 
         return nil, nil
 }
 
-// EvalWriteDiff is an EvalNode implementation that writes the diff to
-// the full diff.
+// EvalWriteDiff is an EvalNode implementation that saves a planned change
+// for an instance object into the set of global planned changes.
 type EvalWriteDiff struct {
-        Name string
-        Diff **InstanceDiff
+        Addr           addrs.ResourceInstance
+        DeposedKey     states.DeposedKey
+        ProviderSchema **ProviderSchema
+        Change         **plans.ResourceInstanceChange
 }
 
 // TODO: test
 func (n *EvalWriteDiff) Eval(ctx EvalContext) (interface{}, error) {
-        diff, lock := ctx.Diff()
-
-        // The diff to write, if its empty it should write nil
-        var diffVal *InstanceDiff
-        if n.Diff != nil {
-                diffVal = *n.Diff
+        changes := ctx.Changes()
+        addr := n.Addr.Absolute(ctx.Path())
+        if n.Change == nil || *n.Change == nil {
+                // Caller sets nil to indicate that we need to remove a change from
+                // the set of changes.
+                gen := states.CurrentGen
+                if n.DeposedKey != states.NotDeposed {
+                        gen = n.DeposedKey
+                }
+                changes.RemoveResourceInstanceChange(addr, gen)
+                return nil, nil
         }
-        if diffVal.Empty() {
-                diffVal = nil
+
+        providerSchema := *n.ProviderSchema
+        change := *n.Change
+
+        if change.Addr.String() != addr.String() || change.DeposedKey != n.DeposedKey {
+                // Should never happen, and indicates a bug in the caller.
+                panic("inconsistent address and/or deposed key in EvalWriteDiff")
         }
 
-        // Acquire the lock so that we can do this safely concurrently
-        lock.Lock()
-        defer lock.Unlock()
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
 
-        // Write the diff
-        modDiff := diff.ModuleByPath(ctx.Path())
-        if modDiff == nil {
-                modDiff = diff.AddModule(ctx.Path())
+        csrc, err := change.Encode(schema.ImpliedType())
+        if err != nil {
+                return nil, fmt.Errorf("failed to encode planned changes for %s: %s", addr, err)
         }
-        if diffVal != nil {
-                modDiff.Resources[n.Name] = diffVal
+
+        changes.AppendResourceInstanceChange(csrc)
+        if n.DeposedKey == states.NotDeposed {
+                log.Printf("[TRACE] EvalWriteDiff: recorded %s change for %s", change.Action, addr)
         } else {
-                delete(modDiff.Resources, n.Name)
+                log.Printf("[TRACE] EvalWriteDiff: recorded %s change for %s deposed object %s", change.Action, addr, n.DeposedKey)
         }
 
         return nil, nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go b/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go
index 62cc581..a60f4a0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go
@@ -2,47 +2,63 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalImportState is an EvalNode implementation that performs an
 // ImportState operation on a provider. This will return the imported
 // states but won't modify any actual state.
 type EvalImportState struct {
-        Provider *ResourceProvider
-        Info     *InstanceInfo
-        Id       string
-        Output   *[]*InstanceState
+        Addr     addrs.ResourceInstance
+        Provider *providers.Interface
+        ID       string
+        Output   *[]providers.ImportedResource
 }
 
 // TODO: test
 func (n *EvalImportState) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
         provider := *n.Provider
+        var diags tfdiags.Diagnostics
 
         {
                 // Call pre-import hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreImportState(n.Info, n.Id)
+                        return h.PreImportState(absAddr, n.ID)
                 })
                 if err != nil {
                         return nil, err
                 }
         }
 
-        // Import!
-        state, err := provider.ImportState(n.Info, n.Id)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "import %s (id: %s): %s", n.Info.HumanId(), n.Id, err)
+        resp := provider.ImportResourceState(providers.ImportResourceStateRequest{
+                TypeName: n.Addr.Resource.Type,
+                ID:       n.ID,
+        })
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        imported := resp.ImportedResources
+
+        for _, obj := range imported {
+                log.Printf("[TRACE] EvalImportState: import %s %q produced instance object of type %s", absAddr.String(), n.ID, obj.TypeName)
         }
 
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = imported
         }
 
         {
                 // Call post-import hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostImportState(n.Info, state)
+                        return h.PostImportState(absAddr, imported)
                 })
                 if err != nil {
                         return nil, err
@@ -55,22 +71,25 @@ func (n *EvalImportState) Eval(ctx EvalContext) (interface{}, error) {
 // EvalImportStateVerify verifies the state after ImportState and
 // after the refresh to make sure it is non-nil and valid.
 type EvalImportStateVerify struct {
-        Info  *InstanceInfo
-        Id    string
-        State **InstanceState
+        Addr  addrs.ResourceInstance
+        State **states.ResourceInstanceObject
 }
 
 // TODO: test
 func (n *EvalImportStateVerify) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+
         state := *n.State
-        if state.Empty() {
-                return nil, fmt.Errorf(
-                        "import %s (id: %s): Terraform detected a resource with this ID doesn't\n"+
-                                "exist. Please verify the ID is correct. You cannot import non-existent\n"+
-                                "resources using Terraform import.",
-                        n.Info.HumanId(),
-                        n.Id)
+        if state.Value.IsNull() {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Cannot import non-existent remote object",
+                        fmt.Sprintf(
+                                "While attempting to import an existing object to %s, the provider detected that no object exists with the given id. Only pre-existing objects can be imported; check that the id is correct and that it is associated with the provider's configured region or endpoint, or use \"terraform apply\" to create a new remote object for this resource.",
+                                n.Addr.String(),
+                        ),
+                ))
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
deleted file mode 100644
index 6a78a6b..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package terraform
-
-import (
-        "log"
-
-        "github.com/hashicorp/terraform/config"
-)
-
-// EvalInterpolate is an EvalNode implementation that takes a raw
-// configuration and interpolates it.
-type EvalInterpolate struct {
-        Config        *config.RawConfig
-        Resource      *Resource
-        Output        **ResourceConfig
-        ContinueOnErr bool
-}
-
-func (n *EvalInterpolate) Eval(ctx EvalContext) (interface{}, error) {
-        rc, err := ctx.Interpolate(n.Config, n.Resource)
-        if err != nil {
-                if n.ContinueOnErr {
-                        log.Printf("[WARN] Interpolation %q failed: %s", n.Config.Key, err)
-                        return nil, EvalEarlyExitError{}
-                }
-                return nil, err
-        }
-
-        if n.Output != nil {
-                *n.Output = rc
-        }
-
-        return nil, nil
-}
-
-// EvalInterpolateProvider is an EvalNode implementation that takes a
-// ProviderConfig and interpolates it. Provider configurations are the only
-// "inherited" type of configuration we have, and the original raw config may
-// have a different interpolation scope.
-type EvalInterpolateProvider struct {
-        Config   *config.ProviderConfig
-        Resource *Resource
-        Output   **ResourceConfig
-}
-
-func (n *EvalInterpolateProvider) Eval(ctx EvalContext) (interface{}, error) {
-        rc, err := ctx.InterpolateProvider(n.Config, n.Resource)
-        if err != nil {
-                return nil, err
-        }
-
-        if n.Output != nil {
-                *n.Output = rc
-        }
-
-        return nil, nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_lang.go b/vendor/github.com/hashicorp/terraform/terraform/eval_lang.go
new file mode 100644
index 0000000..0c051f7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_lang.go
@@ -0,0 +1,61 @@
+package terraform
+
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// EvalConfigBlock is an EvalNode implementation that takes a raw
+// configuration block and evaluates any expressions within it.
+//
+// ExpandedConfig is populated with the result of expanding any "dynamic"
+// blocks in the given body, which can be useful for extracting correct source
+// location information for specific attributes in the result.
+type EvalConfigBlock struct {
+        Config         *hcl.Body
+        Schema         *configschema.Block
+        SelfAddr       addrs.Referenceable
+        Output         *cty.Value
+        ExpandedConfig *hcl.Body
+        ContinueOnErr  bool
+}
+
+func (n *EvalConfigBlock) Eval(ctx EvalContext) (interface{}, error) {
+        val, body, diags := ctx.EvaluateBlock(*n.Config, n.Schema, n.SelfAddr, EvalDataForNoInstanceKey)
+        if diags.HasErrors() && n.ContinueOnErr {
+                log.Printf("[WARN] Block evaluation failed: %s", diags.Err())
+                return nil, EvalEarlyExitError{}
+        }
+
+        if n.Output != nil {
+                *n.Output = val
+        }
+        if n.ExpandedConfig != nil {
+                *n.ExpandedConfig = body
+        }
+
+        return nil, diags.ErrWithWarnings()
+}
+
+// EvalConfigExpr is an EvalNode implementation that takes a raw configuration
+// expression and evaluates it.
+type EvalConfigExpr struct {
+        Expr     hcl.Expression
+        SelfAddr addrs.Referenceable
+        Output   *cty.Value
+}
+
+func (n *EvalConfigExpr) Eval(ctx EvalContext) (interface{}, error) {
+        val, diags := ctx.EvaluateExpr(n.Expr, cty.DynamicPseudoType, n.SelfAddr)
+
+        if n.Output != nil {
+                *n.Output = val
+        }
+
+        return nil, diags.ErrWithWarnings()
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_local.go b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
index a4b2a50..bad9ac5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
@@ -3,56 +3,55 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalLocal is an EvalNode implementation that evaluates the
 // expression for a local value and writes it into a transient part of
 // the state.
 type EvalLocal struct {
-        Name  string
-        Value *config.RawConfig
+        Addr addrs.LocalValue
+        Expr hcl.Expression
 }
 
 func (n *EvalLocal) Eval(ctx EvalContext) (interface{}, error) {
-        cfg, err := ctx.Interpolate(n.Value, nil)
-        if err != nil {
-                return nil, fmt.Errorf("local.%s: %s", n.Name, err)
+        var diags tfdiags.Diagnostics
+
+        // We ignore diags here because any problems we might find will be found
+        // again in EvaluateExpr below.
+        refs, _ := lang.ReferencesInExpr(n.Expr)
+        for _, ref := range refs {
+                if ref.Subject == n.Addr {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Self-referencing local value",
+                                Detail:   fmt.Sprintf("Local value %s cannot use its own result as part of its expression.", n.Addr),
+                                Subject:  ref.SourceRange.ToHCL().Ptr(),
+                                Context:  n.Expr.Range().Ptr(),
+                        })
+                }
         }
-
-        state, lock := ctx.State()
-        if state == nil {
-                return nil, fmt.Errorf("cannot write local value to nil state")
+        if diags.HasErrors() {
+                return nil, diags.Err()
         }
 
-        // Get a write lock so we can access the state
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                mod = state.AddModule(ctx.Path())
+        val, moreDiags := ctx.EvaluateExpr(n.Expr, cty.DynamicPseudoType, nil)
+        diags = diags.Append(moreDiags)
+        if moreDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
-        // Get the value from the config
-        var valueRaw interface{} = config.UnknownVariableValue
-        if cfg != nil {
-                var ok bool
-                valueRaw, ok = cfg.Get("value")
-                if !ok {
-                        valueRaw = ""
-                }
-                if cfg.IsComputed("value") {
-                        valueRaw = config.UnknownVariableValue
-                }
+        state := ctx.State()
+        if state == nil {
+                return nil, fmt.Errorf("cannot write local value to nil state")
         }
 
-        if mod.Locals == nil {
-                // initialize
-                mod.Locals = map[string]interface{}{}
-        }
-        mod.Locals[n.Name] = valueRaw
+        state.SetLocalValue(n.Addr.Absolute(ctx.Path()), val)
 
         return nil, nil
 }
@@ -61,26 +60,15 @@ func (n *EvalLocal) Eval(ctx EvalContext) (interface{}, error) {
 // from the state. Locals aren't persisted, but we don't need to evaluate them
 // during destroy.
 type EvalDeleteLocal struct {
-        Name string
+        Addr addrs.LocalValue
 }
 
 func (n *EvalDeleteLocal) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
+        state := ctx.State()
         if state == nil {
                 return nil, nil
         }
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        delete(mod.Locals, n.Name)
-
+        state.RemoveLocalValue(n.Addr.Absolute(ctx.Path()))
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
index a834627..1057397 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
@@ -4,131 +4,132 @@ import (
         "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
 )
 
 // EvalDeleteOutput is an EvalNode implementation that deletes an output
 // from the state.
 type EvalDeleteOutput struct {
-        Name string
+        Addr addrs.OutputValue
 }
 
 // TODO: test
 func (n *EvalDeleteOutput) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
+        state := ctx.State()
         if state == nil {
                 return nil, nil
         }
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        delete(mod.Outputs, n.Name)
-
+        state.RemoveOutputValue(n.Addr.Absolute(ctx.Path()))
         return nil, nil
 }
 
 // EvalWriteOutput is an EvalNode implementation that writes the output
 // for the given name to the current state.
 type EvalWriteOutput struct {
-        Name      string
+        Addr      addrs.OutputValue
         Sensitive bool
-        Value     *config.RawConfig
+        Expr      hcl.Expression
         // ContinueOnErr allows interpolation to fail during Input
         ContinueOnErr bool
 }
 
 // TODO: test
 func (n *EvalWriteOutput) Eval(ctx EvalContext) (interface{}, error) {
-        // This has to run before we have a state lock, since interpolation also
+        addr := n.Addr.Absolute(ctx.Path())
+
+        // This has to run before we have a state lock, since evaluation also
         // reads the state
-        cfg, err := ctx.Interpolate(n.Value, nil)
-        // handle the error after we have the module from the state
+        val, diags := ctx.EvaluateExpr(n.Expr, cty.DynamicPseudoType, nil)
+        // We'll handle errors below, after we have loaded the module.
 
-        state, lock := ctx.State()
+        state := ctx.State()
         if state == nil {
-                return nil, fmt.Errorf("cannot write state to nil state")
+                return nil, nil
         }
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                mod = state.AddModule(ctx.Path())
-        }
+        changes := ctx.Changes() // may be nil, if we're not working on a changeset
 
         // handling the interpolation error
-        if err != nil {
+        if diags.HasErrors() {
                 if n.ContinueOnErr || flagWarnOutputErrors {
-                        log.Printf("[ERROR] Output interpolation %q failed: %s", n.Name, err)
+                        log.Printf("[ERROR] Output interpolation %q failed: %s", n.Addr.Name, diags.Err())
                         // if we're continuing, make sure the output is included, and
-                        // marked as unknown
-                        mod.Outputs[n.Name] = &OutputState{
-                                Type:  "string",
-                                Value: config.UnknownVariableValue,
-                        }
+                        // marked as unknown. If the evaluator was able to find a type
+                        // for the value in spite of the error then we'll use it.
+                        n.setValue(addr, state, changes, cty.UnknownVal(val.Type()))
                         return nil, EvalEarlyExitError{}
                 }
-                return nil, err
+                return nil, diags.Err()
         }
 
-        // Get the value from the config
-        var valueRaw interface{} = config.UnknownVariableValue
-        if cfg != nil {
-                var ok bool
-                valueRaw, ok = cfg.Get("value")
-                if !ok {
-                        valueRaw = ""
-                }
-                if cfg.IsComputed("value") {
-                        valueRaw = config.UnknownVariableValue
-                }
+        n.setValue(addr, state, changes, val)
+
+        return nil, nil
+}
+
+func (n *EvalWriteOutput) setValue(addr addrs.AbsOutputValue, state *states.SyncState, changes *plans.ChangesSync, val cty.Value) {
+        if val.IsKnown() && !val.IsNull() {
+                // The state itself doesn't represent unknown values, so we null them
+                // out here and then we'll save the real unknown value in the planned
+                // changeset below, if we have one on this graph walk.
+                log.Printf("[TRACE] EvalWriteOutput: Saving value for %s in state", addr)
+                stateVal := cty.UnknownAsNull(val)
+                state.SetOutputValue(addr, stateVal, n.Sensitive)
+        } else {
+                log.Printf("[TRACE] EvalWriteOutput: Removing %s from state (it is now null)", addr)
+                state.RemoveOutputValue(addr)
         }
 
-        switch valueTyped := valueRaw.(type) {
-        case string:
-                mod.Outputs[n.Name] = &OutputState{
-                        Type:      "string",
-                        Sensitive: n.Sensitive,
-                        Value:     valueTyped,
-                }
-        case []interface{}:
-                mod.Outputs[n.Name] = &OutputState{
-                        Type:      "list",
-                        Sensitive: n.Sensitive,
-                        Value:     valueTyped,
-                }
-        case map[string]interface{}:
-                mod.Outputs[n.Name] = &OutputState{
-                        Type:      "map",
-                        Sensitive: n.Sensitive,
-                        Value:     valueTyped,
-                }
-        case []map[string]interface{}:
-                // an HCL map is multi-valued, so if this was read out of a config the
-                // map may still be in a slice.
-                if len(valueTyped) == 1 {
-                        mod.Outputs[n.Name] = &OutputState{
-                                Type:      "map",
+        // If we also have an active changeset then we'll replicate the value in
+        // there. This is used in preference to the state where present, since it
+        // *is* able to represent unknowns, while the state cannot.
+        if changes != nil {
+                // For the moment we are not properly tracking changes to output
+                // values, and just marking them always as "Create" or "Destroy"
+                // actions. A future release will rework the output lifecycle so we
+                // can track their changes properly, in a similar way to how we work
+                // with resource instances.
+
+                var change *plans.OutputChange
+                if !val.IsNull() {
+                        change = &plans.OutputChange{
+                                Addr:      addr,
                                 Sensitive: n.Sensitive,
-                                Value:     valueTyped[0],
+                                Change: plans.Change{
+                                        Action: plans.Create,
+                                        Before: cty.NullVal(cty.DynamicPseudoType),
+                                        After:  val,
+                                },
+                        }
+                } else {
+                        change = &plans.OutputChange{
+                                Addr:      addr,
+                                Sensitive: n.Sensitive,
+                                Change: plans.Change{
+                                        // This is just a weird placeholder delete action since
+                                        // we don't have an actual prior value to indicate.
+                                        // FIXME: Generate real planned changes for output values
+                                        // that include the old values.
+                                        Action: plans.Delete,
+                                        Before: cty.NullVal(cty.DynamicPseudoType),
+                                        After:  cty.NullVal(cty.DynamicPseudoType),
+                                },
                         }
-                        break
                 }
-                return nil, fmt.Errorf("output %s type (%T) with %d values not valid for type map",
-                        n.Name, valueTyped, len(valueTyped))
-        default:
-                return nil, fmt.Errorf("output %s is not a valid type (%T)\n", n.Name, valueTyped)
-        }
 
-        return nil, nil
+                cs, err := change.Encode()
+                if err != nil {
+                        // Should never happen, since we just constructed this right above
+                        panic(fmt.Sprintf("planned change for %s could not be encoded: %s", addr, err))
+                }
+                log.Printf("[TRACE] EvalWriteOutput: Saving %s change for %s in changeset", change.Action, addr)
+                changes.RemoveOutputChange(addr) // remove any existing planned change, if present
+                changes.AppendOutputChange(cs)   // add the new planned change
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
index 61f6ff9..7df6584 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
@@ -2,50 +2,86 @@ package terraform
 
 import (
         "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalBuildProviderConfig outputs a *ResourceConfig that is properly
-// merged with parents and inputs on top of what is configured in the file.
-type EvalBuildProviderConfig struct {
-        Provider string
-        Config   **ResourceConfig
-        Output   **ResourceConfig
-}
+func buildProviderConfig(ctx EvalContext, addr addrs.ProviderConfig, config *configs.Provider) hcl.Body {
+        var configBody hcl.Body
+        if config != nil {
+                configBody = config.Config
+        }
 
-func (n *EvalBuildProviderConfig) Eval(ctx EvalContext) (interface{}, error) {
-        cfg := *n.Config
-
-        // If we have an Input configuration set, then merge that in
-        if input := ctx.ProviderInput(n.Provider); input != nil {
-                // "input" is a map of the subset of config values that were known
-                // during the input walk, set by EvalInputProvider. Note that
-                // in particular it does *not* include attributes that had
-                // computed values at input time; those appear *only* in
-                // "cfg" here.
-                rc, err := config.NewRawConfig(input)
-                if err != nil {
-                        return nil, err
-                }
-
-                merged := rc.Merge(cfg.raw)
-                cfg = NewResourceConfig(merged)
+        var inputBody hcl.Body
+        inputConfig := ctx.ProviderInput(addr)
+        if len(inputConfig) > 0 {
+                inputBody = configs.SynthBody("<input-prompt>", inputConfig)
         }
 
-        *n.Output = cfg
-        return nil, nil
+        switch {
+        case configBody != nil && inputBody != nil:
+                log.Printf("[TRACE] buildProviderConfig for %s: merging explicit config and input", addr)
+                // Note that the inputBody is the _base_ here, because configs.MergeBodies
+                // expects the base have all of the required fields, while these are
+                // forced to be optional for the override. The input process should
+                // guarantee that we have a value for each of the required arguments and
+                // that in practice the sets of attributes in each body will be
+                // disjoint.
+                return configs.MergeBodies(inputBody, configBody)
+        case configBody != nil:
+                log.Printf("[TRACE] buildProviderConfig for %s: using explicit config only", addr)
+                return configBody
+        case inputBody != nil:
+                log.Printf("[TRACE] buildProviderConfig for %s: using input only", addr)
+                return inputBody
+        default:
+                log.Printf("[TRACE] buildProviderConfig for %s: no configuration at all", addr)
+                return hcl.EmptyBody()
+        }
 }
 
 // EvalConfigProvider is an EvalNode implementation that configures
 // a provider that is already initialized and retrieved.
 type EvalConfigProvider struct {
-        Provider string
-        Config   **ResourceConfig
+        Addr     addrs.ProviderConfig
+        Provider *providers.Interface
+        Config   *configs.Provider
 }
 
 func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
-        return nil, ctx.ConfigureProvider(n.Provider, *n.Config)
+        if n.Provider == nil {
+                return nil, fmt.Errorf("EvalConfigProvider Provider is nil")
+        }
+
+        var diags tfdiags.Diagnostics
+        provider := *n.Provider
+        config := n.Config
+
+        configBody := buildProviderConfig(ctx, n.Addr, config)
+
+        resp := provider.GetSchema()
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.NonFatalErr()
+        }
+
+        configSchema := resp.Provider.Block
+        configVal, configBody, evalDiags := ctx.EvaluateBlock(configBody, configSchema, nil, EvalDataForNoInstanceKey)
+        diags = diags.Append(evalDiags)
+        if evalDiags.HasErrors() {
+                return nil, diags.NonFatalErr()
+        }
+
+        configDiags := ctx.ConfigureProvider(n.Addr, configVal)
+        configDiags = configDiags.InConfigBody(configBody)
+
+        return nil, configDiags.ErrWithWarnings()
 }
 
 // EvalInitProvider is an EvalNode implementation that initializes a provider
@@ -53,85 +89,59 @@ func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
 // EvalGetProvider node.
 type EvalInitProvider struct {
         TypeName string
-        Name     string
+        Addr     addrs.ProviderConfig
 }
 
 func (n *EvalInitProvider) Eval(ctx EvalContext) (interface{}, error) {
-        return ctx.InitProvider(n.TypeName, n.Name)
+        return ctx.InitProvider(n.TypeName, n.Addr)
 }
 
 // EvalCloseProvider is an EvalNode implementation that closes provider
 // connections that aren't needed anymore.
 type EvalCloseProvider struct {
-        Name string
+        Addr addrs.ProviderConfig
 }
 
 func (n *EvalCloseProvider) Eval(ctx EvalContext) (interface{}, error) {
-        ctx.CloseProvider(n.Name)
+        ctx.CloseProvider(n.Addr)
         return nil, nil
 }
 
 // EvalGetProvider is an EvalNode implementation that retrieves an already
 // initialized provider instance for the given name.
+//
+// Unlike most eval nodes, this takes an _absolute_ provider configuration,
+// because providers can be passed into and inherited between modules.
+// Resource nodes must therefore know the absolute path of the provider they
+// will use, which is usually accomplished by implementing
+// interface GraphNodeProviderConsumer.
 type EvalGetProvider struct {
-        Name   string
-        Output *ResourceProvider
+        Addr   addrs.AbsProviderConfig
+        Output *providers.Interface
+
+        // If non-nil, Schema will be updated after eval to refer to the
+        // schema of the provider.
+        Schema **ProviderSchema
 }
 
 func (n *EvalGetProvider) Eval(ctx EvalContext) (interface{}, error) {
-        result := ctx.Provider(n.Name)
+        if n.Addr.ProviderConfig.Type == "" {
+                // Should never happen
+                panic("EvalGetProvider used with uninitialized provider configuration address")
+        }
+
+        result := ctx.Provider(n.Addr)
         if result == nil {
-                return nil, fmt.Errorf("provider %s not initialized", n.Name)
+                return nil, fmt.Errorf("provider %s not initialized", n.Addr)
         }
 
         if n.Output != nil {
                 *n.Output = result
         }
 
-        return nil, nil
-}
-
-// EvalInputProvider is an EvalNode implementation that asks for input
-// for the given provider configurations.
-type EvalInputProvider struct {
-        Name     string
-        Provider *ResourceProvider
-        Config   **ResourceConfig
-}
-
-func (n *EvalInputProvider) Eval(ctx EvalContext) (interface{}, error) {
-        rc := *n.Config
-        orig := rc.DeepCopy()
-
-        // Wrap the input into a namespace
-        input := &PrefixUIInput{
-                IdPrefix:    fmt.Sprintf("provider.%s", n.Name),
-                QueryPrefix: fmt.Sprintf("provider.%s.", n.Name),
-                UIInput:     ctx.Input(),
-        }
-
-        // Go through each provider and capture the input necessary
-        // to satisfy it.
-        config, err := (*n.Provider).Input(input, rc)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "Error configuring %s: %s", n.Name, err)
+        if n.Schema != nil {
+                *n.Schema = ctx.ProviderSchema(n.Addr)
         }
 
-        // We only store values that have changed through Input.
-        // The goal is to cache cache input responses, not to provide a complete
-        // config for other providers.
-        confMap := make(map[string]interface{})
-        if config != nil && len(config.Config) > 0 {
-                // any values that weren't in the original ResourcConfig will be cached
-                for k, v := range config.Config {
-                        if _, ok := orig.Config[k]; !ok {
-                                confMap[k] = v
-                        }
-                }
-        }
-
-        ctx.SetProviderInput(n.Name, confMap)
-
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go
index 89579c0..bc6b5cc 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go
@@ -2,6 +2,9 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/provisioners"
 )
 
 // EvalInitProvisioner is an EvalNode implementation that initializes a provisioner
@@ -30,7 +33,8 @@ func (n *EvalCloseProvisioner) Eval(ctx EvalContext) (interface{}, error) {
 // initialized provisioner instance for the given name.
 type EvalGetProvisioner struct {
         Name   string
-        Output *ResourceProvisioner
+        Output *provisioners.Interface
+        Schema **configschema.Block
 }
 
 func (n *EvalGetProvisioner) Eval(ctx EvalContext) (interface{}, error) {
@@ -43,5 +47,9 @@ func (n *EvalGetProvisioner) Eval(ctx EvalContext) (interface{}, error) {
                 *n.Output = result
         }
 
+        if n.Schema != nil {
+                *n.Schema = ctx.ProvisionerSchema(n.Name)
+        }
+
         return result, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go b/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
index fb85a28..34f2d60 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
@@ -2,105 +2,320 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalReadDataDiff is an EvalNode implementation that executes a data
-// resource's ReadDataDiff method to discover what attributes it exports.
-type EvalReadDataDiff struct {
-        Provider    *ResourceProvider
-        Output      **InstanceDiff
-        OutputState **InstanceState
-        Config      **ResourceConfig
-        Info        *InstanceInfo
-
-        // Set Previous when re-evaluating diff during apply, to ensure that
-        // the "Destroy" flag is preserved.
-        Previous **InstanceDiff
+// EvalReadData is an EvalNode implementation that deals with the main part
+// of the data resource lifecycle: either actually reading from the data source
+// or generating a plan to do so.
+type EvalReadData struct {
+        Addr           addrs.ResourceInstance
+        Config         *configs.Resource
+        Dependencies   []addrs.Referenceable
+        Provider       *providers.Interface
+        ProviderAddr   addrs.AbsProviderConfig
+        ProviderSchema **ProviderSchema
+
+        // Planned is set when dealing with data resources that were deferred to
+        // the apply walk, to let us see what was planned. If this is set, the
+        // evaluation of the config is required to produce a wholly-known
+        // configuration which is consistent with the partial object included
+        // in this planned change.
+        Planned **plans.ResourceInstanceChange
+
+        // ForcePlanRead, if true, overrides the usual behavior of immediately
+        // reading from the data source where possible, instead forcing us to
+        // _always_ generate a plan. This is used during the plan walk, since we
+        // mustn't actually apply anything there. (The resulting state doesn't
+        // get persisted)
+        ForcePlanRead bool
+
+        // The result from this EvalNode has a few different possibilities
+        // depending on the input:
+        // - If Planned is nil then we assume we're aiming to _produce_ the plan,
+        //   and so the following two outcomes are possible:
+        //     - OutputChange.Action is plans.NoOp and OutputState is the complete
+        //       result of reading from the data source. This is the easy path.
+        //     - OutputChange.Action is plans.Read and OutputState is a planned
+        //       object placeholder (states.ObjectPlanned). In this case, the
+        //       returned change must be recorded in the overral changeset and
+        //       eventually passed to another instance of this struct during the
+        //       apply walk.
+        // - If Planned is non-nil then we assume we're aiming to complete a
+        //   planned read from an earlier plan walk. In this case the only possible
+        //   non-error outcome is to set Output.Action (if non-nil) to a plans.NoOp
+        //   change and put the complete resulting state in OutputState, ready to
+        //   be saved in the overall state and used for expression evaluation.
+        OutputChange      **plans.ResourceInstanceChange
+        OutputValue       *cty.Value
+        OutputConfigValue *cty.Value
+        OutputState       **states.ResourceInstanceObject
 }
 
-func (n *EvalReadDataDiff) Eval(ctx EvalContext) (interface{}, error) {
-        // TODO: test
+func (n *EvalReadData) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
+        log.Printf("[TRACE] EvalReadData: working on %s", absAddr)
 
-        err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreDiff(n.Info, nil)
-        })
-        if err != nil {
-                return nil, err
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                return nil, fmt.Errorf("provider schema not available for %s", n.Addr)
         }
 
-        var diff *InstanceDiff
+        var diags tfdiags.Diagnostics
+        var change *plans.ResourceInstanceChange
+        var configVal cty.Value
 
-        if n.Previous != nil && *n.Previous != nil && (*n.Previous).GetDestroy() {
-                // If we're re-diffing for a diff that was already planning to
-                // destroy, then we'll just continue with that plan.
-                diff = &InstanceDiff{Destroy: true}
-        } else {
-                provider := *n.Provider
-                config := *n.Config
+        // TODO: Do we need to handle Delete changes here? EvalReadDataDiff and
+        // EvalReadDataApply did, but it seems like we should handle that via a
+        // separate mechanism since it boils down to just deleting the object from
+        // the state... and we do that on every plan anyway, forcing the data
+        // resource to re-read.
 
-                var err error
-                diff, err = provider.ReadDataDiff(n.Info, config)
+        config := *n.Config
+        provider := *n.Provider
+        providerSchema := *n.ProviderSchema
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider %q does not support data source %q", n.ProviderAddr.ProviderConfig.Type, n.Addr.Resource.Type)
+        }
+
+        // We'll always start by evaluating the configuration. What we do after
+        // that will depend on the evaluation result along with what other inputs
+        // we were given.
+        objTy := schema.ImpliedType()
+        priorVal := cty.NullVal(objTy) // for data resources, prior is always null because we start fresh every time
+
+        keyData := EvalDataForInstanceKey(n.Addr.Key)
+
+        var configDiags tfdiags.Diagnostics
+        configVal, _, configDiags = ctx.EvaluateBlock(config.Config, schema, nil, keyData)
+        diags = diags.Append(configDiags)
+        if configDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        proposedNewVal := objchange.PlannedDataResourceObject(schema, configVal)
+
+        // If our configuration contains any unknown values then we must defer the
+        // read to the apply phase by producing a "Read" change for this resource,
+        // and a placeholder value for it in the state.
+        if n.ForcePlanRead || !configVal.IsWhollyKnown() {
+                // If the configuration is still unknown when we're applying a planned
+                // change then that indicates a bug in Terraform, since we should have
+                // everything resolved by now.
+                if n.Planned != nil && *n.Planned != nil {
+                        return nil, fmt.Errorf(
+                                "configuration for %s still contains unknown values during apply (this is a bug in Terraform; please report it!)",
+                                absAddr,
+                        )
+                }
+                if n.ForcePlanRead {
+                        log.Printf("[TRACE] EvalReadData: %s configuration is fully known, but we're forcing a read plan to be created", absAddr)
+                } else {
+                        log.Printf("[TRACE] EvalReadData: %s configuration not fully known yet, so deferring to apply phase", absAddr)
+                }
+
+                err := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PreDiff(absAddr, states.CurrentGen, priorVal, proposedNewVal)
+                })
                 if err != nil {
                         return nil, err
                 }
-                if diff == nil {
-                        diff = new(InstanceDiff)
+
+                change = &plans.ResourceInstanceChange{
+                        Addr:         absAddr,
+                        ProviderAddr: n.ProviderAddr,
+                        Change: plans.Change{
+                                Action: plans.Read,
+                                Before: priorVal,
+                                After:  proposedNewVal,
+                        },
                 }
 
-                // if id isn't explicitly set then it's always computed, because we're
-                // always "creating a new resource".
-                diff.init()
-                if _, ok := diff.Attributes["id"]; !ok {
-                        diff.SetAttribute("id", &ResourceAttrDiff{
-                                Old:         "",
-                                NewComputed: true,
-                                RequiresNew: true,
-                                Type:        DiffAttrOutput,
-                        })
+                err = ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostDiff(absAddr, states.CurrentGen, change.Action, priorVal, proposedNewVal)
+                })
+                if err != nil {
+                        return nil, err
+                }
+
+                if n.OutputChange != nil {
+                        *n.OutputChange = change
+                }
+                if n.OutputValue != nil {
+                        *n.OutputValue = change.After
+                }
+                if n.OutputConfigValue != nil {
+                        *n.OutputConfigValue = configVal
                 }
+                if n.OutputState != nil {
+                        state := &states.ResourceInstanceObject{
+                                Value:        change.After,
+                                Status:       states.ObjectPlanned, // because the partial value in the plan must be used for now
+                                Dependencies: n.Dependencies,
+                        }
+                        *n.OutputState = state
+                }
+
+                return nil, diags.ErrWithWarnings()
         }
 
-        err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostDiff(n.Info, diff)
+        if n.Planned != nil && *n.Planned != nil && (*n.Planned).Action != plans.Read {
+                // If any other action gets in here then that's always a bug; this
+                // EvalNode only deals with reading.
+                return nil, fmt.Errorf(
+                        "invalid action %s for %s: only Read is supported (this is a bug in Terraform; please report it!)",
+                        (*n.Planned).Action, absAddr,
+                )
+        }
+
+        // If we get down here then our configuration is complete and we're read
+        // to actually call the provider to read the data.
+        log.Printf("[TRACE] EvalReadData: %s configuration is complete, so reading from provider", absAddr)
+
+        err := ctx.Hook(func(h Hook) (HookAction, error) {
+                // We don't have a state yet, so we'll just give the hook an
+                // empty one to work with.
+                return h.PreRefresh(absAddr, states.CurrentGen, cty.NullVal(cty.DynamicPseudoType))
         })
         if err != nil {
                 return nil, err
         }
 
-        *n.Output = diff
+        resp := provider.ReadDataSource(providers.ReadDataSourceRequest{
+                TypeName: n.Addr.Resource.Type,
+                Config:   configVal,
+        })
+        diags = diags.Append(resp.Diagnostics.InConfigBody(n.Config.Config))
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+        newVal := resp.State
+        if newVal == cty.NilVal {
+                // This can happen with incompletely-configured mocks. We'll allow it
+                // and treat it as an alias for a properly-typed null value.
+                newVal = cty.NullVal(schema.ImpliedType())
+        }
+
+        for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q produced an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if newVal.IsNull() {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced null object",
+                        fmt.Sprintf(
+                                "Provider %q produced a null value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, absAddr,
+                        ),
+                ))
+        }
+        if !newVal.IsWhollyKnown() {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q produced a value for %s that is not wholly known.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, absAddr,
+                        ),
+                ))
+
+                // We'll still save the object, but we need to eliminate any unknown
+                // values first because we can't serialize them in the state file.
+                // Note that this may cause set elements to be coalesced if they
+                // differed only by having unknown values, but we don't worry about
+                // that here because we're saving the value only for inspection
+                // purposes; the error we added above will halt the graph walk.
+                newVal = cty.UnknownAsNull(newVal)
+        }
+
+        // Since we've completed the read, we actually have no change to make, but
+        // we'll produce a NoOp one anyway to preserve the usual flow of the
+        // plan phase and allow it to produce a complete plan.
+        change = &plans.ResourceInstanceChange{
+                Addr:         absAddr,
+                ProviderAddr: n.ProviderAddr,
+                Change: plans.Change{
+                        Action: plans.NoOp,
+                        Before: newVal,
+                        After:  newVal,
+                },
+        }
+        state := &states.ResourceInstanceObject{
+                Value:        change.After,
+                Status:       states.ObjectReady, // because we completed the read from the provider
+                Dependencies: n.Dependencies,
+        }
+
+        err = ctx.Hook(func(h Hook) (HookAction, error) {
+                return h.PostRefresh(absAddr, states.CurrentGen, change.Before, newVal)
+        })
+        if err != nil {
+                return nil, err
+        }
 
+        if n.OutputChange != nil {
+                *n.OutputChange = change
+        }
+        if n.OutputValue != nil {
+                *n.OutputValue = change.After
+        }
+        if n.OutputConfigValue != nil {
+                *n.OutputConfigValue = configVal
+        }
         if n.OutputState != nil {
-                state := &InstanceState{}
                 *n.OutputState = state
-
-                // Apply the diff to the returned state, so the state includes
-                // any attribute values that are not computed.
-                if !diff.Empty() && n.OutputState != nil {
-                        *n.OutputState = state.MergeDiff(diff)
-                }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // EvalReadDataApply is an EvalNode implementation that executes a data
 // resource's ReadDataApply method to read data from the data source.
 type EvalReadDataApply struct {
-        Provider *ResourceProvider
-        Output   **InstanceState
-        Diff     **InstanceDiff
-        Info     *InstanceInfo
+        Addr            addrs.ResourceInstance
+        Provider        *providers.Interface
+        ProviderAddr    addrs.AbsProviderConfig
+        ProviderSchema  **ProviderSchema
+        Output          **states.ResourceInstanceObject
+        Config          *configs.Resource
+        Change          **plans.ResourceInstanceChange
+        StateReferences []addrs.Referenceable
 }
 
 func (n *EvalReadDataApply) Eval(ctx EvalContext) (interface{}, error) {
-        // TODO: test
         provider := *n.Provider
-        diff := *n.Diff
+        change := *n.Change
+        providerSchema := *n.ProviderSchema
+        absAddr := n.Addr.Absolute(ctx.Path())
+
+        var diags tfdiags.Diagnostics
 
         // If the diff is for *destroying* this resource then we'll
         // just drop its state and move on, since data resources don't
         // support an actual "destroy" action.
-        if diff != nil && diff.GetDestroy() {
+        if change != nil && change.Action == plans.Delete {
                 if n.Output != nil {
                         *n.Output = nil
                 }
@@ -113,27 +328,56 @@ func (n *EvalReadDataApply) Eval(ctx EvalContext) (interface{}, error) {
         err := ctx.Hook(func(h Hook) (HookAction, error) {
                 // We don't have a state yet, so we'll just give the hook an
                 // empty one to work with.
-                return h.PreRefresh(n.Info, &InstanceState{})
+                return h.PreRefresh(absAddr, states.CurrentGen, cty.NullVal(cty.DynamicPseudoType))
         })
         if err != nil {
                 return nil, err
         }
 
-        state, err := provider.ReadDataApply(n.Info, diff)
-        if err != nil {
-                return nil, fmt.Errorf("%s: %s", n.Info.Id, err)
+        resp := provider.ReadDataSource(providers.ReadDataSourceRequest{
+                TypeName: n.Addr.Resource.Type,
+                Config:   change.After,
+        })
+        diags = diags.Append(resp.Diagnostics.InConfigBody(n.Config.Config))
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support data source %q", n.Addr.Resource.Type)
+        }
+
+        newVal := resp.State
+        for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q planned an invalid value for %s. The result could not be saved.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
         }
 
         err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostRefresh(n.Info, state)
+                return h.PostRefresh(absAddr, states.CurrentGen, change.Before, newVal)
         })
         if err != nil {
                 return nil, err
         }
 
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = &states.ResourceInstanceObject{
+                        Value:        newVal,
+                        Status:       states.ObjectReady,
+                        Dependencies: n.StateReferences,
+                }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
index fa2b812..03bc948 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
@@ -3,53 +3,102 @@ package terraform
 import (
         "fmt"
         "log"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalRefresh is an EvalNode implementation that does a refresh for
 // a resource.
 type EvalRefresh struct {
-        Provider *ResourceProvider
-        State    **InstanceState
-        Info     *InstanceInfo
-        Output   **InstanceState
+        Addr           addrs.ResourceInstance
+        ProviderAddr   addrs.AbsProviderConfig
+        Provider       *providers.Interface
+        ProviderSchema **ProviderSchema
+        State          **states.ResourceInstanceObject
+        Output         **states.ResourceInstanceObject
 }
 
 // TODO: test
 func (n *EvalRefresh) Eval(ctx EvalContext) (interface{}, error) {
-        provider := *n.Provider
         state := *n.State
+        absAddr := n.Addr.Absolute(ctx.Path())
+
+        var diags tfdiags.Diagnostics
 
         // If we have no state, we don't do any refreshing
         if state == nil {
-                log.Printf("[DEBUG] refresh: %s: no state, not refreshing", n.Info.Id)
-                return nil, nil
+                log.Printf("[DEBUG] refresh: %s: no state, so not refreshing", n.Addr.Absolute(ctx.Path()))
+                return nil, diags.ErrWithWarnings()
+        }
+
+        schema, _ := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
         }
 
         // Call pre-refresh hook
         err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreRefresh(n.Info, state)
+                return h.PreRefresh(absAddr, states.CurrentGen, state.Value)
         })
         if err != nil {
-                return nil, err
+                return nil, diags.ErrWithWarnings()
         }
 
         // Refresh!
-        state, err = provider.Refresh(n.Info, state)
-        if err != nil {
-                return nil, fmt.Errorf("%s: %s", n.Info.Id, err.Error())
+        priorVal := state.Value
+        req := providers.ReadResourceRequest{
+                TypeName:   n.Addr.Resource.Type,
+                PriorState: priorVal,
         }
 
+        provider := *n.Provider
+        resp := provider.ReadResource(req)
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if resp.NewState == cty.NilVal {
+                // This ought not to happen in real cases since it's not possible to
+                // send NilVal over the plugin RPC channel, but it can come up in
+                // tests due to sloppy mocking.
+                panic("new state is cty.NilVal")
+        }
+
+        for _, err := range resp.NewState.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q planned an invalid value for %s during refresh: %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, absAddr, tfdiags.FormatError(err),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        newState := state.DeepCopy()
+        newState.Value = resp.NewState
+
         // Call post-refresh hook
         err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostRefresh(n.Info, state)
+                return h.PostRefresh(absAddr, states.CurrentGen, priorVal, newState.Value)
         })
         if err != nil {
                 return nil, err
         }
 
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = newState
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_resource.go b/vendor/github.com/hashicorp/terraform/terraform/eval_resource.go
deleted file mode 100644
index 5eca678..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_resource.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package terraform
-
-// EvalInstanceInfo is an EvalNode implementation that fills in the
-// InstanceInfo as much as it can.
-type EvalInstanceInfo struct {
-        Info *InstanceInfo
-}
-
-// TODO: test
-func (n *EvalInstanceInfo) Eval(ctx EvalContext) (interface{}, error) {
-        n.Info.ModulePath = ctx.Path()
-        return nil, nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go b/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go
index 82d8178..3485e4f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go
@@ -1,22 +1,37 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
 // EvalSequence is an EvalNode that evaluates in sequence.
 type EvalSequence struct {
         Nodes []EvalNode
 }
 
 func (n *EvalSequence) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+
         for _, n := range n.Nodes {
                 if n == nil {
                         continue
                 }
 
                 if _, err := EvalRaw(n, ctx); err != nil {
-                        return nil, err
+                        if _, isEarlyExit := err.(EvalEarlyExitError); isEarlyExit {
+                                // In this path we abort early, losing any non-error
+                                // diagnostics we saw earlier.
+                                return nil, err
+                        }
+                        diags = diags.Append(err)
+                        if diags.HasErrors() {
+                                // Halt if we get some errors, but warnings are okay.
+                                break
+                        }
                 }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // EvalNodeFilterable impl.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
index 1182690..d506ce3 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
@@ -2,91 +2,149 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalReadState is an EvalNode implementation that reads the
-// primary InstanceState for a specific resource out of the state.
+// current object for a specific instance in the state.
 type EvalReadState struct {
-        Name   string
-        Output **InstanceState
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // ProviderSchema is the schema for the provider given in Provider.
+        ProviderSchema **ProviderSchema
+
+        // Provider is the provider that will subsequently perform actions on
+        // the the state object. This is used to perform any schema upgrades
+        // that might be required to prepare the stored data for use.
+        Provider *providers.Interface
+
+        // Output will be written with a pointer to the retrieved object.
+        Output **states.ResourceInstanceObject
 }
 
 func (n *EvalReadState) Eval(ctx EvalContext) (interface{}, error) {
-        return readInstanceFromState(ctx, n.Name, n.Output, func(rs *ResourceState) (*InstanceState, error) {
-                return rs.Primary, nil
-        })
+        if n.Provider == nil || *n.Provider == nil {
+                panic("EvalReadState used with no Provider object")
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                panic("EvalReadState used with no ProviderSchema object")
+        }
+
+        absAddr := n.Addr.Absolute(ctx.Path())
+        log.Printf("[TRACE] EvalReadState: reading state for %s", absAddr)
+
+        src := ctx.State().ResourceInstanceObject(absAddr, states.CurrentGen)
+        if src == nil {
+                // Presumably we only have deposed objects, then.
+                log.Printf("[TRACE] EvalReadState: no state present for %s", absAddr)
+                return nil, nil
+        }
+
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Shouldn't happen since we should've failed long ago if no schema is present
+                return nil, fmt.Errorf("no schema available for %s while reading state; this is a bug in Terraform and should be reported", absAddr)
+        }
+        var diags tfdiags.Diagnostics
+        src, diags = UpgradeResourceState(absAddr, *n.Provider, src, schema, currentVersion)
+        if diags.HasErrors() {
+                // Note that we don't have any channel to return warnings here. We'll
+                // accept that for now since warnings during a schema upgrade would
+                // be pretty weird anyway, since this operation is supposed to seem
+                // invisible to the user.
+                return nil, diags.Err()
+        }
+
+        obj, err := src.Decode(schema.ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        if n.Output != nil {
+                *n.Output = obj
+        }
+        return obj, nil
 }
 
 // EvalReadStateDeposed is an EvalNode implementation that reads the
 // deposed InstanceState for a specific resource out of the state
 type EvalReadStateDeposed struct {
-        Name   string
-        Output **InstanceState
-        // Index indicates which instance in the Deposed list to target, or -1 for
-        // the last item.
-        Index int
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // Key identifies which deposed object we will read.
+        Key states.DeposedKey
+
+        // ProviderSchema is the schema for the provider given in Provider.
+        ProviderSchema **ProviderSchema
+
+        // Provider is the provider that will subsequently perform actions on
+        // the the state object. This is used to perform any schema upgrades
+        // that might be required to prepare the stored data for use.
+        Provider *providers.Interface
+
+        // Output will be written with a pointer to the retrieved object.
+        Output **states.ResourceInstanceObject
 }
 
 func (n *EvalReadStateDeposed) Eval(ctx EvalContext) (interface{}, error) {
-        return readInstanceFromState(ctx, n.Name, n.Output, func(rs *ResourceState) (*InstanceState, error) {
-                // Get the index. If it is negative, then we get the last one
-                idx := n.Index
-                if idx < 0 {
-                        idx = len(rs.Deposed) - 1
-                }
-                if idx >= 0 && idx < len(rs.Deposed) {
-                        return rs.Deposed[idx], nil
-                } else {
-                        return nil, fmt.Errorf("bad deposed index: %d, for resource: %#v", idx, rs)
-                }
-        })
-}
+        if n.Provider == nil || *n.Provider == nil {
+                panic("EvalReadStateDeposed used with no Provider object")
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                panic("EvalReadStateDeposed used with no ProviderSchema object")
+        }
 
-// Does the bulk of the work for the various flavors of ReadState eval nodes.
-// Each node just provides a reader function to get from the ResourceState to the
-// InstanceState, and this takes care of all the plumbing.
-func readInstanceFromState(
-        ctx EvalContext,
-        resourceName string,
-        output **InstanceState,
-        readerFn func(*ResourceState) (*InstanceState, error),
-) (*InstanceState, error) {
-        state, lock := ctx.State()
-
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
+        key := n.Key
+        if key == states.NotDeposed {
+                return nil, fmt.Errorf("EvalReadStateDeposed used with no instance key; this is a bug in Terraform and should be reported")
         }
+        absAddr := n.Addr.Absolute(ctx.Path())
+        log.Printf("[TRACE] EvalReadStateDeposed: reading state for %s deposed object %s", absAddr, n.Key)
 
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[resourceName]
-        if rs == nil {
+        src := ctx.State().ResourceInstanceObject(absAddr, key)
+        if src == nil {
+                // Presumably we only have deposed objects, then.
+                log.Printf("[TRACE] EvalReadStateDeposed: no state present for %s deposed object %s", absAddr, n.Key)
                 return nil, nil
         }
 
-        // Use the delegate function to get the instance state from the resource state
-        is, err := readerFn(rs)
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Shouldn't happen since we should've failed long ago if no schema is present
+                return nil, fmt.Errorf("no schema available for %s while reading state; this is a bug in Terraform and should be reported", absAddr)
+        }
+        var diags tfdiags.Diagnostics
+        src, diags = UpgradeResourceState(absAddr, *n.Provider, src, schema, currentVersion)
+        if diags.HasErrors() {
+                // Note that we don't have any channel to return warnings here. We'll
+                // accept that for now since warnings during a schema upgrade would
+                // be pretty weird anyway, since this operation is supposed to seem
+                // invisible to the user.
+                return nil, diags.Err()
+        }
+
+        obj, err := src.Decode(schema.ImpliedType())
         if err != nil {
                 return nil, err
         }
-
-        // Write the result to the output pointer
-        if output != nil {
-                *output = is
+        if n.Output != nil {
+                *n.Output = obj
         }
-
-        return is, nil
+        return obj, nil
 }
 
-// EvalRequireState is an EvalNode implementation that early exits
-// if the state doesn't have an ID.
+// EvalRequireState is an EvalNode implementation that exits early if the given
+// object is null.
 type EvalRequireState struct {
-        State **InstanceState
+        State **states.ResourceInstanceObject
 }
 
 func (n *EvalRequireState) Eval(ctx EvalContext) (interface{}, error) {
@@ -95,7 +153,7 @@ func (n *EvalRequireState) Eval(ctx EvalContext) (interface{}, error) {
         }
 
         state := *n.State
-        if state == nil || state.ID == "" {
+        if state == nil || state.Value.IsNull() {
                 return nil, EvalEarlyExitError{}
         }
 
@@ -107,12 +165,14 @@ func (n *EvalRequireState) Eval(ctx EvalContext) (interface{}, error) {
 type EvalUpdateStateHook struct{}
 
 func (n *EvalUpdateStateHook) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-
-        // Get a full lock. Even calling something like WriteState can modify
-        // (prune) the state, so we need the full lock.
-        lock.Lock()
-        defer lock.Unlock()
+        // In principle we could grab the lock here just long enough to take a
+        // deep copy and then pass that to our hooks below, but we'll instead
+        // hold the hook for the duration to avoid the potential confusing
+        // situation of us racing to call PostStateUpdate concurrently with
+        // different state snapshots.
+        stateSync := ctx.State()
+        state := stateSync.Lock().DeepCopy()
+        defer stateSync.Unlock()
 
         // Call the hook
         err := ctx.Hook(func(h Hook) (HookAction, error) {
@@ -125,171 +185,285 @@ func (n *EvalUpdateStateHook) Eval(ctx EvalContext) (interface{}, error) {
         return nil, nil
 }
 
-// EvalWriteState is an EvalNode implementation that writes the
-// primary InstanceState for a specific resource into the state.
+// EvalWriteState is an EvalNode implementation that saves the given object
+// as the current object for the selected resource instance.
 type EvalWriteState struct {
-        Name         string
-        ResourceType string
-        Provider     string
-        Dependencies []string
-        State        **InstanceState
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // State is the object state to save.
+        State **states.ResourceInstanceObject
+
+        // ProviderSchema is the schema for the provider given in ProviderAddr.
+        ProviderSchema **ProviderSchema
+
+        // ProviderAddr is the address of the provider configuration that
+        // produced the given object.
+        ProviderAddr addrs.AbsProviderConfig
 }
 
 func (n *EvalWriteState) Eval(ctx EvalContext) (interface{}, error) {
-        return writeInstanceToState(ctx, n.Name, n.ResourceType, n.Provider, n.Dependencies,
-                func(rs *ResourceState) error {
-                        rs.Primary = *n.State
-                        return nil
-                },
-        )
+        if n.State == nil {
+                // Note that a pointer _to_ nil is valid here, indicating the total
+                // absense of an object as we'd see during destroy.
+                panic("EvalWriteState used with no ResourceInstanceObject")
+        }
+
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        if n.ProviderAddr.ProviderConfig.Type == "" {
+                return nil, fmt.Errorf("failed to write state for %s, missing provider type", absAddr)
+        }
+
+        obj := *n.State
+        if obj == nil || obj.Value.IsNull() {
+                // No need to encode anything: we'll just write it directly.
+                state.SetResourceInstanceCurrent(absAddr, nil, n.ProviderAddr)
+                log.Printf("[TRACE] EvalWriteState: removing state object for %s", absAddr)
+                return nil, nil
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                // Should never happen, unless our state object is nil
+                panic("EvalWriteState used with pointer to nil ProviderSchema object")
+        }
+
+        if obj != nil {
+                log.Printf("[TRACE] EvalWriteState: writing current state object for %s", absAddr)
+        } else {
+                log.Printf("[TRACE] EvalWriteState: removing current state object for %s", absAddr)
+        }
+
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // It shouldn't be possible to get this far in any real scenario
+                // without a schema, but we might end up here in contrived tests that
+                // fail to set up their world properly.
+                return nil, fmt.Errorf("failed to encode %s in state: no resource type schema available", absAddr)
+        }
+        src, err := obj.Encode(schema.ImpliedType(), currentVersion)
+        if err != nil {
+                return nil, fmt.Errorf("failed to encode %s in state: %s", absAddr, err)
+        }
+
+        state.SetResourceInstanceCurrent(absAddr, src, n.ProviderAddr)
+        return nil, nil
 }
 
 // EvalWriteStateDeposed is an EvalNode implementation that writes
 // an InstanceState out to the Deposed list of a resource in the state.
 type EvalWriteStateDeposed struct {
-        Name         string
-        ResourceType string
-        Provider     string
-        Dependencies []string
-        State        **InstanceState
-        // Index indicates which instance in the Deposed list to target, or -1 to append.
-        Index int
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // Key indicates which deposed object to write to.
+        Key states.DeposedKey
+
+        // State is the object state to save.
+        State **states.ResourceInstanceObject
+
+        // ProviderSchema is the schema for the provider given in ProviderAddr.
+        ProviderSchema **ProviderSchema
+
+        // ProviderAddr is the address of the provider configuration that
+        // produced the given object.
+        ProviderAddr addrs.AbsProviderConfig
 }
 
 func (n *EvalWriteStateDeposed) Eval(ctx EvalContext) (interface{}, error) {
-        return writeInstanceToState(ctx, n.Name, n.ResourceType, n.Provider, n.Dependencies,
-                func(rs *ResourceState) error {
-                        if n.Index == -1 {
-                                rs.Deposed = append(rs.Deposed, *n.State)
-                        } else {
-                                rs.Deposed[n.Index] = *n.State
-                        }
-                        return nil
-                },
-        )
-}
+        if n.State == nil {
+                // Note that a pointer _to_ nil is valid here, indicating the total
+                // absense of an object as we'd see during destroy.
+                panic("EvalWriteStateDeposed used with no ResourceInstanceObject")
+        }
 
-// Pulls together the common tasks of the EvalWriteState nodes.  All the args
-// are passed directly down from the EvalNode along with a `writer` function
-// which is yielded the *ResourceState and is responsible for writing an
-// InstanceState to the proper field in the ResourceState.
-func writeInstanceToState(
-        ctx EvalContext,
-        resourceName string,
-        resourceType string,
-        provider string,
-        dependencies []string,
-        writerFn func(*ResourceState) error,
-) (*InstanceState, error) {
-        state, lock := ctx.State()
-        if state == nil {
-                return nil, fmt.Errorf("cannot write state to nil state")
-        }
-
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                mod = state.AddModule(ctx.Path())
-        }
-
-        // Look for the resource state.
-        rs := mod.Resources[resourceName]
-        if rs == nil {
-                rs = &ResourceState{}
-                rs.init()
-                mod.Resources[resourceName] = rs
-        }
-        rs.Type = resourceType
-        rs.Dependencies = dependencies
-        rs.Provider = provider
-
-        if err := writerFn(rs); err != nil {
-                return nil, err
+        absAddr := n.Addr.Absolute(ctx.Path())
+        key := n.Key
+        state := ctx.State()
+
+        if key == states.NotDeposed {
+                // should never happen
+                return nil, fmt.Errorf("can't save deposed object for %s without a deposed key; this is a bug in Terraform that should be reported", absAddr)
+        }
+
+        obj := *n.State
+        if obj == nil {
+                // No need to encode anything: we'll just write it directly.
+                state.SetResourceInstanceDeposed(absAddr, key, nil, n.ProviderAddr)
+                log.Printf("[TRACE] EvalWriteStateDeposed: removing state object for %s deposed %s", absAddr, key)
+                return nil, nil
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                // Should never happen, unless our state object is nil
+                panic("EvalWriteStateDeposed used with no ProviderSchema object")
+        }
+
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // It shouldn't be possible to get this far in any real scenario
+                // without a schema, but we might end up here in contrived tests that
+                // fail to set up their world properly.
+                return nil, fmt.Errorf("failed to encode %s in state: no resource type schema available", absAddr)
+        }
+        src, err := obj.Encode(schema.ImpliedType(), currentVersion)
+        if err != nil {
+                return nil, fmt.Errorf("failed to encode %s in state: %s", absAddr, err)
         }
 
+        log.Printf("[TRACE] EvalWriteStateDeposed: writing state object for %s deposed %s", absAddr, key)
+        state.SetResourceInstanceDeposed(absAddr, key, src, n.ProviderAddr)
         return nil, nil
 }
 
-// EvalDeposeState is an EvalNode implementation that takes the primary
-// out of a state and makes it Deposed. This is done at the beginning of
-// create-before-destroy calls so that the create can create while preserving
-// the old state of the to-be-destroyed resource.
+// EvalDeposeState is an EvalNode implementation that moves the current object
+// for the given instance to instead be a deposed object, leaving the instance
+// with no current object.
+// This is used at the beginning of a create-before-destroy replace action so
+// that the create can create while preserving the old state of the
+// to-be-destroyed object.
 type EvalDeposeState struct {
-        Name string
+        Addr addrs.ResourceInstance
+
+        // ForceKey, if a value other than states.NotDeposed, will be used as the
+        // key for the newly-created deposed object that results from this action.
+        // If set to states.NotDeposed (the zero value), a new unique key will be
+        // allocated.
+        ForceKey states.DeposedKey
+
+        // OutputKey, if non-nil, will be written with the deposed object key that
+        // was generated for the object. This can then be passed to
+        // EvalUndeposeState.Key so it knows which deposed instance to forget.
+        OutputKey *states.DeposedKey
 }
 
 // TODO: test
 func (n *EvalDeposeState) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[n.Name]
-        if rs == nil {
-                return nil, nil
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        var key states.DeposedKey
+        if n.ForceKey == states.NotDeposed {
+                key = state.DeposeResourceInstanceObject(absAddr)
+        } else {
+                key = n.ForceKey
+                state.DeposeResourceInstanceObjectForceKey(absAddr, key)
         }
+        log.Printf("[TRACE] EvalDeposeState: prior object for %s now deposed with key %s", absAddr, key)
 
-        // If we don't have a primary, we have nothing to depose
-        if rs.Primary == nil {
-                return nil, nil
+        if n.OutputKey != nil {
+                *n.OutputKey = key
         }
 
-        // Depose
-        rs.Deposed = append(rs.Deposed, rs.Primary)
-        rs.Primary = nil
-
         return nil, nil
 }
 
-// EvalUndeposeState is an EvalNode implementation that reads the
-// InstanceState for a specific resource out of the state.
-type EvalUndeposeState struct {
-        Name  string
-        State **InstanceState
+// EvalMaybeRestoreDeposedObject is an EvalNode implementation that will
+// restore a particular deposed object of the specified resource instance
+// to be the "current" object if and only if the instance doesn't currently
+// have a current object.
+//
+// This is intended for use when the create leg of a create before destroy
+// fails with no partial new object: if we didn't take any action, the user
+// would be left in the unfortunate situation of having no current object
+// and the previously-workign object now deposed. This EvalNode causes a
+// better outcome by restoring things to how they were before the replace
+// operation began.
+//
+// The create operation may have produced a partial result even though it
+// failed and it's important that we don't "forget" that state, so in that
+// situation the prior object remains deposed and the partial new object
+// remains the current object, allowing the situation to hopefully be
+// improved in a subsequent run.
+type EvalMaybeRestoreDeposedObject struct {
+        Addr addrs.ResourceInstance
+
+        // Key is a pointer to the deposed object key that should be forgotten
+        // from the state, which must be non-nil.
+        Key *states.DeposedKey
 }
 
 // TODO: test
-func (n *EvalUndeposeState) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
+func (n *EvalMaybeRestoreDeposedObject) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
+        dk := *n.Key
+        state := ctx.State()
+
+        restored := state.MaybeRestoreResourceInstanceDeposed(absAddr, dk)
+        if restored {
+                log.Printf("[TRACE] EvalMaybeRestoreDeposedObject: %s deposed object %s was restored as the current object", absAddr, dk)
+        } else {
+                log.Printf("[TRACE] EvalMaybeRestoreDeposedObject: %s deposed object %s remains deposed", absAddr, dk)
+        }
 
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
+        return nil, nil
+}
 
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
+// EvalWriteResourceState is an EvalNode implementation that ensures that
+// a suitable resource-level state record is present in the state, if that's
+// required for the "each mode" of that resource.
+//
+// This is important primarily for the situation where count = 0, since this
+// eval is the only change we get to set the resource "each mode" to list
+// in that case, allowing expression evaluation to see it as a zero-element
+// list rather than as not set at all.
+type EvalWriteResourceState struct {
+        Addr         addrs.Resource
+        Config       *configs.Resource
+        ProviderAddr addrs.AbsProviderConfig
+}
 
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[n.Name]
-        if rs == nil {
-                return nil, nil
+// TODO: test
+func (n *EvalWriteResourceState) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        count, countDiags := evaluateResourceCountExpression(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
-        // If we don't have any desposed resource, then we don't have anything to do
-        if len(rs.Deposed) == 0 {
-                return nil, nil
+        // Currently we ony support NoEach and EachList, because for_each support
+        // is not fully wired up across Terraform. Once for_each support is added,
+        // we'll need to handle that here too, setting states.EachMap if the
+        // assigned expression is a map.
+        eachMode := states.NoEach
+        if count >= 0 { // -1 signals "count not set"
+                eachMode = states.EachList
         }
 
-        // Undepose
-        idx := len(rs.Deposed) - 1
-        rs.Primary = rs.Deposed[idx]
-        rs.Deposed[idx] = *n.State
+        // This method takes care of all of the business logic of updating this
+        // while ensuring that any existing instances are preserved, etc.
+        state.SetResourceMeta(absAddr, eachMode, n.ProviderAddr)
+
+        return nil, nil
+}
+
+// EvalForgetResourceState is an EvalNode implementation that prunes out an
+// empty resource-level state for a given resource address, or produces an
+// error if it isn't empty after all.
+//
+// This should be the last action taken for a resource that has been removed
+// from the configuration altogether, to clean up the leftover husk of the
+// resource in the state after other EvalNodes have destroyed and removed
+// all of the instances and instance objects beneath it.
+type EvalForgetResourceState struct {
+        Addr addrs.Resource
+}
+
+func (n *EvalForgetResourceState) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        pruned := state.RemoveResourceIfEmpty(absAddr)
+        if !pruned {
+                // If this produces an error, it indicates a bug elsewhere in Terraform
+                // -- probably missing graph nodes, graph edges, or
+                // incorrectly-implemented evaluation steps.
+                return nil, fmt.Errorf("orphan resource %s still has a non-empty state after apply; this is a bug in Terraform", absAddr)
+        }
+        log.Printf("[TRACE] EvalForgetResourceState: Pruned husk of %s from state", absAddr)
 
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_state_upgrade.go b/vendor/github.com/hashicorp/terraform/terraform/eval_state_upgrade.go
new file mode 100644
index 0000000..e194000
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_state_upgrade.go
@@ -0,0 +1,106 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// UpgradeResourceState will, if necessary, run the provider-defined upgrade
+// logic against the given state object to make it compliant with the
+// current schema version. This is a no-op if the given state object is
+// already at the latest version.
+//
+// If any errors occur during upgrade, error diagnostics are returned. In that
+// case it is not safe to proceed with using the original state object.
+func UpgradeResourceState(addr addrs.AbsResourceInstance, provider providers.Interface, src *states.ResourceInstanceObjectSrc, currentSchema *configschema.Block, currentVersion uint64) (*states.ResourceInstanceObjectSrc, tfdiags.Diagnostics) {
+        if addr.Resource.Resource.Mode != addrs.ManagedResourceMode {
+                // We only do state upgrading for managed resources.
+                return src, nil
+        }
+
+        stateIsFlatmap := len(src.AttrsJSON) == 0
+
+        providerType := addr.Resource.Resource.DefaultProviderConfig().Type
+        if src.SchemaVersion > currentVersion {
+                log.Printf("[TRACE] UpgradeResourceState: can't downgrade state for %s from version %d to %d", addr, src.SchemaVersion, currentVersion)
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Resource instance managed by newer provider version",
+                        // This is not a very good error message, but we don't retain enough
+                        // information in state to give good feedback on what provider
+                        // version might be required here. :(
+                        fmt.Sprintf("The current state of %s was created by a newer provider version than is currently selected. Upgrade the %s provider to work with this state.", addr, providerType),
+                ))
+                return nil, diags
+        }
+
+        // If we get down here then we need to upgrade the state, with the
+        // provider's help.
+        // If this state was originally created by a version of Terraform prior to
+        // v0.12, this also includes translating from legacy flatmap to new-style
+        // representation, since only the provider has enough information to
+        // understand a flatmap built against an older schema.
+        if src.SchemaVersion != currentVersion {
+                log.Printf("[TRACE] UpgradeResourceState: upgrading state for %s from version %d to %d using provider %q", addr, src.SchemaVersion, currentVersion, providerType)
+        } else {
+                log.Printf("[TRACE] UpgradeResourceState: schema version of %s is still %d; calling provider %q for any other minor fixups", addr, currentVersion, providerType)
+        }
+
+        req := providers.UpgradeResourceStateRequest{
+                TypeName: addr.Resource.Resource.Type,
+
+                // TODO: The internal schema version representations are all using
+                // uint64 instead of int64, but unsigned integers aren't friendly
+                // to all protobuf target languages so in practice we use int64
+                // on the wire. In future we will change all of our internal
+                // representations to int64 too.
+                Version: int64(src.SchemaVersion),
+        }
+
+        if stateIsFlatmap {
+                req.RawStateFlatmap = src.AttrsFlat
+        } else {
+                req.RawStateJSON = src.AttrsJSON
+        }
+
+        resp := provider.UpgradeResourceState(req)
+        diags := resp.Diagnostics
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        // After upgrading, the new value must conform to the current schema. When
+        // going over RPC this is actually already ensured by the
+        // marshaling/unmarshaling of the new value, but we'll check it here
+        // anyway for robustness, e.g. for in-process providers.
+        newValue := resp.UpgradedState
+        if errs := newValue.Type().TestConformance(currentSchema.ImpliedType()); len(errs) > 0 {
+                for _, err := range errs {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource state upgrade",
+                                fmt.Sprintf("The %s provider upgraded the state for %s from a previous version, but produced an invalid result: %s.", providerType, addr, tfdiags.FormatError(err)),
+                        ))
+                }
+                return nil, diags
+        }
+
+        new, err := src.CompleteUpgrade(newValue, currentSchema.ImpliedType(), uint64(currentVersion))
+        if err != nil {
+                // We already checked for type conformance above, so getting into this
+                // codepath should be rare and is probably a bug somewhere under CompleteUpgrade.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to encode result of resource state upgrade",
+                        fmt.Sprintf("Failed to encode state for %s after resource schema upgrade: %s.", addr, tfdiags.FormatError(err)),
+                ))
+        }
+        return new, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
index 3e5a84c..0033e01 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
@@ -2,126 +2,163 @@ package terraform
 
 import (
         "fmt"
-
-        "github.com/hashicorp/terraform/config"
-        "github.com/mitchellh/mapstructure"
+        "log"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/gocty"
 )
 
-// EvalValidateError is the error structure returned if there were
-// validation errors.
-type EvalValidateError struct {
-        Warnings []string
-        Errors   []error
-}
-
-func (e *EvalValidateError) Error() string {
-        return fmt.Sprintf("Warnings: %s. Errors: %s", e.Warnings, e.Errors)
-}
-
 // EvalValidateCount is an EvalNode implementation that validates
 // the count of a resource.
 type EvalValidateCount struct {
-        Resource *config.Resource
+        Resource *configs.Resource
 }
 
 // TODO: test
 func (n *EvalValidateCount) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
         var count int
-        var errs []error
         var err error
-        if _, err := ctx.Interpolate(n.Resource.RawCount, nil); err != nil {
-                errs = append(errs, fmt.Errorf(
-                        "Failed to interpolate count: %s", err))
+
+        val, valDiags := ctx.EvaluateExpr(n.Resource.Count, cty.Number, nil)
+        diags = diags.Append(valDiags)
+        if valDiags.HasErrors() {
                 goto RETURN
         }
-
-        count, err = n.Resource.Count()
-        if err != nil {
-                // If we can't get the count during validation, then
-                // just replace it with the number 1.
-                c := n.Resource.RawCount.Config()
-                c[n.Resource.RawCount.Key] = "1"
-                count = 1
+        if val.IsNull() || !val.IsKnown() {
+                goto RETURN
         }
-        err = nil
 
-        if count < 0 {
-                errs = append(errs, fmt.Errorf(
-                        "Count is less than zero: %d", count))
+        err = gocty.FromCtyValue(val, &count)
+        if err != nil {
+                // The EvaluateExpr call above already guaranteed us a number value,
+                // so if we end up here then we have something that is out of range
+                // for an int, and the error message will include a description of
+                // the valid range.
+                rawVal := val.AsBigFloat()
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count value",
+                        Detail:   fmt.Sprintf("The number %s is not a valid count value: %s.", rawVal, err),
+                        Subject:  n.Resource.Count.Range().Ptr(),
+                })
+        } else if count < 0 {
+                rawVal := val.AsBigFloat()
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count value",
+                        Detail:   fmt.Sprintf("The number %s is not a valid count value: count must not be negative.", rawVal),
+                        Subject:  n.Resource.Count.Range().Ptr(),
+                })
         }
 
 RETURN:
-        if len(errs) != 0 {
-                err = &EvalValidateError{
-                        Errors: errs,
-                }
-        }
-        return nil, err
+        return nil, diags.NonFatalErr()
 }
 
 // EvalValidateProvider is an EvalNode implementation that validates
-// the configuration of a resource.
+// a provider configuration.
 type EvalValidateProvider struct {
-        Provider *ResourceProvider
-        Config   **ResourceConfig
+        Addr     addrs.ProviderConfig
+        Provider *providers.Interface
+        Config   *configs.Provider
 }
 
 func (n *EvalValidateProvider) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
         provider := *n.Provider
-        config := *n.Config
 
-        warns, errs := provider.Validate(config)
-        if len(warns) == 0 && len(errs) == 0 {
-                return nil, nil
+        configBody := buildProviderConfig(ctx, n.Addr, n.Config)
+
+        resp := provider.GetSchema()
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.NonFatalErr()
         }
 
-        return nil, &EvalValidateError{
-                Warnings: warns,
-                Errors:   errs,
+        configSchema := resp.Provider.Block
+        if configSchema == nil {
+                // Should never happen in real code, but often comes up in tests where
+                // mock schemas are being used that tend to be incomplete.
+                log.Printf("[WARN] EvalValidateProvider: no config schema is available for %s, so using empty schema", n.Addr)
+                configSchema = &configschema.Block{}
         }
+
+        configVal, configBody, evalDiags := ctx.EvaluateBlock(configBody, configSchema, nil, EvalDataForNoInstanceKey)
+        diags = diags.Append(evalDiags)
+        if evalDiags.HasErrors() {
+                return nil, diags.NonFatalErr()
+        }
+
+        req := providers.PrepareProviderConfigRequest{
+                Config: configVal,
+        }
+
+        validateResp := provider.PrepareProviderConfig(req)
+        diags = diags.Append(validateResp.Diagnostics)
+
+        return nil, diags.NonFatalErr()
 }
 
 // EvalValidateProvisioner is an EvalNode implementation that validates
-// the configuration of a resource.
+// the configuration of a provisioner belonging to a resource. The provisioner
+// config is expected to contain the merged connection configurations.
 type EvalValidateProvisioner struct {
-        Provisioner *ResourceProvisioner
-        Config      **ResourceConfig
-        ConnConfig  **ResourceConfig
+        ResourceAddr     addrs.Resource
+        Provisioner      *provisioners.Interface
+        Schema           **configschema.Block
+        Config           *configs.Provisioner
+        ResourceHasCount bool
 }
 
 func (n *EvalValidateProvisioner) Eval(ctx EvalContext) (interface{}, error) {
         provisioner := *n.Provisioner
         config := *n.Config
-        var warns []string
-        var errs []error
+        schema := *n.Schema
+
+        var diags tfdiags.Diagnostics
 
         {
                 // Validate the provisioner's own config first
-                w, e := provisioner.Validate(config)
-                warns = append(warns, w...)
-                errs = append(errs, e...)
-        }
 
-        {
-                // Now validate the connection config, which might either be from
-                // the provisioner block itself or inherited from the resource's
-                // shared connection info.
-                w, e := n.validateConnConfig(*n.ConnConfig)
-                warns = append(warns, w...)
-                errs = append(errs, e...)
-        }
+                configVal, _, configDiags := n.evaluateBlock(ctx, config.Config, schema)
+                diags = diags.Append(configDiags)
+                if configDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
 
-        if len(warns) == 0 && len(errs) == 0 {
-                return nil, nil
+                if configVal == cty.NilVal {
+                        // Should never happen for a well-behaved EvaluateBlock implementation
+                        return nil, fmt.Errorf("EvaluateBlock returned nil value")
+                }
+
+                req := provisioners.ValidateProvisionerConfigRequest{
+                        Config: configVal,
+                }
+
+                resp := provisioner.ValidateProvisionerConfig(req)
+                diags = diags.Append(resp.Diagnostics)
         }
 
-        return nil, &EvalValidateError{
-                Warnings: warns,
-                Errors:   errs,
+        {
+                // Now validate the connection config, which contains the merged bodies
+                // of the resource and provisioner connection blocks.
+                connDiags := n.validateConnConfig(ctx, config.Connection, n.ResourceAddr)
+                diags = diags.Append(connDiags)
         }
+
+        return nil, diags.NonFatalErr()
 }
 
-func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig) (warns []string, errs []error) {
+func (n *EvalValidateProvisioner) validateConnConfig(ctx EvalContext, config *configs.Connection, self addrs.Referenceable) tfdiags.Diagnostics {
         // We can't comprehensively validate the connection config since its
         // final structure is decided by the communicator and we can't instantiate
         // that until we have a complete instance state. However, we *can* catch
@@ -129,103 +166,379 @@ func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig)
         // typos early rather than waiting until we actually try to run one of
         // the resource's provisioners.
 
-        type connConfigSuperset struct {
-                // All attribute types are interface{} here because at this point we
-                // may still have unresolved interpolation expressions, which will
-                // appear as strings regardless of the final goal type.
+        var diags tfdiags.Diagnostics
 
-                Type       interface{} `mapstructure:"type"`
-                User       interface{} `mapstructure:"user"`
-                Password   interface{} `mapstructure:"password"`
-                Host       interface{} `mapstructure:"host"`
-                Port       interface{} `mapstructure:"port"`
-                Timeout    interface{} `mapstructure:"timeout"`
-                ScriptPath interface{} `mapstructure:"script_path"`
+        if config == nil || config.Config == nil {
+                // No block to validate
+                return diags
+        }
 
-                // For type=ssh only (enforced in ssh communicator)
-                PrivateKey        interface{} `mapstructure:"private_key"`
-                HostKey           interface{} `mapstructure:"host_key"`
-                Agent             interface{} `mapstructure:"agent"`
-                BastionHost       interface{} `mapstructure:"bastion_host"`
-                BastionHostKey    interface{} `mapstructure:"bastion_host_key"`
-                BastionPort       interface{} `mapstructure:"bastion_port"`
-                BastionUser       interface{} `mapstructure:"bastion_user"`
-                BastionPassword   interface{} `mapstructure:"bastion_password"`
-                BastionPrivateKey interface{} `mapstructure:"bastion_private_key"`
-                AgentIdentity     interface{} `mapstructure:"agent_identity"`
+        // We evaluate here just by evaluating the block and returning any
+        // diagnostics we get, since evaluation alone is enough to check for
+        // extraneous arguments and incorrectly-typed arguments.
+        _, _, configDiags := n.evaluateBlock(ctx, config.Config, connectionBlockSupersetSchema)
+        diags = diags.Append(configDiags)
 
-                // For type=winrm only (enforced in winrm communicator)
-                HTTPS    interface{} `mapstructure:"https"`
-                Insecure interface{} `mapstructure:"insecure"`
-                NTLM     interface{} `mapstructure:"use_ntlm"`
-                CACert   interface{} `mapstructure:"cacert"`
-        }
+        return diags
+}
 
-        var metadata mapstructure.Metadata
-        decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
-                Metadata: &metadata,
-                Result:   &connConfigSuperset{}, // result is disregarded; we only care about unused keys
-        })
-        if err != nil {
-                // should never happen
-                errs = append(errs, err)
-                return
-        }
+func (n *EvalValidateProvisioner) evaluateBlock(ctx EvalContext, body hcl.Body, schema *configschema.Block) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+        keyData := EvalDataForNoInstanceKey
+        selfAddr := n.ResourceAddr.Instance(addrs.NoKey)
 
-        if err := decoder.Decode(connConfig.Config); err != nil {
-                errs = append(errs, err)
-                return
-        }
+        if n.ResourceHasCount {
+                // For a resource that has count, we allow count.index but don't
+                // know at this stage what it will return.
+                keyData = InstanceKeyEvalData{
+                        CountIndex: cty.UnknownVal(cty.Number),
+                }
 
-        for _, attrName := range metadata.Unused {
-                errs = append(errs, fmt.Errorf("unknown 'connection' argument %q", attrName))
+                // "self" can't point to an unknown key, but we'll force it to be
+                // key 0 here, which should return an unknown value of the
+                // expected type since none of these elements are known at this
+                // point anyway.
+                selfAddr = n.ResourceAddr.Instance(addrs.IntKey(0))
         }
-        return
+
+        return ctx.EvaluateBlock(body, schema, selfAddr, keyData)
+}
+
+// connectionBlockSupersetSchema is a schema representing the superset of all
+// possible arguments for "connection" blocks across all supported connection
+// types.
+//
+// This currently lives here because we've not yet updated our communicator
+// subsystem to be aware of schema itself. Once that is done, we can remove
+// this and use a type-specific schema from the communicator to validate
+// exactly what is expected for a given connection type.
+var connectionBlockSupersetSchema = &configschema.Block{
+        Attributes: map[string]*configschema.Attribute{
+                // NOTE: "type" is not included here because it's treated special
+                // by the config loader and stored away in a separate field.
+
+                // Common attributes for both connection types
+                "host": {
+                        Type:     cty.String,
+                        Required: true,
+                },
+                "type": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "user": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "password": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "port": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "timeout": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "script_path": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+
+                // For type=ssh only (enforced in ssh communicator)
+                "private_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "certificate": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "host_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "agent": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+                "agent_identity": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_host": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_host_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_port": {
+                        Type:     cty.Number,
+                        Optional: true,
+                },
+                "bastion_user": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_password": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_private_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+
+                // For type=winrm only (enforced in winrm communicator)
+                "https": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+                "insecure": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+                "cacert": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "use_ntlm": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+        },
+}
+
+// connectionBlockSupersetSchema is a schema representing the superset of all
+// possible arguments for "connection" blocks across all supported connection
+// types.
+//
+// This currently lives here because we've not yet updated our communicator
+// subsystem to be aware of schema itself. It's exported only for use in the
+// configs/configupgrade package and should not be used from anywhere else.
+// The caller may not modify any part of the returned schema data structure.
+func ConnectionBlockSupersetSchema() *configschema.Block {
+        return connectionBlockSupersetSchema
 }
 
 // EvalValidateResource is an EvalNode implementation that validates
 // the configuration of a resource.
 type EvalValidateResource struct {
-        Provider     *ResourceProvider
-        Config       **ResourceConfig
-        ResourceName string
-        ResourceType string
-        ResourceMode config.ResourceMode
+        Addr           addrs.Resource
+        Provider       *providers.Interface
+        ProviderSchema **ProviderSchema
+        Config         *configs.Resource
 
         // IgnoreWarnings means that warnings will not be passed through. This allows
         // "just-in-time" passes of validation to continue execution through warnings.
         IgnoreWarnings bool
+
+        // ConfigVal, if non-nil, will be updated with the value resulting from
+        // evaluating the given configuration body. Since validation is performed
+        // very early, this value is likely to contain lots of unknown values,
+        // but its type will conform to the schema of the resource type associated
+        // with the resource instance being validated.
+        ConfigVal *cty.Value
 }
 
 func (n *EvalValidateResource) Eval(ctx EvalContext) (interface{}, error) {
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                return nil, fmt.Errorf("EvalValidateResource has nil schema for %s", n.Addr)
+        }
+
+        var diags tfdiags.Diagnostics
         provider := *n.Provider
         cfg := *n.Config
-        var warns []string
-        var errs []error
+        schema := *n.ProviderSchema
+        mode := cfg.Mode
+
+        keyData := EvalDataForNoInstanceKey
+        if n.Config.Count != nil {
+                // If the config block has count, we'll evaluate with an unknown
+                // number as count.index so we can still type check even though
+                // we won't expand count until the plan phase.
+                keyData = InstanceKeyEvalData{
+                        CountIndex: cty.UnknownVal(cty.Number),
+                }
+
+                // Basic type-checking of the count argument. More complete validation
+                // of this will happen when we DynamicExpand during the plan walk.
+                countDiags := n.validateCount(ctx, n.Config.Count)
+                diags = diags.Append(countDiags)
+        }
+
+        for _, traversal := range n.Config.DependsOn {
+                ref, refDiags := addrs.ParseRef(traversal)
+                diags = diags.Append(refDiags)
+                if len(ref.Remaining) != 0 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid depends_on reference",
+                                Detail:   "References in depends_on must be to a whole object (resource, etc), not to an attribute of an object.",
+                                Subject:  ref.Remaining.SourceRange().Ptr(),
+                        })
+                }
+
+                // The ref must also refer to something that exists. To test that,
+                // we'll just eval it and count on the fact that our evaluator will
+                // detect references to non-existent objects.
+                if !diags.HasErrors() {
+                        scope := ctx.EvaluationScope(nil, EvalDataForNoInstanceKey)
+                        if scope != nil { // sometimes nil in tests, due to incomplete mocks
+                                _, refDiags = scope.EvalReference(ref, cty.DynamicPseudoType)
+                                diags = diags.Append(refDiags)
+                        }
+                }
+        }
+
         // Provider entry point varies depending on resource mode, because
         // managed resources and data resources are two distinct concepts
         // in the provider abstraction.
-        switch n.ResourceMode {
-        case config.ManagedResourceMode:
-                warns, errs = provider.ValidateResource(n.ResourceType, cfg)
-        case config.DataResourceMode:
-                warns, errs = provider.ValidateDataSource(n.ResourceType, cfg)
-        }
+        switch mode {
+        case addrs.ManagedResourceMode:
+                schema, _ := schema.SchemaForResourceType(mode, cfg.Type)
+                if schema == nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource type",
+                                Detail:   fmt.Sprintf("The provider %s does not support resource type %q.", cfg.ProviderConfigAddr(), cfg.Type),
+                                Subject:  &cfg.TypeRange,
+                        })
+                        return nil, diags.Err()
+                }
+
+                configVal, _, valDiags := ctx.EvaluateBlock(cfg.Config, schema, nil, keyData)
+                diags = diags.Append(valDiags)
+                if valDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
+
+                if cfg.Managed != nil { // can be nil only in tests with poorly-configured mocks
+                        for _, traversal := range cfg.Managed.IgnoreChanges {
+                                moreDiags := schema.StaticValidateTraversal(traversal)
+                                diags = diags.Append(moreDiags)
+                        }
+                }
+
+                req := providers.ValidateResourceTypeConfigRequest{
+                        TypeName: cfg.Type,
+                        Config:   configVal,
+                }
+
+                resp := provider.ValidateResourceTypeConfig(req)
+                diags = diags.Append(resp.Diagnostics.InConfigBody(cfg.Config))
+
+                if n.ConfigVal != nil {
+                        *n.ConfigVal = configVal
+                }
+
+        case addrs.DataResourceMode:
+                schema, _ := schema.SchemaForResourceType(mode, cfg.Type)
+                if schema == nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid data source",
+                                Detail:   fmt.Sprintf("The provider %s does not support data source %q.", cfg.ProviderConfigAddr(), cfg.Type),
+                                Subject:  &cfg.TypeRange,
+                        })
+                        return nil, diags.Err()
+                }
+
+                configVal, _, valDiags := ctx.EvaluateBlock(cfg.Config, schema, nil, keyData)
+                diags = diags.Append(valDiags)
+                if valDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
 
-        // If the resource name doesn't match the name regular
-        // expression, show an error.
-        if !config.NameRegexp.Match([]byte(n.ResourceName)) {
-                errs = append(errs, fmt.Errorf(
-                        "%s: resource name can only contain letters, numbers, "+
-                                "dashes, and underscores.", n.ResourceName))
+                req := providers.ValidateDataSourceConfigRequest{
+                        TypeName: cfg.Type,
+                        Config:   configVal,
+                }
+
+                resp := provider.ValidateDataSourceConfig(req)
+                diags = diags.Append(resp.Diagnostics.InConfigBody(cfg.Config))
         }
 
-        if (len(warns) == 0 || n.IgnoreWarnings) && len(errs) == 0 {
+        if n.IgnoreWarnings {
+                // If we _only_ have warnings then we'll return nil.
+                if diags.HasErrors() {
+                        return nil, diags.NonFatalErr()
+                }
                 return nil, nil
+        } else {
+                // We'll return an error if there are any diagnostics at all, even if
+                // some of them are warnings.
+                return nil, diags.NonFatalErr()
+        }
+}
+
+func (n *EvalValidateResource) validateCount(ctx EvalContext, expr hcl.Expression) tfdiags.Diagnostics {
+        if expr == nil {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+
+        countVal, countDiags := ctx.EvaluateExpr(expr, cty.Number, nil)
+        diags = diags.Append(countDiags)
+        if diags.HasErrors() {
+                return diags
+        }
+
+        if countVal.IsNull() {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is null. An integer is required.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
         }
 
-        return nil, &EvalValidateError{
-                Warnings: warns,
-                Errors:   errs,
+        var err error
+        countVal, err = convert.Convert(countVal, cty.Number)
+        if err != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   fmt.Sprintf(`The given "count" argument value is unsuitable: %s.`, err),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
         }
+
+        // If the value isn't known then that's the best we can do for now, but
+        // we'll check more thoroughly during the plan walk.
+        if !countVal.IsKnown() {
+                return diags
+        }
+
+        // If we _do_ know the value, then we can do a few more checks here.
+        var count int
+        err = gocty.FromCtyValue(countVal, &count)
+        if err != nil {
+                // Isn't a whole number, etc.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   fmt.Sprintf(`The given "count" argument value is unsuitable: %s.`, err),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
+        }
+
+        if count < 0 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is unsuitable: count cannot be negative.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
+        }
+
+        return diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go
index ae4436a..edd604f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go
@@ -3,72 +3,65 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalValidateResourceSelfRef is an EvalNode implementation that validates that
-// a configuration doesn't contain a reference to the resource itself.
-//
-// This must be done prior to interpolating configuration in order to avoid
-// any infinite loop scenarios.
-type EvalValidateResourceSelfRef struct {
-        Addr   **ResourceAddress
-        Config **config.RawConfig
+// EvalValidateSelfRef is an EvalNode implementation that checks to ensure that
+// expressions within a particular referencable block do not reference that
+// same block.
+type EvalValidateSelfRef struct {
+        Addr           addrs.Referenceable
+        Config         hcl.Body
+        ProviderSchema **ProviderSchema
 }
 
-func (n *EvalValidateResourceSelfRef) Eval(ctx EvalContext) (interface{}, error) {
-        addr := *n.Addr
-        conf := *n.Config
-
-        // Go through the variables and find self references
-        var errs []error
-        for k, raw := range conf.Variables {
-                rv, ok := raw.(*config.ResourceVariable)
-                if !ok {
-                        continue
-                }
-
-                // Build an address from the variable
-                varAddr := &ResourceAddress{
-                        Path:         addr.Path,
-                        Mode:         rv.Mode,
-                        Type:         rv.Type,
-                        Name:         rv.Name,
-                        Index:        rv.Index,
-                        InstanceType: TypePrimary,
-                }
+func (n *EvalValidateSelfRef) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+        addr := n.Addr
 
-                // If the variable access is a multi-access (*), then we just
-                // match the index so that we'll match our own addr if everything
-                // else matches.
-                if rv.Multi && rv.Index == -1 {
-                        varAddr.Index = addr.Index
-                }
+        addrStrs := make([]string, 0, 1)
+        addrStrs = append(addrStrs, addr.String())
+        switch tAddr := addr.(type) {
+        case addrs.ResourceInstance:
+                // A resource instance may not refer to its containing resource either.
+                addrStrs = append(addrStrs, tAddr.ContainingResource().String())
+        }
 
-                // This is a weird thing where ResourceAddres has index "-1" when
-                // index isn't set at all. This means index "0" for resource access.
-                // So, if we have this scenario, just set our varAddr to -1 so it
-                // matches.
-                if addr.Index == -1 && varAddr.Index == 0 {
-                        varAddr.Index = -1
-                }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                return nil, fmt.Errorf("provider schema unavailable while validating %s for self-references; this is a bug in Terraform and should be reported", addr)
+        }
 
-                // If the addresses match, then this is a self reference
-                if varAddr.Equals(addr) && varAddr.Index == addr.Index {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: self reference not allowed: %q",
-                                addr, k))
-                }
+        providerSchema := *n.ProviderSchema
+        var schema *configschema.Block
+        switch tAddr := addr.(type) {
+        case addrs.Resource:
+                schema, _ = providerSchema.SchemaForResourceAddr(tAddr)
+        case addrs.ResourceInstance:
+                schema, _ = providerSchema.SchemaForResourceAddr(tAddr.ContainingResource())
         }
 
-        // If no errors, no errors!
-        if len(errs) == 0 {
-                return nil, nil
+        if schema == nil {
+                return nil, fmt.Errorf("no schema available for %s to validate for self-references; this is a bug in Terraform and should be reported", addr)
         }
 
-        // Wrap the errors in the proper wrapper so we can handle validation
-        // formatting properly upstream.
-        return nil, &EvalValidateError{
-                Errors: errs,
+        refs, _ := lang.ReferencesInBlock(n.Config, schema)
+        for _, ref := range refs {
+                for _, addrStr := range addrStrs {
+                        if ref.Subject.String() == addrStr {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Self-referential block",
+                                        Detail:   fmt.Sprintf("Configuration for %s may not refer to itself.", addrStr),
+                                        Subject:  ref.SourceRange.ToHCL().Ptr(),
+                                })
+                        }
+                }
         }
+
+        return nil, diags.NonFatalErr()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go b/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
index e39a33c..68adf76 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
@@ -4,12 +4,17 @@ import (
         "fmt"
         "log"
         "reflect"
-        "strconv"
         "strings"
 
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
+
+        "github.com/hashicorp/terraform/addrs"
+
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/helper/hilmapstructure"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
 )
 
 // EvalTypeCheckVariable is an EvalNode which ensures that the variable
@@ -93,166 +98,88 @@ func (n *EvalTypeCheckVariable) Eval(ctx EvalContext) (interface{}, error) {
         return nil, nil
 }
 
-// EvalSetVariables is an EvalNode implementation that sets the variables
-// explicitly for interpolation later.
-type EvalSetVariables struct {
-        Module    *string
-        Variables map[string]interface{}
+// EvalSetModuleCallArguments is an EvalNode implementation that sets values
+// for arguments of a child module call, for later retrieval during
+// expression evaluation.
+type EvalSetModuleCallArguments struct {
+        Module addrs.ModuleCallInstance
+        Values map[string]cty.Value
 }
 
 // TODO: test
-func (n *EvalSetVariables) Eval(ctx EvalContext) (interface{}, error) {
-        ctx.SetVariables(*n.Module, n.Variables)
+func (n *EvalSetModuleCallArguments) Eval(ctx EvalContext) (interface{}, error) {
+        ctx.SetModuleCallArguments(n.Module, n.Values)
         return nil, nil
 }
 
-// EvalVariableBlock is an EvalNode implementation that evaluates the
-// given configuration, and uses the final values as a way to set the
-// mapping.
-type EvalVariableBlock struct {
-        Config         **ResourceConfig
-        VariableValues map[string]interface{}
+// EvalModuleCallArgument is an EvalNode implementation that produces the value
+// for a particular variable as will be used by a child module instance.
+//
+// The result is written into the map given in Values, with its key
+// set to the local name of the variable, disregarding the module instance
+// address. Any existing values in that map are deleted first. This weird
+// interface is a result of trying to be convenient for use with
+// EvalContext.SetModuleCallArguments, which expects a map to merge in with
+// any existing arguments.
+type EvalModuleCallArgument struct {
+        Addr   addrs.InputVariable
+        Config *configs.Variable
+        Expr   hcl.Expression
+
+        // If this flag is set, any diagnostics are discarded and this operation
+        // will always succeed, though may produce an unknown value in the
+        // event of an error.
+        IgnoreDiagnostics bool
+
+        Values map[string]cty.Value
 }
 
-func (n *EvalVariableBlock) Eval(ctx EvalContext) (interface{}, error) {
+func (n *EvalModuleCallArgument) Eval(ctx EvalContext) (interface{}, error) {
         // Clear out the existing mapping
-        for k, _ := range n.VariableValues {
-                delete(n.VariableValues, k)
-        }
-
-        // Get our configuration
-        rc := *n.Config
-        for k, v := range rc.Config {
-                vKind := reflect.ValueOf(v).Type().Kind()
-
-                switch vKind {
-                case reflect.Slice:
-                        var vSlice []interface{}
-                        if err := hilmapstructure.WeakDecode(v, &vSlice); err == nil {
-                                n.VariableValues[k] = vSlice
-                                continue
-                        }
-                case reflect.Map:
-                        var vMap map[string]interface{}
-                        if err := hilmapstructure.WeakDecode(v, &vMap); err == nil {
-                                n.VariableValues[k] = vMap
-                                continue
-                        }
-                default:
-                        var vString string
-                        if err := hilmapstructure.WeakDecode(v, &vString); err == nil {
-                                n.VariableValues[k] = vString
-                                continue
-                        }
-                }
-
-                return nil, fmt.Errorf("Variable value for %s is not a string, list or map type", k)
-        }
-
-        for _, path := range rc.ComputedKeys {
-                log.Printf("[DEBUG] Setting Unknown Variable Value for computed key: %s", path)
-                err := n.setUnknownVariableValueForPath(path)
-                if err != nil {
-                        return nil, err
-                }
+        for k := range n.Values {
+                delete(n.Values, k)
         }
 
-        return nil, nil
-}
-
-func (n *EvalVariableBlock) setUnknownVariableValueForPath(path string) error {
-        pathComponents := strings.Split(path, ".")
-
-        if len(pathComponents) < 1 {
-                return fmt.Errorf("No path comoponents in %s", path)
+        wantType := n.Config.Type
+        name := n.Addr.Name
+        expr := n.Expr
+
+        if expr == nil {
+                // Should never happen, but we'll bail out early here rather than
+                // crash in case it does. We set no value at all in this case,
+                // making a subsequent call to EvalContext.SetModuleCallArguments
+                // a no-op.
+                log.Printf("[ERROR] attempt to evaluate %s with nil expression", n.Addr.String())
+                return nil, nil
         }
 
-        if len(pathComponents) == 1 {
-                // Special case the "top level" since we know the type
-                if _, ok := n.VariableValues[pathComponents[0]]; !ok {
-                        n.VariableValues[pathComponents[0]] = config.UnknownVariableValue
-                }
-                return nil
+        val, diags := ctx.EvaluateExpr(expr, cty.DynamicPseudoType, nil)
+
+        // We intentionally passed DynamicPseudoType to EvaluateExpr above because
+        // now we can do our own local type conversion and produce an error message
+        // with better context if it fails.
+        var convErr error
+        val, convErr = convert.Convert(val, wantType)
+        if convErr != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid value for module argument",
+                        Detail: fmt.Sprintf(
+                                "The given value is not suitable for child module variable %q defined at %s: %s.",
+                                name, n.Config.DeclRange.String(), convErr,
+                        ),
+                        Subject: expr.Range().Ptr(),
+                })
+                // We'll return a placeholder unknown value to avoid producing
+                // redundant downstream errors.
+                val = cty.UnknownVal(wantType)
         }
 
-        // Otherwise find the correct point in the tree and then set to unknown
-        var current interface{} = n.VariableValues[pathComponents[0]]
-        for i := 1; i < len(pathComponents); i++ {
-                switch tCurrent := current.(type) {
-                case []interface{}:
-                        index, err := strconv.Atoi(pathComponents[i])
-                        if err != nil {
-                                return fmt.Errorf("Cannot convert %s to slice index in path %s",
-                                        pathComponents[i], path)
-                        }
-                        current = tCurrent[index]
-                case []map[string]interface{}:
-                        index, err := strconv.Atoi(pathComponents[i])
-                        if err != nil {
-                                return fmt.Errorf("Cannot convert %s to slice index in path %s",
-                                        pathComponents[i], path)
-                        }
-                        current = tCurrent[index]
-                case map[string]interface{}:
-                        if val, hasVal := tCurrent[pathComponents[i]]; hasVal {
-                                current = val
-                                continue
-                        }
-
-                        tCurrent[pathComponents[i]] = config.UnknownVariableValue
-                        break
-                }
+        n.Values[name] = val
+        if n.IgnoreDiagnostics {
+                return nil, nil
         }
-
-        return nil
-}
-
-// EvalCoerceMapVariable is an EvalNode implementation that recognizes a
-// specific ambiguous HCL parsing situation and resolves it. In HCL parsing, a
-// bare map literal is indistinguishable from a list of maps w/ one element.
-//
-// We take all the same inputs as EvalTypeCheckVariable above, since we need
-// both the target type and the proposed value in order to properly coerce.
-type EvalCoerceMapVariable struct {
-        Variables  map[string]interface{}
-        ModulePath []string
-        ModuleTree *module.Tree
-}
-
-// Eval implements the EvalNode interface. See EvalCoerceMapVariable for
-// details.
-func (n *EvalCoerceMapVariable) Eval(ctx EvalContext) (interface{}, error) {
-        currentTree := n.ModuleTree
-        for _, pathComponent := range n.ModulePath[1:] {
-                currentTree = currentTree.Children()[pathComponent]
-        }
-        targetConfig := currentTree.Config()
-
-        prototypes := make(map[string]config.VariableType)
-        for _, variable := range targetConfig.Variables {
-                prototypes[variable.Name] = variable.Type()
-        }
-
-        for name, declaredType := range prototypes {
-                if declaredType != config.VariableTypeMap {
-                        continue
-                }
-
-                proposedValue, ok := n.Variables[name]
-                if !ok {
-                        continue
-                }
-
-                if list, ok := proposedValue.([]interface{}); ok && len(list) == 1 {
-                        if m, ok := list[0].(map[string]interface{}); ok {
-                                log.Printf("[DEBUG] EvalCoerceMapVariable: "+
-                                        "Coercing single element list into map: %#v", m)
-                                n.Variables[name] = m
-                        }
-                }
-        }
-
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // hclTypeName returns the name of the type that would represent this value in
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
index 0c3da48..6b4df67 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
@@ -1,48 +1,34 @@
 package terraform
 
 import (
-        "strings"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/providers"
 )
 
 // ProviderEvalTree returns the evaluation tree for initializing and
 // configuring providers.
-func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) EvalNode {
-        var provider ResourceProvider
-        var resourceConfig *ResourceConfig
+func ProviderEvalTree(n *NodeApplyableProvider, config *configs.Provider) EvalNode {
+        var provider providers.Interface
 
-        typeName := strings.SplitN(n.NameValue, ".", 2)[0]
+        addr := n.Addr
+        relAddr := addr.ProviderConfig
 
         seq := make([]EvalNode, 0, 5)
         seq = append(seq, &EvalInitProvider{
-                TypeName: typeName,
-                Name:     n.Name(),
+                TypeName: relAddr.Type,
+                Addr:     addr.ProviderConfig,
         })
 
         // Input stuff
         seq = append(seq, &EvalOpFilter{
-                Ops: []walkOperation{walkInput, walkImport},
+                Ops: []walkOperation{walkImport},
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.Name(),
+                                        Addr:   addr,
                                         Output: &provider,
                                 },
-                                &EvalInterpolateProvider{
-                                        Config: config,
-                                        Output: &resourceConfig,
-                                },
-                                &EvalBuildProviderConfig{
-                                        Provider: n.NameValue,
-                                        Config:   &resourceConfig,
-                                        Output:   &resourceConfig,
-                                },
-                                &EvalInputProvider{
-                                        Name:     n.NameValue,
-                                        Provider: &provider,
-                                        Config:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -52,21 +38,13 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.Name(),
+                                        Addr:   addr,
                                         Output: &provider,
                                 },
-                                &EvalInterpolateProvider{
-                                        Config: config,
-                                        Output: &resourceConfig,
-                                },
-                                &EvalBuildProviderConfig{
-                                        Provider: n.NameValue,
-                                        Config:   &resourceConfig,
-                                        Output:   &resourceConfig,
-                                },
                                 &EvalValidateProvider{
+                                        Addr:     relAddr,
                                         Provider: &provider,
-                                        Config:   &resourceConfig,
+                                        Config:   config,
                                 },
                         },
                 },
@@ -78,18 +56,9 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.Name(),
+                                        Addr:   addr,
                                         Output: &provider,
                                 },
-                                &EvalInterpolateProvider{
-                                        Config: config,
-                                        Output: &resourceConfig,
-                                },
-                                &EvalBuildProviderConfig{
-                                        Provider: n.NameValue,
-                                        Config:   &resourceConfig,
-                                        Output:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -101,8 +70,9 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalConfigProvider{
-                                        Provider: n.Name(),
-                                        Config:   &resourceConfig,
+                                        Addr:     relAddr,
+                                        Provider: &provider,
+                                        Config:   config,
                                 },
                         },
                 },
@@ -113,6 +83,6 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
 
 // CloseProviderEvalTree returns the evaluation tree for closing
 // provider connections that aren't needed anymore.
-func CloseProviderEvalTree(n string) EvalNode {
-        return &EvalCloseProvider{Name: n}
+func CloseProviderEvalTree(addr addrs.AbsProviderConfig) EvalNode {
+        return &EvalCloseProvider{Addr: addr.ProviderConfig}
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaluate.go b/vendor/github.com/hashicorp/terraform/terraform/evaluate.go
new file mode 100644
index 0000000..ab65d47
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaluate.go
@@ -0,0 +1,933 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strconv"
+        "sync"
+
+        "github.com/agext/levenshtein"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Evaluator provides the necessary contextual data for evaluating expressions
+// for a particular walk operation.
+type Evaluator struct {
+        // Operation defines what type of operation this evaluator is being used
+        // for.
+        Operation walkOperation
+
+        // Meta is contextual metadata about the current operation.
+        Meta *ContextMeta
+
+        // Config is the root node in the configuration tree.
+        Config *configs.Config
+
+        // VariableValues is a map from variable names to their associated values,
+        // within the module indicated by ModulePath. VariableValues is modified
+        // concurrently, and so it must be accessed only while holding
+        // VariableValuesLock.
+        //
+        // The first map level is string representations of addr.ModuleInstance
+        // values, while the second level is variable names.
+        VariableValues     map[string]map[string]cty.Value
+        VariableValuesLock *sync.Mutex
+
+        // Schemas is a repository of all of the schemas we should need to
+        // evaluate expressions. This must be constructed by the caller to
+        // include schemas for all of the providers, resource types, data sources
+        // and provisioners used by the given configuration and state.
+        //
+        // This must not be mutated during evaluation.
+        Schemas *Schemas
+
+        // State is the current state, embedded in a wrapper that ensures that
+        // it can be safely accessed and modified concurrently.
+        State *states.SyncState
+
+        // Changes is the set of proposed changes, embedded in a wrapper that
+        // ensures they can be safely accessed and modified concurrently.
+        Changes *plans.ChangesSync
+}
+
+// Scope creates an evaluation scope for the given module path and optional
+// resource.
+//
+// If the "self" argument is nil then the "self" object is not available
+// in evaluated expressions. Otherwise, it behaves as an alias for the given
+// address.
+func (e *Evaluator) Scope(data lang.Data, self addrs.Referenceable) *lang.Scope {
+        return &lang.Scope{
+                Data:     data,
+                SelfAddr: self,
+                PureOnly: e.Operation != walkApply && e.Operation != walkDestroy,
+                BaseDir:  ".", // Always current working directory for now.
+        }
+}
+
+// evaluationStateData is an implementation of lang.Data that resolves
+// references primarily (but not exclusively) using information from a State.
+type evaluationStateData struct {
+        Evaluator *Evaluator
+
+        // ModulePath is the path through the dynamic module tree to the module
+        // that references will be resolved relative to.
+        ModulePath addrs.ModuleInstance
+
+        // InstanceKeyData describes the values, if any, that are accessible due
+        // to repetition of a containing object using "count" or "for_each"
+        // arguments. (It is _not_ used for the for_each inside "dynamic" blocks,
+        // since the user specifies in that case which variable name to locally
+        // shadow.)
+        InstanceKeyData InstanceKeyEvalData
+
+        // Operation records the type of walk the evaluationStateData is being used
+        // for.
+        Operation walkOperation
+}
+
+// InstanceKeyEvalData is used during evaluation to specify which values,
+// if any, should be produced for count.index, each.key, and each.value.
+type InstanceKeyEvalData struct {
+        // CountIndex is the value for count.index, or cty.NilVal if evaluating
+        // in a context where the "count" argument is not active.
+        //
+        // For correct operation, this should always be of type cty.Number if not
+        // nil.
+        CountIndex cty.Value
+
+        // EachKey and EachValue are the values for each.key and each.value
+        // respectively, or cty.NilVal if evaluating in a context where the
+        // "for_each" argument is not active. These must either both be set
+        // or neither set.
+        //
+        // For correct operation, EachKey must always be either of type cty.String
+        // or cty.Number if not nil.
+        EachKey, EachValue cty.Value
+}
+
+// EvalDataForInstanceKey constructs a suitable InstanceKeyEvalData for
+// evaluating in a context that has the given instance key.
+func EvalDataForInstanceKey(key addrs.InstanceKey) InstanceKeyEvalData {
+        // At the moment we don't actually implement for_each, so we only
+        // ever populate CountIndex.
+        // (When we implement for_each later we may need to reorganize this some,
+        // so that we can resolve the ambiguity that an int key may either be
+        // a count.index or an each.key where for_each is over a list.)
+
+        var countIdx cty.Value
+        if intKey, ok := key.(addrs.IntKey); ok {
+                countIdx = cty.NumberIntVal(int64(intKey))
+        }
+
+        return InstanceKeyEvalData{
+                CountIndex: countIdx,
+        }
+}
+
+// EvalDataForNoInstanceKey is a value of InstanceKeyData that sets no instance
+// key values at all, suitable for use in contexts where no keyed instance
+// is relevant.
+var EvalDataForNoInstanceKey = InstanceKeyEvalData{}
+
+// evaluationStateData must implement lang.Data
+var _ lang.Data = (*evaluationStateData)(nil)
+
+func (d *evaluationStateData) GetCountAttr(addr addrs.CountAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        switch addr.Name {
+
+        case "index":
+                idxVal := d.InstanceKeyData.CountIndex
+                if idxVal == cty.NilVal {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Reference to "count" in non-counted context`,
+                                Detail:   fmt.Sprintf(`The "count" object can be used only in "resource" and "data" blocks, and only when the "count" argument is set.`),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.UnknownVal(cty.Number), diags
+                }
+                return idxVal, diags
+
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "count" attribute`,
+                        Detail:   fmt.Sprintf(`The "count" object does not have an attribute named %q. The only supported attribute is count.index, which is the index of each instance of a resource block that has the "count" argument set.`, addr.Name),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+}
+
+func (d *evaluationStateData) GetInputVariable(addr addrs.InputVariable, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // First we'll make sure the requested value is declared in configuration,
+        // so we can produce a nice message if not.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+        if moduleConfig == nil {
+                // should never happen, since we can't be evaluating in a module
+                // that wasn't mentioned in configuration.
+                panic(fmt.Sprintf("input variable read from %s, which has no configuration", d.ModulePath))
+        }
+
+        config := moduleConfig.Module.Variables[addr.Name]
+        if config == nil {
+                var suggestions []string
+                for k := range moduleConfig.Module.Variables {
+                        suggestions = append(suggestions, k)
+                }
+                suggestion := nameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                } else {
+                        suggestion = fmt.Sprintf(" This variable can be declared with a variable %q {} block.", addr.Name)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared input variable`,
+                        Detail:   fmt.Sprintf(`An input variable with the name %q has not been declared.%s`, addr.Name, suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        wantType := cty.DynamicPseudoType
+        if config.Type != cty.NilType {
+                wantType = config.Type
+        }
+
+        d.Evaluator.VariableValuesLock.Lock()
+        defer d.Evaluator.VariableValuesLock.Unlock()
+
+        // During the validate walk, input variables are always unknown so
+        // that we are validating the configuration for all possible input values
+        // rather than for a specific set. Checking against a specific set of
+        // input values then happens during the plan walk.
+        //
+        // This is important because otherwise the validation walk will tend to be
+        // overly strict, requiring expressions throughout the configuration to
+        // be complicated to accommodate all possible inputs, whereas returning
+        // known here allows for simpler patterns like using input values as
+        // guards to broadly enable/disable resources, avoid processing things
+        // that are disabled, etc. Terraform's static validation leans towards
+        // being liberal in what it accepts because the subsequent plan walk has
+        // more information available and so can be more conservative.
+        if d.Operation == walkValidate {
+                return cty.UnknownVal(wantType), diags
+        }
+
+        moduleAddrStr := d.ModulePath.String()
+        vals := d.Evaluator.VariableValues[moduleAddrStr]
+        if vals == nil {
+                return cty.UnknownVal(wantType), diags
+        }
+
+        val, isSet := vals[addr.Name]
+        if !isSet {
+                if config.Default != cty.NilVal {
+                        return config.Default, diags
+                }
+                return cty.UnknownVal(wantType), diags
+        }
+
+        var err error
+        val, err = convert.Convert(val, wantType)
+        if err != nil {
+                // We should never get here because this problem should've been caught
+                // during earlier validation, but we'll do something reasonable anyway.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Incorrect variable type`,
+                        Detail:   fmt.Sprintf(`The resolved value of variable %q is not appropriate: %s.`, addr.Name, err),
+                        Subject:  &config.DeclRange,
+                })
+                // Stub out our return value so that the semantic checker doesn't
+                // produce redundant downstream errors.
+                val = cty.UnknownVal(wantType)
+        }
+
+        return val, diags
+}
+
+func (d *evaluationStateData) GetLocalValue(addr addrs.LocalValue, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // First we'll make sure the requested value is declared in configuration,
+        // so we can produce a nice message if not.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+        if moduleConfig == nil {
+                // should never happen, since we can't be evaluating in a module
+                // that wasn't mentioned in configuration.
+                panic(fmt.Sprintf("local value read from %s, which has no configuration", d.ModulePath))
+        }
+
+        config := moduleConfig.Module.Locals[addr.Name]
+        if config == nil {
+                var suggestions []string
+                for k := range moduleConfig.Module.Locals {
+                        suggestions = append(suggestions, k)
+                }
+                suggestion := nameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared local value`,
+                        Detail:   fmt.Sprintf(`A local value with the name %q has not been declared.%s`, addr.Name, suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        val := d.Evaluator.State.LocalValue(addr.Absolute(d.ModulePath))
+        if val == cty.NilVal {
+                // Not evaluated yet?
+                val = cty.DynamicVal
+        }
+
+        return val, diags
+}
+
+func (d *evaluationStateData) GetModuleInstance(addr addrs.ModuleCallInstance, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Output results live in the module that declares them, which is one of
+        // the child module instances of our current module path.
+        moduleAddr := addr.ModuleInstance(d.ModulePath)
+
+        // We'll consult the configuration to see what output names we are
+        // expecting, so we can ensure the resulting object is of the expected
+        // type even if our data is incomplete for some reason.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(moduleAddr)
+        if moduleConfig == nil {
+                // should never happen, since this should've been caught during
+                // static validation.
+                panic(fmt.Sprintf("output value read from %s, which has no configuration", moduleAddr))
+        }
+        outputConfigs := moduleConfig.Module.Outputs
+
+        vals := map[string]cty.Value{}
+        for n := range outputConfigs {
+                addr := addrs.OutputValue{Name: n}.Absolute(moduleAddr)
+
+                // If a pending change is present in our current changeset then its value
+                // takes priority over what's in state. (It will usually be the same but
+                // will differ if the new value is unknown during planning.)
+                if changeSrc := d.Evaluator.Changes.GetOutputChange(addr); changeSrc != nil {
+                        change, err := changeSrc.Decode()
+                        if err != nil {
+                                // This should happen only if someone has tampered with a plan
+                                // file, so we won't bother with a pretty error for it.
+                                diags = diags.Append(fmt.Errorf("planned change for %s could not be decoded: %s", addr, err))
+                                vals[n] = cty.DynamicVal
+                                continue
+                        }
+                        // We care only about the "after" value, which is the value this output
+                        // will take on after the plan is applied.
+                        vals[n] = change.After
+                } else {
+                        os := d.Evaluator.State.OutputValue(addr)
+                        if os == nil {
+                                // Not evaluated yet?
+                                vals[n] = cty.DynamicVal
+                                continue
+                        }
+                        vals[n] = os.Value
+                }
+        }
+        return cty.ObjectVal(vals), diags
+}
+
+func (d *evaluationStateData) GetModuleInstanceOutput(addr addrs.ModuleCallOutput, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Output results live in the module that declares them, which is one of
+        // the child module instances of our current module path.
+        absAddr := addr.AbsOutputValue(d.ModulePath)
+        moduleAddr := absAddr.Module
+
+        // First we'll consult the configuration to see if an output of this
+        // name is declared at all.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(moduleAddr)
+        if moduleConfig == nil {
+                // this doesn't happen in normal circumstances due to our validation
+                // pass, but it can turn up in some unusual situations, like in the
+                // "terraform console" repl where arbitrary expressions can be
+                // evaluated.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared module`,
+                        Detail:   fmt.Sprintf(`The configuration contains no %s.`, moduleAddr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        config := moduleConfig.Module.Outputs[addr.Name]
+        if config == nil {
+                var suggestions []string
+                for k := range moduleConfig.Module.Outputs {
+                        suggestions = append(suggestions, k)
+                }
+                suggestion := nameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared output value`,
+                        Detail:   fmt.Sprintf(`An output value with the name %q has not been declared in %s.%s`, addr.Name, moduleDisplayAddr(moduleAddr), suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        // If a pending change is present in our current changeset then its value
+        // takes priority over what's in state. (It will usually be the same but
+        // will differ if the new value is unknown during planning.)
+        if changeSrc := d.Evaluator.Changes.GetOutputChange(absAddr); changeSrc != nil {
+                change, err := changeSrc.Decode()
+                if err != nil {
+                        // This should happen only if someone has tampered with a plan
+                        // file, so we won't bother with a pretty error for it.
+                        diags = diags.Append(fmt.Errorf("planned change for %s could not be decoded: %s", absAddr, err))
+                        return cty.DynamicVal, diags
+                }
+                // We care only about the "after" value, which is the value this output
+                // will take on after the plan is applied.
+                return change.After, diags
+        }
+
+        os := d.Evaluator.State.OutputValue(absAddr)
+        if os == nil {
+                // Not evaluated yet?
+                return cty.DynamicVal, diags
+        }
+
+        return os.Value, diags
+}
+
+func (d *evaluationStateData) GetPathAttr(addr addrs.PathAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        switch addr.Name {
+
+        case "cwd":
+                wd, err := os.Getwd()
+                if err != nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Failed to get working directory`,
+                                Detail:   fmt.Sprintf(`The value for path.cwd cannot be determined due to a system error: %s`, err),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+                return cty.StringVal(filepath.ToSlash(wd)), diags
+
+        case "module":
+                moduleConfig := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+                if moduleConfig == nil {
+                        // should never happen, since we can't be evaluating in a module
+                        // that wasn't mentioned in configuration.
+                        panic(fmt.Sprintf("module.path read from module %s, which has no configuration", d.ModulePath))
+                }
+                sourceDir := moduleConfig.Module.SourceDir
+                return cty.StringVal(filepath.ToSlash(sourceDir)), diags
+
+        case "root":
+                sourceDir := d.Evaluator.Config.Module.SourceDir
+                return cty.StringVal(filepath.ToSlash(sourceDir)), diags
+
+        default:
+                suggestion := nameSuggestion(addr.Name, []string{"cwd", "module", "root"})
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "path" attribute`,
+                        Detail:   fmt.Sprintf(`The "path" object does not have an attribute named %q.%s`, addr.Name, suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+}
+
+func (d *evaluationStateData) GetResourceInstance(addr addrs.ResourceInstance, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Although we are giving a ResourceInstance address here, if it has
+        // a key of addrs.NoKey then it might actually be a request for all of
+        // the instances of a particular resource. The reference resolver can't
+        // resolve the ambiguity itself, so we must do it in here.
+
+        // First we'll consult the configuration to see if an resource of this
+        // name is declared at all.
+        moduleAddr := d.ModulePath
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(moduleAddr)
+        if moduleConfig == nil {
+                // should never happen, since we can't be evaluating in a module
+                // that wasn't mentioned in configuration.
+                panic(fmt.Sprintf("resource value read from %s, which has no configuration", moduleAddr))
+        }
+
+        config := moduleConfig.Module.ResourceByAddr(addr.ContainingResource())
+        if config == nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared resource`,
+                        Detail:   fmt.Sprintf(`A resource %q %q has not been declared in %s`, addr.Resource.Type, addr.Resource.Name, moduleDisplayAddr(moduleAddr)),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        // First we'll find the state for the resource as a whole, and decide
+        // from there whether we're going to interpret the given address as a
+        // resource or a resource instance address.
+        rs := d.Evaluator.State.Resource(addr.ContainingResource().Absolute(d.ModulePath))
+
+        if rs == nil {
+                schema := d.getResourceSchema(addr.ContainingResource(), config.ProviderConfigAddr().Absolute(d.ModulePath))
+
+                // If it doesn't exist at all then we can't reliably determine whether
+                // single-instance or whole-resource interpretation was intended, but
+                // we can decide this partially...
+                if addr.Key != addrs.NoKey {
+                        // If there's an instance key then the user must be intending
+                        // single-instance interpretation, and so we can return a
+                        // properly-typed unknown value to help with type checking.
+                        return cty.UnknownVal(schema.ImpliedType()), diags
+                }
+
+                // otherwise we must return DynamicVal so that both interpretations
+                // can proceed without generating errors, and we'll deal with this
+                // in a later step where more information is gathered.
+                // (In practice we should only end up here during the validate walk,
+                // since later walks should have at least partial states populated
+                // for all resources in the configuration.)
+                return cty.DynamicVal, diags
+        }
+
+        // Break out early during validation, because resource may not be expanded
+        // yet and indexed references may show up as invalid.
+        if d.Operation == walkValidate {
+                return cty.DynamicVal, diags
+        }
+
+        schema := d.getResourceSchema(addr.ContainingResource(), rs.ProviderConfig)
+
+        // If we are able to automatically convert to the "right" type of instance
+        // key for this each mode then we'll do so, to match with how we generally
+        // treat values elsewhere in the language. This allows code below to
+        // assume that any possible conversions have already been dealt with and
+        // just worry about validation.
+        key := d.coerceInstanceKey(addr.Key, rs.EachMode)
+
+        multi := false
+
+        switch rs.EachMode {
+        case states.NoEach:
+                if key != addrs.NoKey {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource index",
+                                Detail:   fmt.Sprintf("Resource %s does not have either \"count\" or \"for_each\" set, so it cannot be indexed.", addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        case states.EachList:
+                multi = key == addrs.NoKey
+                if _, ok := addr.Key.(addrs.IntKey); !multi && !ok {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource index",
+                                Detail:   fmt.Sprintf("Resource %s must be indexed with a number value.", addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        case states.EachMap:
+                multi = key == addrs.NoKey
+                if _, ok := addr.Key.(addrs.IntKey); !multi && !ok {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource index",
+                                Detail:   fmt.Sprintf("Resource %s must be indexed with a string value.", addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        }
+
+        if !multi {
+                log.Printf("[TRACE] GetResourceInstance: %s is a single instance", addr)
+                is := rs.Instance(key)
+                if is == nil {
+                        return cty.UnknownVal(schema.ImpliedType()), diags
+                }
+                return d.getResourceInstanceSingle(addr, rng, is, config, rs.ProviderConfig)
+        }
+
+        log.Printf("[TRACE] GetResourceInstance: %s has multiple keyed instances", addr)
+        return d.getResourceInstancesAll(addr.ContainingResource(), rng, config, rs, rs.ProviderConfig)
+}
+
+func (d *evaluationStateData) getResourceInstanceSingle(addr addrs.ResourceInstance, rng tfdiags.SourceRange, is *states.ResourceInstance, config *configs.Resource, providerAddr addrs.AbsProviderConfig) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        schema := d.getResourceSchema(addr.ContainingResource(), providerAddr)
+        if schema == nil {
+                // This shouldn't happen, since validation before we get here should've
+                // taken care of it, but we'll show a reasonable error message anyway.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource type schema`,
+                        Detail:   fmt.Sprintf("No schema is available for %s in %s. This is a bug in Terraform and should be reported.", addr, providerAddr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        ty := schema.ImpliedType()
+        if is == nil || is.Current == nil {
+                // Assume we're dealing with an instance that hasn't been created yet.
+                return cty.UnknownVal(ty), diags
+        }
+
+        if is.Current.Status == states.ObjectPlanned {
+                // If there's a pending change for this instance in our plan, we'll prefer
+                // that. This is important because the state can't represent unknown values
+                // and so its data is inaccurate when changes are pending.
+                if change := d.Evaluator.Changes.GetResourceInstanceChange(addr.Absolute(d.ModulePath), states.CurrentGen); change != nil {
+                        val, err := change.After.Decode(ty)
+                        if err != nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid resource instance data in plan",
+                                        Detail:   fmt.Sprintf("Instance %s data could not be decoded from the plan: %s.", addr.Absolute(d.ModulePath), err),
+                                        Subject:  &config.DeclRange,
+                                })
+                                return cty.UnknownVal(ty), diags
+                        }
+                        return val, diags
+                } else {
+                        // If the object is in planned status then we should not
+                        // get here, since we should've found a pending value
+                        // in the plan above instead.
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing pending object in plan",
+                                Detail:   fmt.Sprintf("Instance %s is marked as having a change pending but that change is not recorded in the plan. This is a bug in Terraform; please report it.", addr),
+                                Subject:  &config.DeclRange,
+                        })
+                        return cty.UnknownVal(ty), diags
+                }
+        }
+
+        ios, err := is.Current.Decode(ty)
+        if err != nil {
+                // This shouldn't happen, since by the time we get here
+                // we should've upgraded the state data already.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid resource instance data in state",
+                        Detail:   fmt.Sprintf("Instance %s data could not be decoded from the state: %s.", addr.Absolute(d.ModulePath), err),
+                        Subject:  &config.DeclRange,
+                })
+                return cty.UnknownVal(ty), diags
+        }
+
+        return ios.Value, diags
+}
+
+func (d *evaluationStateData) getResourceInstancesAll(addr addrs.Resource, rng tfdiags.SourceRange, config *configs.Resource, rs *states.Resource, providerAddr addrs.AbsProviderConfig) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        schema := d.getResourceSchema(addr, providerAddr)
+        if schema == nil {
+                // This shouldn't happen, since validation before we get here should've
+                // taken care of it, but we'll show a reasonable error message anyway.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource type schema`,
+                        Detail:   fmt.Sprintf("No schema is available for %s in %s. This is a bug in Terraform and should be reported.", addr, providerAddr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        switch rs.EachMode {
+
+        case states.EachList:
+                // We need to infer the length of our resulting tuple by searching
+                // for the max IntKey in our instances map.
+                length := 0
+                for k := range rs.Instances {
+                        if ik, ok := k.(addrs.IntKey); ok {
+                                if int(ik) >= length {
+                                        length = int(ik) + 1
+                                }
+                        }
+                }
+
+                vals := make([]cty.Value, length)
+                for i := 0; i < length; i++ {
+                        ty := schema.ImpliedType()
+                        key := addrs.IntKey(i)
+                        is, exists := rs.Instances[key]
+                        if exists {
+                                instAddr := addr.Instance(key).Absolute(d.ModulePath)
+
+                                // Prefer pending value in plan if present. See getResourceInstanceSingle
+                                // comment for the rationale.
+                                if is.Current.Status == states.ObjectPlanned {
+                                        if change := d.Evaluator.Changes.GetResourceInstanceChange(instAddr, states.CurrentGen); change != nil {
+                                                val, err := change.After.Decode(ty)
+                                                if err != nil {
+                                                        diags = diags.Append(&hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Invalid resource instance data in plan",
+                                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the plan: %s.", instAddr, err),
+                                                                Subject:  &config.DeclRange,
+                                                        })
+                                                        continue
+                                                }
+                                                vals[i] = val
+                                                continue
+                                        } else {
+                                                // If the object is in planned status then we should not
+                                                // get here, since we should've found a pending value
+                                                // in the plan above instead.
+                                                diags = diags.Append(&hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Missing pending object in plan",
+                                                        Detail:   fmt.Sprintf("Instance %s is marked as having a change pending but that change is not recorded in the plan. This is a bug in Terraform; please report it.", instAddr),
+                                                        Subject:  &config.DeclRange,
+                                                })
+                                                continue
+                                        }
+                                }
+
+                                ios, err := is.Current.Decode(ty)
+                                if err != nil {
+                                        // This shouldn't happen, since by the time we get here
+                                        // we should've upgraded the state data already.
+                                        diags = diags.Append(&hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid resource instance data in state",
+                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the state: %s.", instAddr, err),
+                                                Subject:  &config.DeclRange,
+                                        })
+                                        continue
+                                }
+                                vals[i] = ios.Value
+                        } else {
+                                // There shouldn't normally be "gaps" in our list but we'll
+                                // allow it under the assumption that we're in a weird situation
+                                // where e.g. someone has run "terraform state mv" to reorder
+                                // a list and left a hole behind.
+                                vals[i] = cty.UnknownVal(schema.ImpliedType())
+                        }
+                }
+
+                // We use a tuple rather than a list here because resource schemas may
+                // include dynamically-typed attributes, which will then cause each
+                // instance to potentially have a different runtime type even though
+                // they all conform to the static schema.
+                return cty.TupleVal(vals), diags
+
+        case states.EachMap:
+                ty := schema.ImpliedType()
+                vals := make(map[string]cty.Value, len(rs.Instances))
+                for k, is := range rs.Instances {
+                        if sk, ok := k.(addrs.StringKey); ok {
+                                instAddr := addr.Instance(k).Absolute(d.ModulePath)
+
+                                // Prefer pending value in plan if present. See getResourceInstanceSingle
+                                // comment for the rationale.
+                                // Prefer pending value in plan if present. See getResourceInstanceSingle
+                                // comment for the rationale.
+                                if is.Current.Status == states.ObjectPlanned {
+                                        if change := d.Evaluator.Changes.GetResourceInstanceChange(instAddr, states.CurrentGen); change != nil {
+                                                val, err := change.After.Decode(ty)
+                                                if err != nil {
+                                                        diags = diags.Append(&hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Invalid resource instance data in plan",
+                                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the plan: %s.", instAddr, err),
+                                                                Subject:  &config.DeclRange,
+                                                        })
+                                                        continue
+                                                }
+                                                vals[string(sk)] = val
+                                                continue
+                                        } else {
+                                                // If the object is in planned status then we should not
+                                                // get here, since we should've found a pending value
+                                                // in the plan above instead.
+                                                diags = diags.Append(&hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Missing pending object in plan",
+                                                        Detail:   fmt.Sprintf("Instance %s is marked as having a change pending but that change is not recorded in the plan. This is a bug in Terraform; please report it.", instAddr),
+                                                        Subject:  &config.DeclRange,
+                                                })
+                                                continue
+                                        }
+                                }
+
+                                ios, err := is.Current.Decode(ty)
+                                if err != nil {
+                                        // This shouldn't happen, since by the time we get here
+                                        // we should've upgraded the state data already.
+                                        diags = diags.Append(&hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid resource instance data in state",
+                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the state: %s.", instAddr, err),
+                                                Subject:  &config.DeclRange,
+                                        })
+                                        continue
+                                }
+                                vals[string(sk)] = ios.Value
+                        }
+                }
+
+                // We use an object rather than a map here because resource schemas may
+                // include dynamically-typed attributes, which will then cause each
+                // instance to potentially have a different runtime type even though
+                // they all conform to the static schema.
+                return cty.ObjectVal(vals), diags
+
+        default:
+                // Should never happen since caller should deal with other modes
+                panic(fmt.Sprintf("unsupported EachMode %s", rs.EachMode))
+        }
+}
+
+func (d *evaluationStateData) getResourceSchema(addr addrs.Resource, providerAddr addrs.AbsProviderConfig) *configschema.Block {
+        providerType := providerAddr.ProviderConfig.Type
+        schemas := d.Evaluator.Schemas
+        schema, _ := schemas.ResourceTypeConfig(providerType, addr.Mode, addr.Type)
+        return schema
+}
+
+// coerceInstanceKey attempts to convert the given key to the type expected
+// for the given EachMode.
+//
+// If the key is already of the correct type or if it cannot be converted then
+// it is returned verbatim. If conversion is required and possible, the
+// converted value is returned. Callers should not try to determine if
+// conversion was possible, should instead just check if the result is of
+// the expected type.
+func (d *evaluationStateData) coerceInstanceKey(key addrs.InstanceKey, mode states.EachMode) addrs.InstanceKey {
+        if key == addrs.NoKey {
+                // An absent key can't be converted
+                return key
+        }
+
+        switch mode {
+        case states.NoEach:
+                // No conversions possible at all
+                return key
+        case states.EachMap:
+                if intKey, isInt := key.(addrs.IntKey); isInt {
+                        return addrs.StringKey(strconv.Itoa(int(intKey)))
+                }
+                return key
+        case states.EachList:
+                if strKey, isStr := key.(addrs.StringKey); isStr {
+                        i, err := strconv.Atoi(string(strKey))
+                        if err != nil {
+                                return key
+                        }
+                        return addrs.IntKey(i)
+                }
+                return key
+        default:
+                return key
+        }
+}
+
+func (d *evaluationStateData) GetTerraformAttr(addr addrs.TerraformAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        switch addr.Name {
+
+        case "workspace":
+                workspaceName := d.Evaluator.Meta.Env
+                return cty.StringVal(workspaceName), diags
+
+        case "env":
+                // Prior to Terraform 0.12 there was an attribute "env", which was
+                // an alias name for "workspace". This was deprecated and is now
+                // removed.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "terraform" attribute`,
+                        Detail:   `The terraform.env attribute was deprecated in v0.10 and removed in v0.12. The "state environment" concept was rename to "workspace" in v0.12, and so the workspace name can now be accessed using the terraform.workspace attribute.`,
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "terraform" attribute`,
+                        Detail:   fmt.Sprintf(`The "terraform" object does not have an attribute named %q. The only supported attribute is terraform.workspace, the name of the currently-selected workspace.`, addr.Name),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+}
+
+// nameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func nameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
+
+// moduleDisplayAddr returns a string describing the given module instance
+// address that is appropriate for returning to users in situations where the
+// root module is possible. Specifically, it returns "the root module" if the
+// root module instance is given, or a string representation of the module
+// address otherwise.
+func moduleDisplayAddr(addr addrs.ModuleInstance) string {
+        switch {
+        case addr.IsRoot():
+                return "the root module"
+        default:
+                return addr.String()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaluate_valid.go b/vendor/github.com/hashicorp/terraform/terraform/evaluate_valid.go
new file mode 100644
index 0000000..4255102
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaluate_valid.go
@@ -0,0 +1,299 @@
+package terraform
+
+import (
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/helper/didyoumean"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// StaticValidateReferences checks the given references against schemas and
+// other statically-checkable rules, producing error diagnostics if any
+// problems are found.
+//
+// If this method returns errors for a particular reference then evaluating
+// that reference is likely to generate a very similar error, so callers should
+// not run this method and then also evaluate the source expression(s) and
+// merge the two sets of diagnostics together, since this will result in
+// confusing redundant errors.
+//
+// This method can find more errors than can be found by evaluating an
+// expression with a partially-populated scope, since it checks the referenced
+// names directly against the schema rather than relying on evaluation errors.
+//
+// The result may include warning diagnostics if, for example, deprecated
+// features are referenced.
+func (d *evaluationStateData) StaticValidateReferences(refs []*addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        for _, ref := range refs {
+                moreDiags := d.staticValidateReference(ref, self)
+                diags = diags.Append(moreDiags)
+        }
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateReference(ref *addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics {
+        modCfg := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+        if modCfg == nil {
+                // This is a bug in the caller rather than a problem with the
+                // reference, but rather than crashing out here in an unhelpful way
+                // we'll just ignore it and trust a different layer to catch it.
+                return nil
+        }
+
+        if ref.Subject == addrs.Self {
+                // The "self" address is a special alias for the address given as
+                // our self parameter here, if present.
+                if self == nil {
+                        var diags tfdiags.Diagnostics
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Invalid "self" reference`,
+                                // This detail message mentions some current practice that
+                                // this codepath doesn't really "know about". If the "self"
+                                // object starts being supported in more contexts later then
+                                // we'll need to adjust this message.
+                                Detail:  `The "self" object is not available in this context. This object can be used only in resource provisioner and connection blocks.`,
+                                Subject: ref.SourceRange.ToHCL().Ptr(),
+                        })
+                        return diags
+                }
+
+                synthRef := *ref // shallow copy
+                synthRef.Subject = self
+                ref = &synthRef
+        }
+
+        switch addr := ref.Subject.(type) {
+
+        // For static validation we validate both resource and resource instance references the same way.
+        // We mostly disregard the index, though we do some simple validation of
+        // its _presence_ in staticValidateSingleResourceReference and
+        // staticValidateMultiResourceReference respectively.
+        case addrs.Resource:
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(d.staticValidateSingleResourceReference(modCfg, addr, ref.Remaining, ref.SourceRange))
+                diags = diags.Append(d.staticValidateResourceReference(modCfg, addr, ref.Remaining, ref.SourceRange))
+                return diags
+        case addrs.ResourceInstance:
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(d.staticValidateMultiResourceReference(modCfg, addr, ref.Remaining, ref.SourceRange))
+                diags = diags.Append(d.staticValidateResourceReference(modCfg, addr.ContainingResource(), ref.Remaining, ref.SourceRange))
+                return diags
+
+        // We also handle all module call references the same way, disregarding index.
+        case addrs.ModuleCall:
+                return d.staticValidateModuleCallReference(modCfg, addr, ref.Remaining, ref.SourceRange)
+        case addrs.ModuleCallInstance:
+                return d.staticValidateModuleCallReference(modCfg, addr.Call, ref.Remaining, ref.SourceRange)
+        case addrs.ModuleCallOutput:
+                // This one is a funny one because we will take the output name referenced
+                // and use it to fake up a "remaining" that would make sense for the
+                // module call itself, rather than for the specific output, and then
+                // we can just re-use our static module call validation logic.
+                remain := make(hcl.Traversal, len(ref.Remaining)+1)
+                copy(remain[1:], ref.Remaining)
+                remain[0] = hcl.TraverseAttr{
+                        Name: addr.Name,
+
+                        // Using the whole reference as the source range here doesn't exactly
+                        // match how HCL would normally generate an attribute traversal,
+                        // but is close enough for our purposes.
+                        SrcRange: ref.SourceRange.ToHCL(),
+                }
+                return d.staticValidateModuleCallReference(modCfg, addr.Call.Call, remain, ref.SourceRange)
+
+        default:
+                // Anything else we'll just permit through without any static validation
+                // and let it be caught during dynamic evaluation, in evaluate.go .
+                return nil
+        }
+}
+
+func (d *evaluationStateData) staticValidateSingleResourceReference(modCfg *configs.Config, addr addrs.Resource, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        // If we have at least one step in "remain" and this resource has
+        // "count" set then we know for sure this in invalid because we have
+        // something like:
+        //     aws_instance.foo.bar
+        // ...when we really need
+        //     aws_instance.foo[count.index].bar
+
+        // It is _not_ safe to do this check when remain is empty, because that
+        // would also match aws_instance.foo[count.index].bar due to `count.index`
+        // not being statically-resolvable as part of a reference, and match
+        // direct references to the whole aws_instance.foo tuple.
+        if len(remain) == 0 {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+
+        cfg := modCfg.Module.ResourceByAddr(addr)
+        if cfg == nil {
+                // We'll just bail out here and catch this in our subsequent call to
+                // staticValidateResourceReference, then.
+                return diags
+        }
+
+        if cfg.Count != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource instance key`,
+                        Detail:   fmt.Sprintf("Because %s has \"count\" set, its attributes must be accessed on specific instances.\n\nFor example, to correlate with indices of a referring resource, use:\n    %s[count.index]", addr, addr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+        }
+        if cfg.ForEach != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource instance key`,
+                        Detail:   fmt.Sprintf("Because %s has \"for_each\" set, its attributes must be accessed on specific instances.\n\nFor example, to correlate with indices of a referring resource, use:\n    %s[each.key]", addr, addr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+        }
+
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateMultiResourceReference(modCfg *configs.Config, addr addrs.ResourceInstance, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        cfg := modCfg.Module.ResourceByAddr(addr.ContainingResource())
+        if cfg == nil {
+                // We'll just bail out here and catch this in our subsequent call to
+                // staticValidateResourceReference, then.
+                return diags
+        }
+
+        if addr.Key == addrs.NoKey {
+                // This is a different path into staticValidateSingleResourceReference
+                return d.staticValidateSingleResourceReference(modCfg, addr.ContainingResource(), remain, rng)
+        } else {
+                if cfg.Count == nil && cfg.ForEach == nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Unexpected resource instance key`,
+                                Detail:   fmt.Sprintf(`Because %s does not have "count" or "for_each" set, references to it must not include an index key. Remove the bracketed index to refer to the single instance of this resource.`, addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                }
+        }
+
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateResourceReference(modCfg *configs.Config, addr addrs.Resource, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        var modeAdjective string
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                modeAdjective = "managed"
+        case addrs.DataResourceMode:
+                modeAdjective = "data"
+        default:
+                // should never happen
+                modeAdjective = "<invalid-mode>"
+        }
+
+        cfg := modCfg.Module.ResourceByAddr(addr)
+        if cfg == nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared resource`,
+                        Detail:   fmt.Sprintf(`A %s resource %q %q has not been declared in %s.`, modeAdjective, addr.Type, addr.Name, moduleConfigDisplayAddr(modCfg.Path)),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return diags
+        }
+
+        // Normally accessing this directly is wrong because it doesn't take into
+        // account provider inheritance, etc but it's okay here because we're only
+        // paying attention to the type anyway.
+        providerType := cfg.ProviderConfigAddr().Type
+        schema, _ := d.Evaluator.Schemas.ResourceTypeConfig(providerType, addr.Mode, addr.Type)
+
+        if schema == nil {
+                // Prior validation should've taken care of a resource block with an
+                // unsupported type, so we should never get here but we'll handle it
+                // here anyway for robustness.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid resource type`,
+                        Detail:   fmt.Sprintf(`A %s resource type %q is not supported by provider %q.`, modeAdjective, addr.Type, providerType),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return diags
+        }
+
+        // As a special case we'll detect attempts to access an attribute called
+        // "count" and produce a special error for it, since versions of Terraform
+        // prior to v0.12 offered this as a weird special case that we can no
+        // longer support.
+        if len(remain) > 0 {
+                if step, ok := remain[0].(hcl.TraverseAttr); ok && step.Name == "count" {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Invalid resource count attribute`,
+                                Detail:   fmt.Sprintf(`The special "count" attribute is no longer supported after Terraform v0.12. Instead, use length(%s) to count resource instances.`, addr),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return diags
+                }
+        }
+
+        // If we got this far then we'll try to validate the remaining traversal
+        // steps against our schema.
+        moreDiags := schema.StaticValidateTraversal(remain)
+        diags = diags.Append(moreDiags)
+
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateModuleCallReference(modCfg *configs.Config, addr addrs.ModuleCall, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        // For now, our focus here is just in testing that the referenced module
+        // call exists. All other validation is deferred until evaluation time.
+        _, exists := modCfg.Module.ModuleCalls[addr.Name]
+        if !exists {
+                var suggestions []string
+                for name := range modCfg.Module.ModuleCalls {
+                        suggestions = append(suggestions, name)
+                }
+                sort.Strings(suggestions)
+                suggestion := didyoumean.NameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared module`,
+                        Detail:   fmt.Sprintf(`No module call named %q is declared in %s.%s`, addr.Name, moduleConfigDisplayAddr(modCfg.Path), suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return diags
+        }
+
+        return diags
+}
+
+// moduleConfigDisplayAddr returns a string describing the given module
+// address that is appropriate for returning to users in situations where the
+// root module is possible. Specifically, it returns "the root module" if the
+// root module instance is given, or a string representation of the module
+// address otherwise.
+func moduleConfigDisplayAddr(addr addrs.Module) string {
+        switch {
+        case addr.IsRoot():
+                return "the root module"
+        default:
+                return addr.String()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph.go b/vendor/github.com/hashicorp/terraform/terraform/graph.go
index 735ec4e..58d45a7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph.go
@@ -3,17 +3,13 @@ package terraform
 import (
         "fmt"
         "log"
-        "runtime/debug"
-        "strings"
 
-        "github.com/hashicorp/terraform/dag"
-)
+        "github.com/hashicorp/terraform/tfdiags"
 
-// RootModuleName is the name given to the root module implicitly.
-const RootModuleName = "root"
+        "github.com/hashicorp/terraform/addrs"
 
-// RootModulePath is the path for the root module.
-var RootModulePath = []string{RootModuleName}
+        "github.com/hashicorp/terraform/dag"
+)
 
 // Graph represents the graph that Terraform uses to represent resources
 // and their dependencies.
@@ -23,9 +19,7 @@ type Graph struct {
         dag.AcyclicGraph
 
         // Path is the path in the module tree that this Graph represents.
-        // The root is represented by a single element list containing
-        // RootModuleName
-        Path []string
+        Path addrs.ModuleInstance
 
         // debugName is a name for reference in the debug output. This is usually
         // to indicate what topmost builder was, and if this graph is a shadow or
@@ -40,71 +34,42 @@ func (g *Graph) DirectedGraph() dag.Grapher {
 // Walk walks the graph with the given walker for callbacks. The graph
 // will be walked with full parallelism, so the walker should expect
 // to be called in concurrently.
-func (g *Graph) Walk(walker GraphWalker) error {
+func (g *Graph) Walk(walker GraphWalker) tfdiags.Diagnostics {
         return g.walk(walker)
 }
 
-func (g *Graph) walk(walker GraphWalker) error {
+func (g *Graph) walk(walker GraphWalker) tfdiags.Diagnostics {
         // The callbacks for enter/exiting a graph
         ctx := walker.EnterPath(g.Path)
         defer walker.ExitPath(g.Path)
 
         // Get the path for logs
-        path := strings.Join(ctx.Path(), ".")
-
-        // Determine if our walker is a panic wrapper
-        panicwrap, ok := walker.(GraphWalkerPanicwrapper)
-        if !ok {
-                panicwrap = nil // just to be sure
-        }
+        path := ctx.Path().String()
 
         debugName := "walk-graph.json"
         if g.debugName != "" {
                 debugName = g.debugName + "-" + debugName
         }
 
-        debugBuf := dbug.NewFileWriter(debugName)
-        g.SetDebugWriter(debugBuf)
-        defer debugBuf.Close()
-
         // Walk the graph.
         var walkFn dag.WalkFunc
-        walkFn = func(v dag.Vertex) (rerr error) {
-                log.Printf("[TRACE] vertex '%s.%s': walking", path, dag.VertexName(v))
+        walkFn = func(v dag.Vertex) (diags tfdiags.Diagnostics) {
+                log.Printf("[TRACE] vertex %q: starting visit (%T)", dag.VertexName(v), v)
                 g.DebugVisitInfo(v, g.debugName)
 
-                // If we have a panic wrap GraphWalker and a panic occurs, recover
-                // and call that. We ensure the return value is an error, however,
-                // so that future nodes are not called.
                 defer func() {
-                        // If no panicwrap, do nothing
-                        if panicwrap == nil {
-                                return
-                        }
-
-                        // If no panic, do nothing
-                        err := recover()
-                        if err == nil {
-                                return
-                        }
-
-                        // Modify the return value to show the error
-                        rerr = fmt.Errorf("vertex %q captured panic: %s\n\n%s",
-                                dag.VertexName(v), err, debug.Stack())
-
-                        // Call the panic wrapper
-                        panicwrap.Panic(v, err)
+                        log.Printf("[TRACE] vertex %q: visit complete", dag.VertexName(v))
                 }()
 
                 walker.EnterVertex(v)
-                defer walker.ExitVertex(v, rerr)
+                defer walker.ExitVertex(v, diags)
 
                 // vertexCtx is the context that we use when evaluating. This
                 // is normally the context of our graph but can be overridden
                 // with a GraphNodeSubPath impl.
                 vertexCtx := ctx
                 if pn, ok := v.(GraphNodeSubPath); ok && len(pn.Path()) > 0 {
-                        vertexCtx = walker.EnterPath(normalizeModulePath(pn.Path()))
+                        vertexCtx = walker.EnterPath(pn.Path())
                         defer walker.ExitPath(pn.Path())
                 }
 
@@ -112,60 +77,64 @@ func (g *Graph) walk(walker GraphWalker) error {
                 if ev, ok := v.(GraphNodeEvalable); ok {
                         tree := ev.EvalTree()
                         if tree == nil {
-                                panic(fmt.Sprintf(
-                                        "%s.%s (%T): nil eval tree", path, dag.VertexName(v), v))
+                                panic(fmt.Sprintf("%q (%T): nil eval tree", dag.VertexName(v), v))
                         }
 
                         // Allow the walker to change our tree if needed. Eval,
                         // then callback with the output.
-                        log.Printf("[TRACE] vertex '%s.%s': evaluating", path, dag.VertexName(v))
+                        log.Printf("[TRACE] vertex %q: evaluating", dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("evaluating %T(%s)", v, path))
 
                         tree = walker.EnterEvalTree(v, tree)
                         output, err := Eval(tree, vertexCtx)
-                        if rerr = walker.ExitEvalTree(v, output, err); rerr != nil {
+                        diags = diags.Append(walker.ExitEvalTree(v, output, err))
+                        if diags.HasErrors() {
                                 return
                         }
                 }
 
                 // If the node is dynamically expanded, then expand it
                 if ev, ok := v.(GraphNodeDynamicExpandable); ok {
-                        log.Printf(
-                                "[TRACE] vertex '%s.%s': expanding/walking dynamic subgraph",
-                                path,
-                                dag.VertexName(v))
+                        log.Printf("[TRACE] vertex %q: expanding dynamic subgraph", dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("expanding %T(%s)", v, path))
 
                         g, err := ev.DynamicExpand(vertexCtx)
                         if err != nil {
-                                rerr = err
+                                diags = diags.Append(err)
                                 return
                         }
                         if g != nil {
                                 // Walk the subgraph
-                                if rerr = g.walk(walker); rerr != nil {
+                                log.Printf("[TRACE] vertex %q: entering dynamic subgraph", dag.VertexName(v))
+                                subDiags := g.walk(walker)
+                                diags = diags.Append(subDiags)
+                                if subDiags.HasErrors() {
+                                        log.Printf("[TRACE] vertex %q: dynamic subgraph encountered errors", dag.VertexName(v))
                                         return
                                 }
+                                log.Printf("[TRACE] vertex %q: dynamic subgraph completed successfully", dag.VertexName(v))
+                        } else {
+                                log.Printf("[TRACE] vertex %q: produced no dynamic subgraph", dag.VertexName(v))
                         }
                 }
 
                 // If the node has a subgraph, then walk the subgraph
                 if sn, ok := v.(GraphNodeSubgraph); ok {
-                        log.Printf(
-                                "[TRACE] vertex '%s.%s': walking subgraph",
-                                path,
-                                dag.VertexName(v))
+                        log.Printf("[TRACE] vertex %q: entering static subgraph", dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("subgraph: %T(%s)", v, path))
 
-                        if rerr = sn.Subgraph().(*Graph).walk(walker); rerr != nil {
+                        subDiags := sn.Subgraph().(*Graph).walk(walker)
+                        if subDiags.HasErrors() {
+                                log.Printf("[TRACE] vertex %q: static subgraph encountered errors", dag.VertexName(v))
                                 return
                         }
+                        log.Printf("[TRACE] vertex %q: static subgraph completed successfully", dag.VertexName(v))
                 }
 
-                return nil
+                return
         }
 
         return g.AcyclicGraph.Walk(walkFn)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go
index 6374bb9..66b21f3 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go
@@ -4,6 +4,10 @@ import (
         "fmt"
         "log"
         "strings"
+
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
 // GraphBuilder is an interface that can be implemented and used with
@@ -12,7 +16,7 @@ type GraphBuilder interface {
         // Build builds the graph for the given module path. It is up to
         // the interface implementation whether this build should expand
         // the graph or not.
-        Build(path []string) (*Graph, error)
+        Build(addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics)
 }
 
 // BasicGraphBuilder is a GraphBuilder that builds a graph out of a
@@ -25,21 +29,16 @@ type BasicGraphBuilder struct {
         Name string
 }
 
-func (b *BasicGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *BasicGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
         g := &Graph{Path: path}
 
-        debugName := "graph.json"
-        if b.Name != "" {
-                debugName = b.Name + "-" + debugName
-        }
-        debugBuf := dbug.NewFileWriter(debugName)
-        g.SetDebugWriter(debugBuf)
-        defer debugBuf.Close()
-
+        var lastStepStr string
         for _, step := range b.Steps {
                 if step == nil {
                         continue
                 }
+                log.Printf("[TRACE] Executing graph transform %T", step)
 
                 stepName := fmt.Sprintf("%T", step)
                 dot := strings.LastIndex(stepName, ".")
@@ -56,12 +55,20 @@ func (b *BasicGraphBuilder) Build(path []string) (*Graph, error) {
                 }
                 debugOp.End(errMsg)
 
-                log.Printf(
-                        "[TRACE] Graph after step %T:\n\n%s",
-                        step, g.StringWithNodeTypes())
+                if thisStepStr := g.StringWithNodeTypes(); thisStepStr != lastStepStr {
+                        log.Printf("[TRACE] Completed graph transform %T with new graph:\n%s------", step, thisStepStr)
+                        lastStepStr = thisStepStr
+                } else {
+                        log.Printf("[TRACE] Completed graph transform %T (no changes)", step)
+                }
 
                 if err != nil {
-                        return g, err
+                        if nf, isNF := err.(tfdiags.NonFatalError); isNF {
+                                diags = diags.Append(nf.Diagnostics)
+                        } else {
+                                diags = diags.Append(err)
+                                return g, diags
+                        }
                 }
         }
 
@@ -69,9 +76,10 @@ func (b *BasicGraphBuilder) Build(path []string) (*Graph, error) {
         if b.Validate {
                 if err := g.Validate(); err != nil {
                         log.Printf("[ERROR] Graph validation failed. Graph:\n\n%s", g.String())
-                        return nil, err
+                        diags = diags.Append(err)
+                        return nil, diags
                 }
         }
 
-        return g, nil
+        return g, diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
index 0c2b233..7182dd7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
@@ -1,8 +1,12 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ApplyGraphBuilder implements GraphBuilder and is responsible for building
@@ -13,26 +17,28 @@ import (
 // that aren't explicitly in the diff. There are other scenarios where the
 // diff can be deviated, so this is just one layer of protection.
 type ApplyGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree that the diff was built from.
+        Config *configs.Config
 
-        // Diff is the diff to apply.
-        Diff *Diff
+        // Changes describes the changes that we need apply.
+        Changes *plans.Changes
 
         // State is the current state
-        State *State
+        State *states.State
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
 
-        // Provisioners is the list of provisioners supported.
-        Provisioners []string
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target. This is only required to make sure
         // unnecessary outputs aren't included in the apply graph. The plan
         // builder successfully handles targeting resources. In the future,
         // outputs should go into the diff so that this is unnecessary.
-        Targets []string
+        Targets []addrs.Targetable
 
         // DisableReduce, if true, will not reduce the graph. Great for testing.
         DisableReduce bool
@@ -45,7 +51,7 @@ type ApplyGraphBuilder struct {
 }
 
 // See GraphBuilder
-func (b *ApplyGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *ApplyGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -68,53 +74,99 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 }
         }
 
+        concreteOrphanResource := func(a *NodeAbstractResource) dag.Vertex {
+                return &NodeDestroyResource{
+                        NodeAbstractResource: a,
+                }
+        }
+
+        concreteResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
+                return &NodeApplyableResourceInstance{
+                        NodeAbstractResourceInstance: a,
+                }
+        }
+
         steps := []GraphTransformer{
-                // Creates all the nodes represented in the diff.
-                &DiffTransformer{
+                // Creates all the resources represented in the config. During apply,
+                // we use this just to ensure that the whole-resource metadata is
+                // updated to reflect things such as whether the count argument is
+                // set in config, or which provider configuration manages each resource.
+                &ConfigTransformer{
                         Concrete: concreteResource,
+                        Config:   b.Config,
+                },
 
-                        Diff:   b.Diff,
-                        Module: b.Module,
-                        State:  b.State,
+                // Creates all the resource instances represented in the diff, along
+                // with dependency edges against the whole-resource nodes added by
+                // ConfigTransformer above.
+                &DiffTransformer{
+                        Concrete: concreteResourceInstance,
+                        State:    b.State,
+                        Changes:  b.Changes,
+                },
+
+                // Creates extra cleanup nodes for any entire resources that are
+                // no longer present in config, so we can make sure we clean up the
+                // leftover empty resource states after the instances have been
+                // destroyed.
+                // (We don't track this particular type of change in the plan because
+                // it's just cleanup of our own state object, and so doesn't effect
+                // any real remote objects or consumable outputs.)
+                &OrphanResourceTransformer{
+                        Concrete: concreteOrphanResource,
+                        Config:   b.Config,
+                        State:    b.State,
                 },
 
                 // Create orphan output nodes
-                &OrphanOutputTransformer{Module: b.Module, State: b.State},
+                &OrphanOutputTransformer{Config: b.Config, State: b.State},
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
 
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
-                // add providers
-                TransformProviders(b.Providers, concreteProvider, b.Module),
-
                 // Destruction ordering
-                &DestroyEdgeTransformer{Module: b.Module, State: b.State},
+                &DestroyEdgeTransformer{
+                        Config:  b.Config,
+                        State:   b.State,
+                        Schemas: b.Schemas,
+                },
                 GraphTransformIf(
                         func() bool { return !b.Destroy },
-                        &CBDEdgeTransformer{Module: b.Module, State: b.State},
+                        &CBDEdgeTransformer{
+                                Config:  b.Config,
+                                State:   b.State,
+                                Schemas: b.Schemas,
+                        },
                 ),
 
                 // Provisioner-related transformations
-                &MissingProvisionerTransformer{Provisioners: b.Provisioners},
+                &MissingProvisionerTransformer{Provisioners: b.Components.ResourceProvisioners()},
                 &ProvisionerTransformer{},
 
                 // Add root variables
-                &RootVariableTransformer{Module: b.Module},
+                &RootVariableTransformer{Config: b.Config},
 
                 // Add the local values
-                &LocalTransformer{Module: b.Module},
+                &LocalTransformer{Config: b.Config},
 
                 // Add the outputs
-                &OutputTransformer{Module: b.Module},
+                &OutputTransformer{Config: b.Config},
 
                 // Add module variables
-                &ModuleVariableTransformer{Module: b.Module},
+                &ModuleVariableTransformer{Config: b.Config},
+
+                // add providers
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
 
                 // Remove modules no longer present in the config
-                &RemovedModuleTransformer{Module: b.Module, State: b.State},
+                &RemovedModuleTransformer{Config: b.Config, State: b.State},
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -135,7 +187,9 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 ),
 
                 // Add the node to fix the state count boundaries
-                &CountBoundaryTransformer{},
+                &CountBoundaryTransformer{
+                        Config: b.Config,
+                },
 
                 // Target
                 &TargetsTransformer{Targets: b.Targets},
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go
index 014b348..a6047a9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go
@@ -1,8 +1,11 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // DestroyPlanGraphBuilder implements GraphBuilder and is responsible for
@@ -11,21 +14,29 @@ import (
 // Planning a pure destroy operation is simple because we can ignore most
 // ordering configuration and simply reverse the state.
 type DestroyPlanGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree to build the plan from.
+        Config *configs.Config
 
         // State is the current state
-        State *State
+        State *states.State
+
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
+
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target
-        Targets []string
+        Targets []addrs.Targetable
 
         // Validate will do structural validation of the graph.
         Validate bool
 }
 
 // See GraphBuilder
-func (b *DestroyPlanGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *DestroyPlanGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -35,25 +46,44 @@ func (b *DestroyPlanGraphBuilder) Build(path []string) (*Graph, error) {
 
 // See GraphBuilder
 func (b *DestroyPlanGraphBuilder) Steps() []GraphTransformer {
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
-                return &NodePlanDestroyableResource{
-                        NodeAbstractResource: a,
+        concreteResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
+                return &NodePlanDestroyableResourceInstance{
+                        NodeAbstractResourceInstance: a,
+                }
+        }
+        concreteResourceInstanceDeposed := func(a *NodeAbstractResourceInstance, key states.DeposedKey) dag.Vertex {
+                return &NodePlanDeposedResourceInstanceObject{
+                        NodeAbstractResourceInstance: a,
+                        DeposedKey:                   key,
+                }
+        }
+
+        concreteProvider := func(a *NodeAbstractProvider) dag.Vertex {
+                return &NodeApplyableProvider{
+                        NodeAbstractProvider: a,
                 }
         }
 
         steps := []GraphTransformer{
-                // Creates all the nodes represented in the state.
+                // Creates nodes for the resource instances tracked in the state.
                 &StateTransformer{
-                        Concrete: concreteResource,
-                        State:    b.State,
+                        ConcreteCurrent: concreteResourceInstance,
+                        ConcreteDeposed: concreteResourceInstanceDeposed,
+                        State:           b.State,
                 },
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
 
                 // Destruction ordering. We require this only so that
                 // targeting below will prune the correct things.
-                &DestroyEdgeTransformer{Module: b.Module, State: b.State},
+                &DestroyEdgeTransformer{
+                        Config:  b.Config,
+                        State:   b.State,
+                        Schemas: b.Schemas,
+                },
 
                 // Target. Note we don't set "Destroy: true" here since we already
                 // created proper destroy ordering.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_eval.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_eval.go
new file mode 100644
index 0000000..eb6c897
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_eval.go
@@ -0,0 +1,108 @@
+package terraform
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// EvalGraphBuilder implements GraphBuilder and constructs a graph suitable
+// for evaluating in-memory values (input variables, local values, output
+// values) in the state without any other side-effects.
+//
+// This graph is used only in weird cases, such as the "terraform console"
+// CLI command, where we need to evaluate expressions against the state
+// without taking any other actions.
+//
+// The generated graph will include nodes for providers, resources, etc
+// just to allow indirect dependencies to be resolved, but these nodes will
+// not take any actions themselves since we assume that their parts of the
+// state, if any, are already complete.
+//
+// Although the providers are never configured, they must still be available
+// in order to obtain schema information used for type checking, etc.
+type EvalGraphBuilder struct {
+        // Config is the configuration tree.
+        Config *configs.Config
+
+        // State is the current state
+        State *states.State
+
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
+
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
+}
+
+// See GraphBuilder
+func (b *EvalGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
+        return (&BasicGraphBuilder{
+                Steps:    b.Steps(),
+                Validate: true,
+                Name:     "EvalGraphBuilder",
+        }).Build(path)
+}
+
+// See GraphBuilder
+func (b *EvalGraphBuilder) Steps() []GraphTransformer {
+        concreteProvider := func(a *NodeAbstractProvider) dag.Vertex {
+                return &NodeEvalableProvider{
+                        NodeAbstractProvider: a,
+                }
+        }
+
+        steps := []GraphTransformer{
+                // Creates all the data resources that aren't in the state. This will also
+                // add any orphans from scaling in as destroy nodes.
+                &ConfigTransformer{
+                        Concrete: nil, // just use the abstract type
+                        Config:   b.Config,
+                        Unique:   true,
+                },
+
+                // Attach the state
+                &AttachStateTransformer{State: b.State},
+
+                // Attach the configuration to any resources
+                &AttachResourceConfigTransformer{Config: b.Config},
+
+                // Add root variables
+                &RootVariableTransformer{Config: b.Config},
+
+                // Add the local values
+                &LocalTransformer{Config: b.Config},
+
+                // Add the outputs
+                &OutputTransformer{Config: b.Config},
+
+                // Add module variables
+                &ModuleVariableTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
+
+                // Connect so that the references are ready for targeting. We'll
+                // have to connect again later for providers and so on.
+                &ReferenceTransformer{},
+
+                // Although we don't configure providers, we do still start them up
+                // to get their schemas, and so we must shut them down again here.
+                &CloseProviderTransformer{},
+
+                // Single root
+                &RootTransformer{},
+
+                // Remove redundant edges to simplify the graph.
+                &TransitiveReductionTransformer{},
+        }
+
+        return steps
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
index 07a1eaf..7b0e39f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
@@ -1,8 +1,10 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportGraphBuilder implements GraphBuilder and is responsible for building
@@ -12,15 +14,19 @@ type ImportGraphBuilder struct {
         // ImportTargets are the list of resources to import.
         ImportTargets []*ImportTarget
 
-        // Module is the module to add to the graph. See ImportOpts.Module.
-        Module *module.Tree
+        // Module is a configuration to build the graph from. See ImportOpts.Config.
+        Config *configs.Config
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Components is the factory for our available plugin components.
+        Components contextComponentFactory
+
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 }
 
 // Build builds the graph according to the steps returned by Steps.
-func (b *ImportGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *ImportGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: true,
@@ -33,9 +39,9 @@ func (b *ImportGraphBuilder) Build(path []string) (*Graph, error) {
 func (b *ImportGraphBuilder) Steps() []GraphTransformer {
         // Get the module. If we don't have one, we just use an empty tree
         // so that the transform still works but does nothing.
-        mod := b.Module
-        if mod == nil {
-                mod = module.NewEmptyTree()
+        config := b.Config
+        if config == nil {
+                config = configs.NewEmptyConfig()
         }
 
         // Custom factory for creating providers.
@@ -47,16 +53,36 @@ func (b *ImportGraphBuilder) Steps() []GraphTransformer {
 
         steps := []GraphTransformer{
                 // Create all our resources from the configuration and state
-                &ConfigTransformer{Module: mod},
+                &ConfigTransformer{Config: config},
 
                 // Add the import steps
                 &ImportStateTransformer{Targets: b.ImportTargets},
 
-                TransformProviders(b.Providers, concreteProvider, mod),
+                // Add root variables
+                &RootVariableTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, config),
 
                 // This validates that the providers only depend on variables
                 &ImportProviderValidateTransformer{},
 
+                // Add the local values
+                &LocalTransformer{Config: b.Config},
+
+                // Add the outputs
+                &OutputTransformer{Config: b.Config},
+
+                // Add module variables
+                &ModuleVariableTransformer{Config: b.Config},
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
+
+                // Connect so that the references are ready for targeting. We'll
+                // have to connect again later for providers and so on.
+                &ReferenceTransformer{},
+
                 // Close opened plugin connections
                 &CloseProviderTransformer{},
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_input.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_input.go
deleted file mode 100644
index 0df48cd..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_input.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package terraform
-
-import (
-        "github.com/hashicorp/terraform/dag"
-)
-
-// InputGraphBuilder creates the graph for the input operation.
-//
-// Unlike other graph builders, this is a function since it currently modifies
-// and is based on the PlanGraphBuilder. The PlanGraphBuilder passed in will be
-// modified and should not be used for any other operations.
-func InputGraphBuilder(p *PlanGraphBuilder) GraphBuilder {
-        // We're going to customize the concrete functions
-        p.CustomConcrete = true
-
-        // Set the provider to the normal provider. This will ask for input.
-        p.ConcreteProvider = func(a *NodeAbstractProvider) dag.Vertex {
-                return &NodeApplyableProvider{
-                        NodeAbstractProvider: a,
-                }
-        }
-
-        // We purposely don't set any more concrete fields since the remainder
-        // should be no-ops.
-
-        return p
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
index f8dd0fc..17adfd2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
@@ -3,8 +3,11 @@ package terraform
 import (
         "sync"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // PlanGraphBuilder implements GraphBuilder and is responsible for building
@@ -19,20 +22,22 @@ import (
 //     create-before-destroy can be completely ignored.
 //
 type PlanGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree to build a plan from.
+        Config *configs.Config
 
         // State is the current state
-        State *State
+        State *states.State
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
 
-        // Provisioners is the list of provisioners supported.
-        Provisioners []string
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target
-        Targets []string
+        Targets []addrs.Targetable
 
         // DisableReduce, if true, will not reduce the graph. Great for testing.
         DisableReduce bool
@@ -46,13 +51,13 @@ type PlanGraphBuilder struct {
         CustomConcrete         bool
         ConcreteProvider       ConcreteProviderNodeFunc
         ConcreteResource       ConcreteResourceNodeFunc
-        ConcreteResourceOrphan ConcreteResourceNodeFunc
+        ConcreteResourceOrphan ConcreteResourceInstanceNodeFunc
 
         once sync.Once
 }
 
 // See GraphBuilder
-func (b *PlanGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *PlanGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -64,66 +69,82 @@ func (b *PlanGraphBuilder) Build(path []string) (*Graph, error) {
 func (b *PlanGraphBuilder) Steps() []GraphTransformer {
         b.once.Do(b.init)
 
+        concreteResourceInstanceDeposed := func(a *NodeAbstractResourceInstance, key states.DeposedKey) dag.Vertex {
+                return &NodePlanDeposedResourceInstanceObject{
+                        NodeAbstractResourceInstance: a,
+                        DeposedKey:                   key,
+                }
+        }
+
         steps := []GraphTransformer{
                 // Creates all the resources represented in the config
                 &ConfigTransformer{
                         Concrete: b.ConcreteResource,
-                        Module:   b.Module,
+                        Config:   b.Config,
                 },
 
                 // Add the local values
-                &LocalTransformer{Module: b.Module},
+                &LocalTransformer{Config: b.Config},
 
                 // Add the outputs
-                &OutputTransformer{Module: b.Module},
+                &OutputTransformer{Config: b.Config},
 
                 // Add orphan resources
-                &OrphanResourceTransformer{
+                &OrphanResourceInstanceTransformer{
                         Concrete: b.ConcreteResourceOrphan,
                         State:    b.State,
-                        Module:   b.Module,
+                        Config:   b.Config,
+                },
+
+                // We also need nodes for any deposed instance objects present in the
+                // state, so we can plan to destroy them. (This intentionally
+                // skips creating nodes for _current_ objects, since ConfigTransformer
+                // created nodes that will do that during DynamicExpand.)
+                &StateTransformer{
+                        ConcreteDeposed: concreteResourceInstanceDeposed,
+                        State:           b.State,
                 },
 
                 // Create orphan output nodes
                 &OrphanOutputTransformer{
-                        Module: b.Module,
+                        Config: b.Config,
                         State:  b.State,
                 },
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
 
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
                 // Add root variables
-                &RootVariableTransformer{Module: b.Module},
-
-                TransformProviders(b.Providers, b.ConcreteProvider, b.Module),
+                &RootVariableTransformer{Config: b.Config},
 
-                // Provisioner-related transformations. Only add these if requested.
-                GraphTransformIf(
-                        func() bool { return b.Provisioners != nil },
-                        GraphTransformMulti(
-                                &MissingProvisionerTransformer{Provisioners: b.Provisioners},
-                                &ProvisionerTransformer{},
-                        ),
-                ),
+                &MissingProvisionerTransformer{Provisioners: b.Components.ResourceProvisioners()},
+                &ProvisionerTransformer{},
 
                 // Add module variables
                 &ModuleVariableTransformer{
-                        Module: b.Module,
+                        Config: b.Config,
                 },
 
+                TransformProviders(b.Components.ResourceProviders(), b.ConcreteProvider, b.Config),
+
                 // Remove modules no longer present in the config
-                &RemovedModuleTransformer{Module: b.Module, State: b.State},
+                &RemovedModuleTransformer{Config: b.Config, State: b.State},
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
 
                 // Connect so that the references are ready for targeting. We'll
                 // have to connect again later for providers and so on.
                 &ReferenceTransformer{},
 
                 // Add the node to fix the state count boundaries
-                &CountBoundaryTransformer{},
+                &CountBoundaryTransformer{
+                        Config: b.Config,
+                },
 
                 // Target
                 &TargetsTransformer{
@@ -136,6 +157,10 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                         IgnoreIndices: true,
                 },
 
+                // Detect when create_before_destroy must be forced on for a particular
+                // node due to dependency edges, to avoid graph cycles during apply.
+                &ForcedCBDTransformer{},
+
                 // Close opened plugin connections
                 &CloseProviderTransformer{},
                 &CloseProvisionerTransformer{},
@@ -167,15 +192,13 @@ func (b *PlanGraphBuilder) init() {
 
         b.ConcreteResource = func(a *NodeAbstractResource) dag.Vertex {
                 return &NodePlannableResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
-        b.ConcreteResourceOrphan = func(a *NodeAbstractResource) dag.Vertex {
-                return &NodePlannableResourceOrphan{
-                        NodeAbstractResource: a,
+        b.ConcreteResourceOrphan = func(a *NodeAbstractResourceInstance) dag.Vertex {
+                return &NodePlannableResourceInstanceOrphan{
+                        NodeAbstractResourceInstance: a,
                 }
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
index 9638d4c..0342cdb 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
@@ -3,8 +3,11 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -21,17 +24,22 @@ import (
 //     create-before-destroy can be completely ignored.
 //
 type RefreshGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree.
+        Config *configs.Config
+
+        // State is the prior state
+        State *states.State
 
-        // State is the current state
-        State *State
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target
-        Targets []string
+        Targets []addrs.Targetable
 
         // DisableReduce, if true, will not reduce the graph. Great for testing.
         DisableReduce bool
@@ -41,7 +49,7 @@ type RefreshGraphBuilder struct {
 }
 
 // See GraphBuilder
-func (b *RefreshGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *RefreshGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -60,23 +68,27 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
 
         concreteManagedResource := func(a *NodeAbstractResource) dag.Vertex {
                 return &NodeRefreshableManagedResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
-        concreteManagedResourceInstance := func(a *NodeAbstractResource) dag.Vertex {
+        concreteManagedResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 return &NodeRefreshableManagedResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
+                }
+        }
+
+        concreteResourceInstanceDeposed := func(a *NodeAbstractResourceInstance, key states.DeposedKey) dag.Vertex {
+                // The "Plan" node type also handles refreshing behavior.
+                return &NodePlanDeposedResourceInstanceObject{
+                        NodeAbstractResourceInstance: a,
+                        DeposedKey:                   key,
                 }
         }
 
         concreteDataResource := func(a *NodeAbstractResource) dag.Vertex {
                 return &NodeRefreshableDataResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
@@ -88,13 +100,13 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
                         if b.State.HasResources() {
                                 return &ConfigTransformer{
                                         Concrete:   concreteManagedResource,
-                                        Module:     b.Module,
+                                        Config:     b.Config,
                                         Unique:     true,
                                         ModeFilter: true,
-                                        Mode:       config.ManagedResourceMode,
+                                        Mode:       addrs.ManagedResourceMode,
                                 }
                         }
-                        log.Println("[TRACE] No managed resources in state during refresh, skipping managed resource transformer")
+                        log.Println("[TRACE] No managed resources in state during refresh; skipping managed resource transformer")
                         return nil
                 }(),
 
@@ -102,40 +114,53 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
                 // add any orphans from scaling in as destroy nodes.
                 &ConfigTransformer{
                         Concrete:   concreteDataResource,
-                        Module:     b.Module,
+                        Config:     b.Config,
                         Unique:     true,
                         ModeFilter: true,
-                        Mode:       config.DataResourceMode,
+                        Mode:       addrs.DataResourceMode,
                 },
 
                 // Add any fully-orphaned resources from config (ones that have been
                 // removed completely, not ones that are just orphaned due to a scaled-in
                 // count.
-                &OrphanResourceTransformer{
+                &OrphanResourceInstanceTransformer{
                         Concrete: concreteManagedResourceInstance,
                         State:    b.State,
-                        Module:   b.Module,
+                        Config:   b.Config,
+                },
+
+                // We also need nodes for any deposed instance objects present in the
+                // state, so we can check if they still exist. (This intentionally
+                // skips creating nodes for _current_ objects, since ConfigTransformer
+                // created nodes that will do that during DynamicExpand.)
+                &StateTransformer{
+                        ConcreteDeposed: concreteResourceInstanceDeposed,
+                        State:           b.State,
                 },
 
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
 
                 // Add root variables
-                &RootVariableTransformer{Module: b.Module},
-
-                TransformProviders(b.Providers, concreteProvider, b.Module),
+                &RootVariableTransformer{Config: b.Config},
 
                 // Add the local values
-                &LocalTransformer{Module: b.Module},
+                &LocalTransformer{Config: b.Config},
 
                 // Add the outputs
-                &OutputTransformer{Module: b.Module},
+                &OutputTransformer{Config: b.Config},
 
                 // Add module variables
-                &ModuleVariableTransformer{Module: b.Module},
+                &ModuleVariableTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
 
                 // Connect so that the references are ready for targeting. We'll
                 // have to connect again later for providers and so on.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go
index 645ec7b..1881f95 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go
@@ -23,9 +23,7 @@ func ValidateGraphBuilder(p *PlanGraphBuilder) GraphBuilder {
 
         p.ConcreteResource = func(a *NodeAbstractResource) dag.Vertex {
                 return &NodeValidatableResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go b/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go
index 2897eb5..768590f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go
@@ -1,7 +1,11 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/addrs"
+)
+
 // GraphNodeSubPath says that a node is part of a graph with a
 // different path, and the context should be adjusted accordingly.
 type GraphNodeSubPath interface {
-        Path() []string
+        Path() addrs.ModuleInstance
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go
index 34ce6f6..e980e0c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go
@@ -1,60 +1,32 @@
 package terraform
 
 import (
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // GraphWalker is an interface that can be implemented that when used
 // with Graph.Walk will invoke the given callbacks under certain events.
 type GraphWalker interface {
-        EnterPath([]string) EvalContext
-        ExitPath([]string)
+        EnterPath(addrs.ModuleInstance) EvalContext
+        ExitPath(addrs.ModuleInstance)
         EnterVertex(dag.Vertex)
-        ExitVertex(dag.Vertex, error)
+        ExitVertex(dag.Vertex, tfdiags.Diagnostics)
         EnterEvalTree(dag.Vertex, EvalNode) EvalNode
-        ExitEvalTree(dag.Vertex, interface{}, error) error
+        ExitEvalTree(dag.Vertex, interface{}, error) tfdiags.Diagnostics
 }
 
-// GrpahWalkerPanicwrapper can be optionally implemented to catch panics
-// that occur while walking the graph. This is not generally recommended
-// since panics should crash Terraform and result in a bug report. However,
-// this is particularly useful for situations like the shadow graph where
-// you don't ever want to cause a panic.
-type GraphWalkerPanicwrapper interface {
-        GraphWalker
-
-        // Panic is called when a panic occurs. This will halt the panic from
-        // propogating so if the walker wants it to crash still it should panic
-        // again. This is called from within a defer so runtime/debug.Stack can
-        // be used to get the stack trace of the panic.
-        Panic(dag.Vertex, interface{})
-}
-
-// GraphWalkerPanicwrap wraps an existing Graphwalker to wrap and swallow
-// the panics. This doesn't lose the panics since the panics are still
-// returned as errors as part of a graph walk.
-func GraphWalkerPanicwrap(w GraphWalker) GraphWalkerPanicwrapper {
-        return &graphWalkerPanicwrapper{
-                GraphWalker: w,
-        }
-}
-
-type graphWalkerPanicwrapper struct {
-        GraphWalker
-}
-
-func (graphWalkerPanicwrapper) Panic(dag.Vertex, interface{}) {}
-
 // NullGraphWalker is a GraphWalker implementation that does nothing.
 // This can be embedded within other GraphWalker implementations for easily
 // implementing all the required functions.
 type NullGraphWalker struct{}
 
-func (NullGraphWalker) EnterPath([]string) EvalContext                  { return new(MockEvalContext) }
-func (NullGraphWalker) ExitPath([]string)                               {}
+func (NullGraphWalker) EnterPath(addrs.ModuleInstance) EvalContext      { return new(MockEvalContext) }
+func (NullGraphWalker) ExitPath(addrs.ModuleInstance)                   {}
 func (NullGraphWalker) EnterVertex(dag.Vertex)                          {}
-func (NullGraphWalker) ExitVertex(dag.Vertex, error)                    {}
+func (NullGraphWalker) ExitVertex(dag.Vertex, tfdiags.Diagnostics)      {}
 func (NullGraphWalker) EnterEvalTree(v dag.Vertex, n EvalNode) EvalNode { return n }
-func (NullGraphWalker) ExitEvalTree(dag.Vertex, interface{}, error) error {
+func (NullGraphWalker) ExitEvalTree(dag.Vertex, interface{}, error) tfdiags.Diagnostics {
         return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
index 89f376e..03c192a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
@@ -2,12 +2,19 @@ package terraform
 
 import (
         "context"
-        "fmt"
         "log"
         "sync"
 
-        "github.com/hashicorp/errwrap"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ContextGraphWalker is the GraphWalker implementation used with the
@@ -16,54 +23,56 @@ type ContextGraphWalker struct {
         NullGraphWalker
 
         // Configurable values
-        Context     *Context
-        Operation   walkOperation
-        StopContext context.Context
-
-        // Outputs, do not set these. Do not read these while the graph
-        // is being walked.
-        ValidationWarnings []string
-        ValidationErrors   []error
-
-        errorLock           sync.Mutex
-        once                sync.Once
-        contexts            map[string]*BuiltinEvalContext
-        contextLock         sync.Mutex
-        interpolaterVars    map[string]map[string]interface{}
-        interpolaterVarLock sync.Mutex
-        providerCache       map[string]ResourceProvider
-        providerLock        sync.Mutex
-        provisionerCache    map[string]ResourceProvisioner
-        provisionerLock     sync.Mutex
+        Context            *Context
+        State              *states.SyncState  // Used for safe concurrent access to state
+        Changes            *plans.ChangesSync // Used for safe concurrent writes to changes
+        Operation          walkOperation
+        StopContext        context.Context
+        RootVariableValues InputValues
+
+        // This is an output. Do not set this, nor read it while a graph walk
+        // is in progress.
+        NonFatalDiagnostics tfdiags.Diagnostics
+
+        errorLock          sync.Mutex
+        once               sync.Once
+        contexts           map[string]*BuiltinEvalContext
+        contextLock        sync.Mutex
+        variableValues     map[string]map[string]cty.Value
+        variableValuesLock sync.Mutex
+        providerCache      map[string]providers.Interface
+        providerSchemas    map[string]*ProviderSchema
+        providerLock       sync.Mutex
+        provisionerCache   map[string]provisioners.Interface
+        provisionerSchemas map[string]*configschema.Block
+        provisionerLock    sync.Mutex
 }
 
-func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
+func (w *ContextGraphWalker) EnterPath(path addrs.ModuleInstance) EvalContext {
         w.once.Do(w.init)
 
         w.contextLock.Lock()
         defer w.contextLock.Unlock()
 
         // If we already have a context for this path cached, use that
-        key := PathCacheKey(path)
+        key := path.String()
         if ctx, ok := w.contexts[key]; ok {
                 return ctx
         }
 
-        // Setup the variables for this interpolater
-        variables := make(map[string]interface{})
-        if len(path) <= 1 {
-                for k, v := range w.Context.variables {
-                        variables[k] = v
-                }
-        }
-        w.interpolaterVarLock.Lock()
-        if m, ok := w.interpolaterVars[key]; ok {
-                for k, v := range m {
-                        variables[k] = v
-                }
+        // Our evaluator shares some locks with the main context and the walker
+        // so that we can safely run multiple evaluations at once across
+        // different modules.
+        evaluator := &Evaluator{
+                Meta:               w.Context.meta,
+                Config:             w.Context.config,
+                Operation:          w.Operation,
+                State:              w.State,
+                Changes:            w.Changes,
+                Schemas:            w.Context.schemas,
+                VariableValues:     w.variableValues,
+                VariableValuesLock: &w.variableValuesLock,
         }
-        w.interpolaterVars[key] = variables
-        w.interpolaterVarLock.Unlock()
 
         ctx := &BuiltinEvalContext{
                 StopContext:         w.StopContext,
@@ -71,26 +80,17 @@ func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
                 Hooks:               w.Context.hooks,
                 InputValue:          w.Context.uiInput,
                 Components:          w.Context.components,
+                Schemas:             w.Context.schemas,
                 ProviderCache:       w.providerCache,
                 ProviderInputConfig: w.Context.providerInputConfig,
                 ProviderLock:        &w.providerLock,
                 ProvisionerCache:    w.provisionerCache,
                 ProvisionerLock:     &w.provisionerLock,
-                DiffValue:           w.Context.diff,
-                DiffLock:            &w.Context.diffLock,
-                StateValue:          w.Context.state,
-                StateLock:           &w.Context.stateLock,
-                Interpolater: &Interpolater{
-                        Operation:          w.Operation,
-                        Meta:               w.Context.meta,
-                        Module:             w.Context.module,
-                        State:              w.Context.state,
-                        StateLock:          &w.Context.stateLock,
-                        VariableValues:     variables,
-                        VariableValuesLock: &w.interpolaterVarLock,
-                },
-                InterpolaterVars:    w.interpolaterVars,
-                InterpolaterVarLock: &w.interpolaterVarLock,
+                ChangesValue:        w.Changes,
+                StateValue:          w.State,
+                Evaluator:           evaluator,
+                VariableValues:      w.variableValues,
+                VariableValuesLock:  &w.variableValuesLock,
         }
 
         w.contexts[key] = ctx
@@ -98,8 +98,7 @@ func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
 }
 
 func (w *ContextGraphWalker) EnterEvalTree(v dag.Vertex, n EvalNode) EvalNode {
-        log.Printf("[TRACE] [%s] Entering eval tree: %s",
-                w.Operation, dag.VertexName(v))
+        log.Printf("[TRACE] [%s] Entering eval tree: %s", w.Operation, dag.VertexName(v))
 
         // Acquire a lock on the semaphore
         w.Context.parallelSem.Acquire()
@@ -109,10 +108,8 @@ func (w *ContextGraphWalker) EnterEvalTree(v dag.Vertex, n EvalNode) EvalNode {
         return EvalFilter(n, EvalNodeFilterOp(w.Operation))
 }
 
-func (w *ContextGraphWalker) ExitEvalTree(
-        v dag.Vertex, output interface{}, err error) error {
-        log.Printf("[TRACE] [%s] Exiting eval tree: %s",
-                w.Operation, dag.VertexName(v))
+func (w *ContextGraphWalker) ExitEvalTree(v dag.Vertex, output interface{}, err error) tfdiags.Diagnostics {
+        log.Printf("[TRACE] [%s] Exiting eval tree: %s", w.Operation, dag.VertexName(v))
 
         // Release the semaphore
         w.Context.parallelSem.Release()
@@ -125,30 +122,36 @@ func (w *ContextGraphWalker) ExitEvalTree(
         w.errorLock.Lock()
         defer w.errorLock.Unlock()
 
-        // Try to get a validation error out of it. If its not a validation
-        // error, then just record the normal error.
-        verr, ok := err.(*EvalValidateError)
-        if !ok {
-                return err
-        }
-
-        for _, msg := range verr.Warnings {
-                w.ValidationWarnings = append(
-                        w.ValidationWarnings,
-                        fmt.Sprintf("%s: %s", dag.VertexName(v), msg))
-        }
-        for _, e := range verr.Errors {
-                w.ValidationErrors = append(
-                        w.ValidationErrors,
-                        errwrap.Wrapf(fmt.Sprintf("%s: {{err}}", dag.VertexName(v)), e))
+        // If the error is non-fatal then we'll accumulate its diagnostics in our
+        // non-fatal list, rather than returning it directly, so that the graph
+        // walk can continue.
+        if nferr, ok := err.(tfdiags.NonFatalError); ok {
+                log.Printf("[WARN] %s: %s", dag.VertexName(v), nferr)
+                w.NonFatalDiagnostics = w.NonFatalDiagnostics.Append(nferr.Diagnostics)
+                return nil
         }
 
-        return nil
+        // Otherwise, we'll let our usual diagnostics machinery figure out how to
+        // unpack this as one or more diagnostic messages and return that. If we
+        // get down here then the returned diagnostics will contain at least one
+        // error, causing the graph walk to halt.
+        var diags tfdiags.Diagnostics
+        diags = diags.Append(err)
+        return diags
 }
 
 func (w *ContextGraphWalker) init() {
-        w.contexts = make(map[string]*BuiltinEvalContext, 5)
-        w.providerCache = make(map[string]ResourceProvider, 5)
-        w.provisionerCache = make(map[string]ResourceProvisioner, 5)
-        w.interpolaterVars = make(map[string]map[string]interface{}, 5)
+        w.contexts = make(map[string]*BuiltinEvalContext)
+        w.providerCache = make(map[string]providers.Interface)
+        w.providerSchemas = make(map[string]*ProviderSchema)
+        w.provisionerCache = make(map[string]provisioners.Interface)
+        w.provisionerSchemas = make(map[string]*configschema.Block)
+        w.variableValues = make(map[string]map[string]cty.Value)
+
+        // Populate root module variable values. Other modules will be populated
+        // during the graph walk.
+        w.variableValues[""] = make(map[string]cty.Value)
+        for k, iv := range w.RootVariableValues {
+                w.variableValues[""][k] = iv.Value
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go
index 3fb3748..a3756e7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go
@@ -7,7 +7,6 @@ type walkOperation byte
 
 const (
         walkInvalid walkOperation = iota
-        walkInput
         walkApply
         walkPlan
         walkPlanDestroy
@@ -15,4 +14,5 @@ const (
         walkValidate
         walkDestroy
         walkImport
+        walkEval // used just to prepare EvalContext for expression evaluation, with no other actions
 )
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
index 95ef4e9..b51e1a2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
@@ -4,9 +4,23 @@ package terraform
 
 import "strconv"
 
-const _GraphType_name = "GraphTypeInvalidGraphTypeLegacyGraphTypeRefreshGraphTypePlanGraphTypePlanDestroyGraphTypeApplyGraphTypeInputGraphTypeValidate"
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[GraphTypeInvalid-0]
+        _ = x[GraphTypeLegacy-1]
+        _ = x[GraphTypeRefresh-2]
+        _ = x[GraphTypePlan-3]
+        _ = x[GraphTypePlanDestroy-4]
+        _ = x[GraphTypeApply-5]
+        _ = x[GraphTypeValidate-6]
+        _ = x[GraphTypeEval-7]
+}
+
+const _GraphType_name = "GraphTypeInvalidGraphTypeLegacyGraphTypeRefreshGraphTypePlanGraphTypePlanDestroyGraphTypeApplyGraphTypeValidateGraphTypeEval"
 
-var _GraphType_index = [...]uint8{0, 16, 31, 47, 60, 80, 94, 108, 125}
+var _GraphType_index = [...]uint8{0, 16, 31, 47, 60, 80, 94, 111, 124}
 
 func (i GraphType) String() string {
         if i >= GraphType(len(_GraphType_index)-1) {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/hook.go b/vendor/github.com/hashicorp/terraform/terraform/hook.go
index ab11e8e..c0bb23a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/hook.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/hook.go
@@ -1,5 +1,14 @@
 package terraform
 
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
 // HookAction is an enum of actions that can be taken as a result of a hook
 // callback. This allows you to modify the behavior of Terraform at runtime.
 type HookAction byte
@@ -21,42 +30,56 @@ const (
 // NilHook into your struct, which implements all of the interface but does
 // nothing. Then, override only the functions you want to implement.
 type Hook interface {
-        // PreApply and PostApply are called before and after a single
-        // resource is applied. The error argument in PostApply is the
+        // PreApply and PostApply are called before and after an action for a
+        // single instance is applied. The error argument in PostApply is the
         // error, if any, that was returned from the provider Apply call itself.
-        PreApply(*InstanceInfo, *InstanceState, *InstanceDiff) (HookAction, error)
-        PostApply(*InstanceInfo, *InstanceState, error) (HookAction, error)
-
-        // PreDiff and PostDiff are called before and after a single resource
-        // resource is diffed.
-        PreDiff(*InstanceInfo, *InstanceState) (HookAction, error)
-        PostDiff(*InstanceInfo, *InstanceDiff) (HookAction, error)
-
-        // Provisioning hooks
+        PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error)
+        PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error)
+
+        // PreDiff and PostDiff are called before and after a provider is given
+        // the opportunity to customize the proposed new state to produce the
+        // planned new state.
+        PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error)
+        PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error)
+
+        // The provisioning hooks signal both the overall start end end of
+        // provisioning for a particular instance and of each of the individual
+        // configured provisioners for each instance. The sequence of these
+        // for a given instance might look something like this:
         //
-        // All should be self-explanatory. ProvisionOutput is called with
-        // output sent back by the provisioners. This will be called multiple
-        // times as output comes in, but each call should represent a line of
-        // output. The ProvisionOutput method cannot control whether the
-        // hook continues running.
-        PreProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error)
-        PostProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error)
-        PreProvision(*InstanceInfo, string) (HookAction, error)
-        PostProvision(*InstanceInfo, string, error) (HookAction, error)
-        ProvisionOutput(*InstanceInfo, string, string)
+        //          PreProvisionInstance(aws_instance.foo[1], ...)
+        //      PreProvisionInstanceStep(aws_instance.foo[1], "file")
+        //     PostProvisionInstanceStep(aws_instance.foo[1], "file", nil)
+        //      PreProvisionInstanceStep(aws_instance.foo[1], "remote-exec")
+        //               ProvisionOutput(aws_instance.foo[1], "remote-exec", "Installing foo...")
+        //               ProvisionOutput(aws_instance.foo[1], "remote-exec", "Configuring bar...")
+        //     PostProvisionInstanceStep(aws_instance.foo[1], "remote-exec", nil)
+        //         PostProvisionInstance(aws_instance.foo[1], ...)
+        //
+        // ProvisionOutput is called with output sent back by the provisioners.
+        // This will be called multiple times as output comes in, with each call
+        // representing one line of output. It cannot control whether the
+        // provisioner continues running.
+        PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error)
+        PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error)
+        PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error)
+        PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error)
+        ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string)
 
         // PreRefresh and PostRefresh are called before and after a single
         // resource state is refreshed, respectively.
-        PreRefresh(*InstanceInfo, *InstanceState) (HookAction, error)
-        PostRefresh(*InstanceInfo, *InstanceState) (HookAction, error)
-
-        // PostStateUpdate is called after the state is updated.
-        PostStateUpdate(*State) (HookAction, error)
+        PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error)
+        PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error)
 
         // PreImportState and PostImportState are called before and after
-        // a single resource's state is being improted.
-        PreImportState(*InstanceInfo, string) (HookAction, error)
-        PostImportState(*InstanceInfo, []*InstanceState) (HookAction, error)
+        // (respectively) each state import operation for a given resource address.
+        PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error)
+        PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error)
+
+        // PostStateUpdate is called each time the state is updated. It receives
+        // a deep copy of the state, which it may therefore access freely without
+        // any need for locks to protect from concurrent writes from the caller.
+        PostStateUpdate(new *states.State) (HookAction, error)
 }
 
 // NilHook is a Hook implementation that does nothing. It exists only to
@@ -64,59 +87,60 @@ type Hook interface {
 // and only implement the functions you are interested in.
 type NilHook struct{}
 
-func (*NilHook) PreApply(*InstanceInfo, *InstanceState, *InstanceDiff) (HookAction, error) {
+var _ Hook = (*NilHook)(nil)
+
+func (*NilHook) PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostApply(*InstanceInfo, *InstanceState, error) (HookAction, error) {
+func (*NilHook) PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreDiff(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostDiff(*InstanceInfo, *InstanceDiff) (HookAction, error) {
+func (*NilHook) PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreProvision(*InstanceInfo, string) (HookAction, error) {
+func (*NilHook) PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostProvision(*InstanceInfo, string, error) (HookAction, error) {
+func (*NilHook) PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) ProvisionOutput(
-        *InstanceInfo, string, string) {
+func (*NilHook) ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string) {
 }
 
-func (*NilHook) PreRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreImportState(*InstanceInfo, string) (HookAction, error) {
+func (*NilHook) PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostImportState(*InstanceInfo, []*InstanceState) (HookAction, error) {
+func (*NilHook) PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostStateUpdate(*State) (HookAction, error) {
+func (*NilHook) PostStateUpdate(new *states.State) (HookAction, error) {
         return HookActionContinue, nil
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go b/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go
index 0e46400..6efa319 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go
@@ -1,245 +1,274 @@
 package terraform
 
-import "sync"
+import (
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
 
 // MockHook is an implementation of Hook that can be used for tests.
 // It records all of its function calls.
 type MockHook struct {
         sync.Mutex
 
-        PreApplyCalled bool
-        PreApplyInfo   *InstanceInfo
-        PreApplyDiff   *InstanceDiff
-        PreApplyState  *InstanceState
-        PreApplyReturn HookAction
-        PreApplyError  error
+        PreApplyCalled       bool
+        PreApplyAddr         addrs.AbsResourceInstance
+        PreApplyGen          states.Generation
+        PreApplyAction       plans.Action
+        PreApplyPriorState   cty.Value
+        PreApplyPlannedState cty.Value
+        PreApplyReturn       HookAction
+        PreApplyError        error
 
         PostApplyCalled      bool
-        PostApplyInfo        *InstanceInfo
-        PostApplyState       *InstanceState
+        PostApplyAddr        addrs.AbsResourceInstance
+        PostApplyGen         states.Generation
+        PostApplyNewState    cty.Value
         PostApplyError       error
         PostApplyReturn      HookAction
         PostApplyReturnError error
-        PostApplyFn          func(*InstanceInfo, *InstanceState, error) (HookAction, error)
-
-        PreDiffCalled bool
-        PreDiffInfo   *InstanceInfo
-        PreDiffState  *InstanceState
-        PreDiffReturn HookAction
-        PreDiffError  error
-
-        PostDiffCalled bool
-        PostDiffInfo   *InstanceInfo
-        PostDiffDiff   *InstanceDiff
-        PostDiffReturn HookAction
-        PostDiffError  error
-
-        PreProvisionResourceCalled bool
-        PreProvisionResourceInfo   *InstanceInfo
-        PreProvisionInstanceState  *InstanceState
-        PreProvisionResourceReturn HookAction
-        PreProvisionResourceError  error
-
-        PostProvisionResourceCalled bool
-        PostProvisionResourceInfo   *InstanceInfo
-        PostProvisionInstanceState  *InstanceState
-        PostProvisionResourceReturn HookAction
-        PostProvisionResourceError  error
-
-        PreProvisionCalled        bool
-        PreProvisionInfo          *InstanceInfo
-        PreProvisionProvisionerId string
-        PreProvisionReturn        HookAction
-        PreProvisionError         error
-
-        PostProvisionCalled        bool
-        PostProvisionInfo          *InstanceInfo
-        PostProvisionProvisionerId string
-        PostProvisionErrorArg      error
-        PostProvisionReturn        HookAction
-        PostProvisionError         error
-
-        ProvisionOutputCalled        bool
-        ProvisionOutputInfo          *InstanceInfo
-        ProvisionOutputProvisionerId string
-        ProvisionOutputMessage       string
-
-        PostRefreshCalled bool
-        PostRefreshInfo   *InstanceInfo
-        PostRefreshState  *InstanceState
-        PostRefreshReturn HookAction
-        PostRefreshError  error
-
-        PreRefreshCalled bool
-        PreRefreshInfo   *InstanceInfo
-        PreRefreshState  *InstanceState
-        PreRefreshReturn HookAction
-        PreRefreshError  error
+        PostApplyFn          func(addrs.AbsResourceInstance, states.Generation, cty.Value, error) (HookAction, error)
+
+        PreDiffCalled        bool
+        PreDiffAddr          addrs.AbsResourceInstance
+        PreDiffGen           states.Generation
+        PreDiffPriorState    cty.Value
+        PreDiffProposedState cty.Value
+        PreDiffReturn        HookAction
+        PreDiffError         error
+
+        PostDiffCalled       bool
+        PostDiffAddr         addrs.AbsResourceInstance
+        PostDiffGen          states.Generation
+        PostDiffAction       plans.Action
+        PostDiffPriorState   cty.Value
+        PostDiffPlannedState cty.Value
+        PostDiffReturn       HookAction
+        PostDiffError        error
+
+        PreProvisionInstanceCalled bool
+        PreProvisionInstanceAddr   addrs.AbsResourceInstance
+        PreProvisionInstanceState  cty.Value
+        PreProvisionInstanceReturn HookAction
+        PreProvisionInstanceError  error
+
+        PostProvisionInstanceCalled bool
+        PostProvisionInstanceAddr   addrs.AbsResourceInstance
+        PostProvisionInstanceState  cty.Value
+        PostProvisionInstanceReturn HookAction
+        PostProvisionInstanceError  error
+
+        PreProvisionInstanceStepCalled          bool
+        PreProvisionInstanceStepAddr            addrs.AbsResourceInstance
+        PreProvisionInstanceStepProvisionerType string
+        PreProvisionInstanceStepReturn          HookAction
+        PreProvisionInstanceStepError           error
+
+        PostProvisionInstanceStepCalled          bool
+        PostProvisionInstanceStepAddr            addrs.AbsResourceInstance
+        PostProvisionInstanceStepProvisionerType string
+        PostProvisionInstanceStepErrorArg        error
+        PostProvisionInstanceStepReturn          HookAction
+        PostProvisionInstanceStepError           error
+
+        ProvisionOutputCalled          bool
+        ProvisionOutputAddr            addrs.AbsResourceInstance
+        ProvisionOutputProvisionerType string
+        ProvisionOutputMessage         string
+
+        PreRefreshCalled     bool
+        PreRefreshAddr       addrs.AbsResourceInstance
+        PreRefreshGen        states.Generation
+        PreRefreshPriorState cty.Value
+        PreRefreshReturn     HookAction
+        PreRefreshError      error
+
+        PostRefreshCalled     bool
+        PostRefreshAddr       addrs.AbsResourceInstance
+        PostRefreshGen        states.Generation
+        PostRefreshPriorState cty.Value
+        PostRefreshNewState   cty.Value
+        PostRefreshReturn     HookAction
+        PostRefreshError      error
 
         PreImportStateCalled bool
-        PreImportStateInfo   *InstanceInfo
-        PreImportStateId     string
+        PreImportStateAddr   addrs.AbsResourceInstance
+        PreImportStateID     string
         PreImportStateReturn HookAction
         PreImportStateError  error
 
-        PostImportStateCalled bool
-        PostImportStateInfo   *InstanceInfo
-        PostImportStateState  []*InstanceState
-        PostImportStateReturn HookAction
-        PostImportStateError  error
+        PostImportStateCalled    bool
+        PostImportStateAddr      addrs.AbsResourceInstance
+        PostImportStateNewStates []providers.ImportedResource
+        PostImportStateReturn    HookAction
+        PostImportStateError     error
 
         PostStateUpdateCalled bool
-        PostStateUpdateState  *State
+        PostStateUpdateState  *states.State
         PostStateUpdateReturn HookAction
         PostStateUpdateError  error
 }
 
-func (h *MockHook) PreApply(n *InstanceInfo, s *InstanceState, d *InstanceDiff) (HookAction, error) {
+var _ Hook = (*MockHook)(nil)
+
+func (h *MockHook) PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreApplyCalled = true
-        h.PreApplyInfo = n
-        h.PreApplyDiff = d
-        h.PreApplyState = s
+        h.PreApplyAddr = addr
+        h.PreApplyGen = gen
+        h.PreApplyAction = action
+        h.PreApplyPriorState = priorState
+        h.PreApplyPlannedState = plannedNewState
         return h.PreApplyReturn, h.PreApplyError
 }
 
-func (h *MockHook) PostApply(n *InstanceInfo, s *InstanceState, e error) (HookAction, error) {
+func (h *MockHook) PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostApplyCalled = true
-        h.PostApplyInfo = n
-        h.PostApplyState = s
-        h.PostApplyError = e
+        h.PostApplyAddr = addr
+        h.PostApplyGen = gen
+        h.PostApplyNewState = newState
+        h.PostApplyError = err
 
         if h.PostApplyFn != nil {
-                return h.PostApplyFn(n, s, e)
+                return h.PostApplyFn(addr, gen, newState, err)
         }
 
         return h.PostApplyReturn, h.PostApplyReturnError
 }
 
-func (h *MockHook) PreDiff(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreDiffCalled = true
-        h.PreDiffInfo = n
-        h.PreDiffState = s
+        h.PreDiffAddr = addr
+        h.PreDiffGen = gen
+        h.PreDiffPriorState = priorState
+        h.PreDiffProposedState = proposedNewState
         return h.PreDiffReturn, h.PreDiffError
 }
 
-func (h *MockHook) PostDiff(n *InstanceInfo, d *InstanceDiff) (HookAction, error) {
+func (h *MockHook) PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostDiffCalled = true
-        h.PostDiffInfo = n
-        h.PostDiffDiff = d
+        h.PostDiffAddr = addr
+        h.PostDiffGen = gen
+        h.PostDiffAction = action
+        h.PostDiffPriorState = priorState
+        h.PostDiffPlannedState = plannedNewState
         return h.PostDiffReturn, h.PostDiffError
 }
 
-func (h *MockHook) PreProvisionResource(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PreProvisionResourceCalled = true
-        h.PreProvisionResourceInfo = n
-        h.PreProvisionInstanceState = s
-        return h.PreProvisionResourceReturn, h.PreProvisionResourceError
+        h.PreProvisionInstanceCalled = true
+        h.PreProvisionInstanceAddr = addr
+        h.PreProvisionInstanceState = state
+        return h.PreProvisionInstanceReturn, h.PreProvisionInstanceError
 }
 
-func (h *MockHook) PostProvisionResource(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PostProvisionResourceCalled = true
-        h.PostProvisionResourceInfo = n
-        h.PostProvisionInstanceState = s
-        return h.PostProvisionResourceReturn, h.PostProvisionResourceError
+        h.PostProvisionInstanceCalled = true
+        h.PostProvisionInstanceAddr = addr
+        h.PostProvisionInstanceState = state
+        return h.PostProvisionInstanceReturn, h.PostProvisionInstanceError
 }
 
-func (h *MockHook) PreProvision(n *InstanceInfo, provId string) (HookAction, error) {
+func (h *MockHook) PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PreProvisionCalled = true
-        h.PreProvisionInfo = n
-        h.PreProvisionProvisionerId = provId
-        return h.PreProvisionReturn, h.PreProvisionError
+        h.PreProvisionInstanceStepCalled = true
+        h.PreProvisionInstanceStepAddr = addr
+        h.PreProvisionInstanceStepProvisionerType = typeName
+        return h.PreProvisionInstanceStepReturn, h.PreProvisionInstanceStepError
 }
 
-func (h *MockHook) PostProvision(n *InstanceInfo, provId string, err error) (HookAction, error) {
+func (h *MockHook) PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PostProvisionCalled = true
-        h.PostProvisionInfo = n
-        h.PostProvisionProvisionerId = provId
-        h.PostProvisionErrorArg = err
-        return h.PostProvisionReturn, h.PostProvisionError
+        h.PostProvisionInstanceStepCalled = true
+        h.PostProvisionInstanceStepAddr = addr
+        h.PostProvisionInstanceStepProvisionerType = typeName
+        h.PostProvisionInstanceStepErrorArg = err
+        return h.PostProvisionInstanceStepReturn, h.PostProvisionInstanceStepError
 }
 
-func (h *MockHook) ProvisionOutput(
-        n *InstanceInfo,
-        provId string,
-        msg string) {
+func (h *MockHook) ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string) {
         h.Lock()
         defer h.Unlock()
 
         h.ProvisionOutputCalled = true
-        h.ProvisionOutputInfo = n
-        h.ProvisionOutputProvisionerId = provId
-        h.ProvisionOutputMessage = msg
+        h.ProvisionOutputAddr = addr
+        h.ProvisionOutputProvisionerType = typeName
+        h.ProvisionOutputMessage = line
 }
 
-func (h *MockHook) PreRefresh(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreRefreshCalled = true
-        h.PreRefreshInfo = n
-        h.PreRefreshState = s
+        h.PreRefreshAddr = addr
+        h.PreRefreshGen = gen
+        h.PreRefreshPriorState = priorState
         return h.PreRefreshReturn, h.PreRefreshError
 }
 
-func (h *MockHook) PostRefresh(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostRefreshCalled = true
-        h.PostRefreshInfo = n
-        h.PostRefreshState = s
+        h.PostRefreshAddr = addr
+        h.PostRefreshPriorState = priorState
+        h.PostRefreshNewState = newState
         return h.PostRefreshReturn, h.PostRefreshError
 }
 
-func (h *MockHook) PreImportState(info *InstanceInfo, id string) (HookAction, error) {
+func (h *MockHook) PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreImportStateCalled = true
-        h.PreImportStateInfo = info
-        h.PreImportStateId = id
+        h.PreImportStateAddr = addr
+        h.PreImportStateID = importID
         return h.PreImportStateReturn, h.PreImportStateError
 }
 
-func (h *MockHook) PostImportState(info *InstanceInfo, s []*InstanceState) (HookAction, error) {
+func (h *MockHook) PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostImportStateCalled = true
-        h.PostImportStateInfo = info
-        h.PostImportStateState = s
+        h.PostImportStateAddr = addr
+        h.PostImportStateNewStates = imported
         return h.PostImportStateReturn, h.PostImportStateError
 }
 
-func (h *MockHook) PostStateUpdate(s *State) (HookAction, error) {
+func (h *MockHook) PostStateUpdate(new *states.State) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostStateUpdateCalled = true
-        h.PostStateUpdateState = s
+        h.PostStateUpdateState = new
         return h.PostStateUpdateReturn, h.PostStateUpdateError
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go b/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go
index 104d009..811fb33 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go
@@ -2,6 +2,13 @@ package terraform
 
 import (
         "sync/atomic"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
 )
 
 // stopHook is a private Hook implementation that Terraform uses to
@@ -10,63 +17,69 @@ type stopHook struct {
         stop uint32
 }
 
-func (h *stopHook) PreApply(*InstanceInfo, *InstanceState, *InstanceDiff) (HookAction, error) {
+var _ Hook = (*stopHook)(nil)
+
+func (h *stopHook) PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostApply(*InstanceInfo, *InstanceState, error) (HookAction, error) {
+func (h *stopHook) PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreDiff(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostDiff(*InstanceInfo, *InstanceDiff) (HookAction, error) {
+func (h *stopHook) PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreProvision(*InstanceInfo, string) (HookAction, error) {
+func (h *stopHook) PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostProvision(*InstanceInfo, string, error) (HookAction, error) {
+func (h *stopHook) PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) ProvisionOutput(*InstanceInfo, string, string) {
+func (h *stopHook) ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string) {
 }
 
-func (h *stopHook) PreRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreImportState(*InstanceInfo, string) (HookAction, error) {
+func (h *stopHook) PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostImportState(*InstanceInfo, []*InstanceState) (HookAction, error) {
+func (h *stopHook) PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostStateUpdate(*State) (HookAction, error) {
+func (h *stopHook) PostStateUpdate(new *states.State) (HookAction, error) {
         return h.hook()
 }
 
 func (h *stopHook) hook() (HookAction, error) {
         if h.Stopped() {
+                // FIXME: This should really return an error since stopping partway
+                // through is not a successful run-to-completion, but we'll need to
+                // introduce that cautiously since existing automation solutions may
+                // be depending on this behavior.
                 return HookActionHalt, nil
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
index b8e7d1f..95b7a98 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
@@ -4,6 +4,16 @@ package terraform
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeInvalid-0]
+        _ = x[TypePrimary-1]
+        _ = x[TypeTainted-2]
+        _ = x[TypeDeposed-3]
+}
+
 const _InstanceType_name = "TypeInvalidTypePrimaryTypeTaintedTypeDeposed"
 
 var _InstanceType_index = [...]uint8{0, 11, 22, 33, 44}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
index 4f4e178..26c1857 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
@@ -45,65 +45,7 @@ type InterpolationScope struct {
 func (i *Interpolater) Values(
         scope *InterpolationScope,
         vars map[string]config.InterpolatedVariable) (map[string]ast.Variable, error) {
-        if scope == nil {
-                scope = &InterpolationScope{}
-        }
-
-        result := make(map[string]ast.Variable, len(vars))
-
-        // Copy the default variables
-        if i.Module != nil && scope != nil {
-                mod := i.Module
-                if len(scope.Path) > 1 {
-                        mod = i.Module.Child(scope.Path[1:])
-                }
-                for _, v := range mod.Config().Variables {
-                        // Set default variables
-                        if v.Default == nil {
-                                continue
-                        }
-
-                        n := fmt.Sprintf("var.%s", v.Name)
-                        variable, err := hil.InterfaceToVariable(v.Default)
-                        if err != nil {
-                                return nil, fmt.Errorf("invalid default map value for %s: %v", v.Name, v.Default)
-                        }
-
-                        result[n] = variable
-                }
-        }
-
-        for n, rawV := range vars {
-                var err error
-                switch v := rawV.(type) {
-                case *config.CountVariable:
-                        err = i.valueCountVar(scope, n, v, result)
-                case *config.ModuleVariable:
-                        err = i.valueModuleVar(scope, n, v, result)
-                case *config.PathVariable:
-                        err = i.valuePathVar(scope, n, v, result)
-                case *config.ResourceVariable:
-                        err = i.valueResourceVar(scope, n, v, result)
-                case *config.SelfVariable:
-                        err = i.valueSelfVar(scope, n, v, result)
-                case *config.SimpleVariable:
-                        err = i.valueSimpleVar(scope, n, v, result)
-                case *config.TerraformVariable:
-                        err = i.valueTerraformVar(scope, n, v, result)
-                case *config.LocalVariable:
-                        err = i.valueLocalVar(scope, n, v, result)
-                case *config.UserVariable:
-                        err = i.valueUserVar(scope, n, v, result)
-                default:
-                        err = fmt.Errorf("%s: unknown variable type: %T", n, rawV)
-                }
-
-                if err != nil {
-                        return nil, err
-                }
-        }
-
-        return result, nil
+        return nil, fmt.Errorf("type Interpolator is no longer supported; use the evaluator API instead")
 }
 
 func (i *Interpolater) valueCountVar(
@@ -153,7 +95,7 @@ func (i *Interpolater) valueModuleVar(
         defer i.StateLock.RUnlock()
 
         // Get the module where we're looking for the value
-        mod := i.State.ModuleByPath(path)
+        mod := i.State.ModuleByPath(normalizeModulePath(path))
         if mod == nil {
                 // If the module doesn't exist, then we can return an empty string.
                 // This happens usually only in Refresh() when we haven't populated
@@ -257,13 +199,13 @@ func (i *Interpolater) valueResourceVar(
         }
 
         if variable == nil {
-                // During the input walk we tolerate missing variables because
+                // During the refresh walk we tolerate missing variables because
                 // we haven't yet had a chance to refresh state, so dynamic data may
                 // not yet be complete.
                 // If it truly is missing, we'll catch it on a later walk.
                 // This applies only to graph nodes that interpolate during the
-                // config walk, e.g. providers.
-                if i.Operation == walkInput || i.Operation == walkRefresh {
+                // refresh walk, e.g. providers.
+                if i.Operation == walkRefresh {
                         result[n] = unknownVariable()
                         return nil
                 }
@@ -365,7 +307,7 @@ func (i *Interpolater) valueLocalVar(
         }
 
         // Get the relevant module
-        module := i.State.ModuleByPath(scope.Path)
+        module := i.State.ModuleByPath(normalizeModulePath(scope.Path))
         if module == nil {
                 result[n] = unknownVariable()
                 return nil
@@ -584,10 +526,7 @@ MISSING:
         //
         // For a Destroy, we're also fine with computed values, since our goal is
         // only to get destroy nodes for existing resources.
-        //
-        // For an input walk, computed values are okay to return because we're only
-        // looking for missing variables to prompt the user for.
-        if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkInput {
+        if i.Operation == walkRefresh || i.Operation == walkPlanDestroy {
                 return &unknownVariable, nil
         }
 
@@ -607,13 +546,6 @@ func (i *Interpolater) computeResourceMultiVariable(
 
         unknownVariable := unknownVariable()
 
-        // If we're only looking for input, we don't need to expand a
-        // multi-variable. This prevents us from encountering things that should be
-        // known but aren't because the state has yet to be refreshed.
-        if i.Operation == walkInput {
-                return &unknownVariable, nil
-        }
-
         // Get the information about this resource variable, and verify
         // that it exists and such.
         module, cr, err := i.resourceVariableInfo(scope, v)
@@ -695,7 +627,7 @@ func (i *Interpolater) computeResourceMultiVariable(
                 //
                 // For an input walk, computed values are okay to return because we're only
                 // looking for missing variables to prompt the user for.
-                if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkDestroy || i.Operation == walkInput {
+                if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkDestroy {
                         return &unknownVariable, nil
                 }
 
@@ -776,7 +708,7 @@ func (i *Interpolater) resourceVariableInfo(
         }
 
         // Get the relevant module
-        module := i.State.ModuleByPath(scope.Path)
+        module := i.State.ModuleByPath(normalizeModulePath(scope.Path))
         return module, cr, nil
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
index 4594cb6..66a68c7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
@@ -1,84 +1,135 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/moduledeps"
         "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/states"
 )
 
-// ModuleTreeDependencies returns the dependencies of the tree of modules
-// described by the given configuration tree and state.
+// ConfigTreeDependencies returns the dependencies of the tree of modules
+// described by the given configuration and state.
 //
 // Both configuration and state are required because there can be resources
 // implied by instances in the state that no longer exist in config.
-//
-// This function will panic if any invalid version constraint strings are
-// present in the configuration. This is guaranteed not to happen for any
-// configuration that has passed a call to Config.Validate().
-func ModuleTreeDependencies(root *module.Tree, state *State) *moduledeps.Module {
+func ConfigTreeDependencies(root *configs.Config, state *states.State) *moduledeps.Module {
         // First we walk the configuration tree to build the overall structure
         // and capture the explicit/implicit/inherited provider dependencies.
-        deps := moduleTreeConfigDependencies(root, nil)
+        deps := configTreeConfigDependencies(root, nil)
 
         // Next we walk over the resources in the state to catch any additional
         // dependencies created by existing resources that are no longer in config.
         // Most things we find in state will already be present in 'deps', but
         // we're interested in the rare thing that isn't.
-        moduleTreeMergeStateDependencies(deps, state)
+        configTreeMergeStateDependencies(deps, state)
 
         return deps
 }
 
-func moduleTreeConfigDependencies(root *module.Tree, inheritProviders map[string]*config.ProviderConfig) *moduledeps.Module {
+func configTreeConfigDependencies(root *configs.Config, inheritProviders map[string]*configs.Provider) *moduledeps.Module {
         if root == nil {
                 // If no config is provided, we'll make a synthetic root.
                 // This isn't necessarily correct if we're called with a nil that
                 // *isn't* at the root, but in practice that can never happen.
                 return &moduledeps.Module{
-                        Name: "root",
+                        Name:      "root",
+                        Providers: make(moduledeps.Providers),
                 }
         }
 
+        name := "root"
+        if len(root.Path) != 0 {
+                name = root.Path[len(root.Path)-1]
+        }
+
         ret := &moduledeps.Module{
-                Name: root.Name(),
+                Name: name,
         }
 
-        cfg := root.Config()
-        providerConfigs := cfg.ProviderConfigsByFullName()
+        module := root.Module
 
         // Provider dependencies
         {
-                providers := make(moduledeps.Providers, len(providerConfigs))
+                providers := make(moduledeps.Providers)
 
-                // Any providerConfigs elements are *explicit* provider dependencies,
-                // which is the only situation where the user might provide an actual
-                // version constraint. We'll take care of these first.
-                for fullName, pCfg := range providerConfigs {
+                // The main way to declare a provider dependency is explicitly inside
+                // the "terraform" block, which allows declaring a requirement without
+                // also creating a configuration.
+                for fullName, constraints := range module.ProviderRequirements {
                         inst := moduledeps.ProviderInstance(fullName)
-                        versionSet := discovery.AllVersions
-                        if pCfg.Version != "" {
-                                versionSet = discovery.ConstraintStr(pCfg.Version).MustParse()
+
+                        // The handling here is a bit fiddly because the moduledeps package
+                        // was designed around the legacy (pre-0.12) configuration model
+                        // and hasn't yet been revised to handle the new model. As a result,
+                        // we need to do some translation here.
+                        // FIXME: Eventually we should adjust the underlying model so we
+                        // can also retain the source location of each constraint, for
+                        // more informative output from the "terraform providers" command.
+                        var rawConstraints version.Constraints
+                        for _, constraint := range constraints {
+                                rawConstraints = append(rawConstraints, constraint.Required...)
                         }
+                        discoConstraints := discovery.NewConstraints(rawConstraints)
+
                         providers[inst] = moduledeps.ProviderDependency{
-                                Constraints: versionSet,
+                                Constraints: discoConstraints,
                                 Reason:      moduledeps.ProviderDependencyExplicit,
                         }
                 }
 
+                // Provider configurations can also include version constraints,
+                // allowing for more terse declaration in situations where both a
+                // configuration and a constraint are defined in the same module.
+                for fullName, pCfg := range module.ProviderConfigs {
+                        inst := moduledeps.ProviderInstance(fullName)
+                        discoConstraints := discovery.AllVersions
+                        if pCfg.Version.Required != nil {
+                                discoConstraints = discovery.NewConstraints(pCfg.Version.Required)
+                        }
+                        if existing, exists := providers[inst]; exists {
+                                existing.Constraints = existing.Constraints.Append(discoConstraints)
+                        } else {
+                                providers[inst] = moduledeps.ProviderDependency{
+                                        Constraints: discoConstraints,
+                                        Reason:      moduledeps.ProviderDependencyExplicit,
+                                }
+                        }
+                }
+
                 // Each resource in the configuration creates an *implicit* provider
                 // dependency, though we'll only record it if there isn't already
                 // an explicit dependency on the same provider.
-                for _, rc := range cfg.Resources {
-                        fullName := rc.ProviderFullName()
-                        inst := moduledeps.ProviderInstance(fullName)
+                for _, rc := range module.ManagedResources {
+                        addr := rc.ProviderConfigAddr()
+                        inst := moduledeps.ProviderInstance(addr.StringCompact())
+                        if _, exists := providers[inst]; exists {
+                                // Explicit dependency already present
+                                continue
+                        }
+
+                        reason := moduledeps.ProviderDependencyImplicit
+                        if _, inherited := inheritProviders[addr.StringCompact()]; inherited {
+                                reason = moduledeps.ProviderDependencyInherited
+                        }
+
+                        providers[inst] = moduledeps.ProviderDependency{
+                                Constraints: discovery.AllVersions,
+                                Reason:      reason,
+                        }
+                }
+                for _, rc := range module.DataResources {
+                        addr := rc.ProviderConfigAddr()
+                        inst := moduledeps.ProviderInstance(addr.StringCompact())
                         if _, exists := providers[inst]; exists {
                                 // Explicit dependency already present
                                 continue
                         }
 
                         reason := moduledeps.ProviderDependencyImplicit
-                        if _, inherited := inheritProviders[fullName]; inherited {
+                        if _, inherited := inheritProviders[addr.String()]; inherited {
                                 reason = moduledeps.ProviderDependencyInherited
                         }
 
@@ -91,31 +142,31 @@ func moduleTreeConfigDependencies(root *module.Tree, inheritProviders map[string
                 ret.Providers = providers
         }
 
-        childInherit := make(map[string]*config.ProviderConfig)
+        childInherit := make(map[string]*configs.Provider)
         for k, v := range inheritProviders {
                 childInherit[k] = v
         }
-        for k, v := range providerConfigs {
+        for k, v := range module.ProviderConfigs {
                 childInherit[k] = v
         }
-        for _, c := range root.Children() {
-                ret.Children = append(ret.Children, moduleTreeConfigDependencies(c, childInherit))
+        for _, c := range root.Children {
+                ret.Children = append(ret.Children, configTreeConfigDependencies(c, childInherit))
         }
 
         return ret
 }
 
-func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
+func configTreeMergeStateDependencies(root *moduledeps.Module, state *states.State) {
         if state == nil {
                 return
         }
 
-        findModule := func(path []string) *moduledeps.Module {
+        findModule := func(path addrs.ModuleInstance) *moduledeps.Module {
                 module := root
-                for _, name := range path[1:] { // skip initial "root"
+                for _, step := range path {
                         var next *moduledeps.Module
                         for _, cm := range module.Children {
-                                if cm.Name == name {
+                                if cm.Name == step.Name {
                                         next = cm
                                         break
                                 }
@@ -124,7 +175,8 @@ func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
                         if next == nil {
                                 // If we didn't find a next node, we'll need to make one
                                 next = &moduledeps.Module{
-                                        Name: name,
+                                        Name:      step.Name,
+                                        Providers: make(moduledeps.Providers),
                                 }
                                 module.Children = append(module.Children, next)
                         }
@@ -135,15 +187,11 @@ func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
         }
 
         for _, ms := range state.Modules {
-                module := findModule(ms.Path)
+                module := findModule(ms.Addr)
 
-                for _, is := range ms.Resources {
-                        fullName := config.ResourceProviderFullName(is.Type, is.Provider)
-                        inst := moduledeps.ProviderInstance(fullName)
+                for _, rs := range ms.Resources {
+                        inst := moduledeps.ProviderInstance(rs.ProviderConfig.ProviderConfig.StringCompact())
                         if _, exists := module.Providers[inst]; !exists {
-                                if module.Providers == nil {
-                                        module.Providers = make(moduledeps.Providers)
-                                }
                                 module.Providers[inst] = moduledeps.ProviderDependency{
                                         Constraints: discovery.AllVersions,
                                         Reason:      moduledeps.ProviderDependencyFromState,
@@ -151,5 +199,4 @@ func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
                         }
                 }
         }
-
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go b/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go
index bd32c79..e495203 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go
@@ -1,14 +1,22 @@
 package terraform
 
-// NodeCountBoundary fixes any "count boundarie" in the state: resources
-// that are named "foo.0" when they should be named "foo"
-type NodeCountBoundary struct{}
+import (
+        "github.com/hashicorp/terraform/configs"
+)
+
+// NodeCountBoundary fixes up any transitions between "each modes" in objects
+// saved in state, such as switching from NoEach to EachInt.
+type NodeCountBoundary struct {
+        Config *configs.Config
+}
 
 func (n *NodeCountBoundary) Name() string {
-        return "meta.count-boundary (count boundary fixup)"
+        return "meta.count-boundary (EachMode fixup)"
 }
 
 // GraphNodeEvalable
 func (n *NodeCountBoundary) EvalTree() EvalNode {
-        return &EvalCountFixZeroOneBoundaryGlobal{}
+        return &EvalCountFixZeroOneBoundaryGlobal{
+                Config: n.Config,
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go
index e32cea8..6ba3990 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go
@@ -1,22 +1,40 @@
 package terraform
 
-// NodeDestroyableDataResource represents a resource that is "plannable":
-// it is ready to be planned in order to create a diff.
-type NodeDestroyableDataResource struct {
-        *NodeAbstractResource
+import (
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// NodeDestroyableDataResourceInstance represents a resource that is "destroyable":
+// it is ready to be destroyed.
+type NodeDestroyableDataResourceInstance struct {
+        *NodeAbstractResourceInstance
 }
 
 // GraphNodeEvalable
-func (n *NodeDestroyableDataResource) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+func (n *NodeDestroyableDataResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+        var providerSchema *ProviderSchema
+        // We don't need the provider, but we're calling EvalGetProvider to load the
+        // schema.
+        var provider providers.Interface
 
         // Just destroy it.
-        var state *InstanceState
-        return &EvalWriteState{
-                Name:  stateId,
-                State: &state, // state is nil here
+        var state *states.ResourceInstanceObject
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                State:          &state,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                        },
+                },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
index d5ca641..ab82163 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
@@ -2,46 +2,71 @@ package terraform
 
 import (
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
 )
 
-// NodeRefreshableDataResource represents a resource that is "plannable":
-// it is ready to be planned in order to create a diff.
+// NodeRefreshableDataResource represents a resource that is "refreshable".
 type NodeRefreshableDataResource struct {
-        *NodeAbstractCountResource
+        *NodeAbstractResource
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeDynamicExpandable    = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeReferenceable        = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeReferencer           = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeResource             = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeRefreshableDataResource)(nil)
+)
+
 // GraphNodeDynamicExpandable
 func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count, err := n.Config.Count()
-        if err != nil {
-                return nil, err
+        var diags tfdiags.Diagnostics
+
+        count, countKnown, countDiags := evaluateResourceCountExpressionKnown(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+        if !countKnown {
+                // If the count isn't known yet, we'll skip refreshing and try expansion
+                // again during the plan walk.
+                return nil, nil
         }
 
+        // Next we need to potentially rename an instance address in the state
+        // if we're transitioning whether "count" is set at all.
+        fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
+
+        // Our graph transformers require access to the full state, so we'll
+        // temporarily lock it while we work on this.
+        state := ctx.State().Lock()
+        defer ctx.State().Unlock()
+
         // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
+        concreteResource := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableDataResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
         // We also need a destroyable resource for orphans that are a result of a
         // scaled-in count.
-        concreteResourceDestroyable := func(a *NodeAbstractResource) dag.Vertex {
-                // Add the config since we don't do that via transforms
+        concreteResourceDestroyable := func(a *NodeAbstractResourceInstance) dag.Vertex {
+                // Add the config and provider since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
-                return &NodeDestroyableDataResource{
-                        NodeAbstractResource: a,
+                return &NodeDestroyableDataResourceInstance{
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
@@ -50,6 +75,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 // Expand the count.
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
+                        Schema:   n.Schema,
                         Count:    count,
                         Addr:     n.ResourceAddr(),
                 },
@@ -67,7 +93,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 &AttachStateTransformer{State: state},
 
                 // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
+                &TargetsTransformer{Targets: n.Targets},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -83,139 +109,118 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 Name:     "NodeRefreshableDataResource",
         }
 
-        return b.Build(ctx.Path())
+        graph, diags := b.Build(ctx.Path())
+        return graph, diags.ErrWithWarnings()
 }
 
-// NodeRefreshableDataResourceInstance represents a _single_ resource instance
+// NodeRefreshableDataResourceInstance represents a single resource instance
 // that is refreshable.
 type NodeRefreshableDataResourceInstance struct {
-        *NodeAbstractResource
+        *NodeAbstractResourceInstance
 }
 
 // GraphNodeEvalable
 func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
-        }
-
-        // Get the state if we have it, if not we build it
-        rs := n.ResourceState
-        if rs == nil {
-                rs = &ResourceState{
-                        Provider: n.ResolvedProvider,
-                }
-        }
+        addr := n.ResourceInstanceAddr()
 
-        // If the config isn't empty we update the state
-        if n.Config != nil {
-                rs = &ResourceState{
-                        Type:         n.Config.Type,
-                        Provider:     n.Config.Provider,
-                        Dependencies: n.StateReferences(),
-                }
-        }
-
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
-
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var config *ResourceConfig
-        var diff *InstanceDiff
-        var provider ResourceProvider
-        var state *InstanceState
+        // These variables are the state for the eval sequence below, and are
+        // updated through pointers.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var configVal cty.Value
 
         return &EvalSequence{
                 Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+
                         // Always destroy the existing state first, since we must
                         // make sure that values from a previous read will not
                         // get interpolated if we end up needing to defer our
                         // loading until apply time.
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: rs.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: rs.Dependencies,
-                                State:        &state, // state is nil here
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                State:          &state, // a pointer to nil, here
+                                ProviderSchema: &providerSchema,
                         },
 
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
-                        },
-
-                        // The rest of this pass can proceed only if there are no
-                        // computed values in our config.
-                        // (If there are, we'll deal with this during the plan and
-                        // apply phases.)
                         &EvalIf{
                                 If: func(ctx EvalContext) (bool, error) {
-                                        if config.ComputedKeys != nil && len(config.ComputedKeys) > 0 {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
                                         // If the config explicitly has a depends_on for this
                                         // data source, assume the intention is to prevent
-                                        // refreshing ahead of that dependency.
+                                        // refreshing ahead of that dependency, and therefore
+                                        // we need to deal with this resource during the apply
+                                        // phase..
                                         if len(n.Config.DependsOn) > 0 {
                                                 return true, EvalEarlyExitError{}
                                         }
 
                                         return true, nil
                                 },
-
                                 Then: EvalNoop{},
                         },
 
-                        // The remainder of this pass is the same as running
-                        // a "plan" pass immediately followed by an "apply" pass,
-                        // populating the state early so it'll be available to
-                        // provider configurations that need this data during
-                        // refresh/plan.
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-
-                        &EvalReadDataDiff{
-                                Info:        info,
-                                Config:      &config,
-                                Provider:    &provider,
-                                Output:      &diff,
-                                OutputState: &state,
-                        },
-
-                        &EvalReadDataApply{
-                                Info:     info,
-                                Diff:     &diff,
-                                Provider: &provider,
-                                Output:   &state,
+                        // EvalReadData will _attempt_ to read the data source, but may
+                        // generate an incomplete planned object if the configuration
+                        // includes values that won't be known until apply.
+                        &EvalReadData{
+                                Addr:              addr.Resource,
+                                Config:            n.Config,
+                                Dependencies:      n.StateReferences(),
+                                Provider:          &provider,
+                                ProviderAddr:      n.ResolvedProvider,
+                                ProviderSchema:    &providerSchema,
+                                OutputChange:      &change,
+                                OutputConfigValue: &configVal,
+                                OutputState:       &state,
                         },
 
-                        &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: rs.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: rs.Dependencies,
-                                State:        &state,
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        return (*state).Status != states.ObjectPlanned, nil
+                                },
+                                Then: &EvalSequence{
+                                        Nodes: []EvalNode{
+                                                &EvalWriteState{
+                                                        Addr:           addr.Resource,
+                                                        ProviderAddr:   n.ResolvedProvider,
+                                                        State:          &state,
+                                                        ProviderSchema: &providerSchema,
+                                                },
+                                                &EvalUpdateStateHook{},
+                                        },
+                                },
+                                Else: &EvalSequence{
+                                        // We can't deal with this yet, so we'll repeat this step
+                                        // during the plan walk to produce a planned change to read
+                                        // this during the apply walk. However, we do still need to
+                                        // save the generated change and partial state so that
+                                        // results from it can be included in other data resources
+                                        // or provider configurations during the refresh walk.
+                                        // (The planned object we save in the state here will be
+                                        // pruned out at the end of the refresh walk, returning
+                                        // it back to being unset again for subsequent walks.)
+                                        Nodes: []EvalNode{
+                                                &EvalWriteDiff{
+                                                        Addr:           addr.Resource,
+                                                        Change:         &change,
+                                                        ProviderSchema: &providerSchema,
+                                                },
+                                                &EvalWriteState{
+                                                        Addr:           addr.Resource,
+                                                        ProviderAddr:   n.ResolvedProvider,
+                                                        State:          &state,
+                                                        ProviderSchema: &providerSchema,
+                                                },
+                                        },
+                                },
                         },
-
-                        &EvalUpdateStateHook{},
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_local.go b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
index d387222..591eb30 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_local.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
@@ -1,10 +1,10 @@
 package terraform
 
 import (
-        "fmt"
-        "strings"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
 )
 
 // NodeLocal represents a named local value in a particular module.
@@ -12,22 +12,26 @@ import (
 // Local value nodes only have one operation, common to all walk types:
 // evaluate the result and place it in state.
 type NodeLocal struct {
-        PathValue []string
-        Config    *config.Local
+        Addr   addrs.AbsLocalValue
+        Config *configs.Local
 }
 
-func (n *NodeLocal) Name() string {
-        result := fmt.Sprintf("local.%s", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+var (
+        _ GraphNodeSubPath       = (*NodeLocal)(nil)
+        _ RemovableIfNotTargeted = (*NodeLocal)(nil)
+        _ GraphNodeReferenceable = (*NodeLocal)(nil)
+        _ GraphNodeReferencer    = (*NodeLocal)(nil)
+        _ GraphNodeEvalable      = (*NodeLocal)(nil)
+        _ dag.GraphNodeDotter    = (*NodeLocal)(nil)
+)
 
-        return result
+func (n *NodeLocal) Name() string {
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeLocal) Path() []string {
-        return n.PathValue
+func (n *NodeLocal) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -36,31 +40,31 @@ func (n *NodeLocal) RemoveIfNotTargeted() bool {
 }
 
 // GraphNodeReferenceable
-func (n *NodeLocal) ReferenceableName() []string {
-        name := fmt.Sprintf("local.%s", n.Config.Name)
-        return []string{name}
+func (n *NodeLocal) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr.LocalValue}
 }
 
 // GraphNodeReferencer
-func (n *NodeLocal) References() []string {
-        var result []string
-        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
-        for _, v := range result {
-                split := strings.Split(v, "/")
-                for i, s := range split {
-                        split[i] = s + ".destroy"
-                }
-
-                result = append(result, strings.Join(split, "/"))
-        }
-
-        return result
+func (n *NodeLocal) References() []*addrs.Reference {
+        refs, _ := lang.ReferencesInExpr(n.Config.Expr)
+        return appendResourceDestroyReferences(refs)
 }
 
 // GraphNodeEvalable
 func (n *NodeLocal) EvalTree() EvalNode {
         return &EvalLocal{
-                Name:  n.Config.Name,
-                Value: n.Config.RawConfig,
+                Addr: n.Addr.LocalValue,
+                Expr: n.Config.Expr,
+        }
+}
+
+// dag.GraphNodeDotter impl.
+func (n *NodeLocal) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
index bb3e5ee..cb55a1a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
@@ -2,76 +2,80 @@ package terraform
 
 import (
         "fmt"
-        "log"
-        "reflect"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
 // NodeModuleRemoved represents a module that is no longer in the
 // config.
 type NodeModuleRemoved struct {
-        PathValue []string
+        Addr addrs.ModuleInstance
 }
 
+var (
+        _ GraphNodeSubPath          = (*NodeModuleRemoved)(nil)
+        _ GraphNodeEvalable         = (*NodeModuleRemoved)(nil)
+        _ GraphNodeReferencer       = (*NodeModuleRemoved)(nil)
+        _ GraphNodeReferenceOutside = (*NodeModuleRemoved)(nil)
+)
+
 func (n *NodeModuleRemoved) Name() string {
-        return fmt.Sprintf("%s (removed)", modulePrefixStr(n.PathValue))
+        return fmt.Sprintf("%s (removed)", n.Addr.String())
 }
 
 // GraphNodeSubPath
-func (n *NodeModuleRemoved) Path() []string {
-        return n.PathValue
+func (n *NodeModuleRemoved) Path() addrs.ModuleInstance {
+        return n.Addr
 }
 
 // GraphNodeEvalable
 func (n *NodeModuleRemoved) EvalTree() EvalNode {
         return &EvalOpFilter{
                 Ops: []walkOperation{walkRefresh, walkApply, walkDestroy},
-                Node: &EvalDeleteModule{
-                        PathValue: n.PathValue,
+                Node: &EvalCheckModuleRemoved{
+                        Addr: n.Addr,
                 },
         }
 }
 
-func (n *NodeModuleRemoved) ReferenceGlobal() bool {
-        return true
+func (n *NodeModuleRemoved) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+        // Our "References" implementation indicates that this node depends on
+        // the call to the module it represents, which implicitly depends on
+        // everything inside the module. That reference must therefore be
+        // interpreted in terms of our parent module.
+        return n.Addr, n.Addr.Parent()
 }
 
-func (n *NodeModuleRemoved) References() []string {
-        return []string{modulePrefixStr(n.PathValue)}
-}
+func (n *NodeModuleRemoved) References() []*addrs.Reference {
+        // We depend on the call to the module we represent, because that
+        // implicitly then depends on everything inside that module.
+        // Our ReferenceOutside implementation causes this to be interpreted
+        // within the parent module.
 
-// EvalDeleteModule is an EvalNode implementation that removes an empty module
-// entry from the state.
-type EvalDeleteModule struct {
-        PathValue []string
-}
+        _, call := n.Addr.CallInstance()
+        return []*addrs.Reference{
+                {
+                        Subject: call,
 
-func (n *EvalDeleteModule) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-        if state == nil {
-                return nil, nil
+                        // No source range here, because there's nothing reasonable for
+                        // us to return.
+                },
         }
+}
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Make sure we have a clean state
-        // Destroyed resources aren't deleted, they're written with an ID of "".
-        state.prune()
+// EvalCheckModuleRemoved is an EvalNode implementation that verifies that
+// a module has been removed from the state as expected.
+type EvalCheckModuleRemoved struct {
+        Addr addrs.ModuleInstance
+}
 
-        // find the module and delete it
-        for i, m := range state.Modules {
-                if reflect.DeepEqual(m.Path, n.PathValue) {
-                        if !m.Empty() {
-                                // a targeted apply may leave module resources even without a config,
-                                // so just log this and return.
-                                log.Printf("[DEBUG] cannot remove module %s, not empty", modulePrefixStr(n.PathValue))
-                                break
-                        }
-                        state.Modules = append(state.Modules[:i], state.Modules[i+1:]...)
-                        break
-                }
+func (n *EvalCheckModuleRemoved) Eval(ctx EvalContext) (interface{}, error) {
+        mod := ctx.State().Module(n.Addr)
+        if mod != nil {
+                // If we get here then that indicates a bug either in the states
+                // module or in an earlier step of the graph walk, since we should've
+                // pruned out the module when the last resource was removed from it.
+                return nil, fmt.Errorf("leftover module %s in state that should have been removed; this is a bug in Terraform and should be reported", n.Addr)
         }
-
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
index 66ff7d5..aca5a6a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
@@ -1,40 +1,43 @@
 package terraform
 
 import (
-        "fmt"
-
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // NodeApplyableModuleVariable represents a module variable input during
 // the apply step.
 type NodeApplyableModuleVariable struct {
-        PathValue []string
-        Config    *config.Variable  // Config is the var in the config
-        Value     *config.RawConfig // Value is the value that is set
-
-        Module *module.Tree // Antiquated, want to remove
+        Addr   addrs.AbsInputVariableInstance
+        Config *configs.Variable // Config is the var in the config
+        Expr   hcl.Expression    // Expr is the value expression given in the call
 }
 
-func (n *NodeApplyableModuleVariable) Name() string {
-        result := fmt.Sprintf("var.%s", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+// Ensure that we are implementing all of the interfaces we think we are
+// implementing.
+var (
+        _ GraphNodeSubPath          = (*NodeApplyableModuleVariable)(nil)
+        _ RemovableIfNotTargeted    = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeReferenceOutside = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeReferenceable    = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeReferencer       = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeEvalable         = (*NodeApplyableModuleVariable)(nil)
+        _ dag.GraphNodeDotter       = (*NodeApplyableModuleVariable)(nil)
+)
 
-        return result
+func (n *NodeApplyableModuleVariable) Name() string {
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeApplyableModuleVariable) Path() []string {
-        // We execute in the parent scope (above our own module) so that
-        // we can access the proper interpolations.
-        if len(n.PathValue) > 2 {
-                return n.PathValue[:len(n.PathValue)-1]
-        }
-
-        return rootModulePath
+func (n *NodeApplyableModuleVariable) Path() addrs.ModuleInstance {
+        // We execute in the parent scope (above our own module) because
+        // expressions in our value are resolved in that context.
+        return n.Addr.Module.Parent()
 }
 
 // RemovableIfNotTargeted
@@ -44,95 +47,96 @@ func (n *NodeApplyableModuleVariable) RemoveIfNotTargeted() bool {
         return true
 }
 
-// GraphNodeReferenceGlobal
-func (n *NodeApplyableModuleVariable) ReferenceGlobal() bool {
-        // We have to create fully qualified references because we cross
-        // boundaries here: our ReferenceableName is in one path and our
-        // References are from another path.
-        return true
+// GraphNodeReferenceOutside implementation
+func (n *NodeApplyableModuleVariable) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+
+        // Module input variables have their value expressions defined in the
+        // context of their calling (parent) module, and so references from
+        // a node of this type should be resolved in the parent module instance.
+        referencePath = n.Addr.Module.Parent()
+
+        // Input variables are _referenced_ from their own module, though.
+        selfPath = n.Addr.Module
+
+        return // uses named return values
 }
 
 // GraphNodeReferenceable
-func (n *NodeApplyableModuleVariable) ReferenceableName() []string {
-        return []string{n.Name()}
+func (n *NodeApplyableModuleVariable) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr.Variable}
 }
 
 // GraphNodeReferencer
-func (n *NodeApplyableModuleVariable) References() []string {
-        // If we have no value set, we depend on nothing
-        if n.Value == nil {
-                return nil
-        }
+func (n *NodeApplyableModuleVariable) References() []*addrs.Reference {
 
-        // Can't depend on anything if we're in the root
-        if len(n.PathValue) < 2 {
+        // If we have no value expression, we cannot depend on anything.
+        if n.Expr == nil {
                 return nil
         }
 
-        // Otherwise, we depend on anything that is in our value, but
-        // specifically in the namespace of the parent path.
-        // Create the prefix based on the path
-        var prefix string
-        if p := n.Path(); len(p) > 0 {
-                prefix = modulePrefixStr(p)
+        // Variables in the root don't depend on anything, because their values
+        // are gathered prior to the graph walk and recorded in the context.
+        if len(n.Addr.Module) == 0 {
+                return nil
         }
 
-        result := ReferencesFromConfig(n.Value)
-        return modulePrefixList(result, prefix)
+        // Otherwise, we depend on anything referenced by our value expression.
+        // We ignore diagnostics here under the assumption that we'll re-eval
+        // all these things later and catch them then; for our purposes here,
+        // we only care about valid references.
+        //
+        // Due to our GraphNodeReferenceOutside implementation, the addresses
+        // returned by this function are interpreted in the _parent_ module from
+        // where our associated variable was declared, which is correct because
+        // our value expression is assigned within a "module" block in the parent
+        // module.
+        refs, _ := lang.ReferencesInExpr(n.Expr)
+        return refs
 }
 
 // GraphNodeEvalable
 func (n *NodeApplyableModuleVariable) EvalTree() EvalNode {
         // If we have no value, do nothing
-        if n.Value == nil {
+        if n.Expr == nil {
                 return &EvalNoop{}
         }
 
         // Otherwise, interpolate the value of this variable and set it
         // within the variables mapping.
-        var config *ResourceConfig
-        variables := make(map[string]interface{})
+        vals := make(map[string]cty.Value)
+
+        _, call := n.Addr.Module.CallInstance()
 
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalOpFilter{
-                                Ops: []walkOperation{walkInput},
-                                Node: &EvalInterpolate{
-                                        Config:        n.Value,
-                                        Output:        &config,
-                                        ContinueOnErr: true,
-                                },
-                        },
-                        &EvalOpFilter{
                                 Ops: []walkOperation{walkRefresh, walkPlan, walkApply,
                                         walkDestroy, walkValidate},
-                                Node: &EvalInterpolate{
-                                        Config: n.Value,
-                                        Output: &config,
-                                },
-                        },
+                                Node: &EvalModuleCallArgument{
+                                        Addr:   n.Addr.Variable,
+                                        Config: n.Config,
+                                        Expr:   n.Expr,
+                                        Values: vals,
 
-                        &EvalVariableBlock{
-                                Config:         &config,
-                                VariableValues: variables,
-                        },
-
-                        &EvalCoerceMapVariable{
-                                Variables:  variables,
-                                ModulePath: n.PathValue,
-                                ModuleTree: n.Module,
+                                        IgnoreDiagnostics: false,
+                                },
                         },
 
-                        &EvalTypeCheckVariable{
-                                Variables:  variables,
-                                ModulePath: n.PathValue,
-                                ModuleTree: n.Module,
+                        &EvalSetModuleCallArguments{
+                                Module: call,
+                                Values: vals,
                         },
+                },
+        }
+}
 
-                        &EvalSetVariables{
-                                Module:    &n.PathValue[len(n.PathValue)-1],
-                                Variables: variables,
-                        },
+// dag.GraphNodeDotter impl.
+func (n *NodeApplyableModuleVariable) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output.go b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
index 83e9925..bb3d065 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
@@ -2,31 +2,38 @@ package terraform
 
 import (
         "fmt"
-        "strings"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
 )
 
 // NodeApplyableOutput represents an output that is "applyable":
 // it is ready to be applied.
 type NodeApplyableOutput struct {
-        PathValue []string
-        Config    *config.Output // Config is the output in the config
+        Addr   addrs.AbsOutputValue
+        Config *configs.Output // Config is the output in the config
 }
 
-func (n *NodeApplyableOutput) Name() string {
-        result := fmt.Sprintf("output.%s", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+var (
+        _ GraphNodeSubPath          = (*NodeApplyableOutput)(nil)
+        _ RemovableIfNotTargeted    = (*NodeApplyableOutput)(nil)
+        _ GraphNodeTargetDownstream = (*NodeApplyableOutput)(nil)
+        _ GraphNodeReferenceable    = (*NodeApplyableOutput)(nil)
+        _ GraphNodeReferencer       = (*NodeApplyableOutput)(nil)
+        _ GraphNodeReferenceOutside = (*NodeApplyableOutput)(nil)
+        _ GraphNodeEvalable         = (*NodeApplyableOutput)(nil)
+        _ dag.GraphNodeDotter       = (*NodeApplyableOutput)(nil)
+)
 
-        return result
+func (n *NodeApplyableOutput) Name() string {
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeApplyableOutput) Path() []string {
-        return n.PathValue
+func (n *NodeApplyableOutput) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -44,27 +51,64 @@ func (n *NodeApplyableOutput) TargetDownstream(targetedDeps, untargetedDeps *dag
         return true
 }
 
+func referenceOutsideForOutput(addr addrs.AbsOutputValue) (selfPath, referencePath addrs.ModuleInstance) {
+
+        // Output values have their expressions resolved in the context of the
+        // module where they are defined.
+        referencePath = addr.Module
+
+        // ...but they are referenced in the context of their calling module.
+        selfPath = addr.Module.Parent()
+
+        return // uses named return values
+
+}
+
+// GraphNodeReferenceOutside implementation
+func (n *NodeApplyableOutput) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+        return referenceOutsideForOutput(n.Addr)
+}
+
+func referenceableAddrsForOutput(addr addrs.AbsOutputValue) []addrs.Referenceable {
+        // An output in the root module can't be referenced at all.
+        if addr.Module.IsRoot() {
+                return nil
+        }
+
+        // Otherwise, we can be referenced via a reference to our output name
+        // on the parent module's call, or via a reference to the entire call.
+        // e.g. module.foo.bar or just module.foo .
+        // Note that our ReferenceOutside method causes these addresses to be
+        // relative to the calling module, not the module where the output
+        // was declared.
+        _, outp := addr.ModuleCallOutput()
+        _, call := addr.Module.CallInstance()
+        return []addrs.Referenceable{outp, call}
+
+}
+
 // GraphNodeReferenceable
-func (n *NodeApplyableOutput) ReferenceableName() []string {
-        name := fmt.Sprintf("output.%s", n.Config.Name)
-        return []string{name}
+func (n *NodeApplyableOutput) ReferenceableAddrs() []addrs.Referenceable {
+        return referenceableAddrsForOutput(n.Addr)
 }
 
-// GraphNodeReferencer
-func (n *NodeApplyableOutput) References() []string {
-        var result []string
-        result = append(result, n.Config.DependsOn...)
-        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
-        for _, v := range result {
-                split := strings.Split(v, "/")
-                for i, s := range split {
-                        split[i] = s + ".destroy"
-                }
-
-                result = append(result, strings.Join(split, "/"))
+func referencesForOutput(c *configs.Output) []*addrs.Reference {
+        impRefs, _ := lang.ReferencesInExpr(c.Expr)
+        expRefs, _ := lang.References(c.DependsOn)
+        l := len(impRefs) + len(expRefs)
+        if l == 0 {
+                return nil
         }
+        refs := make([]*addrs.Reference, 0, l)
+        refs = append(refs, impRefs...)
+        refs = append(refs, expRefs...)
+        return refs
 
-        return result
+}
+
+// GraphNodeReferencer
+func (n *NodeApplyableOutput) References() []*addrs.Reference {
+        return appendResourceDestroyReferences(referencesForOutput(n.Config))
 }
 
 // GraphNodeEvalable
@@ -72,47 +116,51 @@ func (n *NodeApplyableOutput) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalOpFilter{
-                                // Don't let interpolation errors stop Input, since it happens
-                                // before Refresh.
-                                Ops: []walkOperation{walkInput},
-                                Node: &EvalWriteOutput{
-                                        Name:          n.Config.Name,
-                                        Sensitive:     n.Config.Sensitive,
-                                        Value:         n.Config.RawConfig,
-                                        ContinueOnErr: true,
-                                },
-                        },
-                        &EvalOpFilter{
                                 Ops: []walkOperation{walkRefresh, walkPlan, walkApply, walkValidate, walkDestroy, walkPlanDestroy},
                                 Node: &EvalWriteOutput{
-                                        Name:      n.Config.Name,
+                                        Addr:      n.Addr.OutputValue,
                                         Sensitive: n.Config.Sensitive,
-                                        Value:     n.Config.RawConfig,
+                                        Expr:      n.Config.Expr,
                                 },
                         },
                 },
         }
 }
 
+// dag.GraphNodeDotter impl.
+func (n *NodeApplyableOutput) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
+        }
+}
+
 // NodeDestroyableOutput represents an output that is "destroybale":
 // its application will remove the output from the state.
 type NodeDestroyableOutput struct {
-        PathValue []string
-        Config    *config.Output // Config is the output in the config
+        Addr   addrs.AbsOutputValue
+        Config *configs.Output // Config is the output in the config
 }
 
-func (n *NodeDestroyableOutput) Name() string {
-        result := fmt.Sprintf("output.%s (destroy)", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+var (
+        _ GraphNodeSubPath          = (*NodeDestroyableOutput)(nil)
+        _ RemovableIfNotTargeted    = (*NodeDestroyableOutput)(nil)
+        _ GraphNodeTargetDownstream = (*NodeDestroyableOutput)(nil)
+        _ GraphNodeReferencer       = (*NodeDestroyableOutput)(nil)
+        _ GraphNodeEvalable         = (*NodeDestroyableOutput)(nil)
+        _ dag.GraphNodeDotter       = (*NodeDestroyableOutput)(nil)
+)
 
-        return result
+func (n *NodeDestroyableOutput) Name() string {
+        return fmt.Sprintf("%s (destroy)", n.Addr.String())
 }
 
 // GraphNodeSubPath
-func (n *NodeDestroyableOutput) Path() []string {
-        return n.PathValue
+func (n *NodeDestroyableOutput) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -129,25 +177,24 @@ func (n *NodeDestroyableOutput) TargetDownstream(targetedDeps, untargetedDeps *d
 }
 
 // GraphNodeReferencer
-func (n *NodeDestroyableOutput) References() []string {
-        var result []string
-        result = append(result, n.Config.DependsOn...)
-        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
-        for _, v := range result {
-                split := strings.Split(v, "/")
-                for i, s := range split {
-                        split[i] = s + ".destroy"
-                }
-
-                result = append(result, strings.Join(split, "/"))
-        }
-
-        return result
+func (n *NodeDestroyableOutput) References() []*addrs.Reference {
+        return referencesForOutput(n.Config)
 }
 
 // GraphNodeEvalable
 func (n *NodeDestroyableOutput) EvalTree() EvalNode {
         return &EvalDeleteOutput{
-                Name: n.Config.Name,
+                Addr: n.Addr.OutputValue,
+        }
+}
+
+// dag.GraphNodeDotter impl.
+func (n *NodeDestroyableOutput) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
index 0fd1554..518b8aa 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
@@ -2,31 +2,39 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
 // NodeOutputOrphan represents an output that is an orphan.
 type NodeOutputOrphan struct {
-        OutputName string
-        PathValue  []string
+        Addr addrs.AbsOutputValue
 }
 
+var (
+        _ GraphNodeSubPath          = (*NodeOutputOrphan)(nil)
+        _ GraphNodeReferenceable    = (*NodeOutputOrphan)(nil)
+        _ GraphNodeReferenceOutside = (*NodeOutputOrphan)(nil)
+        _ GraphNodeEvalable         = (*NodeOutputOrphan)(nil)
+)
+
 func (n *NodeOutputOrphan) Name() string {
-        result := fmt.Sprintf("output.%s (orphan)", n.OutputName)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+        return fmt.Sprintf("%s (orphan)", n.Addr.String())
+}
 
-        return result
+// GraphNodeReferenceOutside implementation
+func (n *NodeOutputOrphan) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+        return referenceOutsideForOutput(n.Addr)
 }
 
 // GraphNodeReferenceable
-func (n *NodeOutputOrphan) ReferenceableName() []string {
-        return []string{"output." + n.OutputName}
+func (n *NodeOutputOrphan) ReferenceableAddrs() []addrs.Referenceable {
+        return referenceableAddrsForOutput(n.Addr)
 }
 
 // GraphNodeSubPath
-func (n *NodeOutputOrphan) Path() []string {
-        return n.PathValue
+func (n *NodeOutputOrphan) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeEvalable
@@ -34,7 +42,7 @@ func (n *NodeOutputOrphan) EvalTree() EvalNode {
         return &EvalOpFilter{
                 Ops: []walkOperation{walkRefresh, walkApply, walkDestroy},
                 Node: &EvalDeleteOutput{
-                        Name: n.OutputName,
+                        Addr: n.Addr.OutputValue,
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
index 9e490f7..a0cdcfe 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
@@ -1,10 +1,10 @@
 package terraform
 
 import (
-        "fmt"
-        "strings"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
 
-        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -15,37 +15,33 @@ type ConcreteProviderNodeFunc func(*NodeAbstractProvider) dag.Vertex
 // NodeAbstractProvider represents a provider that has no associated operations.
 // It registers all the common interfaces across operations for providers.
 type NodeAbstractProvider struct {
-        NameValue string
-        PathValue []string
+        Addr addrs.AbsProviderConfig
 
         // The fields below will be automatically set using the Attach
         // interfaces if you're running those transforms, but also be explicitly
         // set if you already have that information.
 
-        Config *config.ProviderConfig
+        Config *configs.Provider
+        Schema *configschema.Block
 }
 
-func ResolveProviderName(name string, path []string) string {
-        if strings.Contains(name, "provider.") {
-                // already resolved
-                return name
-        }
-
-        name = fmt.Sprintf("provider.%s", name)
-        if len(path) >= 1 {
-                name = fmt.Sprintf("%s.%s", modulePrefixStr(path), name)
-        }
-
-        return name
-}
+var (
+        _ GraphNodeSubPath                    = (*NodeAbstractProvider)(nil)
+        _ RemovableIfNotTargeted              = (*NodeAbstractProvider)(nil)
+        _ GraphNodeReferencer                 = (*NodeAbstractProvider)(nil)
+        _ GraphNodeProvider                   = (*NodeAbstractProvider)(nil)
+        _ GraphNodeAttachProvider             = (*NodeAbstractProvider)(nil)
+        _ GraphNodeAttachProviderConfigSchema = (*NodeAbstractProvider)(nil)
+        _ dag.GraphNodeDotter                 = (*NodeAbstractProvider)(nil)
+)
 
 func (n *NodeAbstractProvider) Name() string {
-        return ResolveProviderName(n.NameValue, n.PathValue)
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeAbstractProvider) Path() []string {
-        return n.PathValue
+func (n *NodeAbstractProvider) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -56,21 +52,21 @@ func (n *NodeAbstractProvider) RemoveIfNotTargeted() bool {
 }
 
 // GraphNodeReferencer
-func (n *NodeAbstractProvider) References() []string {
-        if n.Config == nil {
+func (n *NodeAbstractProvider) References() []*addrs.Reference {
+        if n.Config == nil || n.Schema == nil {
                 return nil
         }
 
-        return ReferencesFromConfig(n.Config.RawConfig)
+        return ReferencesFromConfig(n.Config.Config, n.Schema)
 }
 
 // GraphNodeProvider
-func (n *NodeAbstractProvider) ProviderName() string {
-        return n.NameValue
+func (n *NodeAbstractProvider) ProviderAddr() addrs.AbsProviderConfig {
+        return n.Addr
 }
 
 // GraphNodeProvider
-func (n *NodeAbstractProvider) ProviderConfig() *config.ProviderConfig {
+func (n *NodeAbstractProvider) ProviderConfig() *configs.Provider {
         if n.Config == nil {
                 return nil
         }
@@ -79,10 +75,15 @@ func (n *NodeAbstractProvider) ProviderConfig() *config.ProviderConfig {
 }
 
 // GraphNodeAttachProvider
-func (n *NodeAbstractProvider) AttachProvider(c *config.ProviderConfig) {
+func (n *NodeAbstractProvider) AttachProvider(c *configs.Provider) {
         n.Config = c
 }
 
+// GraphNodeAttachProviderConfigSchema impl.
+func (n *NodeAbstractProvider) AttachProviderConfigSchema(schema *configschema.Block) {
+        n.Schema = schema
+}
+
 // GraphNodeDotter impl.
 func (n *NodeAbstractProvider) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
         return &dag.DotNode{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
index a00bc46..30d8813 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
@@ -2,6 +2,8 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/dag"
 )
 
 // NodeDisabledProvider represents a provider that is disabled. A disabled
@@ -11,24 +13,15 @@ type NodeDisabledProvider struct {
         *NodeAbstractProvider
 }
 
+var (
+        _ GraphNodeSubPath        = (*NodeDisabledProvider)(nil)
+        _ RemovableIfNotTargeted  = (*NodeDisabledProvider)(nil)
+        _ GraphNodeReferencer     = (*NodeDisabledProvider)(nil)
+        _ GraphNodeProvider       = (*NodeDisabledProvider)(nil)
+        _ GraphNodeAttachProvider = (*NodeDisabledProvider)(nil)
+        _ dag.GraphNodeDotter     = (*NodeDisabledProvider)(nil)
+)
+
 func (n *NodeDisabledProvider) Name() string {
         return fmt.Sprintf("%s (disabled)", n.NodeAbstractProvider.Name())
 }
-
-// GraphNodeEvalable
-func (n *NodeDisabledProvider) EvalTree() EvalNode {
-        var resourceConfig *ResourceConfig
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        &EvalInterpolateProvider{
-                                Config: n.ProviderConfig(),
-                                Output: &resourceConfig,
-                        },
-                        &EvalBuildProviderConfig{
-                                Provider: n.ProviderName(),
-                                Config:   &resourceConfig,
-                                Output:   &resourceConfig,
-                        },
-                },
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_eval.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_eval.go
new file mode 100644
index 0000000..580e60c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_eval.go
@@ -0,0 +1,20 @@
+package terraform
+
+// NodeEvalableProvider represents a provider during an "eval" walk.
+// This special provider node type just initializes a provider and
+// fetches its schema, without configuring it or otherwise interacting
+// with it.
+type NodeEvalableProvider struct {
+        *NodeAbstractProvider
+}
+
+// GraphNodeEvalable
+func (n *NodeEvalableProvider) EvalTree() EvalNode {
+        addr := n.Addr
+        relAddr := addr.ProviderConfig
+
+        return &EvalInitProvider{
+                TypeName: relAddr.Type,
+                Addr:     addr.ProviderConfig,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go
index bb117c1..31ed1a8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go
@@ -3,6 +3,7 @@ package terraform
 import (
         "fmt"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
 )
 
@@ -10,7 +11,7 @@ import (
 // It registers all the common interfaces across operations for providers.
 type NodeProvisioner struct {
         NameValue string
-        PathValue []string
+        PathValue addrs.ModuleInstance
 
         // The fields below will be automatically set using the Attach
         // interfaces if you're running those transforms, but also be explicitly
@@ -19,17 +20,23 @@ type NodeProvisioner struct {
         Config *config.ProviderConfig
 }
 
+var (
+        _ GraphNodeSubPath     = (*NodeProvisioner)(nil)
+        _ GraphNodeProvisioner = (*NodeProvisioner)(nil)
+        _ GraphNodeEvalable    = (*NodeProvisioner)(nil)
+)
+
 func (n *NodeProvisioner) Name() string {
         result := fmt.Sprintf("provisioner.%s", n.NameValue)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
+        if len(n.PathValue) > 0 {
+                result = fmt.Sprintf("%s.%s", n.PathValue.String(), result)
         }
 
         return result
 }
 
 // GraphNodeSubPath
-func (n *NodeProvisioner) Path() []string {
+func (n *NodeProvisioner) Path() addrs.ModuleInstance {
         return n.PathValue
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
index 73509c8..3a0570c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
@@ -2,10 +2,16 @@ package terraform
 
 import (
         "fmt"
-        "strings"
+        "log"
+        "sort"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ConcreteResourceNodeFunc is a callback type used to convert an
@@ -16,225 +22,420 @@ type ConcreteResourceNodeFunc func(*NodeAbstractResource) dag.Vertex
 // The type of operation cannot be assumed, only that this node represents
 // the given resource.
 type GraphNodeResource interface {
-        ResourceAddr() *ResourceAddress
+        ResourceAddr() addrs.AbsResource
+}
+
+// ConcreteResourceInstanceNodeFunc is a callback type used to convert an
+// abstract resource instance to a concrete one of some type.
+type ConcreteResourceInstanceNodeFunc func(*NodeAbstractResourceInstance) dag.Vertex
+
+// GraphNodeResourceInstance is implemented by any nodes that represent
+// a resource instance. A single resource may have multiple instances if,
+// for example, the "count" or "for_each" argument is used for it in
+// configuration.
+type GraphNodeResourceInstance interface {
+        ResourceInstanceAddr() addrs.AbsResourceInstance
 }
 
 // NodeAbstractResource represents a resource that has no associated
 // operations. It registers all the interfaces for a resource that common
 // across multiple operation types.
 type NodeAbstractResource struct {
-        Addr *ResourceAddress // Addr is the address for this resource
+        Addr addrs.AbsResource // Addr is the address for this resource
 
         // The fields below will be automatically set using the Attach
         // interfaces if you're running those transforms, but also be explicitly
         // set if you already have that information.
 
-        Config        *config.Resource // Config is the resource in the config
-        ResourceState *ResourceState   // ResourceState is the ResourceState for this
+        Schema        *configschema.Block // Schema for processing the configuration body
+        SchemaVersion uint64              // Schema version of "Schema", as decided by the provider
+        Config        *configs.Resource   // Config is the resource in the config
 
-        Targets []ResourceAddress // Set from GraphNodeTargetable
+        ProvisionerSchemas map[string]*configschema.Block
+
+        Targets []addrs.Targetable // Set from GraphNodeTargetable
 
         // The address of the provider this resource will use
-        ResolvedProvider string
+        ResolvedProvider addrs.AbsProviderConfig
+}
+
+var (
+        _ GraphNodeSubPath                 = (*NodeAbstractResource)(nil)
+        _ GraphNodeReferenceable           = (*NodeAbstractResource)(nil)
+        _ GraphNodeReferencer              = (*NodeAbstractResource)(nil)
+        _ GraphNodeProviderConsumer        = (*NodeAbstractResource)(nil)
+        _ GraphNodeProvisionerConsumer     = (*NodeAbstractResource)(nil)
+        _ GraphNodeResource                = (*NodeAbstractResource)(nil)
+        _ GraphNodeAttachResourceConfig    = (*NodeAbstractResource)(nil)
+        _ GraphNodeAttachResourceSchema    = (*NodeAbstractResource)(nil)
+        _ GraphNodeAttachProvisionerSchema = (*NodeAbstractResource)(nil)
+        _ GraphNodeTargetable              = (*NodeAbstractResource)(nil)
+        _ dag.GraphNodeDotter              = (*NodeAbstractResource)(nil)
+)
+
+// NewNodeAbstractResource creates an abstract resource graph node for
+// the given absolute resource address.
+func NewNodeAbstractResource(addr addrs.AbsResource) *NodeAbstractResource {
+        return &NodeAbstractResource{
+                Addr: addr,
+        }
+}
+
+// NodeAbstractResourceInstance represents a resource instance with no
+// associated operations. It embeds NodeAbstractResource but additionally
+// contains an instance key, used to identify one of potentially many
+// instances that were created from a resource in configuration, e.g. using
+// the "count" or "for_each" arguments.
+type NodeAbstractResourceInstance struct {
+        NodeAbstractResource
+        InstanceKey addrs.InstanceKey
+
+        // The fields below will be automatically set using the Attach
+        // interfaces if you're running those transforms, but also be explicitly
+        // set if you already have that information.
+
+        ResourceState *states.Resource
+}
+
+var (
+        _ GraphNodeSubPath                 = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeReferenceable           = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeReferencer              = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeProviderConsumer        = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeProvisionerConsumer     = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeResource                = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeResourceInstance        = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachResourceState     = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig    = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachResourceSchema    = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachProvisionerSchema = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeTargetable              = (*NodeAbstractResourceInstance)(nil)
+        _ dag.GraphNodeDotter              = (*NodeAbstractResourceInstance)(nil)
+)
+
+// NewNodeAbstractResourceInstance creates an abstract resource instance graph
+// node for the given absolute resource instance address.
+func NewNodeAbstractResourceInstance(addr addrs.AbsResourceInstance) *NodeAbstractResourceInstance {
+        // Due to the fact that we embed NodeAbstractResource, the given address
+        // actually ends up split between the resource address in the embedded
+        // object and the InstanceKey field in our own struct. The
+        // ResourceInstanceAddr method will stick these back together again on
+        // request.
+        return &NodeAbstractResourceInstance{
+                NodeAbstractResource: NodeAbstractResource{
+                        Addr: addr.ContainingResource(),
+                },
+                InstanceKey: addr.Resource.Key,
+        }
 }
 
 func (n *NodeAbstractResource) Name() string {
-        return n.Addr.String()
+        return n.ResourceAddr().String()
+}
+
+func (n *NodeAbstractResourceInstance) Name() string {
+        return n.ResourceInstanceAddr().String()
 }
 
 // GraphNodeSubPath
-func (n *NodeAbstractResource) Path() []string {
-        return n.Addr.Path
+func (n *NodeAbstractResource) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeReferenceable
-func (n *NodeAbstractResource) ReferenceableName() []string {
-        // We always are referenceable as "type.name" as long as
-        // we have a config or address. Determine what that value is.
-        var id string
-        if n.Config != nil {
-                id = n.Config.Id()
-        } else if n.Addr != nil {
-                addrCopy := n.Addr.Copy()
-                addrCopy.Path = nil // ReferenceTransformer handles paths
-                addrCopy.Index = -1 // We handle indexes below
-                id = addrCopy.String()
-        } else {
-                // No way to determine our type.name, just return
-                return nil
-        }
+func (n *NodeAbstractResource) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr.Resource}
+}
 
-        var result []string
+// GraphNodeReferenceable
+func (n *NodeAbstractResourceInstance) ReferenceableAddrs() []addrs.Referenceable {
+        addr := n.ResourceInstanceAddr()
+        return []addrs.Referenceable{
+                addr.Resource,
+
+                // A resource instance can also be referenced by the address of its
+                // containing resource, so that e.g. a reference to aws_instance.foo
+                // would match both aws_instance.foo[0] and aws_instance.foo[1].
+                addr.ContainingResource().Resource,
+        }
+}
 
-        // Always include our own ID. This is primarily for backwards
-        // compatibility with states that didn't yet support the more
-        // specific dep string.
-        result = append(result, id)
+// GraphNodeReferencer
+func (n *NodeAbstractResource) References() []*addrs.Reference {
+        // If we have a config then we prefer to use that.
+        if c := n.Config; c != nil {
+                var result []*addrs.Reference
+
+                for _, traversal := range c.DependsOn {
+                        ref, err := addrs.ParseRef(traversal)
+                        if err != nil {
+                                // We ignore this here, because this isn't a suitable place to return
+                                // errors. This situation should be caught and rejected during
+                                // validation.
+                                log.Printf("[ERROR] Can't parse %#v from depends_on as reference: %s", traversal, err)
+                                continue
+                        }
 
-        // We represent all multi-access
-        result = append(result, fmt.Sprintf("%s.*", id))
+                        result = append(result, ref)
+                }
 
-        // We represent either a specific number, or all numbers
-        suffix := "N"
-        if n.Addr != nil {
-                idx := n.Addr.Index
-                if idx == -1 {
-                        idx = 0
+                if n.Schema == nil {
+                        // Should never happens, but we'll log if it does so that we can
+                        // see this easily when debugging.
+                        log.Printf("[WARN] no schema is attached to %s, so config references cannot be detected", n.Name())
                 }
 
-                suffix = fmt.Sprintf("%d", idx)
+                refs, _ := lang.ReferencesInExpr(c.Count)
+                result = append(result, refs...)
+                refs, _ = lang.ReferencesInBlock(c.Config, n.Schema)
+                result = append(result, refs...)
+                if c.Managed != nil {
+                        for _, p := range c.Managed.Provisioners {
+                                if p.When != configs.ProvisionerWhenCreate {
+                                        continue
+                                }
+                                if p.Connection != nil {
+                                        refs, _ = lang.ReferencesInBlock(p.Connection.Config, connectionBlockSupersetSchema)
+                                        result = append(result, refs...)
+                                }
+
+                                schema := n.ProvisionerSchemas[p.Type]
+                                if schema == nil {
+                                        log.Printf("[WARN] no schema for provisioner %q is attached to %s, so provisioner block references cannot be detected", p.Type, n.Name())
+                                }
+                                refs, _ = lang.ReferencesInBlock(p.Config, schema)
+                                result = append(result, refs...)
+                        }
+                }
+                return result
         }
-        result = append(result, fmt.Sprintf("%s.%s", id, suffix))
 
-        return result
+        // Otherwise, we have no references.
+        return nil
 }
 
 // GraphNodeReferencer
-func (n *NodeAbstractResource) References() []string {
-        // If we have a config, that is our source of truth
-        if c := n.Config; c != nil {
-                // Grab all the references
-                var result []string
-                result = append(result, c.DependsOn...)
-                result = append(result, ReferencesFromConfig(c.RawCount)...)
-                result = append(result, ReferencesFromConfig(c.RawConfig)...)
-                for _, p := range c.Provisioners {
-                        if p.When == config.ProvisionerWhenCreate {
-                                result = append(result, ReferencesFromConfig(p.ConnInfo)...)
-                                result = append(result, ReferencesFromConfig(p.RawConfig)...)
-                        }
+func (n *NodeAbstractResourceInstance) References() []*addrs.Reference {
+        // If we have a configuration attached then we'll delegate to our
+        // embedded abstract resource, which knows how to extract dependencies
+        // from configuration.
+        if n.Config != nil {
+                if n.Schema == nil {
+                        // We'll produce a log message about this out here so that
+                        // we can include the full instance address, since the equivalent
+                        // message in NodeAbstractResource.References cannot see it.
+                        log.Printf("[WARN] no schema is attached to %s, so config references cannot be detected", n.Name())
+                        return nil
                 }
-
-                return uniqueStrings(result)
+                return n.NodeAbstractResource.References()
         }
 
-        // If we have state, that is our next source
-        if s := n.ResourceState; s != nil {
-                return s.Dependencies
+        // Otherwise, if we have state then we'll use the values stored in state
+        // as a fallback.
+        if rs := n.ResourceState; rs != nil {
+                if s := rs.Instance(n.InstanceKey); s != nil {
+                        // State is still storing dependencies as old-style strings, so we'll
+                        // need to do a little work here to massage this to the form we now
+                        // want.
+                        var result []*addrs.Reference
+                        for _, addr := range s.Current.Dependencies {
+                                if addr == nil {
+                                        // Should never happen; indicates a bug in the state loader
+                                        panic(fmt.Sprintf("dependencies for current object on %s contains nil address", n.ResourceInstanceAddr()))
+                                }
+
+                                // This is a little weird: we need to manufacture an addrs.Reference
+                                // with a fake range here because the state isn't something we can
+                                // make source references into.
+                                result = append(result, &addrs.Reference{
+                                        Subject: addr,
+                                        SourceRange: tfdiags.SourceRange{
+                                                Filename: "(state file)",
+                                        },
+                                })
+                        }
+                        return result
+                }
         }
 
+        // If we have neither config nor state then we have no references.
         return nil
 }
 
+// converts an instance address to the legacy dotted notation
+func dottedInstanceAddr(tr addrs.ResourceInstance) string {
+        // The legacy state format uses dot-separated instance keys,
+        // rather than bracketed as in our modern syntax.
+        var suffix string
+        switch tk := tr.Key.(type) {
+        case addrs.IntKey:
+                suffix = fmt.Sprintf(".%d", int(tk))
+        case addrs.StringKey:
+                suffix = fmt.Sprintf(".%s", string(tk))
+        }
+        return tr.Resource.String() + suffix
+}
+
 // StateReferences returns the dependencies to put into the state for
 // this resource.
-func (n *NodeAbstractResource) StateReferences() []string {
-        self := n.ReferenceableName()
-
-        // Determine what our "prefix" is for checking for references to
-        // ourself.
-        addrCopy := n.Addr.Copy()
-        addrCopy.Index = -1
-        selfPrefix := addrCopy.String() + "."
+func (n *NodeAbstractResourceInstance) StateReferences() []addrs.Referenceable {
+        selfAddrs := n.ReferenceableAddrs()
+
+        // Since we don't include the source location references in our
+        // results from this method, we'll also filter out duplicates:
+        // there's no point in listing the same object twice without
+        // that additional context.
+        seen := map[string]struct{}{}
+
+        // Pretend that we've already "seen" all of our own addresses so that we
+        // won't record self-references in the state. This can arise if, for
+        // example, a provisioner for a resource refers to the resource itself,
+        // which is valid (since provisioners always run after apply) but should
+        // not create an explicit dependency edge.
+        for _, selfAddr := range selfAddrs {
+                seen[selfAddr.String()] = struct{}{}
+                if riAddr, ok := selfAddr.(addrs.ResourceInstance); ok {
+                        seen[riAddr.ContainingResource().String()] = struct{}{}
+                }
+        }
 
         depsRaw := n.References()
-        deps := make([]string, 0, len(depsRaw))
+        deps := make([]addrs.Referenceable, 0, len(depsRaw))
         for _, d := range depsRaw {
-                // Ignore any variable dependencies
-                if strings.HasPrefix(d, "var.") {
-                        continue
+                subj := d.Subject
+                if mco, isOutput := subj.(addrs.ModuleCallOutput); isOutput {
+                        // For state dependencies, we simplify outputs to just refer
+                        // to the module as a whole. It's not really clear why we do this,
+                        // but this logic is preserved from before the 0.12 rewrite of
+                        // this function.
+                        subj = mco.Call
                 }
 
-                // If this has a backup ref, ignore those for now. The old state
-                // file never contained those and I'd rather store the rich types we
-                // add in the future.
-                if idx := strings.IndexRune(d, '/'); idx != -1 {
-                        d = d[:idx]
-                }
-
-                // If we're referencing ourself, then ignore it
-                found := false
-                for _, s := range self {
-                        if d == s {
-                                found = true
-                        }
-                }
-                if found {
+                k := subj.String()
+                if _, exists := seen[k]; exists {
                         continue
                 }
-
-                // If this is a reference to ourself and a specific index, we keep
-                // it. For example, if this resource is "foo.bar" and the reference
-                // is "foo.bar.0" then we keep it exact. Otherwise, we strip it.
-                if strings.HasSuffix(d, ".0") && !strings.HasPrefix(d, selfPrefix) {
-                        d = d[:len(d)-2]
-                }
-
-                // This is sad. The dependencies are currently in the format of
-                // "module.foo.bar" (the full field). This strips the field off.
-                if strings.HasPrefix(d, "module.") {
-                        parts := strings.SplitN(d, ".", 3)
-                        d = strings.Join(parts[0:2], ".")
+                seen[k] = struct{}{}
+                switch tr := subj.(type) {
+                case addrs.ResourceInstance:
+                        deps = append(deps, tr)
+                case addrs.Resource:
+                        deps = append(deps, tr)
+                case addrs.ModuleCallInstance:
+                        deps = append(deps, tr)
+                default:
+                        // No other reference types are recorded in the state.
                 }
-
-                deps = append(deps, d)
         }
 
+        // We'll also sort them, since that'll avoid creating changes in the
+        // serialized state that make no semantic difference.
+        sort.Slice(deps, func(i, j int) bool {
+                // Simple string-based sort because we just care about consistency,
+                // not user-friendliness.
+                return deps[i].String() < deps[j].String()
+        })
+
         return deps
 }
 
-func (n *NodeAbstractResource) SetProvider(p string) {
+func (n *NodeAbstractResource) SetProvider(p addrs.AbsProviderConfig) {
         n.ResolvedProvider = p
 }
 
 // GraphNodeProviderConsumer
-func (n *NodeAbstractResource) ProvidedBy() string {
+func (n *NodeAbstractResource) ProvidedBy() (addrs.AbsProviderConfig, bool) {
         // If we have a config we prefer that above all else
         if n.Config != nil {
-                return resourceProvider(n.Config.Type, n.Config.Provider)
+                relAddr := n.Config.ProviderConfigAddr()
+                return relAddr.Absolute(n.Path()), false
+        }
+
+        // Use our type and containing module path to guess a provider configuration address
+        return n.Addr.Resource.DefaultProviderConfig().Absolute(n.Addr.Module), false
+}
+
+// GraphNodeProviderConsumer
+func (n *NodeAbstractResourceInstance) ProvidedBy() (addrs.AbsProviderConfig, bool) {
+        // If we have a config we prefer that above all else
+        if n.Config != nil {
+                relAddr := n.Config.ProviderConfigAddr()
+                return relAddr.Absolute(n.Path()), false
         }
 
         // If we have state, then we will use the provider from there
-        if n.ResourceState != nil && n.ResourceState.Provider != "" {
-                return n.ResourceState.Provider
+        if n.ResourceState != nil {
+                // An address from the state must match exactly, since we must ensure
+                // we refresh/destroy a resource with the same provider configuration
+                // that created it.
+                return n.ResourceState.ProviderConfig, true
         }
 
-        // Use our type
-        return resourceProvider(n.Addr.Type, "")
+        // Use our type and containing module path to guess a provider configuration address
+        return n.Addr.Resource.DefaultProviderConfig().Absolute(n.Path()), false
 }
 
 // GraphNodeProvisionerConsumer
 func (n *NodeAbstractResource) ProvisionedBy() []string {
         // If we have no configuration, then we have no provisioners
-        if n.Config == nil {
+        if n.Config == nil || n.Config.Managed == nil {
                 return nil
         }
 
         // Build the list of provisioners we need based on the configuration.
         // It is okay to have duplicates here.
-        result := make([]string, len(n.Config.Provisioners))
-        for i, p := range n.Config.Provisioners {
+        result := make([]string, len(n.Config.Managed.Provisioners))
+        for i, p := range n.Config.Managed.Provisioners {
                 result[i] = p.Type
         }
 
         return result
 }
 
-// GraphNodeResource, GraphNodeAttachResourceState
-func (n *NodeAbstractResource) ResourceAddr() *ResourceAddress {
+// GraphNodeProvisionerConsumer
+func (n *NodeAbstractResource) AttachProvisionerSchema(name string, schema *configschema.Block) {
+        if n.ProvisionerSchemas == nil {
+                n.ProvisionerSchemas = make(map[string]*configschema.Block)
+        }
+        n.ProvisionerSchemas[name] = schema
+}
+
+// GraphNodeResource
+func (n *NodeAbstractResource) ResourceAddr() addrs.AbsResource {
         return n.Addr
 }
 
+// GraphNodeResourceInstance
+func (n *NodeAbstractResourceInstance) ResourceInstanceAddr() addrs.AbsResourceInstance {
+        return n.NodeAbstractResource.Addr.Instance(n.InstanceKey)
+}
+
 // GraphNodeAddressable, TODO: remove, used by target, should unify
 func (n *NodeAbstractResource) ResourceAddress() *ResourceAddress {
-        return n.ResourceAddr()
+        return NewLegacyResourceAddress(n.Addr)
 }
 
 // GraphNodeTargetable
-func (n *NodeAbstractResource) SetTargets(targets []ResourceAddress) {
+func (n *NodeAbstractResource) SetTargets(targets []addrs.Targetable) {
         n.Targets = targets
 }
 
 // GraphNodeAttachResourceState
-func (n *NodeAbstractResource) AttachResourceState(s *ResourceState) {
+func (n *NodeAbstractResourceInstance) AttachResourceState(s *states.Resource) {
         n.ResourceState = s
 }
 
 // GraphNodeAttachResourceConfig
-func (n *NodeAbstractResource) AttachResourceConfig(c *config.Resource) {
+func (n *NodeAbstractResource) AttachResourceConfig(c *configs.Resource) {
         n.Config = c
 }
 
+// GraphNodeAttachResourceSchema impl
+func (n *NodeAbstractResource) AttachResourceSchema(schema *configschema.Block, version uint64) {
+        n.Schema = schema
+        n.SchemaVersion = version
+}
+
 // GraphNodeDotter impl.
 func (n *NodeAbstractResource) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
         return &dag.DotNode{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract_count.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract_count.go
deleted file mode 100644
index 573570d..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract_count.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package terraform
-
-// NodeAbstractCountResource should be embedded instead of NodeAbstractResource
-// if the resource has a `count` value that needs to be expanded.
-//
-// The embedder should implement `DynamicExpand` to process the count.
-type NodeAbstractCountResource struct {
-        *NodeAbstractResource
-
-        // Validate, if true, will perform the validation for the count.
-        // This should only be turned on for the "validate" operation.
-        Validate bool
-}
-
-// GraphNodeEvalable
-func (n *NodeAbstractCountResource) EvalTree() EvalNode {
-        // We only check if the count is computed if we're not validating.
-        // If we're validating we allow computed counts since they just turn
-        // into more computed values.
-        var evalCountCheckComputed EvalNode
-        if !n.Validate {
-                evalCountCheckComputed = &EvalCountCheckComputed{Resource: n.Config}
-        }
-
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        // The EvalTree for a plannable resource primarily involves
-                        // interpolating the count since it can contain variables
-                        // we only just received access to.
-                        //
-                        // With the interpolated count, we can then DynamicExpand
-                        // into the proper number of instances.
-                        &EvalInterpolate{Config: n.Config.RawCount},
-
-                        // Check if the count is computed
-                        evalCountCheckComputed,
-
-                        // If validation is enabled, perform the validation
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        return n.Validate, nil
-                                },
-
-                                Then: &EvalValidateCount{Resource: n.Config},
-                        },
-
-                        &EvalCountFixZeroOneBoundary{Resource: n.Config},
-                },
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
index 40ee1cf..3e2fff3 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
@@ -1,400 +1,71 @@
 package terraform
 
 import (
-        "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
 )
 
 // NodeApplyableResource represents a resource that is "applyable":
-// it is ready to be applied and is represented by a diff.
+// it may need to have its record in the state adjusted to match configuration.
+//
+// Unlike in the plan walk, this resource node does not DynamicExpand. Instead,
+// it should be inserted into the same graph as any instances of the nodes
+// with dependency edges ensuring that the resource is evaluated before any
+// of its instances, which will turn ensure that the whole-resource record
+// in the state is suitably prepared to receive any updates to instances.
 type NodeApplyableResource struct {
         *NodeAbstractResource
 }
 
-// GraphNodeCreator
-func (n *NodeApplyableResource) CreateAddr() *ResourceAddress {
-        return n.NodeAbstractResource.Addr
-}
-
-// GraphNodeReferencer, overriding NodeAbstractResource
-func (n *NodeApplyableResource) References() []string {
-        result := n.NodeAbstractResource.References()
-
-        // The "apply" side of a resource generally also depends on the
-        // destruction of its dependencies as well. For example, if a LB
-        // references a set of VMs with ${vm.foo.*.id}, then we must wait for
-        // the destruction so we get the newly updated list of VMs.
-        //
-        // The exception here is CBD. When CBD is set, we don't do this since
-        // it would create a cycle. By not creating a cycle, we require two
-        // applies since the first apply the creation step will use the OLD
-        // values (pre-destroy) and the second step will update.
-        //
-        // This is how Terraform behaved with "legacy" graphs (TF <= 0.7.x).
-        // We mimic that behavior here now and can improve upon it in the future.
-        //
-        // This behavior is tested in graph_build_apply_test.go to test ordering.
-        cbd := n.Config != nil && n.Config.Lifecycle.CreateBeforeDestroy
-        if !cbd {
-                // The "apply" side of a resource always depends on the destruction
-                // of all its dependencies in addition to the creation.
-                for _, v := range result {
-                        result = append(result, v+".destroy")
-                }
-        }
+var (
+        _ GraphNodeResource             = (*NodeApplyableResource)(nil)
+        _ GraphNodeEvalable             = (*NodeApplyableResource)(nil)
+        _ GraphNodeProviderConsumer     = (*NodeApplyableResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeApplyableResource)(nil)
+        _ GraphNodeReferencer           = (*NodeApplyableResource)(nil)
+)
 
-        return result
+func (n *NodeApplyableResource) Name() string {
+        return n.NodeAbstractResource.Name() + " (prepare state)"
 }
 
-// GraphNodeEvalable
-func (n *NodeApplyableResource) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
+func (n *NodeApplyableResource) References() []*addrs.Reference {
+        if n.Config == nil {
+                log.Printf("[WARN] NodeApplyableResource %q: no configuration, so can't determine References", dag.VertexName(n))
+                return nil
         }
 
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+        var result []*addrs.Reference
 
-        // Determine the dependencies for the state.
-        stateDeps := n.StateReferences()
+        // Since this node type only updates resource-level metadata, we only
+        // need to worry about the parts of the configuration that affect
+        // our "each mode": the count and for_each meta-arguments.
+        refs, _ := lang.ReferencesInExpr(n.Config.Count)
+        result = append(result, refs...)
+        refs, _ = lang.ReferencesInExpr(n.Config.ForEach)
+        result = append(result, refs...)
 
-        // Eval info is different depending on what kind of resource this is
-        switch n.Config.Mode {
-        case config.ManagedResourceMode:
-                return n.evalTreeManagedResource(
-                        stateId, info, resource, stateDeps,
-                )
-        case config.DataResourceMode:
-                return n.evalTreeDataResource(
-                        stateId, info, resource, stateDeps)
-        default:
-                panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
-        }
+        return result
 }
 
-func (n *NodeApplyableResource) evalTreeDataResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        var provider ResourceProvider
-        var config *ResourceConfig
-        var diff *InstanceDiff
-        var state *InstanceState
-
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        // Build the instance info
-                        &EvalInstanceInfo{
-                                Info: info,
-                        },
-
-                        // Get the saved diff for apply
-                        &EvalReadDiff{
-                                Name: stateId,
-                                Diff: &diff,
-                        },
-
-                        // Stop here if we don't actually have a diff
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        if diff == nil {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        if diff.GetAttributesLen() == 0 {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        return true, nil
-                                },
-                                Then: EvalNoop{},
-                        },
-
-                        // Normally we interpolate count as a preparation step before
-                        // a DynamicExpand, but an apply graph has pre-expanded nodes
-                        // and so the count would otherwise never be interpolated.
-                        //
-                        // This is redundant when there are multiple instances created
-                        // from the same config (count > 1) but harmless since the
-                        // underlying structures have mutexes to make this concurrency-safe.
-                        //
-                        // In most cases this isn't actually needed because we dealt with
-                        // all of the counts during the plan walk, but we do it here
-                        // for completeness because other code assumes that the
-                        // final count is always available during interpolation.
-                        //
-                        // Here we are just populating the interpolated value in-place
-                        // inside this RawConfig object, like we would in
-                        // NodeAbstractCountResource.
-                        &EvalInterpolate{
-                                Config:        n.Config.RawCount,
-                                ContinueOnErr: true,
-                        },
-
-                        // We need to re-interpolate the config here, rather than
-                        // just using the diff's values directly, because we've
-                        // potentially learned more variable values during the
-                        // apply pass that weren't known when the diff was produced.
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
-                        },
-
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-
-                        // Make a new diff with our newly-interpolated config.
-                        &EvalReadDataDiff{
-                                Info:     info,
-                                Config:   &config,
-                                Previous: &diff,
-                                Provider: &provider,
-                                Output:   &diff,
-                        },
-
-                        &EvalReadDataApply{
-                                Info:     info,
-                                Diff:     &diff,
-                                Provider: &provider,
-                                Output:   &state,
-                        },
-
-                        &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
-                        },
-
-                        // Clear the diff now that we've applied it, so
-                        // later nodes won't see a diff that's now a no-op.
-                        &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: nil,
-                        },
-
-                        &EvalUpdateStateHook{},
-                },
+// GraphNodeEvalable
+func (n *NodeApplyableResource) EvalTree() EvalNode {
+        addr := n.ResourceAddr()
+        config := n.Config
+        providerAddr := n.ResolvedProvider
+
+        if config == nil {
+                // Nothing to do, then.
+                log.Printf("[TRACE] NodeApplyableResource: no configuration present for %s", addr)
+                return &EvalNoop{}
         }
-}
-
-func (n *NodeApplyableResource) evalTreeManagedResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var diff, diffApply *InstanceDiff
-        var state *InstanceState
-        var resourceConfig *ResourceConfig
-        var err error
-        var createNew bool
-        var createBeforeDestroyEnabled bool
-
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        // Build the instance info
-                        &EvalInstanceInfo{
-                                Info: info,
-                        },
-
-                        // Get the saved diff for apply
-                        &EvalReadDiff{
-                                Name: stateId,
-                                Diff: &diffApply,
-                        },
-
-                        // We don't want to do any destroys
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        if diffApply == nil {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        if diffApply.GetDestroy() && diffApply.GetAttributesLen() == 0 {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        diffApply.SetDestroy(false)
-                                        return true, nil
-                                },
-                                Then: EvalNoop{},
-                        },
-
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        destroy := false
-                                        if diffApply != nil {
-                                                destroy = diffApply.GetDestroy() || diffApply.RequiresNew()
-                                        }
-
-                                        createBeforeDestroyEnabled =
-                                                n.Config.Lifecycle.CreateBeforeDestroy &&
-                                                        destroy
-
-                                        return createBeforeDestroyEnabled, nil
-                                },
-                                Then: &EvalDeposeState{
-                                        Name: stateId,
-                                },
-                        },
-
-                        // Normally we interpolate count as a preparation step before
-                        // a DynamicExpand, but an apply graph has pre-expanded nodes
-                        // and so the count would otherwise never be interpolated.
-                        //
-                        // This is redundant when there are multiple instances created
-                        // from the same config (count > 1) but harmless since the
-                        // underlying structures have mutexes to make this concurrency-safe.
-                        //
-                        // In most cases this isn't actually needed because we dealt with
-                        // all of the counts during the plan walk, but we need to do this
-                        // in order to support interpolation of resource counts from
-                        // apply-time-interpolated expressions, such as those in
-                        // "provisioner" blocks.
-                        //
-                        // Here we are just populating the interpolated value in-place
-                        // inside this RawConfig object, like we would in
-                        // NodeAbstractCountResource.
-                        &EvalInterpolate{
-                                Config:        n.Config.RawCount,
-                                ContinueOnErr: true,
-                        },
-
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &resourceConfig,
-                        },
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-                        &EvalReadState{
-                                Name:   stateId,
-                                Output: &state,
-                        },
-                        // Re-run validation to catch any errors we missed, e.g. type
-                        // mismatches on computed values.
-                        &EvalValidateResource{
-                                Provider:       &provider,
-                                Config:         &resourceConfig,
-                                ResourceName:   n.Config.Name,
-                                ResourceType:   n.Config.Type,
-                                ResourceMode:   n.Config.Mode,
-                                IgnoreWarnings: true,
-                        },
-                        &EvalDiff{
-                                Info:       info,
-                                Config:     &resourceConfig,
-                                Resource:   n.Config,
-                                Provider:   &provider,
-                                Diff:       &diffApply,
-                                State:      &state,
-                                OutputDiff: &diffApply,
-                        },
-
-                        // Get the saved diff
-                        &EvalReadDiff{
-                                Name: stateId,
-                                Diff: &diff,
-                        },
-
-                        // Compare the diffs
-                        &EvalCompareDiff{
-                                Info: info,
-                                One:  &diff,
-                                Two:  &diffApply,
-                        },
-
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-                        &EvalReadState{
-                                Name:   stateId,
-                                Output: &state,
-                        },
-                        // Call pre-apply hook
-                        &EvalApplyPre{
-                                Info:  info,
-                                State: &state,
-                                Diff:  &diffApply,
-                        },
-                        &EvalApply{
-                                Info:      info,
-                                State:     &state,
-                                Diff:      &diffApply,
-                                Provider:  &provider,
-                                Output:    &state,
-                                Error:     &err,
-                                CreateNew: &createNew,
-                        },
-                        &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
-                        },
-                        &EvalApplyProvisioners{
-                                Info:           info,
-                                State:          &state,
-                                Resource:       n.Config,
-                                InterpResource: resource,
-                                CreateNew:      &createNew,
-                                Error:          &err,
-                                When:           config.ProvisionerWhenCreate,
-                        },
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        return createBeforeDestroyEnabled && err != nil, nil
-                                },
-                                Then: &EvalUndeposeState{
-                                        Name:  stateId,
-                                        State: &state,
-                                },
-                                Else: &EvalWriteState{
-                                        Name:         stateId,
-                                        ResourceType: n.Config.Type,
-                                        Provider:     n.ResolvedProvider,
-                                        Dependencies: stateDeps,
-                                        State:        &state,
-                                },
-                        },
-
-                        // We clear the diff out here so that future nodes
-                        // don't see a diff that is already complete. There
-                        // is no longer a diff!
-                        &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: nil,
-                        },
 
-                        &EvalApplyPost{
-                                Info:  info,
-                                State: &state,
-                                Error: &err,
-                        },
-                        &EvalUpdateStateHook{},
-                },
+        return &EvalWriteResourceState{
+                Addr:         addr.Resource,
+                Config:       config,
+                ProviderAddr: providerAddr,
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go
new file mode 100644
index 0000000..dad7bfc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go
@@ -0,0 +1,433 @@
+package terraform
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// NodeApplyableResourceInstance represents a resource instance that is
+// "applyable": it is ready to be applied and is represented by a diff.
+//
+// This node is for a specific instance of a resource. It will usually be
+// accompanied in the graph by a NodeApplyableResource representing its
+// containing resource, and should depend on that node to ensure that the
+// state is properly prepared to receive changes to instances.
+type NodeApplyableResourceInstance struct {
+        *NodeAbstractResourceInstance
+
+        destroyNode      GraphNodeDestroyerCBD
+        graphNodeDeposer // implementation of GraphNodeDeposer
+}
+
+var (
+        _ GraphNodeResource         = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeResourceInstance = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeCreator          = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeReferencer       = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeDeposer          = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeEvalable         = (*NodeApplyableResourceInstance)(nil)
+)
+
+// GraphNodeAttachDestroyer
+func (n *NodeApplyableResourceInstance) AttachDestroyNode(d GraphNodeDestroyerCBD) {
+        n.destroyNode = d
+}
+
+// createBeforeDestroy checks this nodes config status and the status af any
+// companion destroy node for CreateBeforeDestroy.
+func (n *NodeApplyableResourceInstance) createBeforeDestroy() bool {
+        cbd := false
+
+        if n.Config != nil && n.Config.Managed != nil {
+                cbd = n.Config.Managed.CreateBeforeDestroy
+        }
+
+        if n.destroyNode != nil {
+                cbd = cbd || n.destroyNode.CreateBeforeDestroy()
+        }
+
+        return cbd
+}
+
+// GraphNodeCreator
+func (n *NodeApplyableResourceInstance) CreateAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
+}
+
+// GraphNodeReferencer, overriding NodeAbstractResourceInstance
+func (n *NodeApplyableResourceInstance) References() []*addrs.Reference {
+        // Start with the usual resource instance implementation
+        ret := n.NodeAbstractResourceInstance.References()
+
+        // Applying a resource must also depend on the destruction of any of its
+        // dependencies, since this may for example affect the outcome of
+        // evaluating an entire list of resources with "count" set (by reducing
+        // the count).
+        //
+        // However, we can't do this in create_before_destroy mode because that
+        // would create a dependency cycle. We make a compromise here of requiring
+        // changes to be updated across two applies in this case, since the first
+        // plan will use the old values.
+        if !n.createBeforeDestroy() {
+                for _, ref := range ret {
+                        switch tr := ref.Subject.(type) {
+                        case addrs.ResourceInstance:
+                                newRef := *ref // shallow copy so we can mutate
+                                newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                                newRef.Remaining = nil // can't access attributes of something being destroyed
+                                ret = append(ret, &newRef)
+                        case addrs.Resource:
+                                newRef := *ref // shallow copy so we can mutate
+                                newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                                newRef.Remaining = nil // can't access attributes of something being destroyed
+                                ret = append(ret, &newRef)
+                        }
+                }
+        }
+
+        return ret
+}
+
+// GraphNodeEvalable
+func (n *NodeApplyableResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
+        // State still uses legacy-style internal ids, so we need to shim to get
+        // a suitable key to use.
+        stateId := NewLegacyResourceInstanceAddress(addr).stateId()
+
+        // Determine the dependencies for the state.
+        stateDeps := n.StateReferences()
+
+        if n.Config == nil {
+                // This should not be possible, but we've got here in at least one
+                // case as discussed in the following issue:
+                //    https://github.com/hashicorp/terraform/issues/21258
+                // To avoid an outright crash here, we'll instead return an explicit
+                // error.
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Resource node has no configuration attached",
+                        fmt.Sprintf(
+                                "The graph node for %s has no configuration attached to it. This suggests a bug in Terraform's apply graph builder; please report it!",
+                                addr,
+                        ),
+                ))
+                err := diags.Err()
+                return &EvalReturnError{
+                        Error: &err,
+                }
+        }
+
+        // Eval info is different depending on what kind of resource this is
+        switch n.Config.Mode {
+        case addrs.ManagedResourceMode:
+                return n.evalTreeManagedResource(addr, stateId, stateDeps)
+        case addrs.DataResourceMode:
+                return n.evalTreeDataResource(addr, stateId, stateDeps)
+        default:
+                panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
+        }
+}
+
+func (n *NodeApplyableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+
+                        // Get the saved diff for apply
+                        &EvalReadDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
+                        },
+
+                        // Stop early if we don't actually have a diff
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if change == nil {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        return true, nil
+                                },
+                                Then: EvalNoop{},
+                        },
+
+                        // In this particular call to EvalReadData we include our planned
+                        // change, which signals that we expect this read to complete fully
+                        // with no unknown values; it'll produce an error if not.
+                        &EvalReadData{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Dependencies:   n.StateReferences(),
+                                Planned:        &change, // setting this indicates that the result must be complete
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                OutputState:    &state,
+                        },
+
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+
+                        // Clear the diff now that we've applied it, so
+                        // later nodes won't see a diff that's now a no-op.
+                        &EvalWriteDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         nil,
+                        },
+
+                        &EvalUpdateStateHook{},
+                },
+        }
+}
+
+func (n *NodeApplyableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        // Declare a bunch of variables that are used for state during
+        // evaluation. Most of this are written to by-address below.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var diff, diffApply *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var err error
+        var createNew bool
+        var createBeforeDestroyEnabled bool
+        var configVal cty.Value
+        var deposedKey states.DeposedKey
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+
+                        // Get the saved diff for apply
+                        &EvalReadDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &diffApply,
+                        },
+
+                        // We don't want to do any destroys
+                        // (these are handled by NodeDestroyResourceInstance instead)
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if diffApply == nil {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        if diffApply.Action == plans.Delete {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        return true, nil
+                                },
+                                Then: EvalNoop{},
+                        },
+
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        destroy := false
+                                        if diffApply != nil {
+                                                destroy = (diffApply.Action == plans.Delete || diffApply.Action.IsReplace())
+                                        }
+                                        if destroy && n.createBeforeDestroy() {
+                                                createBeforeDestroyEnabled = true
+                                        }
+                                        return createBeforeDestroyEnabled, nil
+                                },
+                                Then: &EvalDeposeState{
+                                        Addr:      addr.Resource,
+                                        ForceKey:  n.PreallocatedDeposedKey,
+                                        OutputKey: &deposedKey,
+                                },
+                        },
+
+                        &EvalReadState{
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
+                                Output: &state,
+                        },
+
+                        // Get the saved diff
+                        &EvalReadDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &diff,
+                        },
+
+                        // Make a new diff, in case we've learned new values in the state
+                        // during apply which we can now incorporate.
+                        &EvalDiff{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                PreviousDiff:   &diff,
+                                OutputChange:   &diffApply,
+                                OutputValue:    &configVal,
+                                OutputState:    &state,
+                        },
+
+                        // Compare the diffs
+                        &EvalCheckPlannedChange{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                Planned:        &diff,
+                                Actual:         &diffApply,
+                        },
+
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+                        &EvalReadState{
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
+                                Output: &state,
+                        },
+
+                        &EvalReduceDiff{
+                                Addr:      addr.Resource,
+                                InChange:  &diffApply,
+                                Destroy:   false,
+                                OutChange: &diffApply,
+                        },
+
+                        // EvalReduceDiff may have simplified our planned change
+                        // into a NoOp if it only requires destroying, since destroying
+                        // is handled by NodeDestroyResourceInstance.
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if diffApply == nil || diffApply.Action == plans.NoOp {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        return true, nil
+                                },
+                                Then: EvalNoop{},
+                        },
+
+                        // Call pre-apply hook
+                        &EvalApplyPre{
+                                Addr:   addr.Resource,
+                                State:  &state,
+                                Change: &diffApply,
+                        },
+                        &EvalApply{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Dependencies:   n.StateReferences(),
+                                State:          &state,
+                                Change:         &diffApply,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                Output:         &state,
+                                Error:          &err,
+                                CreateNew:      &createNew,
+                        },
+                        &EvalMaybeTainted{
+                                Addr:        addr.Resource,
+                                State:       &state,
+                                Change:      &diffApply,
+                                Error:       &err,
+                                StateOutput: &state,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+                        &EvalApplyProvisioners{
+                                Addr:           addr.Resource,
+                                State:          &state, // EvalApplyProvisioners will skip if already tainted
+                                ResourceConfig: n.Config,
+                                CreateNew:      &createNew,
+                                Error:          &err,
+                                When:           configs.ProvisionerWhenCreate,
+                        },
+                        &EvalMaybeTainted{
+                                Addr:        addr.Resource,
+                                State:       &state,
+                                Change:      &diffApply,
+                                Error:       &err,
+                                StateOutput: &state,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        return createBeforeDestroyEnabled && err != nil, nil
+                                },
+                                Then: &EvalMaybeRestoreDeposedObject{
+                                        Addr: addr.Resource,
+                                        Key:  &deposedKey,
+                                },
+                        },
+
+                        // We clear the diff out here so that future nodes
+                        // don't see a diff that is already complete. There
+                        // is no longer a diff!
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if !diff.Action.IsReplace() {
+                                                return true, nil
+                                        }
+                                        if !n.createBeforeDestroy() {
+                                                return true, nil
+                                        }
+                                        return false, nil
+                                },
+                                Then: &EvalWriteDiff{
+                                        Addr:           addr.Resource,
+                                        ProviderSchema: &providerSchema,
+                                        Change:         nil,
+                                },
+                        },
+
+                        &EvalApplyPost{
+                                Addr:  addr.Resource,
+                                State: &state,
+                                Error: &err,
+                        },
+                        &EvalUpdateStateHook{},
+                },
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
index 657bbee..ca2267e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
@@ -2,81 +2,114 @@ package terraform
 
 import (
         "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
 )
 
-// NodeDestroyResource represents a resource that is to be destroyed.
-type NodeDestroyResource struct {
-        *NodeAbstractResource
+// NodeDestroyResourceInstance represents a resource instance that is to be
+// destroyed.
+type NodeDestroyResourceInstance struct {
+        *NodeAbstractResourceInstance
+
+        // If DeposedKey is set to anything other than states.NotDeposed then
+        // this node destroys a deposed object of the associated instance
+        // rather than its current object.
+        DeposedKey states.DeposedKey
+
+        CreateBeforeDestroyOverride *bool
 }
 
-func (n *NodeDestroyResource) Name() string {
-        return n.NodeAbstractResource.Name() + " (destroy)"
+var (
+        _ GraphNodeResource            = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeResourceInstance    = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeDestroyer           = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeDestroyerCBD        = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeReferenceable       = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeReferencer          = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeEvalable            = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeProviderConsumer    = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeProvisionerConsumer = (*NodeDestroyResourceInstance)(nil)
+)
+
+func (n *NodeDestroyResourceInstance) Name() string {
+        if n.DeposedKey != states.NotDeposed {
+                return fmt.Sprintf("%s (destroy deposed %s)", n.ResourceInstanceAddr(), n.DeposedKey)
+        }
+        return n.ResourceInstanceAddr().String() + " (destroy)"
 }
 
 // GraphNodeDestroyer
-func (n *NodeDestroyResource) DestroyAddr() *ResourceAddress {
-        return n.Addr
+func (n *NodeDestroyResourceInstance) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
 }
 
 // GraphNodeDestroyerCBD
-func (n *NodeDestroyResource) CreateBeforeDestroy() bool {
+func (n *NodeDestroyResourceInstance) CreateBeforeDestroy() bool {
+        if n.CreateBeforeDestroyOverride != nil {
+                return *n.CreateBeforeDestroyOverride
+        }
+
         // If we have no config, we just assume no
-        if n.Config == nil {
+        if n.Config == nil || n.Config.Managed == nil {
                 return false
         }
 
-        return n.Config.Lifecycle.CreateBeforeDestroy
+        return n.Config.Managed.CreateBeforeDestroy
 }
 
 // GraphNodeDestroyerCBD
-func (n *NodeDestroyResource) ModifyCreateBeforeDestroy(v bool) error {
-        // If we have no config, do nothing since it won't affect the
-        // create step anyways.
-        if n.Config == nil {
-                return nil
-        }
-
-        // Set CBD to true
-        n.Config.Lifecycle.CreateBeforeDestroy = true
-
+func (n *NodeDestroyResourceInstance) ModifyCreateBeforeDestroy(v bool) error {
+        n.CreateBeforeDestroyOverride = &v
         return nil
 }
 
 // GraphNodeReferenceable, overriding NodeAbstractResource
-func (n *NodeDestroyResource) ReferenceableName() []string {
-        // We modify our referenceable name to have the suffix of ".destroy"
-        // since depending on the creation side doesn't necessarilly mean
-        // depending on destruction.
-        suffix := ".destroy"
-
-        // If we're CBD, we also append "-cbd". This is because CBD will setup
-        // its own edges (in CBDEdgeTransformer). Depending on the "destroy"
-        // side generally doesn't mean depending on CBD as well. See GH-11349
+func (n *NodeDestroyResourceInstance) ReferenceableAddrs() []addrs.Referenceable {
+        normalAddrs := n.NodeAbstractResourceInstance.ReferenceableAddrs()
+        destroyAddrs := make([]addrs.Referenceable, len(normalAddrs))
+
+        phaseType := addrs.ResourceInstancePhaseDestroy
         if n.CreateBeforeDestroy() {
-                suffix += "-cbd"
+                phaseType = addrs.ResourceInstancePhaseDestroyCBD
         }
 
-        result := n.NodeAbstractResource.ReferenceableName()
-        for i, v := range result {
-                result[i] = v + suffix
+        for i, normalAddr := range normalAddrs {
+                switch ta := normalAddr.(type) {
+                case addrs.Resource:
+                        destroyAddrs[i] = ta.Phase(phaseType)
+                case addrs.ResourceInstance:
+                        destroyAddrs[i] = ta.Phase(phaseType)
+                default:
+                        destroyAddrs[i] = normalAddr
+                }
         }
 
-        return result
+        return destroyAddrs
 }
 
 // GraphNodeReferencer, overriding NodeAbstractResource
-func (n *NodeDestroyResource) References() []string {
+func (n *NodeDestroyResourceInstance) References() []*addrs.Reference {
         // If we have a config, then we need to include destroy-time dependencies
-        if c := n.Config; c != nil {
-                var result []string
-                for _, p := range c.Provisioners {
-                        // We include conn info and config for destroy time provisioners
-                        // as dependencies that we have.
-                        if p.When == config.ProvisionerWhenDestroy {
-                                result = append(result, ReferencesFromConfig(p.ConnInfo)...)
-                                result = append(result, ReferencesFromConfig(p.RawConfig)...)
+        if c := n.Config; c != nil && c.Managed != nil {
+                var result []*addrs.Reference
+
+                // We include conn info and config for destroy time provisioners
+                // as dependencies that we have.
+                for _, p := range c.Managed.Provisioners {
+                        schema := n.ProvisionerSchemas[p.Type]
+
+                        if p.When == configs.ProvisionerWhenDestroy {
+                                if p.Connection != nil {
+                                        result = append(result, ReferencesFromConfig(p.Connection.Config, connectionBlockSupersetSchema)...)
+                                }
+                                result = append(result, ReferencesFromConfig(p.Config, schema)...)
                         }
                 }
 
@@ -86,117 +119,66 @@ func (n *NodeDestroyResource) References() []string {
         return nil
 }
 
-// GraphNodeDynamicExpandable
-func (n *NodeDestroyResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // If we have no config we do nothing
-        if n.Addr == nil {
-                return nil, nil
-        }
-
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Start creating the steps
-        steps := make([]GraphTransformer, 0, 5)
-
-        // We want deposed resources in the state to be destroyed
-        steps = append(steps, &DeposedTransformer{
-                State:            state,
-                View:             n.Addr.stateId(),
-                ResolvedProvider: n.ResolvedProvider,
-        })
-
-        // Target
-        steps = append(steps, &TargetsTransformer{
-                ParsedTargets: n.Targets,
-        })
-
-        // Always end with the root being added
-        steps = append(steps, &RootTransformer{})
-
-        // Build the graph
-        b := &BasicGraphBuilder{
-                Steps: steps,
-                Name:  "NodeResourceDestroy",
-        }
-        return b.Build(ctx.Path())
-}
-
 // GraphNodeEvalable
-func (n *NodeDestroyResource) EvalTree() EvalNode {
-        // stateId is the ID to put into the state
-        stateId := n.Addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:          stateId,
-                Type:        n.Addr.Type,
-                uniqueExtra: "destroy",
-        }
-
-        // Build the resource for eval
-        addr := n.Addr
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+func (n *NodeDestroyResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
         // Get our state
         rs := n.ResourceState
-        if rs == nil {
-                rs = &ResourceState{
-                        Provider: n.ResolvedProvider,
-                }
+        var is *states.ResourceInstance
+        if rs != nil {
+                is = rs.Instance(n.InstanceKey)
+        }
+        if is == nil {
+                log.Printf("[WARN] NodeDestroyResourceInstance for %s with no state", addr)
         }
 
-        var diffApply *InstanceDiff
-        var provider ResourceProvider
-        var state *InstanceState
+        var changeApply *plans.ResourceInstanceChange
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
         var err error
         return &EvalOpFilter{
                 Ops: []walkOperation{walkApply, walkDestroy},
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
+                                &EvalGetProvider{
+                                        Addr:   n.ResolvedProvider,
+                                        Output: &provider,
+                                        Schema: &providerSchema,
+                                },
+
                                 // Get the saved diff for apply
                                 &EvalReadDiff{
-                                        Name: stateId,
-                                        Diff: &diffApply,
+                                        Addr:           addr.Resource,
+                                        ProviderSchema: &providerSchema,
+                                        Change:         &changeApply,
                                 },
 
-                                // Filter the diff so we only get the destroy
-                                &EvalFilterDiff{
-                                        Diff:    &diffApply,
-                                        Output:  &diffApply,
-                                        Destroy: true,
+                                &EvalReduceDiff{
+                                        Addr:      addr.Resource,
+                                        InChange:  &changeApply,
+                                        Destroy:   true,
+                                        OutChange: &changeApply,
                                 },
 
-                                // If we're not destroying, then compare diffs
+                                // EvalReduceDiff may have simplified our planned change
+                                // into a NoOp if it does not require destroying.
                                 &EvalIf{
                                         If: func(ctx EvalContext) (bool, error) {
-                                                if diffApply != nil && diffApply.GetDestroy() {
-                                                        return true, nil
+                                                if changeApply == nil || changeApply.Action == plans.NoOp {
+                                                        return true, EvalEarlyExitError{}
                                                 }
-
-                                                return true, EvalEarlyExitError{}
+                                                return true, nil
                                         },
                                         Then: EvalNoop{},
                                 },
 
-                                // Load the instance info so we have the module path set
-                                &EvalInstanceInfo{Info: info},
-
-                                &EvalGetProvider{
-                                        Name:   n.ResolvedProvider,
-                                        Output: &provider,
-                                },
                                 &EvalReadState{
-                                        Name:   stateId,
-                                        Output: &state,
+                                        Addr:           addr.Resource,
+                                        Output:         &state,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
                                 },
                                 &EvalRequireState{
                                         State: &state,
@@ -204,15 +186,15 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
 
                                 // Call pre-apply hook
                                 &EvalApplyPre{
-                                        Info:  info,
-                                        State: &state,
-                                        Diff:  &diffApply,
+                                        Addr:   addr.Resource,
+                                        State:  &state,
+                                        Change: &changeApply,
                                 },
 
                                 // Run destroy provisioners if not tainted
                                 &EvalIf{
                                         If: func(ctx EvalContext) (bool, error) {
-                                                if state != nil && state.Tainted {
+                                                if state != nil && state.Status == states.ObjectTainted {
                                                         return false, nil
                                                 }
 
@@ -220,12 +202,11 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                         },
 
                                         Then: &EvalApplyProvisioners{
-                                                Info:           info,
+                                                Addr:           addr.Resource,
                                                 State:          &state,
-                                                Resource:       n.Config,
-                                                InterpResource: resource,
+                                                ResourceConfig: n.Config,
                                                 Error:          &err,
-                                                When:           config.ProvisionerWhenDestroy,
+                                                When:           configs.ProvisionerWhenDestroy,
                                         },
                                 },
 
@@ -237,7 +218,7 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                         },
 
                                         Then: &EvalApplyPost{
-                                                Info:  info,
+                                                Addr:  addr.Resource,
                                                 State: &state,
                                                 Error: &err,
                                         },
@@ -246,41 +227,38 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                 // Make sure we handle data sources properly.
                                 &EvalIf{
                                         If: func(ctx EvalContext) (bool, error) {
-                                                if n.Addr == nil {
-                                                        return false, fmt.Errorf("nil address")
-                                                }
-
-                                                if n.Addr.Mode == config.DataResourceMode {
-                                                        return true, nil
-                                                }
-
-                                                return false, nil
+                                                return addr.Resource.Resource.Mode == addrs.DataResourceMode, nil
                                         },
 
                                         Then: &EvalReadDataApply{
-                                                Info:     info,
-                                                Diff:     &diffApply,
-                                                Provider: &provider,
-                                                Output:   &state,
+                                                Addr:           addr.Resource,
+                                                Config:         n.Config,
+                                                Change:         &changeApply,
+                                                Provider:       &provider,
+                                                ProviderAddr:   n.ResolvedProvider,
+                                                ProviderSchema: &providerSchema,
+                                                Output:         &state,
                                         },
                                         Else: &EvalApply{
-                                                Info:     info,
-                                                State:    &state,
-                                                Diff:     &diffApply,
-                                                Provider: &provider,
-                                                Output:   &state,
-                                                Error:    &err,
+                                                Addr:           addr.Resource,
+                                                Config:         nil, // No configuration because we are destroying
+                                                State:          &state,
+                                                Change:         &changeApply,
+                                                Provider:       &provider,
+                                                ProviderAddr:   n.ResolvedProvider,
+                                                ProviderSchema: &providerSchema,
+                                                Output:         &state,
+                                                Error:          &err,
                                         },
                                 },
                                 &EvalWriteState{
-                                        Name:         stateId,
-                                        ResourceType: n.Addr.Type,
-                                        Provider:     n.ResolvedProvider,
-                                        Dependencies: rs.Dependencies,
-                                        State:        &state,
+                                        Addr:           addr.Resource,
+                                        ProviderAddr:   n.ResolvedProvider,
+                                        ProviderSchema: &providerSchema,
+                                        State:          &state,
                                 },
                                 &EvalApplyPost{
-                                        Info:  info,
+                                        Addr:  addr.Resource,
                                         State: &state,
                                         Error: &err,
                                 },
@@ -289,3 +267,55 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                 },
         }
 }
+
+// NodeDestroyResourceInstance represents a resource that is to be destroyed.
+//
+// Destroying a resource is a state-only operation: it is the individual
+// instances being destroyed that affects remote objects. During graph
+// construction, NodeDestroyResource should always depend on any other node
+// related to the given resource, since it's just a final cleanup to avoid
+// leaving skeleton resource objects in state after their instances have
+// all been destroyed.
+type NodeDestroyResource struct {
+        *NodeAbstractResource
+}
+
+var (
+        _ GraphNodeResource      = (*NodeDestroyResource)(nil)
+        _ GraphNodeReferenceable = (*NodeDestroyResource)(nil)
+        _ GraphNodeReferencer    = (*NodeDestroyResource)(nil)
+        _ GraphNodeEvalable      = (*NodeDestroyResource)(nil)
+)
+
+func (n *NodeDestroyResource) Name() string {
+        return n.ResourceAddr().String() + " (clean up state)"
+}
+
+// GraphNodeReferenceable, overriding NodeAbstractResource
+func (n *NodeDestroyResource) ReferenceableAddrs() []addrs.Referenceable {
+        // NodeDestroyResource doesn't participate in references: the graph
+        // builder that created it should ensure directly that it already depends
+        // on every other node related to its resource, without relying on
+        // references.
+        return nil
+}
+
+// GraphNodeReferencer, overriding NodeAbstractResource
+func (n *NodeDestroyResource) References() []*addrs.Reference {
+        // NodeDestroyResource doesn't participate in references: the graph
+        // builder that created it should ensure directly that it already depends
+        // on every other node related to its resource, without relying on
+        // references.
+        return nil
+}
+
+// GraphNodeEvalable
+func (n *NodeDestroyResource) EvalTree() EvalNode {
+        // This EvalNode will produce an error if the resource isn't already
+        // empty by the time it is called, since it should just be pruning the
+        // leftover husk of a resource in state after all of the child instances
+        // and their objects were destroyed.
+        return &EvalForgetResourceState{
+                Addr: n.ResourceAddr().Resource,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy_deposed.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy_deposed.go
new file mode 100644
index 0000000..67c4691
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy_deposed.go
@@ -0,0 +1,313 @@
+package terraform
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ConcreteResourceInstanceDeposedNodeFunc is a callback type used to convert
+// an abstract resource instance to a concrete one of some type that has
+// an associated deposed object key.
+type ConcreteResourceInstanceDeposedNodeFunc func(*NodeAbstractResourceInstance, states.DeposedKey) dag.Vertex
+
+type GraphNodeDeposedResourceInstanceObject interface {
+        DeposedInstanceObjectKey() states.DeposedKey
+}
+
+// NodePlanDeposedResourceInstanceObject represents deposed resource
+// instance objects during plan. These are distinct from the primary object
+// for each resource instance since the only valid operation to do with them
+// is to destroy them.
+//
+// This node type is also used during the refresh walk to ensure that the
+// record of a deposed object is up-to-date before we plan to destroy it.
+type NodePlanDeposedResourceInstanceObject struct {
+        *NodeAbstractResourceInstance
+        DeposedKey states.DeposedKey
+}
+
+var (
+        _ GraphNodeDeposedResourceInstanceObject = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResource                      = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResourceInstance              = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferenceable                 = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferencer                    = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeEvalable                      = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProviderConsumer              = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProvisionerConsumer           = (*NodePlanDeposedResourceInstanceObject)(nil)
+)
+
+func (n *NodePlanDeposedResourceInstanceObject) Name() string {
+        return fmt.Sprintf("%s (deposed %s)", n.ResourceInstanceAddr().String(), n.DeposedKey)
+}
+
+func (n *NodePlanDeposedResourceInstanceObject) DeposedInstanceObjectKey() states.DeposedKey {
+        return n.DeposedKey
+}
+
+// GraphNodeReferenceable implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodePlanDeposedResourceInstanceObject) ReferenceableAddrs() []addrs.Referenceable {
+        // Deposed objects don't participate in references.
+        return nil
+}
+
+// GraphNodeReferencer implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodePlanDeposedResourceInstanceObject) References() []*addrs.Reference {
+        // We don't evaluate configuration for deposed objects, so they effectively
+        // make no references.
+        return nil
+}
+
+// GraphNodeEvalable impl.
+func (n *NodePlanDeposedResourceInstanceObject) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
+
+        seq := &EvalSequence{Nodes: make([]EvalNode, 0, 5)}
+
+        // During the refresh walk we will ensure that our record of the deposed
+        // object is up-to-date. If it was already deleted outside of Terraform
+        // then this will remove it from state and thus avoid us planning a
+        // destroy for it during the subsequent plan walk.
+        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
+                Ops: []walkOperation{walkRefresh},
+                Node: &EvalSequence{
+                        Nodes: []EvalNode{
+                                &EvalGetProvider{
+                                        Addr:   n.ResolvedProvider,
+                                        Output: &provider,
+                                        Schema: &providerSchema,
+                                },
+                                &EvalReadStateDeposed{
+                                        Addr:           addr.Resource,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
+                                        Key:            n.DeposedKey,
+                                        Output:         &state,
+                                },
+                                &EvalRefresh{
+                                        Addr:           addr.Resource,
+                                        ProviderAddr:   n.ResolvedProvider,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
+                                        State:          &state,
+                                        Output:         &state,
+                                },
+                                &EvalWriteStateDeposed{
+                                        Addr:           addr.Resource,
+                                        Key:            n.DeposedKey,
+                                        ProviderAddr:   n.ResolvedProvider,
+                                        ProviderSchema: &providerSchema,
+                                        State:          &state,
+                                },
+                        },
+                },
+        })
+
+        // During the plan walk we always produce a planned destroy change, because
+        // destroying is the only supported action for deposed objects.
+        var change *plans.ResourceInstanceChange
+        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
+                Ops: []walkOperation{walkPlan, walkPlanDestroy},
+                Node: &EvalSequence{
+                        Nodes: []EvalNode{
+                                &EvalGetProvider{
+                                        Addr:   n.ResolvedProvider,
+                                        Output: &provider,
+                                        Schema: &providerSchema,
+                                },
+                                &EvalReadStateDeposed{
+                                        Addr:           addr.Resource,
+                                        Output:         &state,
+                                        Key:            n.DeposedKey,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
+                                },
+                                &EvalDiffDestroy{
+                                        Addr:         addr.Resource,
+                                        ProviderAddr: n.ResolvedProvider,
+                                        DeposedKey:   n.DeposedKey,
+                                        State:        &state,
+                                        Output:       &change,
+                                },
+                                &EvalWriteDiff{
+                                        Addr:           addr.Resource,
+                                        DeposedKey:     n.DeposedKey,
+                                        ProviderSchema: &providerSchema,
+                                        Change:         &change,
+                                },
+                                // Since deposed objects cannot be referenced by expressions
+                                // elsewhere, we don't need to also record the planned new
+                                // state in this case.
+                        },
+                },
+        })
+
+        return seq
+}
+
+// NodeDestroyDeposedResourceInstanceObject represents deposed resource
+// instance objects during apply. Nodes of this type are inserted by
+// DiffTransformer when the planned changeset contains "delete" changes for
+// deposed instance objects, and its only supported operation is to destroy
+// and then forget the associated object.
+type NodeDestroyDeposedResourceInstanceObject struct {
+        *NodeAbstractResourceInstance
+        DeposedKey states.DeposedKey
+}
+
+var (
+        _ GraphNodeDeposedResourceInstanceObject = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResource                      = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResourceInstance              = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeDestroyer                     = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeDestroyerCBD                  = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferenceable                 = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferencer                    = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeEvalable                      = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProviderConsumer              = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProvisionerConsumer           = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+)
+
+func (n *NodeDestroyDeposedResourceInstanceObject) Name() string {
+        return fmt.Sprintf("%s (destroy deposed %s)", n.Addr.String(), n.DeposedKey)
+}
+
+func (n *NodeDestroyDeposedResourceInstanceObject) DeposedInstanceObjectKey() states.DeposedKey {
+        return n.DeposedKey
+}
+
+// GraphNodeReferenceable implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodeDestroyDeposedResourceInstanceObject) ReferenceableAddrs() []addrs.Referenceable {
+        // Deposed objects don't participate in references.
+        return nil
+}
+
+// GraphNodeReferencer implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodeDestroyDeposedResourceInstanceObject) References() []*addrs.Reference {
+        // We don't evaluate configuration for deposed objects, so they effectively
+        // make no references.
+        return nil
+}
+
+// GraphNodeDestroyer
+func (n *NodeDestroyDeposedResourceInstanceObject) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodeDestroyDeposedResourceInstanceObject) CreateBeforeDestroy() bool {
+        // A deposed instance is always CreateBeforeDestroy by definition, since
+        // we use deposed only to handle create-before-destroy.
+        return true
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodeDestroyDeposedResourceInstanceObject) ModifyCreateBeforeDestroy(v bool) error {
+        if !v {
+                // Should never happen: deposed instances are _always_ create_before_destroy.
+                return fmt.Errorf("can't deactivate create_before_destroy for a deposed instance")
+        }
+        return nil
+}
+
+// GraphNodeEvalable impl.
+func (n *NodeDestroyDeposedResourceInstanceObject) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
+        var change *plans.ResourceInstanceChange
+        var err error
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+                        &EvalReadStateDeposed{
+                                Addr:           addr.Resource,
+                                Output:         &state,
+                                Key:            n.DeposedKey,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                        },
+                        &EvalDiffDestroy{
+                                Addr:         addr.Resource,
+                                ProviderAddr: n.ResolvedProvider,
+                                State:        &state,
+                                Output:       &change,
+                        },
+                        // Call pre-apply hook
+                        &EvalApplyPre{
+                                Addr:   addr.Resource,
+                                State:  &state,
+                                Change: &change,
+                        },
+                        &EvalApply{
+                                Addr:           addr.Resource,
+                                Config:         nil, // No configuration because we are destroying
+                                State:          &state,
+                                Change:         &change,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                Output:         &state,
+                                Error:          &err,
+                        },
+                        // Always write the resource back to the state deposed... if it
+                        // was successfully destroyed it will be pruned. If it was not, it will
+                        // be caught on the next run.
+                        &EvalWriteStateDeposed{
+                                Addr:           addr.Resource,
+                                Key:            n.DeposedKey,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+                        &EvalApplyPost{
+                                Addr:  addr.Resource,
+                                State: &state,
+                                Error: &err,
+                        },
+                        &EvalReturnError{
+                                Error: &err,
+                        },
+                        &EvalUpdateStateHook{},
+                },
+        }
+}
+
+// GraphNodeDeposer is an optional interface implemented by graph nodes that
+// might create a single new deposed object for a specific associated resource
+// instance, allowing a caller to optionally pre-allocate a DeposedKey for
+// it.
+type GraphNodeDeposer interface {
+        // SetPreallocatedDeposedKey will be called during graph construction
+        // if a particular node must use a pre-allocated deposed key if/when it
+        // "deposes" the current object of its associated resource instance.
+        SetPreallocatedDeposedKey(key states.DeposedKey)
+}
+
+// graphNodeDeposer is an embeddable implementation of GraphNodeDeposer.
+// Embed it in a node type to get automatic support for it, and then access
+// the field PreallocatedDeposedKey to access any pre-allocated key.
+type graphNodeDeposer struct {
+        PreallocatedDeposedKey states.DeposedKey
+}
+
+func (n *graphNodeDeposer) SetPreallocatedDeposedKey(key states.DeposedKey) {
+        n.PreallocatedDeposedKey = key
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
index 1afae7a..633c1c4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
@@ -1,47 +1,119 @@
 package terraform
 
 import (
+        "log"
+
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // NodePlannableResource represents a resource that is "plannable":
 // it is ready to be planned in order to create a diff.
 type NodePlannableResource struct {
-        *NodeAbstractCountResource
+        *NodeAbstractResource
+
+        // ForceCreateBeforeDestroy might be set via our GraphNodeDestroyerCBD
+        // during graph construction, if dependencies require us to force this
+        // on regardless of what the configuration says.
+        ForceCreateBeforeDestroy *bool
+}
+
+var (
+        _ GraphNodeSubPath              = (*NodePlannableResource)(nil)
+        _ GraphNodeDestroyerCBD         = (*NodePlannableResource)(nil)
+        _ GraphNodeDynamicExpandable    = (*NodePlannableResource)(nil)
+        _ GraphNodeReferenceable        = (*NodePlannableResource)(nil)
+        _ GraphNodeReferencer           = (*NodePlannableResource)(nil)
+        _ GraphNodeResource             = (*NodePlannableResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlannableResource)(nil)
+)
+
+// GraphNodeEvalable
+func (n *NodePlannableResource) EvalTree() EvalNode {
+        addr := n.ResourceAddr()
+        config := n.Config
+
+        if config == nil {
+                // Nothing to do, then.
+                log.Printf("[TRACE] NodeApplyableResource: no configuration present for %s", addr)
+                return &EvalNoop{}
+        }
+
+        // this ensures we can reference the resource even if the count is 0
+        return &EvalWriteResourceState{
+                Addr:         addr.Resource,
+                Config:       config,
+                ProviderAddr: n.ResolvedProvider,
+        }
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodePlannableResource) CreateBeforeDestroy() bool {
+        if n.ForceCreateBeforeDestroy != nil {
+                return *n.ForceCreateBeforeDestroy
+        }
+
+        // If we have no config, we just assume no
+        if n.Config == nil || n.Config.Managed == nil {
+                return false
+        }
+
+        return n.Config.Managed.CreateBeforeDestroy
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodePlannableResource) ModifyCreateBeforeDestroy(v bool) error {
+        n.ForceCreateBeforeDestroy = &v
+        return nil
 }
 
 // GraphNodeDynamicExpandable
 func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count, err := n.Config.Count()
-        if err != nil {
-                return nil, err
+        var diags tfdiags.Diagnostics
+
+        count, countDiags := evaluateResourceCountExpression(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
+        // Next we need to potentially rename an instance address in the state
+        // if we're transitioning whether "count" is set at all.
+        fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
+
+        // Our graph transformers require access to the full state, so we'll
+        // temporarily lock it while we work on this.
+        state := ctx.State().Lock()
+        defer ctx.State().Unlock()
+
         // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
+        concreteResource := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
+                a.Schema = n.Schema
+                a.ProvisionerSchemas = n.ProvisionerSchemas
 
                 return &NodePlannableResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
+
+                        // By the time we're walking, we've figured out whether we need
+                        // to force on CreateBeforeDestroy due to dependencies on other
+                        // nodes that have it.
+                        ForceCreateBeforeDestroy: n.CreateBeforeDestroy(),
                 }
         }
 
-        // The concrete resource factory we'll use for oprhans
-        concreteResourceOrphan := func(a *NodeAbstractResource) dag.Vertex {
+        // The concrete resource factory we'll use for orphans
+        concreteResourceOrphan := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
+                a.Schema = n.Schema
+                a.ProvisionerSchemas = n.ProvisionerSchemas
 
-                return &NodePlannableResourceOrphan{
-                        NodeAbstractResource: a,
+                return &NodePlannableResourceInstanceOrphan{
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
@@ -50,6 +122,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 // Expand the count.
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
+                        Schema:   n.Schema,
                         Count:    count,
                         Addr:     n.ResourceAddr(),
                 },
@@ -66,7 +139,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 &AttachStateTransformer{State: state},
 
                 // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
+                &TargetsTransformer{Targets: n.Targets},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -81,5 +154,6 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 Validate: true,
                 Name:     "NodePlannableResource",
         }
-        return b.Build(ctx.Path())
+        graph, diags := b.Build(ctx.Path())
+        return graph, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go
index 9b02362..38746f0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go
@@ -1,52 +1,87 @@
 package terraform
 
-// NodePlanDestroyableResource represents a resource that is "applyable":
-// it is ready to be applied and is represented by a diff.
-type NodePlanDestroyableResource struct {
-        *NodeAbstractResource
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// NodePlanDestroyableResourceInstance represents a resource that is ready
+// to be planned for destruction.
+type NodePlanDestroyableResourceInstance struct {
+        *NodeAbstractResourceInstance
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeReferenceable        = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeReferencer           = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeDestroyer            = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeResource             = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeResourceInstance     = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeAttachResourceState  = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeEvalable             = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeProviderConsumer     = (*NodePlanDestroyableResourceInstance)(nil)
+)
+
 // GraphNodeDestroyer
-func (n *NodePlanDestroyableResource) DestroyAddr() *ResourceAddress {
-        return n.Addr
+func (n *NodePlanDestroyableResourceInstance) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
 }
 
 // GraphNodeEvalable
-func (n *NodePlanDestroyableResource) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+func (n *NodePlanDestroyableResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+        // Declare a bunch of variables that are used for state during
+        // evaluation. These are written to by address in the EvalNodes we
+        // declare below.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
 
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
+        if n.ResolvedProvider.ProviderConfig.Type == "" {
+                // Should never happen; indicates that the graph was not constructed
+                // correctly since we didn't get our provider attached.
+                panic(fmt.Sprintf("%T %q was not assigned a resolved provider", n, dag.VertexName(n)))
         }
 
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var diff *InstanceDiff
-        var state *InstanceState
-
         return &EvalSequence{
                 Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
                         &EvalDiffDestroy{
-                                Info:   info,
-                                State:  &state,
-                                Output: &diff,
+                                Addr:         addr.Resource,
+                                ProviderAddr: n.ResolvedProvider,
+                                State:        &state,
+                                Output:       &change,
                         },
                         &EvalCheckPreventDestroy{
-                                Resource: n.Config,
-                                Diff:     &diff,
+                                Addr:   addr.Resource,
+                                Config: n.Config,
+                                Change: &change,
                         },
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
index 7d9fcdd..75e0bcd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
@@ -3,187 +3,205 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // NodePlannableResourceInstance represents a _single_ resource
 // instance that is plannable. This means this represents a single
 // count index, for example.
 type NodePlannableResourceInstance struct {
-        *NodeAbstractResource
+        *NodeAbstractResourceInstance
+        ForceCreateBeforeDestroy bool
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeReferenceable        = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeReferencer           = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeResource             = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeResourceInstance     = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeAttachResourceState  = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeEvalable             = (*NodePlannableResourceInstance)(nil)
+)
+
 // GraphNodeEvalable
 func (n *NodePlannableResourceInstance) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+        addr := n.ResourceInstanceAddr()
 
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:         stateId,
-                Type:       addr.Type,
-                ModulePath: normalizeModulePath(addr.Path),
-        }
-
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+        // State still uses legacy-style internal ids, so we need to shim to get
+        // a suitable key to use.
+        stateId := NewLegacyResourceInstanceAddress(addr).stateId()
 
         // Determine the dependencies for the state.
         stateDeps := n.StateReferences()
 
         // Eval info is different depending on what kind of resource this is
-        switch n.Config.Mode {
-        case config.ManagedResourceMode:
-                return n.evalTreeManagedResource(
-                        stateId, info, resource, stateDeps,
-                )
-        case config.DataResourceMode:
-                return n.evalTreeDataResource(
-                        stateId, info, resource, stateDeps)
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                return n.evalTreeManagedResource(addr, stateId, stateDeps)
+        case addrs.DataResourceMode:
+                return n.evalTreeDataResource(addr, stateId, stateDeps)
         default:
                 panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
         }
 }
 
-func (n *NodePlannableResourceInstance) evalTreeDataResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        var provider ResourceProvider
-        var config *ResourceConfig
-        var diff *InstanceDiff
-        var state *InstanceState
+func (n *NodePlannableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        config := n.Config
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var configVal cty.Value
 
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalReadState{
-                                Name:   stateId,
-                                Output: &state,
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
                         },
 
-                        // We need to re-interpolate the config here because some
-                        // of the attributes may have become computed during
-                        // earlier planning, due to other resources having
-                        // "requires new resource" diffs.
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
+                        &EvalReadState{
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
+                                Output: &state,
                         },
 
+                        // If we already have a non-planned state then we already dealt
+                        // with this during the refresh walk and so we have nothing to do
+                        // here.
                         &EvalIf{
                                 If: func(ctx EvalContext) (bool, error) {
-                                        computed := config.ComputedKeys != nil && len(config.ComputedKeys) > 0
-
-                                        // If the configuration is complete and we
-                                        // already have a state then we don't need to
-                                        // do any further work during apply, because we
-                                        // already populated the state during refresh.
-                                        if !computed && state != nil {
-                                                return true, EvalEarlyExitError{}
+                                        depChanges := false
+
+                                        // Check and see if any of our dependencies have changes.
+                                        changes := ctx.Changes()
+                                        for _, d := range n.StateReferences() {
+                                                ri, ok := d.(addrs.ResourceInstance)
+                                                if !ok {
+                                                        continue
+                                                }
+                                                change := changes.GetResourceInstanceChange(ri.Absolute(ctx.Path()), states.CurrentGen)
+                                                if change != nil && change.Action != plans.NoOp {
+                                                        depChanges = true
+                                                        break
+                                                }
                                         }
 
+                                        refreshed := state != nil && state.Status != states.ObjectPlanned
+
+                                        // If there are no dependency changes, and it's not a forced
+                                        // read because we there was no Refresh, then we don't need
+                                        // to re-read. If any dependencies have changes, it means
+                                        // our config may also have changes and we need to Read the
+                                        // data source again.
+                                        if !depChanges && refreshed {
+                                                return false, EvalEarlyExitError{}
+                                        }
                                         return true, nil
                                 },
                                 Then: EvalNoop{},
                         },
 
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
+                        &EvalValidateSelfRef{
+                                Addr:           addr.Resource,
+                                Config:         config.Config,
+                                ProviderSchema: &providerSchema,
                         },
 
-                        &EvalReadDataDiff{
-                                Info:        info,
-                                Config:      &config,
-                                Provider:    &provider,
-                                Output:      &diff,
-                                OutputState: &state,
+                        &EvalReadData{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Dependencies:   n.StateReferences(),
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                ForcePlanRead:  true, // _always_ produce a Read change, even if the config seems ready
+                                OutputChange:   &change,
+                                OutputValue:    &configVal,
+                                OutputState:    &state,
                         },
 
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
 
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
                         },
                 },
         }
 }
 
-func (n *NodePlannableResourceInstance) evalTreeManagedResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var diff *InstanceDiff
-        var state *InstanceState
-        var resourceConfig *ResourceConfig
+func (n *NodePlannableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        config := n.Config
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
 
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &resourceConfig,
-                        },
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
-                        // Re-run validation to catch any errors we missed, e.g. type
-                        // mismatches on computed values.
-                        &EvalValidateResource{
-                                Provider:       &provider,
-                                Config:         &resourceConfig,
-                                ResourceName:   n.Config.Name,
-                                ResourceType:   n.Config.Type,
-                                ResourceMode:   n.Config.Mode,
-                                IgnoreWarnings: true,
-                        },
+
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
+
+                        &EvalValidateSelfRef{
+                                Addr:           addr.Resource,
+                                Config:         config.Config,
+                                ProviderSchema: &providerSchema,
+                        },
+
                         &EvalDiff{
-                                Name:        stateId,
-                                Info:        info,
-                                Config:      &resourceConfig,
-                                Resource:    n.Config,
-                                Provider:    &provider,
-                                State:       &state,
-                                OutputDiff:  &diff,
-                                OutputState: &state,
+                                Addr:                addr.Resource,
+                                Config:              n.Config,
+                                CreateBeforeDestroy: n.ForceCreateBeforeDestroy,
+                                Provider:            &provider,
+                                ProviderAddr:        n.ResolvedProvider,
+                                ProviderSchema:      &providerSchema,
+                                State:               &state,
+                                OutputChange:        &change,
+                                OutputState:         &state,
                         },
                         &EvalCheckPreventDestroy{
-                                Resource: n.Config,
-                                Diff:     &diff,
+                                Addr:   addr.Resource,
+                                Config: n.Config,
+                                Change: &change,
                         },
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                State:          &state,
+                                ProviderSchema: &providerSchema,
                         },
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go
index 73d6e41..8416694 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go
@@ -1,53 +1,83 @@
 package terraform
 
-// NodePlannableResourceOrphan represents a resource that is "applyable":
+import (
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// NodePlannableResourceInstanceOrphan represents a resource that is "applyable":
 // it is ready to be applied and is represented by a diff.
-type NodePlannableResourceOrphan struct {
-        *NodeAbstractResource
+type NodePlannableResourceInstanceOrphan struct {
+        *NodeAbstractResourceInstance
 }
 
-func (n *NodePlannableResourceOrphan) Name() string {
-        return n.NodeAbstractResource.Name() + " (orphan)"
-}
+var (
+        _ GraphNodeSubPath              = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeReferenceable        = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeReferencer           = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeResource             = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeResourceInstance     = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeAttachResourceState  = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeEvalable             = (*NodePlannableResourceInstanceOrphan)(nil)
+)
 
-// GraphNodeEvalable
-func (n *NodePlannableResourceOrphan) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+var (
+        _ GraphNodeEvalable = (*NodePlannableResourceInstanceOrphan)(nil)
+)
 
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+func (n *NodePlannableResourceInstanceOrphan) Name() string {
+        return n.ResourceInstanceAddr().String() + " (orphan)"
+}
 
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:         stateId,
-                Type:       addr.Type,
-                ModulePath: normalizeModulePath(addr.Path),
-        }
+// GraphNodeEvalable
+func (n *NodePlannableResourceInstanceOrphan) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
-        var diff *InstanceDiff
-        var state *InstanceState
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
 
         return &EvalSequence{
                 Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
                         &EvalDiffDestroy{
-                                Info:   info,
-                                State:  &state,
-                                Output: &diff,
+                                Addr:         addr.Resource,
+                                State:        &state,
+                                ProviderAddr: n.ResolvedProvider,
+                                Output:       &change,
+                                OutputState:  &state, // Will point to a nil state after this complete, signalling destroyed
                         },
                         &EvalCheckPreventDestroy{
-                                Resource:   n.Config,
-                                ResourceId: stateId,
-                                Diff:       &diff,
+                                Addr:   addr.Resource,
+                                Config: n.Config,
+                                Change: &change,
                         },
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
index 697bd49..9506023 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
@@ -2,38 +2,60 @@ package terraform
 
 import (
         "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // NodeRefreshableManagedResource represents a resource that is expanabled into
 // NodeRefreshableManagedResourceInstance. Resource count orphans are also added.
 type NodeRefreshableManagedResource struct {
-        *NodeAbstractCountResource
+        *NodeAbstractResource
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeDynamicExpandable    = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeReferenceable        = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeReferencer           = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeResource             = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeRefreshableManagedResource)(nil)
+)
+
 // GraphNodeDynamicExpandable
 func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count, err := n.Config.Count()
-        if err != nil {
-                return nil, err
+        var diags tfdiags.Diagnostics
+
+        count, countDiags := evaluateResourceCountExpression(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
+        // Next we need to potentially rename an instance address in the state
+        // if we're transitioning whether "count" is set at all.
+        fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
+
+        // Our graph transformers require access to the full state, so we'll
+        // temporarily lock it while we work on this.
+        state := ctx.State().Lock()
+        defer ctx.State().Unlock()
+
         // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
+        concreteResource := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableManagedResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
@@ -42,6 +64,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 // Expand the count.
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
+                        Schema:   n.Schema,
                         Count:    count,
                         Addr:     n.ResourceAddr(),
                 },
@@ -59,7 +82,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 &AttachStateTransformer{State: state},
 
                 // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
+                &TargetsTransformer{Targets: n.Targets},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -75,66 +98,76 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 Name:     "NodeRefreshableManagedResource",
         }
 
-        return b.Build(ctx.Path())
+        graph, diags := b.Build(ctx.Path())
+        return graph, diags.ErrWithWarnings()
 }
 
 // NodeRefreshableManagedResourceInstance represents a resource that is "applyable":
 // it is ready to be applied and is represented by a diff.
 type NodeRefreshableManagedResourceInstance struct {
-        *NodeAbstractResource
+        *NodeAbstractResourceInstance
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeReferenceable        = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeReferencer           = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeDestroyer            = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeResource             = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeResourceInstance     = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeAttachResourceState  = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeEvalable             = (*NodeRefreshableManagedResourceInstance)(nil)
+)
+
 // GraphNodeDestroyer
-func (n *NodeRefreshableManagedResourceInstance) DestroyAddr() *ResourceAddress {
-        return n.Addr
+func (n *NodeRefreshableManagedResourceInstance) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
 }
 
 // GraphNodeEvalable
 func (n *NodeRefreshableManagedResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
         // Eval info is different depending on what kind of resource this is
-        switch mode := n.Addr.Mode; mode {
-        case config.ManagedResourceMode:
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
                 if n.ResourceState == nil {
+                        log.Printf("[TRACE] NodeRefreshableManagedResourceInstance: %s has no existing state to refresh", addr)
                         return n.evalTreeManagedResourceNoState()
                 }
+                log.Printf("[TRACE] NodeRefreshableManagedResourceInstance: %s will be refreshed", addr)
                 return n.evalTreeManagedResource()
 
-        case config.DataResourceMode:
+        case addrs.DataResourceMode:
                 // Get the data source node. If we don't have a configuration
                 // then it is an orphan so we destroy it (remove it from the state).
                 var dn GraphNodeEvalable
                 if n.Config != nil {
                         dn = &NodeRefreshableDataResourceInstance{
-                                NodeAbstractResource: n.NodeAbstractResource,
+                                NodeAbstractResourceInstance: n.NodeAbstractResourceInstance,
                         }
                 } else {
-                        dn = &NodeDestroyableDataResource{
-                                NodeAbstractResource: n.NodeAbstractResource,
+                        dn = &NodeDestroyableDataResourceInstance{
+                                NodeAbstractResourceInstance: n.NodeAbstractResourceInstance,
                         }
                 }
 
                 return dn.EvalTree()
         default:
-                panic(fmt.Errorf("unsupported resource mode %s", mode))
+                panic(fmt.Errorf("unsupported resource mode %s", addr.Resource.Resource.Mode))
         }
 }
 
 func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
-        }
+        addr := n.ResourceInstanceAddr()
 
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var state *InstanceState
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
 
         // This happened during initial development. All known cases were
         // fixed and tested but as a sanity check let's assert here.
@@ -150,25 +183,33 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
+
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
+
                         &EvalRefresh{
-                                Info:     info,
-                                Provider: &provider,
-                                State:    &state,
-                                Output:   &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                Output:         &state,
                         },
+
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.ResourceState.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: n.ResourceState.Dependencies,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
                 },
         }
@@ -186,80 +227,62 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
 // plan, but nothing is done with the diff after it is created - it is dropped,
 // and its changes are not counted in the UI.
 func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResourceNoState() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var state *InstanceState
-        var resourceConfig *ResourceConfig
-
-        addr := n.NodeAbstractResource.Addr
-        stateID := addr.stateId()
-        info := &InstanceInfo{
-                Id:         stateID,
-                Type:       addr.Type,
-                ModulePath: normalizeModulePath(addr.Path),
-        }
-
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
-
-        // Determine the dependencies for the state.
-        stateDeps := n.StateReferences()
-
-        // n.Config can be nil if the config and state don't match
-        var raw *config.RawConfig
-        if n.Config != nil {
-                raw = n.Config.RawConfig.Copy()
-        }
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
 
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
-                                Config:   raw,
-                                Resource: resource,
-                                Output:   &resourceConfig,
-                        },
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
-                        // Re-run validation to catch any errors we missed, e.g. type
-                        // mismatches on computed values.
-                        &EvalValidateResource{
-                                Provider:       &provider,
-                                Config:         &resourceConfig,
-                                ResourceName:   n.Config.Name,
-                                ResourceType:   n.Config.Type,
-                                ResourceMode:   n.Config.Mode,
-                                IgnoreWarnings: true,
-                        },
+
                         &EvalReadState{
-                                Name:   stateID,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
+
                         &EvalDiff{
-                                Name:        stateID,
-                                Info:        info,
-                                Config:      &resourceConfig,
-                                Resource:    n.Config,
-                                Provider:    &provider,
-                                State:       &state,
-                                OutputState: &state,
-                                Stub:        true,
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                OutputChange:   &change,
+                                OutputState:    &state,
+                                Stub:           true,
                         },
+
                         &EvalWriteState{
-                                Name:         stateID,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+
+                        // We must also save the planned change, so that expressions in
+                        // other nodes, such as provider configurations and data resources,
+                        // can work with the planned new value.
+                        //
+                        // This depends on the fact that Context.Refresh creates a
+                        // temporary new empty changeset for the duration of its graph
+                        // walk, and so this recorded change will be discarded immediately
+                        // after the refresh walk completes.
+                        &EvalWriteDiff{
+                                Addr:           addr.Resource,
+                                Change:         &change,
+                                ProviderSchema: &providerSchema,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
index 0df223d..734ec9e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
@@ -1,158 +1,87 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // NodeValidatableResource represents a resource that is used for validation
 // only.
 type NodeValidatableResource struct {
-        *NodeAbstractCountResource
-}
-
-// GraphNodeEvalable
-func (n *NodeValidatableResource) EvalTree() EvalNode {
-        // Ensure we're validating
-        c := n.NodeAbstractCountResource
-        c.Validate = true
-        return c.EvalTree()
-}
-
-// GraphNodeDynamicExpandable
-func (n *NodeValidatableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count := 1
-        if n.Config.RawCount.Value() != unknownValue() {
-                var err error
-                count, err = n.Config.Count()
-                if err != nil {
-                        return nil, err
-                }
-        }
-
-        // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
-                // Add the config and state since we don't do that via transforms
-                a.Config = n.Config
-                a.ResolvedProvider = n.ResolvedProvider
-
-                return &NodeValidatableResourceInstance{
-                        NodeAbstractResource: a,
-                }
-        }
-
-        // Start creating the steps
-        steps := []GraphTransformer{
-                // Expand the count.
-                &ResourceCountTransformer{
-                        Concrete: concreteResource,
-                        Count:    count,
-                        Addr:     n.ResourceAddr(),
-                },
-
-                // Attach the state
-                &AttachStateTransformer{State: state},
-
-                // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
-
-                // Connect references so ordering is correct
-                &ReferenceTransformer{},
-
-                // Make sure there is a single root
-                &RootTransformer{},
-        }
-
-        // Build the graph
-        b := &BasicGraphBuilder{
-                Steps:    steps,
-                Validate: true,
-                Name:     "NodeValidatableResource",
-        }
-
-        return b.Build(ctx.Path())
-}
-
-// This represents a _single_ resource instance to validate.
-type NodeValidatableResourceInstance struct {
         *NodeAbstractResource
 }
 
-// GraphNodeEvalable
-func (n *NodeValidatableResourceInstance) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+var (
+        _ GraphNodeSubPath              = (*NodeValidatableResource)(nil)
+        _ GraphNodeEvalable             = (*NodeValidatableResource)(nil)
+        _ GraphNodeReferenceable        = (*NodeValidatableResource)(nil)
+        _ GraphNodeReferencer           = (*NodeValidatableResource)(nil)
+        _ GraphNodeResource             = (*NodeValidatableResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeValidatableResource)(nil)
+)
 
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+// GraphNodeEvalable
+func (n *NodeValidatableResource) EvalTree() EvalNode {
+        addr := n.ResourceAddr()
+        config := n.Config
 
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var config *ResourceConfig
-        var provider ResourceProvider
+        // Declare the variables will be used are used to pass values along
+        // the evaluation sequence below. These are written to via pointers
+        // passed to the EvalNodes.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var configVal cty.Value
 
         seq := &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalValidateResourceSelfRef{
-                                Addr:   &addr,
-                                Config: &n.Config.RawConfig,
-                        },
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
-                        },
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
+                                Schema: &providerSchema,
                         },
                         &EvalValidateResource{
-                                Provider:     &provider,
-                                Config:       &config,
-                                ResourceName: n.Config.Name,
-                                ResourceType: n.Config.Type,
-                                ResourceMode: n.Config.Mode,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                                Config:         config,
+                                ConfigVal:      &configVal,
                         },
                 },
         }
 
-        // Validate all the provisioners
-        for _, p := range n.Config.Provisioners {
-                var provisioner ResourceProvisioner
-                var connConfig *ResourceConfig
-                seq.Nodes = append(
-                        seq.Nodes,
-                        &EvalGetProvisioner{
-                                Name:   p.Type,
-                                Output: &provisioner,
-                        },
-                        &EvalInterpolate{
-                                Config:   p.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
-                        },
-                        &EvalInterpolate{
-                                Config:   p.ConnInfo.Copy(),
-                                Resource: resource,
-                                Output:   &connConfig,
-                        },
-                        &EvalValidateProvisioner{
-                                Provisioner: &provisioner,
-                                Config:      &config,
-                                ConnConfig:  &connConfig,
-                        },
-                )
+        if managed := n.Config.Managed; managed != nil {
+                hasCount := n.Config.Count != nil
+
+                // Validate all the provisioners
+                for _, p := range managed.Provisioners {
+                        var provisioner provisioners.Interface
+                        var provisionerSchema *configschema.Block
+
+                        if p.Connection == nil {
+                                p.Connection = config.Managed.Connection
+                        } else if config.Managed.Connection != nil {
+                                p.Connection.Config = configs.MergeBodies(config.Managed.Connection.Config, p.Connection.Config)
+                        }
+
+                        seq.Nodes = append(
+                                seq.Nodes,
+                                &EvalGetProvisioner{
+                                        Name:   p.Type,
+                                        Output: &provisioner,
+                                        Schema: &provisionerSchema,
+                                },
+                                &EvalValidateProvisioner{
+                                        ResourceAddr:     addr.Resource,
+                                        Provisioner:      &provisioner,
+                                        Schema:           &provisionerSchema,
+                                        Config:           p,
+                                        ResourceHasCount: hasCount,
+                                },
+                        )
+                }
         }
 
         return seq
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go b/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go
index cb61a4e..1c30290 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go
@@ -1,22 +1,44 @@
 package terraform
 
 import (
-        "fmt"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
 )
 
 // NodeRootVariable represents a root variable input.
 type NodeRootVariable struct {
-        Config *config.Variable
+        Addr   addrs.InputVariable
+        Config *configs.Variable
 }
 
+var (
+        _ GraphNodeSubPath       = (*NodeRootVariable)(nil)
+        _ GraphNodeReferenceable = (*NodeRootVariable)(nil)
+        _ dag.GraphNodeDotter    = (*NodeApplyableModuleVariable)(nil)
+)
+
 func (n *NodeRootVariable) Name() string {
-        result := fmt.Sprintf("var.%s", n.Config.Name)
-        return result
+        return n.Addr.String()
+}
+
+// GraphNodeSubPath
+func (n *NodeRootVariable) Path() addrs.ModuleInstance {
+        return addrs.RootModuleInstance
 }
 
 // GraphNodeReferenceable
-func (n *NodeRootVariable) ReferenceableName() []string {
-        return []string{n.Name()}
+func (n *NodeRootVariable) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr}
+}
+
+// dag.GraphNodeDotter impl.
+func (n *NodeRootVariable) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/path.go b/vendor/github.com/hashicorp/terraform/terraform/path.go
index 51dd412..9757446 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/path.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/path.go
@@ -1,10 +1,17 @@
 package terraform
 
 import (
-        "strings"
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
-// PathCacheKey returns a cache key for a module path.
-func PathCacheKey(path []string) string {
-        return strings.Join(path, "|")
+// PathObjectCacheKey is like PathCacheKey but includes an additional name
+// to be included in the key, for module-namespaced objects.
+//
+// The result of this function is guaranteed unique for any distinct pair
+// of path and name, but is not guaranteed to be in any particular format
+// and in particular should never be shown to end-users.
+func PathObjectCacheKey(path addrs.ModuleInstance, objectName string) string {
+        return fmt.Sprintf("%s|%s", path.String(), objectName)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/plan.go b/vendor/github.com/hashicorp/terraform/terraform/plan.go
index 30db195..af04c6c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/plan.go
@@ -3,14 +3,13 @@ package terraform
 import (
         "bytes"
         "encoding/gob"
-        "errors"
         "fmt"
         "io"
-        "log"
         "sync"
 
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/version"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs"
 )
 
 func init() {
@@ -31,9 +30,9 @@ type Plan struct {
         // plan is applied.
         Diff *Diff
 
-        // Module represents the entire configuration that was present when this
+        // Config represents the entire configuration that was present when this
         // plan was created.
-        Module *module.Tree
+        Config *configs.Config
 
         // State is the Terraform state that was current when this plan was
         // created.
@@ -44,7 +43,7 @@ type Plan struct {
 
         // Vars retains the variables that were set when creating the plan, so
         // that the same variables can be applied during apply.
-        Vars map[string]interface{}
+        Vars map[string]cty.Value
 
         // Targets, if non-empty, contains a set of resource address strings that
         // identify graph nodes that were selected as targets for plan.
@@ -78,64 +77,6 @@ type Plan struct {
         once sync.Once
 }
 
-// Context returns a Context with the data encapsulated in this plan.
-//
-// The following fields in opts are overridden by the plan: Config,
-// Diff, Variables.
-//
-// If State is not provided, it is set from the plan. If it _is_ provided,
-// it must be Equal to the state stored in plan, but may have a newer
-// serial.
-func (p *Plan) Context(opts *ContextOpts) (*Context, error) {
-        var err error
-        opts, err = p.contextOpts(opts)
-        if err != nil {
-                return nil, err
-        }
-        return NewContext(opts)
-}
-
-// contextOpts mutates the given base ContextOpts in place to use input
-// objects obtained from the receiving plan.
-func (p *Plan) contextOpts(base *ContextOpts) (*ContextOpts, error) {
-        opts := base
-
-        opts.Diff = p.Diff
-        opts.Module = p.Module
-        opts.Targets = p.Targets
-        opts.ProviderSHA256s = p.ProviderSHA256s
-        opts.Destroy = p.Destroy
-
-        if opts.State == nil {
-                opts.State = p.State
-        } else if !opts.State.Equal(p.State) {
-                // Even if we're overriding the state, it should be logically equal
-                // to what's in plan. The only valid change to have made by the time
-                // we get here is to have incremented the serial.
-                //
-                // Due to the fact that serialization may change the representation of
-                // the state, there is little chance that these aren't actually equal.
-                // Log the error condition for reference, but continue with the state
-                // we have.
-                log.Println("[WARN] Plan state and ContextOpts state are not equal")
-        }
-
-        thisVersion := version.String()
-        if p.TerraformVersion != "" && p.TerraformVersion != thisVersion {
-                return nil, fmt.Errorf(
-                        "plan was created with a different version of Terraform (created with %s, but running %s)",
-                        p.TerraformVersion, thisVersion,
-                )
-        }
-
-        opts.Variables = make(map[string]interface{})
-        for k, v := range p.Vars {
-                opts.Variables[k] = v
-        }
-
-        return opts, nil
-}
-
 func (p *Plan) String() string {
         buf := new(bytes.Buffer)
         buf.WriteString("DIFF:\n\n")
@@ -158,7 +99,7 @@ func (p *Plan) init() {
                 }
 
                 if p.Vars == nil {
-                        p.Vars = make(map[string]interface{})
+                        p.Vars = make(map[string]cty.Value)
                 }
         })
 }
@@ -172,63 +113,10 @@ const planFormatVersion byte = 2
 // ReadPlan reads a plan structure out of a reader in the format that
 // was written by WritePlan.
 func ReadPlan(src io.Reader) (*Plan, error) {
-        var result *Plan
-        var err error
-        n := 0
-
-        // Verify the magic bytes
-        magic := make([]byte, len(planFormatMagic))
-        for n < len(magic) {
-                n, err = src.Read(magic[n:])
-                if err != nil {
-                        return nil, fmt.Errorf("error while reading magic bytes: %s", err)
-                }
-        }
-        if string(magic) != planFormatMagic {
-                return nil, fmt.Errorf("not a valid plan file")
-        }
-
-        // Verify the version is something we can read
-        var formatByte [1]byte
-        n, err = src.Read(formatByte[:])
-        if err != nil {
-                return nil, err
-        }
-        if n != len(formatByte) {
-                return nil, errors.New("failed to read plan version byte")
-        }
-
-        if formatByte[0] != planFormatVersion {
-                return nil, fmt.Errorf("unknown plan file version: %d", formatByte[0])
-        }
-
-        dec := gob.NewDecoder(src)
-        if err := dec.Decode(&result); err != nil {
-                return nil, err
-        }
-
-        return result, nil
+        return nil, fmt.Errorf("terraform.ReadPlan is no longer in use; use planfile.Open instead")
 }
 
 // WritePlan writes a plan somewhere in a binary format.
 func WritePlan(d *Plan, dst io.Writer) error {
-        // Write the magic bytes so we can determine the file format later
-        n, err := dst.Write([]byte(planFormatMagic))
-        if err != nil {
-                return err
-        }
-        if n != len(planFormatMagic) {
-                return errors.New("failed to write plan format magic bytes")
-        }
-
-        // Write a version byte so we can iterate on version at some point
-        n, err = dst.Write([]byte{planFormatVersion})
-        if err != nil {
-                return err
-        }
-        if n != 1 {
-                return errors.New("failed to write plan version byte")
-        }
-
-        return gob.NewEncoder(dst).Encode(d)
+        return fmt.Errorf("terraform.WritePlan is no longer in use; use planfile.Create instead")
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go b/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go
new file mode 100644
index 0000000..4ae346d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go
@@ -0,0 +1,522 @@
+package terraform
+
+import (
+        "encoding/json"
+        "fmt"
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+var _ providers.Interface = (*MockProvider)(nil)
+
+// MockProvider implements providers.Interface but mocks out all the
+// calls for testing purposes.
+type MockProvider struct {
+        sync.Mutex
+
+        // Anything you want, in case you need to store extra data with the mock.
+        Meta interface{}
+
+        GetSchemaCalled bool
+        GetSchemaReturn *ProviderSchema // This is using ProviderSchema directly rather than providers.GetSchemaResponse for compatibility with old tests
+
+        PrepareProviderConfigCalled   bool
+        PrepareProviderConfigResponse providers.PrepareProviderConfigResponse
+        PrepareProviderConfigRequest  providers.PrepareProviderConfigRequest
+        PrepareProviderConfigFn       func(providers.PrepareProviderConfigRequest) providers.PrepareProviderConfigResponse
+
+        ValidateResourceTypeConfigCalled   bool
+        ValidateResourceTypeConfigTypeName string
+        ValidateResourceTypeConfigResponse providers.ValidateResourceTypeConfigResponse
+        ValidateResourceTypeConfigRequest  providers.ValidateResourceTypeConfigRequest
+        ValidateResourceTypeConfigFn       func(providers.ValidateResourceTypeConfigRequest) providers.ValidateResourceTypeConfigResponse
+
+        ValidateDataSourceConfigCalled   bool
+        ValidateDataSourceConfigTypeName string
+        ValidateDataSourceConfigResponse providers.ValidateDataSourceConfigResponse
+        ValidateDataSourceConfigRequest  providers.ValidateDataSourceConfigRequest
+        ValidateDataSourceConfigFn       func(providers.ValidateDataSourceConfigRequest) providers.ValidateDataSourceConfigResponse
+
+        UpgradeResourceStateCalled   bool
+        UpgradeResourceStateTypeName string
+        UpgradeResourceStateResponse providers.UpgradeResourceStateResponse
+        UpgradeResourceStateRequest  providers.UpgradeResourceStateRequest
+        UpgradeResourceStateFn       func(providers.UpgradeResourceStateRequest) providers.UpgradeResourceStateResponse
+
+        ConfigureCalled   bool
+        ConfigureResponse providers.ConfigureResponse
+        ConfigureRequest  providers.ConfigureRequest
+        ConfigureNewFn    func(providers.ConfigureRequest) providers.ConfigureResponse // Named ConfigureNewFn so we can still have the legacy ConfigureFn declared below
+
+        StopCalled   bool
+        StopFn       func() error
+        StopResponse error
+
+        ReadResourceCalled   bool
+        ReadResourceResponse providers.ReadResourceResponse
+        ReadResourceRequest  providers.ReadResourceRequest
+        ReadResourceFn       func(providers.ReadResourceRequest) providers.ReadResourceResponse
+
+        PlanResourceChangeCalled   bool
+        PlanResourceChangeResponse providers.PlanResourceChangeResponse
+        PlanResourceChangeRequest  providers.PlanResourceChangeRequest
+        PlanResourceChangeFn       func(providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse
+
+        ApplyResourceChangeCalled   bool
+        ApplyResourceChangeResponse providers.ApplyResourceChangeResponse
+        ApplyResourceChangeRequest  providers.ApplyResourceChangeRequest
+        ApplyResourceChangeFn       func(providers.ApplyResourceChangeRequest) providers.ApplyResourceChangeResponse
+
+        ImportResourceStateCalled   bool
+        ImportResourceStateResponse providers.ImportResourceStateResponse
+        ImportResourceStateRequest  providers.ImportResourceStateRequest
+        ImportResourceStateFn       func(providers.ImportResourceStateRequest) providers.ImportResourceStateResponse
+        // Legacy return type for existing tests, which will be shimmed into an
+        // ImportResourceStateResponse if set
+        ImportStateReturn []*InstanceState
+
+        ReadDataSourceCalled   bool
+        ReadDataSourceResponse providers.ReadDataSourceResponse
+        ReadDataSourceRequest  providers.ReadDataSourceRequest
+        ReadDataSourceFn       func(providers.ReadDataSourceRequest) providers.ReadDataSourceResponse
+
+        CloseCalled bool
+        CloseError  error
+
+        // Legacy callbacks: if these are set, we will shim incoming calls for
+        // new-style methods to these old-fashioned terraform.ResourceProvider
+        // mock callbacks, for the benefit of older tests that were written against
+        // the old mock API.
+        ValidateFn  func(c *ResourceConfig) (ws []string, es []error)
+        ConfigureFn func(c *ResourceConfig) error
+        DiffFn      func(info *InstanceInfo, s *InstanceState, c *ResourceConfig) (*InstanceDiff, error)
+        ApplyFn     func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error)
+}
+
+func (p *MockProvider) GetSchema() providers.GetSchemaResponse {
+        p.Lock()
+        defer p.Unlock()
+        p.GetSchemaCalled = true
+        return p.getSchema()
+}
+
+func (p *MockProvider) getSchema() providers.GetSchemaResponse {
+        // This version of getSchema doesn't do any locking, so it's suitable to
+        // call from other methods of this mock as long as they are already
+        // holding the lock.
+
+        ret := providers.GetSchemaResponse{
+                Provider:      providers.Schema{},
+                DataSources:   map[string]providers.Schema{},
+                ResourceTypes: map[string]providers.Schema{},
+        }
+        if p.GetSchemaReturn != nil {
+                ret.Provider.Block = p.GetSchemaReturn.Provider
+                for n, s := range p.GetSchemaReturn.DataSources {
+                        ret.DataSources[n] = providers.Schema{
+                                Block: s,
+                        }
+                }
+                for n, s := range p.GetSchemaReturn.ResourceTypes {
+                        ret.ResourceTypes[n] = providers.Schema{
+                                Version: int64(p.GetSchemaReturn.ResourceTypeSchemaVersions[n]),
+                                Block:   s,
+                        }
+                }
+        }
+
+        return ret
+}
+
+func (p *MockProvider) PrepareProviderConfig(r providers.PrepareProviderConfigRequest) providers.PrepareProviderConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.PrepareProviderConfigCalled = true
+        p.PrepareProviderConfigRequest = r
+        if p.PrepareProviderConfigFn != nil {
+                return p.PrepareProviderConfigFn(r)
+        }
+        return p.PrepareProviderConfigResponse
+}
+
+func (p *MockProvider) ValidateResourceTypeConfig(r providers.ValidateResourceTypeConfigRequest) providers.ValidateResourceTypeConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ValidateResourceTypeConfigCalled = true
+        p.ValidateResourceTypeConfigRequest = r
+
+        if p.ValidateFn != nil {
+                resp := p.getSchema()
+                schema := resp.Provider.Block
+                rc := NewResourceConfigShimmed(r.Config, schema)
+                warns, errs := p.ValidateFn(rc)
+                ret := providers.ValidateResourceTypeConfigResponse{}
+                for _, warn := range warns {
+                        ret.Diagnostics = ret.Diagnostics.Append(tfdiags.SimpleWarning(warn))
+                }
+                for _, err := range errs {
+                        ret.Diagnostics = ret.Diagnostics.Append(err)
+                }
+        }
+        if p.ValidateResourceTypeConfigFn != nil {
+                return p.ValidateResourceTypeConfigFn(r)
+        }
+
+        return p.ValidateResourceTypeConfigResponse
+}
+
+func (p *MockProvider) ValidateDataSourceConfig(r providers.ValidateDataSourceConfigRequest) providers.ValidateDataSourceConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ValidateDataSourceConfigCalled = true
+        p.ValidateDataSourceConfigRequest = r
+
+        if p.ValidateDataSourceConfigFn != nil {
+                return p.ValidateDataSourceConfigFn(r)
+        }
+
+        return p.ValidateDataSourceConfigResponse
+}
+
+func (p *MockProvider) UpgradeResourceState(r providers.UpgradeResourceStateRequest) providers.UpgradeResourceStateResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        schemas := p.getSchema()
+        schema := schemas.ResourceTypes[r.TypeName]
+        schemaType := schema.Block.ImpliedType()
+
+        p.UpgradeResourceStateCalled = true
+        p.UpgradeResourceStateRequest = r
+
+        if p.UpgradeResourceStateFn != nil {
+                return p.UpgradeResourceStateFn(r)
+        }
+
+        resp := p.UpgradeResourceStateResponse
+
+        if resp.UpgradedState == cty.NilVal {
+                switch {
+                case r.RawStateFlatmap != nil:
+                        v, err := hcl2shim.HCL2ValueFromFlatmap(r.RawStateFlatmap, schemaType)
+                        if err != nil {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                                return resp
+                        }
+                        resp.UpgradedState = v
+                case len(r.RawStateJSON) > 0:
+                        v, err := ctyjson.Unmarshal(r.RawStateJSON, schemaType)
+
+                        if err != nil {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                                return resp
+                        }
+                        resp.UpgradedState = v
+                }
+        }
+        return resp
+}
+
+func (p *MockProvider) Configure(r providers.ConfigureRequest) providers.ConfigureResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ConfigureCalled = true
+        p.ConfigureRequest = r
+
+        if p.ConfigureFn != nil {
+                resp := p.getSchema()
+                schema := resp.Provider.Block
+                rc := NewResourceConfigShimmed(r.Config, schema)
+                ret := providers.ConfigureResponse{}
+
+                err := p.ConfigureFn(rc)
+                if err != nil {
+                        ret.Diagnostics = ret.Diagnostics.Append(err)
+                }
+                return ret
+        }
+        if p.ConfigureNewFn != nil {
+                return p.ConfigureNewFn(r)
+        }
+
+        return p.ConfigureResponse
+}
+
+func (p *MockProvider) Stop() error {
+        // We intentionally don't lock in this one because the whole point of this
+        // method is to be called concurrently with another operation that can
+        // be cancelled.  The provider itself is responsible for handling
+        // any concurrency concerns in this case.
+
+        p.StopCalled = true
+        if p.StopFn != nil {
+                return p.StopFn()
+        }
+
+        return p.StopResponse
+}
+
+func (p *MockProvider) ReadResource(r providers.ReadResourceRequest) providers.ReadResourceResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ReadResourceCalled = true
+        p.ReadResourceRequest = r
+
+        if p.ReadResourceFn != nil {
+                return p.ReadResourceFn(r)
+        }
+
+        // make sure the NewState fits the schema
+        newState, err := p.GetSchemaReturn.ResourceTypes[r.TypeName].CoerceValue(p.ReadResourceResponse.NewState)
+        if err != nil {
+                panic(err)
+        }
+        resp := p.ReadResourceResponse
+        resp.NewState = newState
+
+        return resp
+}
+
+func (p *MockProvider) PlanResourceChange(r providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.PlanResourceChangeCalled = true
+        p.PlanResourceChangeRequest = r
+
+        if p.DiffFn != nil {
+                ps := p.getSchema()
+                if ps.ResourceTypes == nil || ps.ResourceTypes[r.TypeName].Block == nil {
+                        return providers.PlanResourceChangeResponse{
+                                Diagnostics: tfdiags.Diagnostics(nil).Append(fmt.Printf("mock provider has no schema for resource type %s", r.TypeName)),
+                        }
+                }
+                schema := ps.ResourceTypes[r.TypeName].Block
+                info := &InstanceInfo{
+                        Type: r.TypeName,
+                }
+                priorState := NewInstanceStateShimmedFromValue(r.PriorState, 0)
+                cfg := NewResourceConfigShimmed(r.Config, schema)
+
+                legacyDiff, err := p.DiffFn(info, priorState, cfg)
+
+                var res providers.PlanResourceChangeResponse
+                res.PlannedState = r.ProposedNewState
+                if err != nil {
+                        res.Diagnostics = res.Diagnostics.Append(err)
+                }
+                if legacyDiff != nil {
+                        newVal, err := legacyDiff.ApplyToValue(r.PriorState, schema)
+                        if err != nil {
+                                res.Diagnostics = res.Diagnostics.Append(err)
+                        }
+
+                        res.PlannedState = newVal
+
+                        var requiresNew []string
+                        for attr, d := range legacyDiff.Attributes {
+                                if d.RequiresNew {
+                                        requiresNew = append(requiresNew, attr)
+                                }
+                        }
+                        requiresReplace, err := hcl2shim.RequiresReplace(requiresNew, schema.ImpliedType())
+                        if err != nil {
+                                res.Diagnostics = res.Diagnostics.Append(err)
+                        }
+                        res.RequiresReplace = requiresReplace
+                }
+                return res
+        }
+        if p.PlanResourceChangeFn != nil {
+                return p.PlanResourceChangeFn(r)
+        }
+
+        return p.PlanResourceChangeResponse
+}
+
+func (p *MockProvider) ApplyResourceChange(r providers.ApplyResourceChangeRequest) providers.ApplyResourceChangeResponse {
+        p.Lock()
+        p.ApplyResourceChangeCalled = true
+        p.ApplyResourceChangeRequest = r
+        p.Unlock()
+
+        if p.ApplyFn != nil {
+                // ApplyFn is a special callback fashioned after our old provider
+                // interface, which expected to be given an actual diff rather than
+                // separate old/new values to apply. Therefore we need to approximate
+                // a diff here well enough that _most_ of our legacy ApplyFns in old
+                // tests still see the behavior they are expecting. New tests should
+                // not use this, and should instead use ApplyResourceChangeFn directly.
+                providerSchema := p.getSchema()
+                schema, ok := providerSchema.ResourceTypes[r.TypeName]
+                if !ok {
+                        return providers.ApplyResourceChangeResponse{
+                                Diagnostics: tfdiags.Diagnostics(nil).Append(fmt.Errorf("no mocked schema available for resource type %s", r.TypeName)),
+                        }
+                }
+
+                info := &InstanceInfo{
+                        Type: r.TypeName,
+                }
+
+                priorVal := r.PriorState
+                plannedVal := r.PlannedState
+                priorMap := hcl2shim.FlatmapValueFromHCL2(priorVal)
+                plannedMap := hcl2shim.FlatmapValueFromHCL2(plannedVal)
+                s := NewInstanceStateShimmedFromValue(priorVal, 0)
+                d := &InstanceDiff{
+                        Attributes: make(map[string]*ResourceAttrDiff),
+                }
+                if plannedMap == nil { // destroying, then
+                        d.Destroy = true
+                        // Destroy diffs don't have any attribute diffs
+                } else {
+                        if priorMap == nil { // creating, then
+                                // We'll just make an empty prior map to make things easier below.
+                                priorMap = make(map[string]string)
+                        }
+
+                        for k, new := range plannedMap {
+                                old := priorMap[k]
+                                newComputed := false
+                                if new == config.UnknownVariableValue {
+                                        new = ""
+                                        newComputed = true
+                                }
+                                d.Attributes[k] = &ResourceAttrDiff{
+                                        Old:         old,
+                                        New:         new,
+                                        NewComputed: newComputed,
+                                        Type:        DiffAttrInput, // not generally used in tests, so just hard-coded
+                                }
+                        }
+                        // Also need any attributes that were removed in "planned"
+                        for k, old := range priorMap {
+                                if _, ok := plannedMap[k]; ok {
+                                        continue
+                                }
+                                d.Attributes[k] = &ResourceAttrDiff{
+                                        Old:        old,
+                                        NewRemoved: true,
+                                        Type:       DiffAttrInput,
+                                }
+                        }
+                }
+                newState, err := p.ApplyFn(info, s, d)
+                resp := providers.ApplyResourceChangeResponse{}
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                }
+                if newState != nil {
+                        var newVal cty.Value
+                        if newState != nil {
+                                var err error
+                                newVal, err = newState.AttrsAsObjectValue(schema.Block.ImpliedType())
+                                if err != nil {
+                                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                                }
+                        } else {
+                                // If apply returned a nil new state then that's the old way to
+                                // indicate that the object was destroyed. Our new interface calls
+                                // for that to be signalled as a null value.
+                                newVal = cty.NullVal(schema.Block.ImpliedType())
+                        }
+                        resp.NewState = newVal
+                }
+
+                return resp
+        }
+        if p.ApplyResourceChangeFn != nil {
+                return p.ApplyResourceChangeFn(r)
+        }
+
+        return p.ApplyResourceChangeResponse
+}
+
+func (p *MockProvider) ImportResourceState(r providers.ImportResourceStateRequest) providers.ImportResourceStateResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        if p.ImportStateReturn != nil {
+                for _, is := range p.ImportStateReturn {
+                        if is.Attributes == nil {
+                                is.Attributes = make(map[string]string)
+                        }
+                        is.Attributes["id"] = is.ID
+
+                        typeName := is.Ephemeral.Type
+                        // Use the requested type if the resource has no type of it's own.
+                        // We still return the empty type, which will error, but this prevents a panic.
+                        if typeName == "" {
+                                typeName = r.TypeName
+                        }
+
+                        schema := p.GetSchemaReturn.ResourceTypes[typeName]
+                        if schema == nil {
+                                panic("no schema found for " + typeName)
+                        }
+
+                        private, err := json.Marshal(is.Meta)
+                        if err != nil {
+                                panic(err)
+                        }
+
+                        state, err := hcl2shim.HCL2ValueFromFlatmap(is.Attributes, schema.ImpliedType())
+                        if err != nil {
+                                panic(err)
+                        }
+
+                        state, err = schema.CoerceValue(state)
+                        if err != nil {
+                                panic(err)
+                        }
+
+                        p.ImportResourceStateResponse.ImportedResources = append(
+                                p.ImportResourceStateResponse.ImportedResources,
+                                providers.ImportedResource{
+                                        TypeName: is.Ephemeral.Type,
+                                        State:    state,
+                                        Private:  private,
+                                })
+                }
+        }
+
+        p.ImportResourceStateCalled = true
+        p.ImportResourceStateRequest = r
+        if p.ImportResourceStateFn != nil {
+                return p.ImportResourceStateFn(r)
+        }
+
+        return p.ImportResourceStateResponse
+}
+
+func (p *MockProvider) ReadDataSource(r providers.ReadDataSourceRequest) providers.ReadDataSourceResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ReadDataSourceCalled = true
+        p.ReadDataSourceRequest = r
+
+        if p.ReadDataSourceFn != nil {
+                return p.ReadDataSourceFn(r)
+        }
+
+        return p.ReadDataSourceResponse
+}
+
+func (p *MockProvider) Close() error {
+        p.CloseCalled = true
+        return p.CloseError
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/provisioner_mock.go b/vendor/github.com/hashicorp/terraform/terraform/provisioner_mock.go
new file mode 100644
index 0000000..f595891
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/provisioner_mock.go
@@ -0,0 +1,154 @@
+package terraform
+
+import (
+        "fmt"
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/provisioners"
+)
+
+var _ provisioners.Interface = (*MockProvisioner)(nil)
+
+// MockProvisioner implements provisioners.Interface but mocks out all the
+// calls for testing purposes.
+type MockProvisioner struct {
+        sync.Mutex
+        // Anything you want, in case you need to store extra data with the mock.
+        Meta interface{}
+
+        GetSchemaCalled   bool
+        GetSchemaResponse provisioners.GetSchemaResponse
+
+        ValidateProvisionerConfigCalled   bool
+        ValidateProvisionerConfigRequest  provisioners.ValidateProvisionerConfigRequest
+        ValidateProvisionerConfigResponse provisioners.ValidateProvisionerConfigResponse
+        ValidateProvisionerConfigFn       func(provisioners.ValidateProvisionerConfigRequest) provisioners.ValidateProvisionerConfigResponse
+
+        ProvisionResourceCalled   bool
+        ProvisionResourceRequest  provisioners.ProvisionResourceRequest
+        ProvisionResourceResponse provisioners.ProvisionResourceResponse
+        ProvisionResourceFn       func(provisioners.ProvisionResourceRequest) provisioners.ProvisionResourceResponse
+
+        StopCalled   bool
+        StopResponse error
+        StopFn       func() error
+
+        CloseCalled   bool
+        CloseResponse error
+        CloseFn       func() error
+
+        // Legacy callbacks: if these are set, we will shim incoming calls for
+        // new-style methods to these old-fashioned terraform.ResourceProvider
+        // mock callbacks, for the benefit of older tests that were written against
+        // the old mock API.
+        ApplyFn func(rs *InstanceState, c *ResourceConfig) error
+}
+
+func (p *MockProvisioner) GetSchema() provisioners.GetSchemaResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.GetSchemaCalled = true
+        return p.getSchema()
+}
+
+// getSchema is the implementation of GetSchema, which can be called from other
+// methods on MockProvisioner that may already be holding the lock.
+func (p *MockProvisioner) getSchema() provisioners.GetSchemaResponse {
+        return p.GetSchemaResponse
+}
+
+func (p *MockProvisioner) ValidateProvisionerConfig(r provisioners.ValidateProvisionerConfigRequest) provisioners.ValidateProvisionerConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ValidateProvisionerConfigCalled = true
+        p.ValidateProvisionerConfigRequest = r
+        if p.ValidateProvisionerConfigFn != nil {
+                return p.ValidateProvisionerConfigFn(r)
+        }
+        return p.ValidateProvisionerConfigResponse
+}
+
+func (p *MockProvisioner) ProvisionResource(r provisioners.ProvisionResourceRequest) provisioners.ProvisionResourceResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ProvisionResourceCalled = true
+        p.ProvisionResourceRequest = r
+        if p.ApplyFn != nil {
+                if !r.Config.IsKnown() {
+                        panic(fmt.Sprintf("cannot provision with unknown value: %#v", r.Config))
+                }
+
+                schema := p.getSchema()
+                rc := NewResourceConfigShimmed(r.Config, schema.Provisioner)
+                connVal := r.Connection
+                connMap := map[string]string{}
+
+                if !connVal.IsNull() && connVal.IsKnown() {
+                        for it := connVal.ElementIterator(); it.Next(); {
+                                ak, av := it.Element()
+                                name := ak.AsString()
+
+                                if !av.IsKnown() || av.IsNull() {
+                                        continue
+                                }
+
+                                av, _ = convert.Convert(av, cty.String)
+                                connMap[name] = av.AsString()
+                        }
+                }
+
+                // We no longer pass the full instance state to a provisioner, so we'll
+                // construct a partial one that should be good enough for what existing
+                // test mocks need.
+                is := &InstanceState{
+                        Ephemeral: EphemeralState{
+                                ConnInfo: connMap,
+                        },
+                }
+                var resp provisioners.ProvisionResourceResponse
+                err := p.ApplyFn(is, rc)
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                }
+                return resp
+        }
+        if p.ProvisionResourceFn != nil {
+                fn := p.ProvisionResourceFn
+                p.Unlock()
+                return fn(r)
+        }
+
+        return p.ProvisionResourceResponse
+}
+
+func (p *MockProvisioner) Stop() error {
+        // We intentionally don't lock in this one because the whole point of this
+        // method is to be called concurrently with another operation that can
+        // be cancelled. The provisioner itself is responsible for handling
+        // any concurrency concerns in this case.
+
+        p.StopCalled = true
+        if p.StopFn != nil {
+                return p.StopFn()
+        }
+
+        return p.StopResponse
+}
+
+func (p *MockProvisioner) Close() error {
+        p.Lock()
+        defer p.Unlock()
+
+        p.CloseCalled = true
+        if p.CloseFn != nil {
+                return p.CloseFn()
+        }
+
+        return p.CloseResponse
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource.go b/vendor/github.com/hashicorp/terraform/terraform/resource.go
index 2f5ebb5..2cd6c5b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource.go
@@ -7,9 +7,14 @@ import (
         "strconv"
         "strings"
 
-        "github.com/hashicorp/terraform/config"
         "github.com/mitchellh/copystructure"
         "github.com/mitchellh/reflectwalk"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
 )
 
 // ResourceProvisionerConfig is used to pair a provisioner
@@ -25,9 +30,10 @@ type ResourceProvisionerConfig struct {
         ConnInfo    *config.RawConfig
 }
 
-// Resource encapsulates a resource, its configuration, its provider,
-// its current state, and potentially a desired diff from the state it
-// wants to reach.
+// Resource is a legacy way to identify a particular resource instance.
+//
+// New code should use addrs.ResourceInstance instead. This is still here
+// only for codepaths that haven't been updated yet.
 type Resource struct {
         // These are all used by the new EvalNode stuff.
         Name       string
@@ -47,6 +53,31 @@ type Resource struct {
         Flags        ResourceFlag
 }
 
+// NewResource constructs a legacy Resource object from an
+// addrs.ResourceInstance value.
+//
+// This is provided to shim to old codepaths that haven't been updated away
+// from this type yet. Since this old type is not able to represent instances
+// that have string keys, this function will panic if given a resource address
+// that has a string key.
+func NewResource(addr addrs.ResourceInstance) *Resource {
+        ret := &Resource{
+                Name: addr.Resource.Name,
+                Type: addr.Resource.Type,
+        }
+
+        if addr.Key != addrs.NoKey {
+                switch tk := addr.Key.(type) {
+                case addrs.IntKey:
+                        ret.CountIndex = int(tk)
+                default:
+                        panic(fmt.Errorf("resource instance with key %#v is not supported", addr.Key))
+                }
+        }
+
+        return ret
+}
+
 // ResourceKind specifies what kind of instance we're working with, whether
 // its a primary instance, a tainted instance, or an orphan.
 type ResourceFlag byte
@@ -72,20 +103,53 @@ type InstanceInfo struct {
         uniqueExtra string
 }
 
-// HumanId is a unique Id that is human-friendly and useful for UI elements.
-func (i *InstanceInfo) HumanId() string {
-        if i == nil {
-                return "<nil>"
+// NewInstanceInfo constructs an InstanceInfo from an addrs.AbsResourceInstance.
+//
+// InstanceInfo is a legacy type, and uses of it should be gradually replaced
+// by direct use of addrs.AbsResource or addrs.AbsResourceInstance as
+// appropriate.
+//
+// The legacy InstanceInfo type cannot represent module instances with instance
+// keys, so this function will panic if given such a path. Uses of this type
+// should all be removed or replaced before implementing "count" and "for_each"
+// arguments on modules in order to avoid such panics.
+//
+// This legacy type also cannot represent resource instances with string
+// instance keys. It will panic if the given key is not either NoKey or an
+// IntKey.
+func NewInstanceInfo(addr addrs.AbsResourceInstance) *InstanceInfo {
+        // We need an old-style []string module path for InstanceInfo.
+        path := make([]string, len(addr.Module))
+        for i, step := range addr.Module {
+                if step.InstanceKey != addrs.NoKey {
+                        panic("NewInstanceInfo cannot convert module instance with key")
+                }
+                path[i] = step.Name
         }
 
-        if len(i.ModulePath) <= 1 {
-                return i.Id
+        // This is a funny old meaning of "id" that is no longer current. It should
+        // not be used for anything users might see. Note that it does not include
+        // a representation of the resource mode, and so it's impossible to
+        // determine from an InstanceInfo alone whether it is a managed or data
+        // resource that is being referred to.
+        id := fmt.Sprintf("%s.%s", addr.Resource.Resource.Type, addr.Resource.Resource.Name)
+        if addr.Resource.Resource.Mode == addrs.DataResourceMode {
+                id = "data." + id
+        }
+        if addr.Resource.Key != addrs.NoKey {
+                switch k := addr.Resource.Key.(type) {
+                case addrs.IntKey:
+                        id = id + fmt.Sprintf(".%d", int(k))
+                default:
+                        panic(fmt.Sprintf("NewInstanceInfo cannot convert resource instance with %T instance key", addr.Resource.Key))
+                }
         }
 
-        return fmt.Sprintf(
-                "module.%s.%s",
-                strings.Join(i.ModulePath[1:], "."),
-                i.Id)
+        return &InstanceInfo{
+                Id:         id,
+                ModulePath: path,
+                Type:       addr.Resource.Resource.Type,
+        }
 }
 
 // ResourceAddress returns the address of the resource that the receiver is describing.
@@ -128,18 +192,9 @@ func (i *InstanceInfo) ResourceAddress() *ResourceAddress {
         return addr
 }
 
-func (i *InstanceInfo) uniqueId() string {
-        prefix := i.HumanId()
-        if v := i.uniqueExtra; v != "" {
-                prefix += " " + v
-        }
-
-        return prefix
-}
-
-// ResourceConfig holds the configuration given for a resource. This is
-// done instead of a raw `map[string]interface{}` type so that rich
-// methods can be added to it to make dealing with it easier.
+// ResourceConfig is a legacy type that was formerly used to represent
+// interpolatable configuration blocks. It is now only used to shim to old
+// APIs that still use this type, via NewResourceConfigShimmed.
 type ResourceConfig struct {
         ComputedKeys []string
         Raw          map[string]interface{}
@@ -155,6 +210,85 @@ func NewResourceConfig(c *config.RawConfig) *ResourceConfig {
         return result
 }
 
+// NewResourceConfigShimmed wraps a cty.Value of object type in a legacy
+// ResourceConfig object, so that it can be passed to older APIs that expect
+// this wrapping.
+//
+// The returned ResourceConfig is already interpolated and cannot be
+// re-interpolated. It is, therefore, useful only to functions that expect
+// an already-populated ResourceConfig which they then treat as read-only.
+//
+// If the given value is not of an object type that conforms to the given
+// schema then this function will panic.
+func NewResourceConfigShimmed(val cty.Value, schema *configschema.Block) *ResourceConfig {
+        if !val.Type().IsObjectType() {
+                panic(fmt.Errorf("NewResourceConfigShimmed given %#v; an object type is required", val.Type()))
+        }
+        ret := &ResourceConfig{}
+
+        legacyVal := hcl2shim.ConfigValueFromHCL2Block(val, schema)
+        if legacyVal != nil {
+                ret.Config = legacyVal
+
+                // Now we need to walk through our structure and find any unknown values,
+                // producing the separate list ComputedKeys to represent these. We use the
+                // schema here so that we can preserve the expected invariant
+                // that an attribute is always either wholly known or wholly unknown, while
+                // a child block can be partially unknown.
+                ret.ComputedKeys = newResourceConfigShimmedComputedKeys(val, "")
+        } else {
+                ret.Config = make(map[string]interface{})
+        }
+        ret.Raw = ret.Config
+
+        return ret
+}
+
+// Record the any config values in ComputedKeys. This field had been unused in
+// helper/schema, but in the new protocol we're using this so that the SDK can
+// now handle having an unknown collection. The legacy diff code doesn't
+// properly handle the unknown, because it can't be expressed in the same way
+// between the config and diff.
+func newResourceConfigShimmedComputedKeys(val cty.Value, path string) []string {
+        var ret []string
+        ty := val.Type()
+
+        if val.IsNull() {
+                return ret
+        }
+
+        if !val.IsKnown() {
+                // we shouldn't have an entirely unknown resource, but prevent empty
+                // strings just in case
+                if len(path) > 0 {
+                        ret = append(ret, path)
+                }
+                return ret
+        }
+
+        if path != "" {
+                path += "."
+        }
+        switch {
+        case ty.IsListType(), ty.IsTupleType(), ty.IsSetType():
+                i := 0
+                for it := val.ElementIterator(); it.Next(); i++ {
+                        _, subVal := it.Element()
+                        keys := newResourceConfigShimmedComputedKeys(subVal, fmt.Sprintf("%s%d", path, i))
+                        ret = append(ret, keys...)
+                }
+
+        case ty.IsMapType(), ty.IsObjectType():
+                for it := val.ElementIterator(); it.Next(); {
+                        subK, subVal := it.Element()
+                        keys := newResourceConfigShimmedComputedKeys(subVal, fmt.Sprintf("%s%s", path, subK.AsString()))
+                        ret = append(ret, keys...)
+                }
+        }
+
+        return ret
+}
+
 // DeepCopy performs a deep copy of the configuration. This makes it safe
 // to modify any of the structures that are part of the resource config without
 // affecting the original configuration.
@@ -374,6 +508,14 @@ func (c *ResourceConfig) get(
 // refactor is complete.
 func (c *ResourceConfig) interpolateForce() {
         if c.raw == nil {
+                // If we don't have a lowercase "raw" but we _do_ have the uppercase
+                // Raw populated then this indicates that we're recieving a shim
+                // ResourceConfig created by NewResourceConfigShimmed, which is already
+                // fully evaluated and thus this function doesn't need to do anything.
+                if c.Raw != nil {
+                        return
+                }
+
                 var err error
                 c.raw, err = config.NewRawConfig(make(map[string]interface{}))
                 if err != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
index a64f5d8..156ecf5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
@@ -7,8 +7,10 @@ import (
         "strconv"
         "strings"
 
+        "github.com/hashicorp/terraform/addrs"
+
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // ResourceAddress is a way of identifying an individual resource (or,
@@ -109,30 +111,47 @@ func (r *ResourceAddress) WholeModuleAddress() *ResourceAddress {
         }
 }
 
-// MatchesConfig returns true if the receiver matches the given
-// configuration resource within the given configuration module.
+// MatchesResourceConfig returns true if the receiver matches the given
+// configuration resource within the given _static_ module path. Note that
+// the module path in a resource address is a _dynamic_ module path, and
+// multiple dynamic resource paths may map to a single static path if
+// count and for_each are in use on module calls.
 //
 // Since resource configuration blocks represent all of the instances of
 // a multi-instance resource, the index of the address (if any) is not
 // considered.
-func (r *ResourceAddress) MatchesConfig(mod *module.Tree, rc *config.Resource) bool {
+func (r *ResourceAddress) MatchesResourceConfig(path addrs.Module, rc *configs.Resource) bool {
         if r.HasResourceSpec() {
-                if r.Mode != rc.Mode || r.Type != rc.Type || r.Name != rc.Name {
+                // FIXME: Some ugliness while we are between worlds. Functionality
+                // in "addrs" should eventually replace this ResourceAddress idea
+                // completely, but for now we'll need to translate to the old
+                // way of representing resource modes.
+                switch r.Mode {
+                case config.ManagedResourceMode:
+                        if rc.Mode != addrs.ManagedResourceMode {
+                                return false
+                        }
+                case config.DataResourceMode:
+                        if rc.Mode != addrs.DataResourceMode {
+                                return false
+                        }
+                }
+                if r.Type != rc.Type || r.Name != rc.Name {
                         return false
                 }
         }
 
         addrPath := r.Path
-        cfgPath := mod.Path()
 
         // normalize
         if len(addrPath) == 0 {
                 addrPath = nil
         }
-        if len(cfgPath) == 0 {
-                cfgPath = nil
+        if len(path) == 0 {
+                path = nil
         }
-        return reflect.DeepEqual(addrPath, cfgPath)
+        rawPath := []string(path)
+        return reflect.DeepEqual(addrPath, rawPath)
 }
 
 // stateId returns the ID that this resource should be entered with
@@ -270,6 +289,144 @@ func ParseResourceAddressForInstanceDiff(path []string, key string) (*ResourceAd
         return addr, nil
 }
 
+// NewLegacyResourceAddress creates a ResourceAddress from a new-style
+// addrs.AbsResource value.
+//
+// This is provided for shimming purposes so that we can still easily call into
+// older functions that expect the ResourceAddress type.
+func NewLegacyResourceAddress(addr addrs.AbsResource) *ResourceAddress {
+        ret := &ResourceAddress{
+                Type: addr.Resource.Type,
+                Name: addr.Resource.Name,
+        }
+
+        switch addr.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                ret.Mode = config.ManagedResourceMode
+        case addrs.DataResourceMode:
+                ret.Mode = config.DataResourceMode
+        default:
+                panic(fmt.Errorf("cannot shim %s to legacy config.ResourceMode value", addr.Resource.Mode))
+        }
+
+        path := make([]string, len(addr.Module))
+        for i, step := range addr.Module {
+                if step.InstanceKey != addrs.NoKey {
+                        // At the time of writing this can't happen because we don't
+                        // ket generate keyed module instances. This legacy codepath must
+                        // be removed before we can support "count" and "for_each" for
+                        // modules.
+                        panic(fmt.Errorf("cannot shim module instance step with key %#v to legacy ResourceAddress.Path", step.InstanceKey))
+                }
+
+                path[i] = step.Name
+        }
+        ret.Path = path
+        ret.Index = -1
+
+        return ret
+}
+
+// NewLegacyResourceInstanceAddress creates a ResourceAddress from a new-style
+// addrs.AbsResource value.
+//
+// This is provided for shimming purposes so that we can still easily call into
+// older functions that expect the ResourceAddress type.
+func NewLegacyResourceInstanceAddress(addr addrs.AbsResourceInstance) *ResourceAddress {
+        ret := &ResourceAddress{
+                Type: addr.Resource.Resource.Type,
+                Name: addr.Resource.Resource.Name,
+        }
+
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                ret.Mode = config.ManagedResourceMode
+        case addrs.DataResourceMode:
+                ret.Mode = config.DataResourceMode
+        default:
+                panic(fmt.Errorf("cannot shim %s to legacy config.ResourceMode value", addr.Resource.Resource.Mode))
+        }
+
+        path := make([]string, len(addr.Module))
+        for i, step := range addr.Module {
+                if step.InstanceKey != addrs.NoKey {
+                        // At the time of writing this can't happen because we don't
+                        // ket generate keyed module instances. This legacy codepath must
+                        // be removed before we can support "count" and "for_each" for
+                        // modules.
+                        panic(fmt.Errorf("cannot shim module instance step with key %#v to legacy ResourceAddress.Path", step.InstanceKey))
+                }
+
+                path[i] = step.Name
+        }
+        ret.Path = path
+
+        if addr.Resource.Key == addrs.NoKey {
+                ret.Index = -1
+        } else if ik, ok := addr.Resource.Key.(addrs.IntKey); ok {
+                ret.Index = int(ik)
+        } else {
+                panic(fmt.Errorf("cannot shim resource instance with key %#v to legacy ResourceAddress.Index", addr.Resource.Key))
+        }
+
+        return ret
+}
+
+// AbsResourceInstanceAddr converts the receiver, a legacy resource address, to
+// the new resource address type addrs.AbsResourceInstance.
+//
+// This method can be used only on an address that has a resource specification.
+// It will panic if called on a module-path-only ResourceAddress. Use
+// method HasResourceSpec to check before calling, in contexts where it is
+// unclear.
+//
+// addrs.AbsResourceInstance does not represent the "tainted" and "deposed"
+// states, and so if these are present on the receiver then they are discarded.
+//
+// This is provided for shimming purposes so that we can easily adapt functions
+// that are returning the legacy ResourceAddress type, for situations where
+// the new type is required.
+func (addr *ResourceAddress) AbsResourceInstanceAddr() addrs.AbsResourceInstance {
+        if !addr.HasResourceSpec() {
+                panic("AbsResourceInstanceAddr called on ResourceAddress with no resource spec")
+        }
+
+        ret := addrs.AbsResourceInstance{
+                Module: addr.ModuleInstanceAddr(),
+                Resource: addrs.ResourceInstance{
+                        Resource: addrs.Resource{
+                                Type: addr.Type,
+                                Name: addr.Name,
+                        },
+                },
+        }
+
+        switch addr.Mode {
+        case config.ManagedResourceMode:
+                ret.Resource.Resource.Mode = addrs.ManagedResourceMode
+        case config.DataResourceMode:
+                ret.Resource.Resource.Mode = addrs.DataResourceMode
+        default:
+                panic(fmt.Errorf("cannot shim %s to addrs.ResourceMode value", addr.Mode))
+        }
+
+        if addr.Index != -1 {
+                ret.Resource.Key = addrs.IntKey(addr.Index)
+        }
+
+        return ret
+}
+
+// ModuleInstanceAddr returns the module path portion of the receiver as a
+// addrs.ModuleInstance value.
+func (addr *ResourceAddress) ModuleInstanceAddr() addrs.ModuleInstance {
+        path := make(addrs.ModuleInstance, len(addr.Path))
+        for i, name := range addr.Path {
+                path[i] = addrs.ModuleInstanceStep{Name: name}
+        }
+        return path
+}
+
 // Contains returns true if and only if the given node is contained within
 // the receiver.
 //
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
index 93fd14f..3455ad8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
@@ -3,8 +3,10 @@ package terraform
 import (
         "fmt"
 
-        multierror "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/providers"
 )
 
 // ResourceProvider is an interface that must be implemented by any
@@ -30,13 +32,12 @@ type ResourceProvider interface {
         // resource or data source has the SchemaAvailable flag set.
         GetSchema(*ProviderSchemaRequest) (*ProviderSchema, error)
 
-        // Input is called to ask the provider to ask the user for input
-        // for completing the configuration if necesarry.
+        // Input was used prior to v0.12 to ask the provider to prompt the user
+        // for input to complete the configuration.
         //
-        // This may or may not be called, so resource provider writers shouldn't
-        // rely on this being available to set some default values for validate
-        // later. Example of a situation where this wouldn't be called is if
-        // the user is not using a TTY.
+        // From v0.12 onwards this method is never called because Terraform Core
+        // is able to handle the necessary input logic itself based on the
+        // schema returned from GetSchema.
         Input(UIInput, *ResourceConfig) (*ResourceConfig, error)
 
         // Validate is called once at the beginning with the raw configuration
@@ -170,18 +171,6 @@ type ResourceProvider interface {
         ReadDataApply(*InstanceInfo, *InstanceDiff) (*InstanceState, error)
 }
 
-// ResourceProviderError may be returned when creating a Context if the
-// required providers cannot be satisfied. This error can then be used to
-// format a more useful message for the user.
-type ResourceProviderError struct {
-        Errors []error
-}
-
-func (e *ResourceProviderError) Error() string {
-        // use multierror to format the default output
-        return multierror.Append(nil, e.Errors...).Error()
-}
-
 // ResourceProviderCloser is an interface that providers that can close
 // connections that aren't needed anymore must implement.
 type ResourceProviderCloser interface {
@@ -296,13 +285,35 @@ func ProviderHasDataSource(p ResourceProvider, n string) bool {
 // This should be called only with configurations that have passed calls
 // to config.Validate(), which ensures that all of the given version
 // constraints are valid. It will panic if any invalid constraints are present.
-func resourceProviderFactories(resolver ResourceProviderResolver, reqd discovery.PluginRequirements) (map[string]ResourceProviderFactory, error) {
+func resourceProviderFactories(resolver providers.Resolver, reqd discovery.PluginRequirements) (map[string]providers.Factory, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
         ret, errs := resolver.ResolveProviders(reqd)
         if errs != nil {
-                return nil, &ResourceProviderError{
-                        Errors: errs,
+                diags = diags.Append(
+                        tfdiags.Sourceless(tfdiags.Error,
+                                "Could not satisfy plugin requirements",
+                                errPluginInit,
+                        ),
+                )
+
+                for _, err := range errs {
+                        diags = diags.Append(err)
                 }
+
+                return nil, diags
         }
 
         return ret, nil
 }
+
+const errPluginInit = `
+Plugin reinitialization required. Please run "terraform init".
+
+Plugins are external binaries that Terraform uses to access and manipulate
+resources. The configuration provided requires plugins which can't be located,
+don't satisfy the version constraints, or are otherwise incompatible.
+
+Terraform automatically discovers provider requirements from your
+configuration, including providers used in child modules. To see the
+requirements and constraints from each module, run "terraform providers".
+`
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go
index 361ec1e..2743dd7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go
@@ -1,9 +1,21 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/provisioners"
+)
+
 // ResourceProvisioner is an interface that must be implemented by any
 // resource provisioner: the thing that initializes resources in
 // a Terraform configuration.
 type ResourceProvisioner interface {
+        // GetConfigSchema returns the schema for the provisioner type's main
+        // configuration block. This is called prior to Validate to enable some
+        // basic structural validation to be performed automatically and to allow
+        // the configuration to be properly extracted from potentially-ambiguous
+        // configuration file formats.
+        GetConfigSchema() (*configschema.Block, error)
+
         // Validate is called once at the beginning with the raw
         // configuration (no interpolation done) and can return a list of warnings
         // and/or errors.
@@ -52,3 +64,7 @@ type ResourceProvisionerCloser interface {
 // ResourceProvisionerFactory is a function type that creates a new instance
 // of a resource provisioner.
 type ResourceProvisionerFactory func() (ResourceProvisioner, error)
+
+// ProvisionerFactory is a function type that creates a new instance
+// of a provisioners.Interface.
+type ProvisionerFactory = provisioners.Factory
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go
index f471a51..7b88cf7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go
@@ -1,6 +1,10 @@
 package terraform
 
-import "sync"
+import (
+        "sync"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
 
 // MockResourceProvisioner implements ResourceProvisioner but mocks out all the
 // calls for testing purposes.
@@ -9,6 +13,10 @@ type MockResourceProvisioner struct {
         // Anything you want, in case you need to store extra data with the mock.
         Meta interface{}
 
+        GetConfigSchemaCalled       bool
+        GetConfigSchemaReturnSchema *configschema.Block
+        GetConfigSchemaReturnError  error
+
         ApplyCalled      bool
         ApplyOutput      UIOutput
         ApplyState       *InstanceState
@@ -27,6 +35,13 @@ type MockResourceProvisioner struct {
         StopReturnError error
 }
 
+var _ ResourceProvisioner = (*MockResourceProvisioner)(nil)
+
+func (p *MockResourceProvisioner) GetConfigSchema() (*configschema.Block, error) {
+        p.GetConfigSchemaCalled = true
+        return p.GetConfigSchemaReturnSchema, p.GetConfigSchemaReturnError
+}
+
 func (p *MockResourceProvisioner) Validate(c *ResourceConfig) ([]string, []error) {
         p.Lock()
         defer p.Unlock()
diff --git a/vendor/github.com/hashicorp/terraform/terraform/schemas.go b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
index ec46efc..62991c8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/schemas.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
@@ -1,18 +1,239 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/configschema"
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
+// Schemas is a container for various kinds of schema that Terraform needs
+// during processing.
 type Schemas struct {
-        Providers ProviderSchemas
+        Providers    map[string]*ProviderSchema
+        Provisioners map[string]*configschema.Block
+}
+
+// ProviderSchema returns the entire ProviderSchema object that was produced
+// by the plugin for the given provider, or nil if no such schema is available.
+//
+// It's usually better to go use the more precise methods offered by type
+// Schemas to handle this detail automatically.
+func (ss *Schemas) ProviderSchema(typeName string) *ProviderSchema {
+        if ss.Providers == nil {
+                return nil
+        }
+        return ss.Providers[typeName]
+}
+
+// ProviderConfig returns the schema for the provider configuration of the
+// given provider type, or nil if no such schema is available.
+func (ss *Schemas) ProviderConfig(typeName string) *configschema.Block {
+        ps := ss.ProviderSchema(typeName)
+        if ps == nil {
+                return nil
+        }
+        return ps.Provider
+}
+
+// ResourceTypeConfig returns the schema for the configuration of a given
+// resource type belonging to a given provider type, or nil of no such
+// schema is available.
+//
+// In many cases the provider type is inferrable from the resource type name,
+// but this is not always true because users can override the provider for
+// a resource using the "provider" meta-argument. Therefore it's important to
+// always pass the correct provider name, even though it many cases it feels
+// redundant.
+func (ss *Schemas) ResourceTypeConfig(providerType string, resourceMode addrs.ResourceMode, resourceType string) (block *configschema.Block, schemaVersion uint64) {
+        ps := ss.ProviderSchema(providerType)
+        if ps == nil || ps.ResourceTypes == nil {
+                return nil, 0
+        }
+        return ps.SchemaForResourceType(resourceMode, resourceType)
+}
+
+// ProvisionerConfig returns the schema for the configuration of a given
+// provisioner, or nil of no such schema is available.
+func (ss *Schemas) ProvisionerConfig(name string) *configschema.Block {
+        return ss.Provisioners[name]
 }
 
-// ProviderSchemas is a map from provider names to provider schemas.
+// LoadSchemas searches the given configuration, state  and plan (any of which
+// may be nil) for constructs that have an associated schema, requests the
+// necessary schemas from the given component factory (which must _not_ be nil),
+// and returns a single object representing all of the necessary schemas.
 //
-// The names in this map are the direct plugin name (e.g. "aws") rather than
-// any alias name (e.g. "aws.foo"), since.
-type ProviderSchemas map[string]*ProviderSchema
+// If an error is returned, it may be a wrapped tfdiags.Diagnostics describing
+// errors across multiple separate objects. Errors here will usually indicate
+// either misbehavior on the part of one of the providers or of the provider
+// protocol itself. When returned with errors, the returned schemas object is
+// still valid but may be incomplete.
+func LoadSchemas(config *configs.Config, state *states.State, components contextComponentFactory) (*Schemas, error) {
+        schemas := &Schemas{
+                Providers:    map[string]*ProviderSchema{},
+                Provisioners: map[string]*configschema.Block{},
+        }
+        var diags tfdiags.Diagnostics
+
+        newDiags := loadProviderSchemas(schemas.Providers, config, state, components)
+        diags = diags.Append(newDiags)
+        newDiags = loadProvisionerSchemas(schemas.Provisioners, config, components)
+        diags = diags.Append(newDiags)
+
+        return schemas, diags.Err()
+}
+
+func loadProviderSchemas(schemas map[string]*ProviderSchema, config *configs.Config, state *states.State, components contextComponentFactory) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        ensure := func(typeName string) {
+                if _, exists := schemas[typeName]; exists {
+                        return
+                }
+
+                log.Printf("[TRACE] LoadSchemas: retrieving schema for provider type %q", typeName)
+                provider, err := components.ResourceProvider(typeName, "early/"+typeName)
+                if err != nil {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[typeName] = &ProviderSchema{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to instantiate provider %q to obtain schema: %s", typeName, err),
+                        )
+                        return
+                }
+                defer func() {
+                        provider.Close()
+                }()
+
+                resp := provider.GetSchema()
+                if resp.Diagnostics.HasErrors() {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[typeName] = &ProviderSchema{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to retrieve schema from provider %q: %s", typeName, resp.Diagnostics.Err()),
+                        )
+                        return
+                }
+
+                s := &ProviderSchema{
+                        Provider:      resp.Provider.Block,
+                        ResourceTypes: make(map[string]*configschema.Block),
+                        DataSources:   make(map[string]*configschema.Block),
+
+                        ResourceTypeSchemaVersions: make(map[string]uint64),
+                }
+
+                if resp.Provider.Version < 0 {
+                        // We're not using the version numbers here yet, but we'll check
+                        // for validity anyway in case we start using them in future.
+                        diags = diags.Append(
+                                fmt.Errorf("invalid negative schema version provider configuration for provider %q", typeName),
+                        )
+                }
+
+                for t, r := range resp.ResourceTypes {
+                        s.ResourceTypes[t] = r.Block
+                        s.ResourceTypeSchemaVersions[t] = uint64(r.Version)
+                        if r.Version < 0 {
+                                diags = diags.Append(
+                                        fmt.Errorf("invalid negative schema version for resource type %s in provider %q", t, typeName),
+                                )
+                        }
+                }
+
+                for t, d := range resp.DataSources {
+                        s.DataSources[t] = d.Block
+                        if d.Version < 0 {
+                                // We're not using the version numbers here yet, but we'll check
+                                // for validity anyway in case we start using them in future.
+                                diags = diags.Append(
+                                        fmt.Errorf("invalid negative schema version for data source %s in provider %q", t, typeName),
+                                )
+                        }
+                }
+
+                schemas[typeName] = s
+        }
+
+        if config != nil {
+                for _, typeName := range config.ProviderTypes() {
+                        ensure(typeName)
+                }
+        }
+
+        if state != nil {
+                needed := providers.AddressedTypesAbs(state.ProviderAddrs())
+                for _, typeName := range needed {
+                        ensure(typeName)
+                }
+        }
+
+        return diags
+}
+
+func loadProvisionerSchemas(schemas map[string]*configschema.Block, config *configs.Config, components contextComponentFactory) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        ensure := func(name string) {
+                if _, exists := schemas[name]; exists {
+                        return
+                }
+
+                log.Printf("[TRACE] LoadSchemas: retrieving schema for provisioner %q", name)
+                provisioner, err := components.ResourceProvisioner(name, "early/"+name)
+                if err != nil {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[name] = &configschema.Block{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to instantiate provisioner %q to obtain schema: %s", name, err),
+                        )
+                        return
+                }
+                defer func() {
+                        if closer, ok := provisioner.(ResourceProvisionerCloser); ok {
+                                closer.Close()
+                        }
+                }()
+
+                resp := provisioner.GetSchema()
+                if resp.Diagnostics.HasErrors() {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[name] = &configschema.Block{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to retrieve schema from provisioner %q: %s", name, resp.Diagnostics.Err()),
+                        )
+                        return
+                }
+
+                schemas[name] = resp.Provisioner
+        }
+
+        if config != nil {
+                for _, rc := range config.Module.ManagedResources {
+                        for _, pc := range rc.Managed.Provisioners {
+                                ensure(pc.Type)
+                        }
+                }
+
+                // Must also visit our child modules, recursively.
+                for _, cc := range config.Children {
+                        childDiags := loadProvisionerSchemas(schemas, cc, components)
+                        diags = diags.Append(childDiags)
+                }
+        }
+
+        return diags
+}
 
 // ProviderSchema represents the schema for a provider's own configuration
 // and the configuration for some or all of its resources and data sources.
@@ -24,6 +245,29 @@ type ProviderSchema struct {
         Provider      *configschema.Block
         ResourceTypes map[string]*configschema.Block
         DataSources   map[string]*configschema.Block
+
+        ResourceTypeSchemaVersions map[string]uint64
+}
+
+// SchemaForResourceType attempts to find a schema for the given mode and type.
+// Returns nil if no such schema is available.
+func (ps *ProviderSchema) SchemaForResourceType(mode addrs.ResourceMode, typeName string) (schema *configschema.Block, version uint64) {
+        switch mode {
+        case addrs.ManagedResourceMode:
+                return ps.ResourceTypes[typeName], ps.ResourceTypeSchemaVersions[typeName]
+        case addrs.DataResourceMode:
+                // Data resources don't have schema versions right now, since state is discarded for each refresh
+                return ps.DataSources[typeName], 0
+        default:
+                // Shouldn't happen, because the above cases are comprehensive.
+                return nil, 0
+        }
+}
+
+// SchemaForResourceAddr attempts to find a schema for the mode and type from
+// the given resource address. Returns nil if no such schema is available.
+func (ps *ProviderSchema) SchemaForResourceAddr(addr addrs.Resource) (schema *configschema.Block, version uint64) {
+        return ps.SchemaForResourceType(addr.Mode, addr.Type)
 }
 
 // ProviderSchemaRequest is used to describe to a ResourceProvider which
diff --git a/vendor/github.com/hashicorp/terraform/terraform/semantics.go b/vendor/github.com/hashicorp/terraform/terraform/semantics.go
deleted file mode 100644
index 20f1d8a..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/semantics.go
+++ /dev/null
@@ -1,132 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "strings"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/dag"
-)
-
-// GraphSemanticChecker is the interface that semantic checks across
-// the entire Terraform graph implement.
-//
-// The graph should NOT be modified by the semantic checker.
-type GraphSemanticChecker interface {
-        Check(*dag.Graph) error
-}
-
-// UnorderedSemanticCheckRunner is an implementation of GraphSemanticChecker
-// that runs a list of SemanticCheckers against the vertices of the graph
-// in no specified order.
-type UnorderedSemanticCheckRunner struct {
-        Checks []SemanticChecker
-}
-
-func (sc *UnorderedSemanticCheckRunner) Check(g *dag.Graph) error {
-        var err error
-        for _, v := range g.Vertices() {
-                for _, check := range sc.Checks {
-                        if e := check.Check(g, v); e != nil {
-                                err = multierror.Append(err, e)
-                        }
-                }
-        }
-
-        return err
-}
-
-// SemanticChecker is the interface that semantic checks across the
-// Terraform graph implement. Errors are accumulated. Even after an error
-// is returned, child vertices in the graph will still be visited.
-//
-// The graph should NOT be modified by the semantic checker.
-//
-// The order in which vertices are visited is left unspecified, so the
-// semantic checks should not rely on that.
-type SemanticChecker interface {
-        Check(*dag.Graph, dag.Vertex) error
-}
-
-// smcUserVariables does all the semantic checks to verify that the
-// variables given satisfy the configuration itself.
-func smcUserVariables(c *config.Config, vs map[string]interface{}) []error {
-        var errs []error
-
-        cvs := make(map[string]*config.Variable)
-        for _, v := range c.Variables {
-                cvs[v.Name] = v
-        }
-
-        // Check that all required variables are present
-        required := make(map[string]struct{})
-        for _, v := range c.Variables {
-                if v.Required() {
-                        required[v.Name] = struct{}{}
-                }
-        }
-        for k, _ := range vs {
-                delete(required, k)
-        }
-        if len(required) > 0 {
-                for k, _ := range required {
-                        errs = append(errs, fmt.Errorf(
-                                "Required variable not set: %s", k))
-                }
-        }
-
-        // Check that types match up
-        for name, proposedValue := range vs {
-                // Check for "map.key" fields. These stopped working with Terraform
-                // 0.7 but we do this to surface a better error message informing
-                // the user what happened.
-                if idx := strings.Index(name, "."); idx > 0 {
-                        key := name[:idx]
-                        if _, ok := cvs[key]; ok {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: Overriding map keys with the format `name.key` is no "+
-                                                "longer allowed. You may still override keys by setting "+
-                                                "`name = { key = value }`. The maps will be merged. This "+
-                                                "behavior appeared in 0.7.0.", name))
-                                continue
-                        }
-                }
-
-                schema, ok := cvs[name]
-                if !ok {
-                        continue
-                }
-
-                declaredType := schema.Type()
-
-                switch declaredType {
-                case config.VariableTypeString:
-                        switch proposedValue.(type) {
-                        case string:
-                                continue
-                        }
-                case config.VariableTypeMap:
-                        switch v := proposedValue.(type) {
-                        case map[string]interface{}:
-                                continue
-                        case []map[string]interface{}:
-                                // if we have a list of 1 map, it will get coerced later as needed
-                                if len(v) == 1 {
-                                        continue
-                                }
-                        }
-                case config.VariableTypeList:
-                        switch proposedValue.(type) {
-                        case []interface{}:
-                                continue
-                        }
-                }
-                errs = append(errs, fmt.Errorf("variable %s should be type %s, got %s",
-                        name, declaredType.Printable(), hclTypeName(proposedValue)))
-        }
-
-        // TODO(mitchellh): variables that are unknown
-
-        return errs
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state.go b/vendor/github.com/hashicorp/terraform/terraform/state.go
index 04b14a6..092b690 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/state.go
@@ -16,12 +16,23 @@ import (
         "strings"
         "sync"
 
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/go-uuid"
-        "github.com/hashicorp/go-version"
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/errwrap"
+        multierror "github.com/hashicorp/go-multierror"
+        uuid "github.com/hashicorp/go-uuid"
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
         "github.com/mitchellh/copystructure"
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/tfdiags"
         tfversion "github.com/hashicorp/terraform/version"
 )
 
@@ -33,26 +44,38 @@ const (
 // rootModulePath is the path of the root module
 var rootModulePath = []string{"root"}
 
+// normalizeModulePath transforms a legacy module path (which may or may not
+// have a redundant "root" label at the start of it) into an
+// addrs.ModuleInstance representing the same module.
+//
+// For legacy reasons, different parts of Terraform disagree about whether the
+// root module has the path []string{} or []string{"root"}, and so this
+// function accepts both and trims off the "root". An implication of this is
+// that it's not possible to actually have a module call in the root module
+// that is itself named "root", since that would be ambiguous.
+//
 // normalizeModulePath takes a raw module path and returns a path that
 // has the rootModulePath prepended to it. If I could go back in time I
 // would've never had a rootModulePath (empty path would be root). We can
 // still fix this but thats a big refactor that my branch doesn't make sense
 // for. Instead, this function normalizes paths.
-func normalizeModulePath(p []string) []string {
-        k := len(rootModulePath)
+func normalizeModulePath(p []string) addrs.ModuleInstance {
+        // FIXME: Remove this once everyone is using addrs.ModuleInstance.
 
-        // If we already have a root module prefix, we're done
-        if len(p) >= len(rootModulePath) {
-                if reflect.DeepEqual(p[:k], rootModulePath) {
-                        return p
-                }
+        if len(p) > 0 && p[0] == "root" {
+                p = p[1:]
         }
 
-        // None? Prefix it
-        result := make([]string, len(rootModulePath)+len(p))
-        copy(result, rootModulePath)
-        copy(result[k:], p)
-        return result
+        ret := make(addrs.ModuleInstance, len(p))
+        for i, name := range p {
+                // For now we don't actually support modules with multiple instances
+                // identified by keys, so we just treat every path element as a
+                // step with no key.
+                ret[i] = addrs.ModuleInstanceStep{
+                        Name: name,
+                }
+        }
+        return ret
 }
 
 // State keeps track of a snapshot state-of-the-world that Terraform
@@ -138,21 +161,43 @@ func (s *State) children(path []string) []*ModuleState {
 //
 // This should be the preferred method to add module states since it
 // allows us to optimize lookups later as well as control sorting.
-func (s *State) AddModule(path []string) *ModuleState {
+func (s *State) AddModule(path addrs.ModuleInstance) *ModuleState {
         s.Lock()
         defer s.Unlock()
 
         return s.addModule(path)
 }
 
-func (s *State) addModule(path []string) *ModuleState {
+func (s *State) addModule(path addrs.ModuleInstance) *ModuleState {
         // check if the module exists first
         m := s.moduleByPath(path)
         if m != nil {
                 return m
         }
 
-        m = &ModuleState{Path: path}
+        // Lower the new-style address into a legacy-style address.
+        // This requires that none of the steps have instance keys, which is
+        // true for all addresses at the time of implementing this because
+        // "count" and "for_each" are not yet implemented for modules.
+        // For the purposes of state, the legacy address format also includes
+        // a redundant extra prefix element "root". It is important to include
+        // this because the "prune" method will remove any module that has a
+        // path length less than one, and other parts of the state code will
+        // trim off the first element indiscriminately.
+        legacyPath := make([]string, len(path)+1)
+        legacyPath[0] = "root"
+        for i, step := range path {
+                if step.InstanceKey != addrs.NoKey {
+                        // FIXME: Once the rest of Terraform is ready to use count and
+                        // for_each, remove all of this and just write the addrs.ModuleInstance
+                        // value itself into the ModuleState.
+                        panic("state cannot represent modules with count or for_each keys")
+                }
+
+                legacyPath[i+1] = step.Name
+        }
+
+        m = &ModuleState{Path: legacyPath}
         m.init()
         s.Modules = append(s.Modules, m)
         s.sort()
@@ -162,7 +207,7 @@ func (s *State) addModule(path []string) *ModuleState {
 // ModuleByPath is used to lookup the module state for the given path.
 // This should be the preferred lookup mechanism as it allows for future
 // lookup optimizations.
-func (s *State) ModuleByPath(path []string) *ModuleState {
+func (s *State) ModuleByPath(path addrs.ModuleInstance) *ModuleState {
         if s == nil {
                 return nil
         }
@@ -172,7 +217,7 @@ func (s *State) ModuleByPath(path []string) *ModuleState {
         return s.moduleByPath(path)
 }
 
-func (s *State) moduleByPath(path []string) *ModuleState {
+func (s *State) moduleByPath(path addrs.ModuleInstance) *ModuleState {
         for _, mod := range s.Modules {
                 if mod == nil {
                         continue
@@ -180,97 +225,14 @@ func (s *State) moduleByPath(path []string) *ModuleState {
                 if mod.Path == nil {
                         panic("missing module path")
                 }
-                if reflect.DeepEqual(mod.Path, path) {
+                modPath := normalizeModulePath(mod.Path)
+                if modPath.String() == path.String() {
                         return mod
                 }
         }
         return nil
 }
 
-// ModuleOrphans returns all the module orphans in this state by
-// returning their full paths. These paths can be used with ModuleByPath
-// to return the actual state.
-func (s *State) ModuleOrphans(path []string, c *config.Config) [][]string {
-        s.Lock()
-        defer s.Unlock()
-
-        return s.moduleOrphans(path, c)
-
-}
-
-func (s *State) moduleOrphans(path []string, c *config.Config) [][]string {
-        // direct keeps track of what direct children we have both in our config
-        // and in our state. childrenKeys keeps track of what isn't an orphan.
-        direct := make(map[string]struct{})
-        childrenKeys := make(map[string]struct{})
-        if c != nil {
-                for _, m := range c.Modules {
-                        childrenKeys[m.Name] = struct{}{}
-                        direct[m.Name] = struct{}{}
-                }
-        }
-
-        // Go over the direct children and find any that aren't in our keys.
-        var orphans [][]string
-        for _, m := range s.children(path) {
-                key := m.Path[len(m.Path)-1]
-
-                // Record that we found this key as a direct child. We use this
-                // later to find orphan nested modules.
-                direct[key] = struct{}{}
-
-                // If we have a direct child still in our config, it is not an orphan
-                if _, ok := childrenKeys[key]; ok {
-                        continue
-                }
-
-                orphans = append(orphans, m.Path)
-        }
-
-        // Find the orphans that are nested...
-        for _, m := range s.Modules {
-                if m == nil {
-                        continue
-                }
-
-                // We only want modules that are at least grandchildren
-                if len(m.Path) < len(path)+2 {
-                        continue
-                }
-
-                // If it isn't part of our tree, continue
-                if !reflect.DeepEqual(path, m.Path[:len(path)]) {
-                        continue
-                }
-
-                // If we have the direct child, then just skip it.
-                key := m.Path[len(path)]
-                if _, ok := direct[key]; ok {
-                        continue
-                }
-
-                orphanPath := m.Path[:len(path)+1]
-
-                // Don't double-add if we've already added this orphan (which can happen if
-                // there are multiple nested sub-modules that get orphaned together).
-                alreadyAdded := false
-                for _, o := range orphans {
-                        if reflect.DeepEqual(o, orphanPath) {
-                                alreadyAdded = true
-                                break
-                        }
-                }
-                if alreadyAdded {
-                        continue
-                }
-
-                // Add this orphan
-                orphans = append(orphans, orphanPath)
-        }
-
-        return orphans
-}
-
 // Empty returns true if the state is empty.
 func (s *State) Empty() bool {
         if s == nil {
@@ -443,7 +405,7 @@ func (s *State) removeModule(path []string, v *ModuleState) {
 
 func (s *State) removeResource(path []string, v *ResourceState) {
         // Get the module this resource lives in. If it doesn't exist, we're done.
-        mod := s.moduleByPath(path)
+        mod := s.moduleByPath(normalizeModulePath(path))
         if mod == nil {
                 return
         }
@@ -487,7 +449,7 @@ func (s *State) removeInstance(path []string, r *ResourceState, v *InstanceState
 
 // RootModule returns the ModuleState for the root module
 func (s *State) RootModule() *ModuleState {
-        root := s.ModuleByPath(rootModulePath)
+        root := s.ModuleByPath(addrs.RootModuleInstance)
         if root == nil {
                 panic("missing root module")
         }
@@ -522,7 +484,7 @@ func (s *State) equal(other *State) bool {
         }
         for _, m := range s.Modules {
                 // This isn't very optimal currently but works.
-                otherM := other.moduleByPath(m.Path)
+                otherM := other.moduleByPath(normalizeModulePath(m.Path))
                 if otherM == nil {
                         return false
                 }
@@ -681,8 +643,8 @@ func (s *State) init() {
                 s.Version = StateVersion
         }
 
-        if s.moduleByPath(rootModulePath) == nil {
-                s.addModule(rootModulePath)
+        if s.moduleByPath(addrs.RootModuleInstance) == nil {
+                s.addModule(addrs.RootModuleInstance)
         }
         s.ensureHasLineage()
 
@@ -811,13 +773,9 @@ func (s *State) String() string {
 
 // BackendState stores the configuration to connect to a remote backend.
 type BackendState struct {
-        Type   string                 `json:"type"`   // Backend type
-        Config map[string]interface{} `json:"config"` // Backend raw config
-
-        // Hash is the hash code to uniquely identify the original source
-        // configuration. We use this to detect when there is a change in
-        // configuration even when "type" isn't changed.
-        Hash uint64 `json:"hash"`
+        Type      string          `json:"type"`   // Backend type
+        ConfigRaw json.RawMessage `json:"config"` // Backend raw config
+        Hash      uint64          `json:"hash"`   // Hash of portion of configuration from config files
 }
 
 // Empty returns true if BackendState has no state.
@@ -825,25 +783,50 @@ func (s *BackendState) Empty() bool {
         return s == nil || s.Type == ""
 }
 
-// Rehash returns a unique content hash for this backend's configuration
-// as a uint64 value.
-// The Hash stored in the backend state needs to match the config itself, but
-// we need to compare the backend config after it has been combined with all
-// options.
-// This function must match the implementation used by config.Backend.
-func (s *BackendState) Rehash() uint64 {
+// Config decodes the type-specific configuration object using the provided
+// schema and returns the result as a cty.Value.
+//
+// An error is returned if the stored configuration does not conform to the
+// given schema.
+func (s *BackendState) Config(schema *configschema.Block) (cty.Value, error) {
+        ty := schema.ImpliedType()
         if s == nil {
-                return 0
+                return cty.NullVal(ty), nil
         }
+        return ctyjson.Unmarshal(s.ConfigRaw, ty)
+}
 
-        cfg := config.Backend{
-                Type: s.Type,
-                RawConfig: &config.RawConfig{
-                        Raw: s.Config,
-                },
+// SetConfig replaces (in-place) the type-specific configuration object using
+// the provided value and associated schema.
+//
+// An error is returned if the given value does not conform to the implied
+// type of the schema.
+func (s *BackendState) SetConfig(val cty.Value, schema *configschema.Block) error {
+        ty := schema.ImpliedType()
+        buf, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return err
         }
+        s.ConfigRaw = buf
+        return nil
+}
 
-        return cfg.Rehash()
+// ForPlan produces an alternative representation of the reciever that is
+// suitable for storing in a plan. The current workspace must additionally
+// be provided, to be stored alongside the backend configuration.
+//
+// The backend configuration schema is required in order to properly
+// encode the backend-specific configuration settings.
+func (s *BackendState) ForPlan(schema *configschema.Block, workspaceName string) (*plans.Backend, error) {
+        if s == nil {
+                return nil, nil
+        }
+
+        configVal, err := s.Config(schema)
+        if err != nil {
+                return nil, errwrap.Wrapf("failed to decode backend config: {{err}}", err)
+        }
+        return plans.NewBackend(s.Type, configVal, schema, workspaceName)
 }
 
 // RemoteState is used to track the information about a remote
@@ -1089,58 +1072,64 @@ func (m *ModuleState) IsDescendent(other *ModuleState) bool {
 // Orphans returns a list of keys of resources that are in the State
 // but aren't present in the configuration itself. Hence, these keys
 // represent the state of resources that are orphans.
-func (m *ModuleState) Orphans(c *config.Config) []string {
+func (m *ModuleState) Orphans(c *configs.Module) []addrs.ResourceInstance {
         m.Lock()
         defer m.Unlock()
 
-        keys := make(map[string]struct{})
-        for k := range m.Resources {
-                keys[k] = struct{}{}
-        }
-
+        inConfig := make(map[string]struct{})
         if c != nil {
-                for _, r := range c.Resources {
-                        delete(keys, r.Id())
-
-                        for k := range keys {
-                                if strings.HasPrefix(k, r.Id()+".") {
-                                        delete(keys, k)
-                                }
-                        }
+                for _, r := range c.ManagedResources {
+                        inConfig[r.Addr().String()] = struct{}{}
+                }
+                for _, r := range c.DataResources {
+                        inConfig[r.Addr().String()] = struct{}{}
                 }
         }
 
-        result := make([]string, 0, len(keys))
-        for k := range keys {
-                result = append(result, k)
-        }
+        var result []addrs.ResourceInstance
+        for k := range m.Resources {
+                // Since we've not yet updated state to use our new address format,
+                // we need to do some shimming here.
+                legacyAddr, err := parseResourceAddressInternal(k)
+                if err != nil {
+                        // Suggests that the user tampered with the state, since we always
+                        // generate valid internal addresses.
+                        log.Printf("ModuleState has invalid resource key %q. Ignoring.", k)
+                        continue
+                }
 
+                addr := legacyAddr.AbsResourceInstanceAddr().Resource
+                compareKey := addr.Resource.String() // compare by resource address, ignoring instance key
+                if _, exists := inConfig[compareKey]; !exists {
+                        result = append(result, addr)
+                }
+        }
         return result
 }
 
 // RemovedOutputs returns a list of outputs that are in the State but aren't
 // present in the configuration itself.
-func (m *ModuleState) RemovedOutputs(c *config.Config) []string {
-        m.Lock()
-        defer m.Unlock()
-
-        keys := make(map[string]struct{})
-        for k := range m.Outputs {
-                keys[k] = struct{}{}
+func (s *ModuleState) RemovedOutputs(outputs map[string]*configs.Output) []addrs.OutputValue {
+        if outputs == nil {
+                // If we got no output map at all then we'll just treat our set of
+                // configured outputs as empty, since that suggests that they've all
+                // been removed by removing their containing module.
+                outputs = make(map[string]*configs.Output)
         }
 
-        if c != nil {
-                for _, o := range c.Outputs {
-                        delete(keys, o.Name)
-                }
-        }
+        s.Lock()
+        defer s.Unlock()
 
-        result := make([]string, 0, len(keys))
-        for k := range keys {
-                result = append(result, k)
+        var ret []addrs.OutputValue
+        for n := range s.Outputs {
+                if _, declared := outputs[n]; !declared {
+                        ret = append(ret, addrs.OutputValue{
+                                Name: n,
+                        })
+                }
         }
 
-        return result
+        return ret
 }
 
 // View returns a view with the given resource prefix.
@@ -1543,6 +1532,24 @@ func (s *ResourceState) Untaint() {
         }
 }
 
+// ProviderAddr returns the provider address for the receiver, by parsing the
+// string representation saved in state. An error can be returned if the
+// value in state is corrupt.
+func (s *ResourceState) ProviderAddr() (addrs.AbsProviderConfig, error) {
+        var diags tfdiags.Diagnostics
+
+        str := s.Provider
+        traversal, travDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(travDiags)
+        if travDiags.HasErrors() {
+                return addrs.AbsProviderConfig{}, diags.Err()
+        }
+
+        addr, addrDiags := addrs.ParseAbsProviderConfig(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags.Err()
+}
+
 func (s *ResourceState) init() {
         s.Lock()
         defer s.Unlock()
@@ -1651,6 +1658,51 @@ func (s *InstanceState) init() {
         s.Ephemeral.init()
 }
 
+// NewInstanceStateShimmedFromValue is a shim method to lower a new-style
+// object value representing the attributes of an instance object into the
+// legacy InstanceState representation.
+//
+// This is for shimming to old components only and should not be used in new code.
+func NewInstanceStateShimmedFromValue(state cty.Value, schemaVersion int) *InstanceState {
+        attrs := hcl2shim.FlatmapValueFromHCL2(state)
+        return &InstanceState{
+                ID:         attrs["id"],
+                Attributes: attrs,
+                Meta: map[string]interface{}{
+                        "schema_version": schemaVersion,
+                },
+        }
+}
+
+// AttrsAsObjectValue shims from the legacy InstanceState representation to
+// a new-style cty object value representation of the state attributes, using
+// the given type for guidance.
+//
+// The given type must be the implied type of the schema of the resource type
+// of the object whose state is being converted, or the result is undefined.
+//
+// This is for shimming from old components only and should not be used in
+// new code.
+func (s *InstanceState) AttrsAsObjectValue(ty cty.Type) (cty.Value, error) {
+        if s == nil {
+                // if the state is nil, we need to construct a complete cty.Value with
+                // null attributes, rather than a single cty.NullVal(ty)
+                s = &InstanceState{}
+        }
+
+        if s.Attributes == nil {
+                s.Attributes = map[string]string{}
+        }
+
+        // make sure ID is included in the attributes. The InstanceState.ID value
+        // takes precedence.
+        if s.ID != "" {
+                s.Attributes["id"] = s.ID
+        }
+
+        return hcl2shim.HCL2ValueFromFlatmap(s.Attributes, ty)
+}
+
 // Copy all the Fields from another InstanceState
 func (s *InstanceState) Set(from *InstanceState) {
         s.Lock()
@@ -1787,13 +1839,19 @@ func (s *InstanceState) MergeDiff(d *InstanceDiff) *InstanceState {
 }
 
 func (s *InstanceState) String() string {
+        notCreated := "<not created>"
+
+        if s == nil {
+                return notCreated
+        }
+
         s.Lock()
         defer s.Unlock()
 
         var buf bytes.Buffer
 
-        if s == nil || s.ID == "" {
-                return "<not created>"
+        if s.ID == "" {
+                return notCreated
         }
 
         buf.WriteString(fmt.Sprintf("ID = %s\n", s.ID))
@@ -2187,19 +2245,6 @@ func (s moduleStateSort) Swap(i, j int) {
         s[i], s[j] = s[j], s[i]
 }
 
-// StateCompatible returns an error if the state is not compatible with the
-// current version of terraform.
-func CheckStateVersion(state *State) error {
-        if state == nil {
-                return nil
-        }
-
-        if state.FromFutureTerraform() {
-                return fmt.Errorf(stateInvalidTerraformVersionErr, state.TFVersion)
-        }
-        return nil
-}
-
 const stateValidateErrMultiModule = `
 Multiple modules with the same path: %s
 
@@ -2208,11 +2253,3 @@ in your state file that point to the same module. This will cause Terraform
 to behave in unexpected and error prone ways and is invalid. Please back up
 and modify your state file manually to resolve this.
 `
-
-const stateInvalidTerraformVersionErr = `
-Terraform doesn't allow running any operations against a state
-that was written by a future Terraform version. The state is
-reporting it is written by Terraform '%s'
-
-Please run at least that version of Terraform to continue.
-`
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state_add.go b/vendor/github.com/hashicorp/terraform/terraform/state_add.go
deleted file mode 100644
index 1163730..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/state_add.go
+++ /dev/null
@@ -1,374 +0,0 @@
-package terraform
-
-import "fmt"
-
-// Add adds the item in the state at the given address.
-//
-// The item can be a ModuleState, ResourceState, or InstanceState. Depending
-// on the item type, the address may or may not be valid. For example, a
-// module cannot be moved to a resource address, however a resource can be
-// moved to a module address (it retains the same name, under that resource).
-//
-// The item can also be a []*ModuleState, which is the case for nested
-// modules. In this case, Add will expect the zero-index to be the top-most
-// module to add and will only nest children from there. For semantics, this
-// is equivalent to module => module.
-//
-// The full semantics of Add:
-//
-//                      ┌───────────────────┬───────────────────┬───────────────────┐
-//                      │  Module Address   │ Resource Address  │ Instance Address  │
-//    ┌─────────────────┼───────────────────┼───────────────────┼───────────────────┤
-//    │   ModuleState   │         ✓         │         x         │         x         │
-//    ├─────────────────┼───────────────────┼───────────────────┼───────────────────┤
-//    │  ResourceState  │         ✓         │         ✓         │      maybe*       │
-//    ├─────────────────┼───────────────────┼───────────────────┼───────────────────┤
-//    │ Instance State  │         ✓         │         ✓         │         ✓         │
-//    └─────────────────┴───────────────────┴───────────────────┴───────────────────┘
-//
-// *maybe - Resources can be added at an instance address only if the resource
-//          represents a single instance (primary). Example:
-//          "aws_instance.foo" can be moved to "aws_instance.bar.tainted"
-//
-func (s *State) Add(fromAddrRaw string, toAddrRaw string, raw interface{}) error {
-        // Parse the address
-
-        toAddr, err := ParseResourceAddress(toAddrRaw)
-        if err != nil {
-                return err
-        }
-
-        // Parse the from address
-        fromAddr, err := ParseResourceAddress(fromAddrRaw)
-        if err != nil {
-                return err
-        }
-
-        // Determine the types
-        from := detectValueAddLoc(raw)
-        to := detectAddrAddLoc(toAddr)
-
-        // Find the function to do this
-        fromMap, ok := stateAddFuncs[from]
-        if !ok {
-                return fmt.Errorf("invalid source to add to state: %T", raw)
-        }
-        f, ok := fromMap[to]
-        if !ok {
-                return fmt.Errorf("invalid destination: %s (%d)", toAddr, to)
-        }
-
-        // Call the migrator
-        if err := f(s, fromAddr, toAddr, raw); err != nil {
-                return err
-        }
-
-        // Prune the state
-        s.prune()
-        return nil
-}
-
-func stateAddFunc_Module_Module(s *State, fromAddr, addr *ResourceAddress, raw interface{}) error {
-        // raw can be either *ModuleState or []*ModuleState. The former means
-        // we're moving just one module. The latter means we're moving a module
-        // and children.
-        root := raw
-        var rest []*ModuleState
-        if list, ok := raw.([]*ModuleState); ok {
-                // We need at least one item
-                if len(list) == 0 {
-                        return fmt.Errorf("module move with no value to: %s", addr)
-                }
-
-                // The first item is always the root
-                root = list[0]
-                if len(list) > 1 {
-                        rest = list[1:]
-                }
-        }
-
-        // Get the actual module state
-        src := root.(*ModuleState).deepcopy()
-
-        // If the target module exists, it is an error
-        path := append([]string{"root"}, addr.Path...)
-        if s.ModuleByPath(path) != nil {
-                return fmt.Errorf("module target is not empty: %s", addr)
-        }
-
-        // Create it and copy our outputs and dependencies
-        mod := s.AddModule(path)
-        mod.Outputs = src.Outputs
-        mod.Dependencies = src.Dependencies
-
-        // Go through the resources perform an add for each of those
-        for k, v := range src.Resources {
-                resourceKey, err := ParseResourceStateKey(k)
-                if err != nil {
-                        return err
-                }
-
-                // Update the resource address for this
-                addrCopy := *addr
-                addrCopy.Type = resourceKey.Type
-                addrCopy.Name = resourceKey.Name
-                addrCopy.Index = resourceKey.Index
-                addrCopy.Mode = resourceKey.Mode
-
-                // Perform an add
-                if err := s.Add(fromAddr.String(), addrCopy.String(), v); err != nil {
-                        return err
-                }
-        }
-
-        // Add all the children if we have them
-        for _, item := range rest {
-                // If item isn't a descendent of our root, then ignore it
-                if !src.IsDescendent(item) {
-                        continue
-                }
-
-                // It is! Strip the leading prefix and attach that to our address
-                extra := item.Path[len(src.Path):]
-                addrCopy := addr.Copy()
-                addrCopy.Path = append(addrCopy.Path, extra...)
-
-                // Add it
-                s.Add(fromAddr.String(), addrCopy.String(), item)
-        }
-
-        return nil
-}
-
-func stateAddFunc_Resource_Module(
-        s *State, from, to *ResourceAddress, raw interface{}) error {
-        // Build the more specific to addr
-        addr := *to
-        addr.Type = from.Type
-        addr.Name = from.Name
-
-        return s.Add(from.String(), addr.String(), raw)
-}
-
-func stateAddFunc_Resource_Resource(s *State, fromAddr, addr *ResourceAddress, raw interface{}) error {
-        // raw can be either *ResourceState or []*ResourceState. The former means
-        // we're moving just one resource. The latter means we're moving a count
-        // of resources.
-        if list, ok := raw.([]*ResourceState); ok {
-                // We need at least one item
-                if len(list) == 0 {
-                        return fmt.Errorf("resource move with no value to: %s", addr)
-                }
-
-                // If there is an index, this is an error since we can't assign
-                // a set of resources to a single index
-                if addr.Index >= 0 && len(list) > 1 {
-                        return fmt.Errorf(
-                                "multiple resources can't be moved to a single index: "+
-                                        "%s => %s", fromAddr, addr)
-                }
-
-                // Add each with a specific index
-                for i, rs := range list {
-                        addrCopy := addr.Copy()
-                        addrCopy.Index = i
-
-                        if err := s.Add(fromAddr.String(), addrCopy.String(), rs); err != nil {
-                                return err
-                        }
-                }
-
-                return nil
-        }
-
-        src := raw.(*ResourceState).deepcopy()
-
-        // Initialize the resource
-        resourceRaw, exists := stateAddInitAddr(s, addr)
-        if exists {
-                return fmt.Errorf("resource exists and not empty: %s", addr)
-        }
-        resource := resourceRaw.(*ResourceState)
-        resource.Type = src.Type
-        resource.Dependencies = src.Dependencies
-        resource.Provider = src.Provider
-
-        // Move the primary
-        if src.Primary != nil {
-                addrCopy := *addr
-                addrCopy.InstanceType = TypePrimary
-                addrCopy.InstanceTypeSet = true
-                if err := s.Add(fromAddr.String(), addrCopy.String(), src.Primary); err != nil {
-                        return err
-                }
-        }
-
-        // Move all deposed
-        if len(src.Deposed) > 0 {
-                resource.Deposed = src.Deposed
-        }
-
-        return nil
-}
-
-func stateAddFunc_Instance_Instance(s *State, fromAddr, addr *ResourceAddress, raw interface{}) error {
-        src := raw.(*InstanceState).DeepCopy()
-
-        // Create the instance
-        instanceRaw, _ := stateAddInitAddr(s, addr)
-        instance := instanceRaw.(*InstanceState)
-
-        // Set it
-        instance.Set(src)
-
-        return nil
-}
-
-func stateAddFunc_Instance_Module(
-        s *State, from, to *ResourceAddress, raw interface{}) error {
-        addr := *to
-        addr.Type = from.Type
-        addr.Name = from.Name
-
-        return s.Add(from.String(), addr.String(), raw)
-}
-
-func stateAddFunc_Instance_Resource(
-        s *State, from, to *ResourceAddress, raw interface{}) error {
-        addr := *to
-        addr.InstanceType = TypePrimary
-        addr.InstanceTypeSet = true
-
-        return s.Add(from.String(), addr.String(), raw)
-}
-
-// stateAddFunc is the type of function for adding an item to a state
-type stateAddFunc func(s *State, from, to *ResourceAddress, item interface{}) error
-
-// stateAddFuncs has the full matrix mapping of the state adders.
-var stateAddFuncs map[stateAddLoc]map[stateAddLoc]stateAddFunc
-
-func init() {
-        stateAddFuncs = map[stateAddLoc]map[stateAddLoc]stateAddFunc{
-                stateAddModule: {
-                        stateAddModule: stateAddFunc_Module_Module,
-                },
-                stateAddResource: {
-                        stateAddModule:   stateAddFunc_Resource_Module,
-                        stateAddResource: stateAddFunc_Resource_Resource,
-                },
-                stateAddInstance: {
-                        stateAddInstance: stateAddFunc_Instance_Instance,
-                        stateAddModule:   stateAddFunc_Instance_Module,
-                        stateAddResource: stateAddFunc_Instance_Resource,
-                },
-        }
-}
-
-// stateAddLoc is an enum to represent the location where state is being
-// moved from/to. We use this for quick lookups in a function map.
-type stateAddLoc uint
-
-const (
-        stateAddInvalid stateAddLoc = iota
-        stateAddModule
-        stateAddResource
-        stateAddInstance
-)
-
-// detectAddrAddLoc detects the state type for the given address. This
-// function is specifically not unit tested since we consider the State.Add
-// functionality to be comprehensive enough to cover this.
-func detectAddrAddLoc(addr *ResourceAddress) stateAddLoc {
-        if addr.Name == "" {
-                return stateAddModule
-        }
-
-        if !addr.InstanceTypeSet {
-                return stateAddResource
-        }
-
-        return stateAddInstance
-}
-
-// detectValueAddLoc determines the stateAddLoc value from the raw value
-// that is some State structure.
-func detectValueAddLoc(raw interface{}) stateAddLoc {
-        switch raw.(type) {
-        case *ModuleState:
-                return stateAddModule
-        case []*ModuleState:
-                return stateAddModule
-        case *ResourceState:
-                return stateAddResource
-        case []*ResourceState:
-                return stateAddResource
-        case *InstanceState:
-                return stateAddInstance
-        default:
-                return stateAddInvalid
-        }
-}
-
-// stateAddInitAddr takes a ResourceAddress and creates the non-existing
-// resources up to that point, returning the empty (or existing) interface
-// at that address.
-func stateAddInitAddr(s *State, addr *ResourceAddress) (interface{}, bool) {
-        addType := detectAddrAddLoc(addr)
-
-        // Get the module
-        path := append([]string{"root"}, addr.Path...)
-        exists := true
-        mod := s.ModuleByPath(path)
-        if mod == nil {
-                mod = s.AddModule(path)
-                exists = false
-        }
-        if addType == stateAddModule {
-                return mod, exists
-        }
-
-        // Add the resource
-        resourceKey := (&ResourceStateKey{
-                Name:  addr.Name,
-                Type:  addr.Type,
-                Index: addr.Index,
-                Mode:  addr.Mode,
-        }).String()
-        exists = true
-        resource, ok := mod.Resources[resourceKey]
-        if !ok {
-                resource = &ResourceState{Type: addr.Type}
-                resource.init()
-                mod.Resources[resourceKey] = resource
-                exists = false
-        }
-        if addType == stateAddResource {
-                return resource, exists
-        }
-
-        // Get the instance
-        exists = true
-        instance := &InstanceState{}
-        switch addr.InstanceType {
-        case TypePrimary, TypeTainted:
-                if v := resource.Primary; v != nil {
-                        instance = resource.Primary
-                } else {
-                        exists = false
-                }
-        case TypeDeposed:
-                idx := addr.Index
-                if addr.Index < 0 {
-                        idx = 0
-                }
-                if len(resource.Deposed) > idx {
-                        instance = resource.Deposed[idx]
-                } else {
-                        resource.Deposed = append(resource.Deposed, instance)
-                        exists = false
-                }
-        }
-
-        return instance, exists
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform.go b/vendor/github.com/hashicorp/terraform/terraform/transform.go
index 0e47f20..fd3f5c7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform.go
@@ -38,13 +38,18 @@ type graphTransformerMulti struct {
 }
 
 func (t *graphTransformerMulti) Transform(g *Graph) error {
+        var lastStepStr string
         for _, t := range t.Transforms {
+                log.Printf("[TRACE] (graphTransformerMulti) Executing graph transform %T", t)
                 if err := t.Transform(g); err != nil {
                         return err
                 }
-                log.Printf(
-                        "[TRACE] Graph after step %T:\n\n%s",
-                        t, g.StringWithNodeTypes())
+                if thisStepStr := g.StringWithNodeTypes(); thisStepStr != lastStepStr {
+                        log.Printf("[TRACE] (graphTransformerMulti) Completed graph transform %T with new graph:\n%s------", t, thisStepStr)
+                        lastStepStr = thisStepStr
+                } else {
+                        log.Printf("[TRACE] (graphTransformerMulti) Completed graph transform %T (no changes)", t)
+                }
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
index 39cf097..897a7e7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
@@ -1,7 +1,8 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // GraphNodeAttachProvider is an interface that must be implemented by nodes
@@ -11,8 +12,8 @@ type GraphNodeAttachProvider interface {
         GraphNodeSubPath
 
         // ProviderName with no module prefix. Example: "aws".
-        ProviderName() string
+        ProviderAddr() addrs.AbsProviderConfig
 
         // Sets the configuration
-        AttachProvider(*config.ProviderConfig)
+        AttachProvider(*configs.Provider)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go
index f2ee37e..03f8564 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go
@@ -1,35 +1,32 @@
 package terraform
 
 import (
-        "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
 )
 
 // GraphNodeAttachResourceConfig is an interface that must be implemented by nodes
 // that want resource configurations attached.
 type GraphNodeAttachResourceConfig interface {
-        // ResourceAddr is the address to the resource
-        ResourceAddr() *ResourceAddress
+        GraphNodeResource
 
         // Sets the configuration
-        AttachResourceConfig(*config.Resource)
+        AttachResourceConfig(*configs.Resource)
 }
 
 // AttachResourceConfigTransformer goes through the graph and attaches
-// resource configuration structures to nodes that implement the interfaces
-// above.
+// resource configuration structures to nodes that implement
+// GraphNodeAttachManagedResourceConfig or GraphNodeAttachDataResourceConfig.
 //
 // The attached configuration structures are directly from the configuration.
 // If they're going to be modified, a copy should be made.
 type AttachResourceConfigTransformer struct {
-        Module *module.Tree // Module is the root module for the config
+        Config *configs.Config // Config is the root node in the config tree
 }
 
 func (t *AttachResourceConfigTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] AttachResourceConfigTransformer: Beginning...")
 
         // Go through and find GraphNodeAttachResource
         for _, v := range g.Vertices() {
@@ -41,36 +38,35 @@ func (t *AttachResourceConfigTransformer) Transform(g *Graph) error {
 
                 // Determine what we're looking for
                 addr := arn.ResourceAddr()
-                log.Printf(
-                        "[TRACE] AttachResourceConfigTransformer: Attach resource "+
-                                "config request: %s", addr)
 
                 // Get the configuration.
-                path := normalizeModulePath(addr.Path)
-                path = path[1:]
-                tree := t.Module.Child(path)
-                if tree == nil {
+                config := t.Config.DescendentForInstance(addr.Module)
+                if config == nil {
+                        log.Printf("[TRACE] AttachResourceConfigTransformer: %q (%T) has no configuration available", dag.VertexName(v), v)
                         continue
                 }
 
-                // Go through the resource configs to find the matching config
-                for _, r := range tree.Config().Resources {
-                        // Get a resource address so we can compare
-                        a, err := parseResourceAddressConfig(r)
-                        if err != nil {
-                                panic(fmt.Sprintf(
-                                        "Error parsing config address, this is a bug: %#v", r))
+                for _, r := range config.Module.ManagedResources {
+                        rAddr := r.Addr()
+
+                        if rAddr != addr.Resource {
+                                // Not the same resource
+                                continue
                         }
-                        a.Path = addr.Path
 
-                        // If this is not the same resource, then continue
-                        if !a.Equals(addr) {
+                        log.Printf("[TRACE] AttachResourceConfigTransformer: attaching to %q (%T) config from %s", dag.VertexName(v), v, r.DeclRange)
+                        arn.AttachResourceConfig(r)
+                }
+                for _, r := range config.Module.DataResources {
+                        rAddr := r.Addr()
+
+                        if rAddr != addr.Resource {
+                                // Not the same resource
                                 continue
                         }
 
-                        log.Printf("[TRACE] Attaching resource config: %#v", r)
+                        log.Printf("[TRACE] AttachResourceConfigTransformer: attaching to %q (%T) config from %#v", dag.VertexName(v), v, r.DeclRange)
                         arn.AttachResourceConfig(r)
-                        break
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_schema.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_schema.go
new file mode 100644
index 0000000..c7695dd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_schema.go
@@ -0,0 +1,99 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/dag"
+)
+
+// GraphNodeAttachResourceSchema is an interface implemented by node types
+// that need a resource schema attached.
+type GraphNodeAttachResourceSchema interface {
+        GraphNodeResource
+        GraphNodeProviderConsumer
+
+        AttachResourceSchema(schema *configschema.Block, version uint64)
+}
+
+// GraphNodeAttachProviderConfigSchema is an interface implemented by node types
+// that need a provider configuration schema attached.
+type GraphNodeAttachProviderConfigSchema interface {
+        GraphNodeProvider
+
+        AttachProviderConfigSchema(*configschema.Block)
+}
+
+// GraphNodeAttachProvisionerSchema is an interface implemented by node types
+// that need one or more provisioner schemas attached.
+type GraphNodeAttachProvisionerSchema interface {
+        ProvisionedBy() []string
+
+        // SetProvisionerSchema is called during transform for each provisioner
+        // type returned from ProvisionedBy, providing the configuration schema
+        // for each provisioner in turn. The implementer should save these for
+        // later use in evaluating provisioner configuration blocks.
+        AttachProvisionerSchema(name string, schema *configschema.Block)
+}
+
+// AttachSchemaTransformer finds nodes that implement
+// GraphNodeAttachResourceSchema, GraphNodeAttachProviderConfigSchema, or
+// GraphNodeAttachProvisionerSchema, looks up the needed schemas for each
+// and then passes them to a method implemented by the node.
+type AttachSchemaTransformer struct {
+        Schemas *Schemas
+}
+
+func (t *AttachSchemaTransformer) Transform(g *Graph) error {
+        if t.Schemas == nil {
+                // Should never happen with a reasonable caller, but we'll return a
+                // proper error here anyway so that we'll fail gracefully.
+                return fmt.Errorf("AttachSchemaTransformer used with nil Schemas")
+        }
+
+        for _, v := range g.Vertices() {
+
+                if tv, ok := v.(GraphNodeAttachResourceSchema); ok {
+                        addr := tv.ResourceAddr()
+                        mode := addr.Resource.Mode
+                        typeName := addr.Resource.Type
+                        providerAddr, _ := tv.ProvidedBy()
+                        providerType := providerAddr.ProviderConfig.Type
+
+                        schema, version := t.Schemas.ResourceTypeConfig(providerType, mode, typeName)
+                        if schema == nil {
+                                log.Printf("[ERROR] AttachSchemaTransformer: No resource schema available for %s", addr)
+                                continue
+                        }
+                        log.Printf("[TRACE] AttachSchemaTransformer: attaching resource schema to %s", dag.VertexName(v))
+                        tv.AttachResourceSchema(schema, version)
+                }
+
+                if tv, ok := v.(GraphNodeAttachProviderConfigSchema); ok {
+                        providerAddr := tv.ProviderAddr()
+                        schema := t.Schemas.ProviderConfig(providerAddr.ProviderConfig.Type)
+                        if schema == nil {
+                                log.Printf("[ERROR] AttachSchemaTransformer: No provider config schema available for %s", providerAddr)
+                                continue
+                        }
+                        log.Printf("[TRACE] AttachSchemaTransformer: attaching provider config schema to %s", dag.VertexName(v))
+                        tv.AttachProviderConfigSchema(schema)
+                }
+
+                if tv, ok := v.(GraphNodeAttachProvisionerSchema); ok {
+                        names := tv.ProvisionedBy()
+                        for _, name := range names {
+                                schema := t.Schemas.ProvisionerConfig(name)
+                                if schema == nil {
+                                        log.Printf("[ERROR] AttachSchemaTransformer: No schema available for provisioner %q on %q", name, dag.VertexName(v))
+                                        continue
+                                }
+                                log.Printf("[TRACE] AttachSchemaTransformer: attaching provisioner %q config schema to %s", name, dag.VertexName(v))
+                                tv.AttachProvisionerSchema(name, schema)
+                        }
+                }
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go
index 564ff08..3af7b98 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go
@@ -4,64 +4,64 @@ import (
         "log"
 
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // GraphNodeAttachResourceState is an interface that can be implemented
 // to request that a ResourceState is attached to the node.
+//
+// Due to a historical naming inconsistency, the type ResourceState actually
+// represents the state for a particular _instance_, while InstanceState
+// represents the values for that instance during a particular phase
+// (e.g. primary vs. deposed). Consequently, GraphNodeAttachResourceState
+// is supported only for nodes that represent resource instances, even though
+// the name might suggest it is for containing resources.
 type GraphNodeAttachResourceState interface {
-        // The address to the resource for the state
-        ResourceAddr() *ResourceAddress
+        GraphNodeResourceInstance
 
         // Sets the state
-        AttachResourceState(*ResourceState)
+        AttachResourceState(*states.Resource)
 }
 
 // AttachStateTransformer goes through the graph and attaches
 // state to nodes that implement the interfaces above.
 type AttachStateTransformer struct {
-        State *State // State is the root state
+        State *states.State // State is the root state
 }
 
 func (t *AttachStateTransformer) Transform(g *Graph) error {
         // If no state, then nothing to do
         if t.State == nil {
-                log.Printf("[DEBUG] Not attaching any state: state is nil")
+                log.Printf("[DEBUG] Not attaching any node states: overall state is nil")
                 return nil
         }
 
-        filter := &StateFilter{State: t.State}
         for _, v := range g.Vertices() {
-                // Only care about nodes requesting we're adding state
+                // Nodes implement this interface to request state attachment.
                 an, ok := v.(GraphNodeAttachResourceState)
                 if !ok {
                         continue
                 }
-                addr := an.ResourceAddr()
+                addr := an.ResourceInstanceAddr()
 
-                // Get the module state
-                results, err := filter.Filter(addr.String())
-                if err != nil {
-                        return err
+                rs := t.State.Resource(addr.ContainingResource())
+                if rs == nil {
+                        log.Printf("[DEBUG] Resource state not found for node %q, instance %s", dag.VertexName(v), addr)
+                        continue
                 }
 
-                // Attach the first resource state we get
-                found := false
-                for _, result := range results {
-                        if rs, ok := result.Value.(*ResourceState); ok {
-                                log.Printf(
-                                        "[DEBUG] Attaching resource state to %q: %#v",
-                                        dag.VertexName(v), rs)
-                                an.AttachResourceState(rs)
-                                found = true
-                                break
-                        }
+                is := rs.Instance(addr.Resource.Key)
+                if is == nil {
+                        // We don't actually need this here, since we'll attach the whole
+                        // resource state, but we still check because it'd be weird
+                        // for the specific instance we're attaching to not to exist.
+                        log.Printf("[DEBUG] Resource instance state not found for node %q, instance %s", dag.VertexName(v), addr)
+                        continue
                 }
 
-                if !found {
-                        log.Printf(
-                                "[DEBUG] Resource state not found for %q: %s",
-                                dag.VertexName(v), addr)
-                }
+                // make sure to attach a copy of the state, so instances can modify the
+                // same ResourceState.
+                an.AttachResourceState(rs.DeepCopy())
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_config.go b/vendor/github.com/hashicorp/terraform/terraform/transform_config.go
index 61bce85..9d3b6f4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_config.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_config.go
@@ -1,13 +1,11 @@
 package terraform
 
 import (
-        "errors"
-        "fmt"
         "log"
         "sync"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -26,14 +24,14 @@ type ConfigTransformer struct {
         Concrete ConcreteResourceNodeFunc
 
         // Module is the module to add resources from.
-        Module *module.Tree
+        Config *configs.Config
 
         // Unique will only add resources that aren't already present in the graph.
         Unique bool
 
         // Mode will only add resources that match the given mode
         ModeFilter bool
-        Mode       config.ResourceMode
+        Mode       addrs.ResourceMode
 
         l         sync.Mutex
         uniqueMap map[string]struct{}
@@ -44,16 +42,11 @@ func (t *ConfigTransformer) Transform(g *Graph) error {
         t.l.Lock()
         defer t.l.Unlock()
 
-        // If no module is given, we don't do anything
-        if t.Module == nil {
+        // If no configuration is available, we don't do anything
+        if t.Config == nil {
                 return nil
         }
 
-        // If the module isn't loaded, that is simply an error
-        if !t.Module.Loaded() {
-                return errors.New("module must be loaded for ConfigTransformer")
-        }
-
         // Reset the uniqueness map. If we're tracking uniques, then populate
         // it with addresses.
         t.uniqueMap = make(map[string]struct{})
@@ -67,22 +60,22 @@ func (t *ConfigTransformer) Transform(g *Graph) error {
         }
 
         // Start the transformation process
-        return t.transform(g, t.Module)
+        return t.transform(g, t.Config)
 }
 
-func (t *ConfigTransformer) transform(g *Graph, m *module.Tree) error {
+func (t *ConfigTransformer) transform(g *Graph, config *configs.Config) error {
         // If no config, do nothing
-        if m == nil {
+        if config == nil {
                 return nil
         }
 
         // Add our resources
-        if err := t.transformSingle(g, m); err != nil {
+        if err := t.transformSingle(g, config); err != nil {
                 return err
         }
 
         // Transform all the children.
-        for _, c := range m.Children() {
+        for _, c := range config.Children {
                 if err := t.transform(g, c); err != nil {
                         return err
                 }
@@ -91,43 +84,48 @@ func (t *ConfigTransformer) transform(g *Graph, m *module.Tree) error {
         return nil
 }
 
-func (t *ConfigTransformer) transformSingle(g *Graph, m *module.Tree) error {
-        log.Printf("[TRACE] ConfigTransformer: Starting for path: %v", m.Path())
-
-        // Get the configuration for this module
-        conf := m.Config()
-
-        // Build the path we're at
-        path := m.Path()
+func (t *ConfigTransformer) transformSingle(g *Graph, config *configs.Config) error {
+        path := config.Path
+        module := config.Module
+        log.Printf("[TRACE] ConfigTransformer: Starting for path: %v", path)
+
+        // For now we assume that each module call produces only one module
+        // instance with no key, since we don't yet support "count" and "for_each"
+        // on modules.
+        // FIXME: As part of supporting "count" and "for_each" on modules, rework
+        // this so that we'll "expand" the module call first and then create graph
+        // nodes for each module instance separately.
+        instPath := path.UnkeyedInstanceShim()
+
+        allResources := make([]*configs.Resource, 0, len(module.ManagedResources)+len(module.DataResources))
+        for _, r := range module.ManagedResources {
+                allResources = append(allResources, r)
+        }
+        for _, r := range module.DataResources {
+                allResources = append(allResources, r)
+        }
 
-        // Write all the resources out
-        for _, r := range conf.Resources {
-                // Build the resource address
-                addr, err := parseResourceAddressConfig(r)
-                if err != nil {
-                        panic(fmt.Sprintf(
-                                "Error parsing config address, this is a bug: %#v", r))
-                }
-                addr.Path = path
+        for _, r := range allResources {
+                relAddr := r.Addr()
 
-                // If this is already in our uniqueness map, don't add it again
-                if _, ok := t.uniqueMap[addr.String()]; ok {
+                if t.ModeFilter && relAddr.Mode != t.Mode {
+                        // Skip non-matching modes
                         continue
                 }
 
-                // Remove non-matching modes
-                if t.ModeFilter && addr.Mode != t.Mode {
+                addr := relAddr.Absolute(instPath)
+                if _, ok := t.uniqueMap[addr.String()]; ok {
+                        // We've already seen a resource with this address. This should
+                        // never happen, because we enforce uniqueness in the config loader.
                         continue
                 }
 
-                // Build the abstract node and the concrete one
                 abstract := &NodeAbstractResource{Addr: addr}
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
                 }
 
-                // Add it to the graph
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go b/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go
index 92f9888..866c917 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go
@@ -1,9 +1,7 @@
 package terraform
 
 import (
-        "errors"
-
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -20,54 +18,47 @@ import (
 type FlatConfigTransformer struct {
         Concrete ConcreteResourceNodeFunc // What to turn resources into
 
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *FlatConfigTransformer) Transform(g *Graph) error {
-        // If no module, we do nothing
-        if t.Module == nil {
+        // We have nothing to do if there is no configuration.
+        if t.Config == nil {
                 return nil
         }
 
-        // If the module is not loaded, that is an error
-        if !t.Module.Loaded() {
-                return errors.New("module must be loaded")
-        }
-
-        return t.transform(g, t.Module)
+        return t.transform(g, t.Config)
 }
 
-func (t *FlatConfigTransformer) transform(g *Graph, m *module.Tree) error {
-        // If no module, no problem
-        if m == nil {
+func (t *FlatConfigTransformer) transform(g *Graph, config *configs.Config) error {
+        // If we have no configuration then there's nothing to do.
+        if config == nil {
                 return nil
         }
 
         // Transform all the children.
-        for _, c := range m.Children() {
+        for _, c := range config.Children {
                 if err := t.transform(g, c); err != nil {
                         return err
                 }
         }
 
-        // Get the configuration for this module
-        config := m.Config()
-
-        // Write all the resources out
-        for _, r := range config.Resources {
-                // Grab the address for this resource
-                addr, err := parseResourceAddressConfig(r)
-                if err != nil {
-                        return err
-                }
-                addr.Path = m.Path()
+        module := config.Module
+        // For now we assume that each module call produces only one module
+        // instance with no key, since we don't yet support "count" and "for_each"
+        // on modules.
+        // FIXME: As part of supporting "count" and "for_each" on modules, rework
+        // this so that we'll "expand" the module call first and then create graph
+        // nodes for each module instance separately.
+        instPath := config.Path.UnkeyedInstanceShim()
 
-                // Build the abstract resource. We have the config already so
-                // we'll just pre-populate that.
+        for _, r := range module.ManagedResources {
+                addr := r.Addr().Absolute(instPath)
                 abstract := &NodeAbstractResource{
                         Addr:   addr,
                         Config: r,
                 }
+                // Grab the address for this resource
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go b/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go
index 83415f3..01601bd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go
@@ -1,16 +1,21 @@
 package terraform
 
 import (
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
 // CountBoundaryTransformer adds a node that depends on everything else
 // so that it runs last in order to clean up the state for nodes that
 // are on the "count boundary": "foo.0" when only one exists becomes "foo"
-type CountBoundaryTransformer struct{}
+type CountBoundaryTransformer struct {
+        Config *configs.Config
+}
 
 func (t *CountBoundaryTransformer) Transform(g *Graph) error {
-        node := &NodeCountBoundary{}
+        node := &NodeCountBoundary{
+                Config: t.Config,
+        }
         g.Add(node)
 
         // Depends on everything
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go b/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
deleted file mode 100644
index 87a1f9c..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
+++ /dev/null
@@ -1,178 +0,0 @@
-package terraform
-
-import "fmt"
-
-// DeposedTransformer is a GraphTransformer that adds deposed resources
-// to the graph.
-type DeposedTransformer struct {
-        // State is the global state. We'll automatically find the correct
-        // ModuleState based on the Graph.Path that is being transformed.
-        State *State
-
-        // View, if non-empty, is the ModuleState.View used around the state
-        // to find deposed resources.
-        View string
-
-        // The provider used by the resourced which were deposed
-        ResolvedProvider string
-}
-
-func (t *DeposedTransformer) Transform(g *Graph) error {
-        state := t.State.ModuleByPath(g.Path)
-        if state == nil {
-                // If there is no state for our module there can't be any deposed
-                // resources, since they live in the state.
-                return nil
-        }
-
-        // If we have a view, apply it now
-        if t.View != "" {
-                state = state.View(t.View)
-        }
-
-        // Go through all the resources in our state to look for deposed resources
-        for k, rs := range state.Resources {
-                // If we have no deposed resources, then move on
-                if len(rs.Deposed) == 0 {
-                        continue
-                }
-
-                deposed := rs.Deposed
-
-                for i, _ := range deposed {
-                        g.Add(&graphNodeDeposedResource{
-                                Index:            i,
-                                ResourceName:     k,
-                                ResourceType:     rs.Type,
-                                ProviderName:     rs.Provider,
-                                ResolvedProvider: t.ResolvedProvider,
-                        })
-                }
-        }
-
-        return nil
-}
-
-// graphNodeDeposedResource is the graph vertex representing a deposed resource.
-type graphNodeDeposedResource struct {
-        Index            int
-        ResourceName     string
-        ResourceType     string
-        ProviderName     string
-        ResolvedProvider string
-}
-
-func (n *graphNodeDeposedResource) Name() string {
-        return fmt.Sprintf("%s (deposed #%d)", n.ResourceName, n.Index)
-}
-
-func (n *graphNodeDeposedResource) ProvidedBy() string {
-        return resourceProvider(n.ResourceName, n.ProviderName)
-}
-
-func (n *graphNodeDeposedResource) SetProvider(p string) {
-        n.ResolvedProvider = p
-}
-
-// GraphNodeEvalable impl.
-func (n *graphNodeDeposedResource) EvalTree() EvalNode {
-        var provider ResourceProvider
-        var state *InstanceState
-
-        seq := &EvalSequence{Nodes: make([]EvalNode, 0, 5)}
-
-        // Build instance info
-        info := &InstanceInfo{Id: n.Name(), Type: n.ResourceType}
-        seq.Nodes = append(seq.Nodes, &EvalInstanceInfo{Info: info})
-
-        // Refresh the resource
-        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
-                Ops: []walkOperation{walkRefresh},
-                Node: &EvalSequence{
-                        Nodes: []EvalNode{
-                                &EvalGetProvider{
-                                        Name:   n.ResolvedProvider,
-                                        Output: &provider,
-                                },
-                                &EvalReadStateDeposed{
-                                        Name:   n.ResourceName,
-                                        Output: &state,
-                                        Index:  n.Index,
-                                },
-                                &EvalRefresh{
-                                        Info:     info,
-                                        Provider: &provider,
-                                        State:    &state,
-                                        Output:   &state,
-                                },
-                                &EvalWriteStateDeposed{
-                                        Name:         n.ResourceName,
-                                        ResourceType: n.ResourceType,
-                                        Provider:     n.ResolvedProvider,
-                                        State:        &state,
-                                        Index:        n.Index,
-                                },
-                        },
-                },
-        })
-
-        // Apply
-        var diff *InstanceDiff
-        var err error
-        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
-                Ops: []walkOperation{walkApply, walkDestroy},
-                Node: &EvalSequence{
-                        Nodes: []EvalNode{
-                                &EvalGetProvider{
-                                        Name:   n.ResolvedProvider,
-                                        Output: &provider,
-                                },
-                                &EvalReadStateDeposed{
-                                        Name:   n.ResourceName,
-                                        Output: &state,
-                                        Index:  n.Index,
-                                },
-                                &EvalDiffDestroy{
-                                        Info:   info,
-                                        State:  &state,
-                                        Output: &diff,
-                                },
-                                // Call pre-apply hook
-                                &EvalApplyPre{
-                                        Info:  info,
-                                        State: &state,
-                                        Diff:  &diff,
-                                },
-                                &EvalApply{
-                                        Info:     info,
-                                        State:    &state,
-                                        Diff:     &diff,
-                                        Provider: &provider,
-                                        Output:   &state,
-                                        Error:    &err,
-                                },
-                                // Always write the resource back to the state deposed... if it
-                                // was successfully destroyed it will be pruned. If it was not, it will
-                                // be caught on the next run.
-                                &EvalWriteStateDeposed{
-                                        Name:         n.ResourceName,
-                                        ResourceType: n.ResourceType,
-                                        Provider:     n.ResolvedProvider,
-                                        State:        &state,
-                                        Index:        n.Index,
-                                },
-                                &EvalApplyPost{
-                                        Info:  info,
-                                        State: &state,
-                                        Error: &err,
-                                },
-                                &EvalReturnError{
-                                        Error: &err,
-                                },
-                                &EvalUpdateStateHook{},
-                        },
-                },
-        })
-
-        return seq
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go
index edfb460..2f4d5ed 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go
@@ -4,15 +4,15 @@ import (
         "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // GraphNodeDestroyerCBD must be implemented by nodes that might be
-// create-before-destroy destroyers.
+// create-before-destroy destroyers, or might plan a create-before-destroy
+// action.
 type GraphNodeDestroyerCBD interface {
-        GraphNodeDestroyer
-
         // CreateBeforeDestroy returns true if this node represents a node
         // that is doing a CBD.
         CreateBeforeDestroy() bool
@@ -23,6 +23,89 @@ type GraphNodeDestroyerCBD interface {
         ModifyCreateBeforeDestroy(bool) error
 }
 
+// GraphNodeAttachDestroyer is implemented by applyable nodes that have a
+// companion destroy node. This allows the creation node to look up the status
+// of the destroy node and determine if it needs to depose the existing state,
+// or replace it.
+// If a node is not marked as create-before-destroy in the configuration, but a
+// dependency forces that status, only the destroy node will be aware of that
+// status.
+type GraphNodeAttachDestroyer interface {
+        // AttachDestroyNode takes a destroy node and saves a reference to that
+        // node in the receiver, so it can later check the status of
+        // CreateBeforeDestroy().
+        AttachDestroyNode(n GraphNodeDestroyerCBD)
+}
+
+// ForcedCBDTransformer detects when a particular CBD-able graph node has
+// dependencies with another that has create_before_destroy set that require
+// it to be forced on, and forces it on.
+//
+// This must be used in the plan graph builder to ensure that
+// create_before_destroy settings are properly propagated before constructing
+// the planned changes. This requires that the plannable resource nodes
+// implement GraphNodeDestroyerCBD.
+type ForcedCBDTransformer struct {
+}
+
+func (t *ForcedCBDTransformer) Transform(g *Graph) error {
+        for _, v := range g.Vertices() {
+                dn, ok := v.(GraphNodeDestroyerCBD)
+                if !ok {
+                        continue
+                }
+
+                if !dn.CreateBeforeDestroy() {
+                        // If there are no CBD decendent (dependent nodes), then we
+                        // do nothing here.
+                        if !t.hasCBDDescendent(g, v) {
+                                log.Printf("[TRACE] ForcedCBDTransformer: %q (%T) has no CBD descendent, so skipping", dag.VertexName(v), v)
+                                continue
+                        }
+
+                        // If this isn't naturally a CBD node, this means that an descendent is
+                        // and we need to auto-upgrade this node to CBD. We do this because
+                        // a CBD node depending on non-CBD will result in cycles. To avoid this,
+                        // we always attempt to upgrade it.
+                        log.Printf("[TRACE] ForcedCBDTransformer: forcing create_before_destroy on for %q (%T)", dag.VertexName(v), v)
+                        if err := dn.ModifyCreateBeforeDestroy(true); err != nil {
+                                return fmt.Errorf(
+                                        "%s: must have create before destroy enabled because "+
+                                                "a dependent resource has CBD enabled. However, when "+
+                                                "attempting to automatically do this, an error occurred: %s",
+                                        dag.VertexName(v), err)
+                        }
+                } else {
+                        log.Printf("[TRACE] ForcedCBDTransformer: %q (%T) already has create_before_destroy set", dag.VertexName(v), v)
+                }
+        }
+        return nil
+}
+
+// hasCBDDescendent returns true if any descendent (node that depends on this)
+// has CBD set.
+func (t *ForcedCBDTransformer) hasCBDDescendent(g *Graph, v dag.Vertex) bool {
+        s, _ := g.Descendents(v)
+        if s == nil {
+                return true
+        }
+
+        for _, ov := range s.List() {
+                dn, ok := ov.(GraphNodeDestroyerCBD)
+                if !ok {
+                        continue
+                }
+
+                if dn.CreateBeforeDestroy() {
+                        // some descendent is CreateBeforeDestroy, so we need to follow suit
+                        log.Printf("[TRACE] ForcedCBDTransformer: %q has CBD descendent %q", dag.VertexName(v), dag.VertexName(ov))
+                        return true
+                }
+        }
+
+        return false
+}
+
 // CBDEdgeTransformer modifies the edges of CBD nodes that went through
 // the DestroyEdgeTransformer to have the right dependencies. There are
 // two real tasks here:
@@ -35,16 +118,25 @@ type GraphNodeDestroyerCBD interface {
 //      update to A. Example: adding a web server updates the load balancer
 //      before deleting the old web server.
 //
+// This transformer requires that a previous transformer has already forced
+// create_before_destroy on for nodes that are depended on by explicit CBD
+// nodes. This is the logic in ForcedCBDTransformer, though in practice we
+// will get here by recording the CBD-ness of each change in the plan during
+// the plan walk and then forcing the nodes into the appropriate setting during
+// DiffTransformer when building the apply graph.
 type CBDEdgeTransformer struct {
         // Module and State are only needed to look up dependencies in
         // any way possible. Either can be nil if not availabile.
-        Module *module.Tree
-        State  *State
+        Config *configs.Config
+        State  *states.State
+
+        // If configuration is present then Schemas is required in order to
+        // obtain schema information from providers and provisioners so we can
+        // properly resolve implicit dependencies.
+        Schemas *Schemas
 }
 
 func (t *CBDEdgeTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] CBDEdgeTransformer: Beginning CBD transformation...")
-
         // Go through and reverse any destroy edges
         destroyMap := make(map[string][]dag.Vertex)
         for _, v := range g.Vertices() {
@@ -52,25 +144,13 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
                 if !ok {
                         continue
                 }
+                dern, ok := v.(GraphNodeDestroyer)
+                if !ok {
+                        continue
+                }
 
                 if !dn.CreateBeforeDestroy() {
-                        // If there are no CBD ancestors (dependent nodes), then we
-                        // do nothing here.
-                        if !t.hasCBDAncestor(g, v) {
-                                continue
-                        }
-
-                        // If this isn't naturally a CBD node, this means that an ancestor is
-                        // and we need to auto-upgrade this node to CBD. We do this because
-                        // a CBD node depending on non-CBD will result in cycles. To avoid this,
-                        // we always attempt to upgrade it.
-                        if err := dn.ModifyCreateBeforeDestroy(true); err != nil {
-                                return fmt.Errorf(
-                                        "%s: must have create before destroy enabled because "+
-                                                "a dependent resource has CBD enabled. However, when "+
-                                                "attempting to automatically do this, an error occurred: %s",
-                                        dag.VertexName(v), err)
-                        }
+                        continue
                 }
 
                 // Find the destroy edge. There should only be one.
@@ -86,7 +166,9 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
 
                         // Found it! Invert.
                         g.RemoveEdge(de)
-                        g.Connect(&DestroyEdge{S: de.Target(), T: de.Source()})
+                        applyNode := de.Source()
+                        destroyNode := de.Target()
+                        g.Connect(&DestroyEdge{S: destroyNode, T: applyNode})
                 }
 
                 // If the address has an index, we strip that. Our depMap creation
@@ -94,15 +176,11 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
                 // dependencies. One day when we limit dependencies more exactly
                 // this will have to change. We have a test case covering this
                 // (depNonCBDCountBoth) so it'll be caught.
-                addr := dn.DestroyAddr()
-                if addr.Index >= 0 {
-                        addr = addr.Copy() // Copy so that we don't modify any pointers
-                        addr.Index = -1
-                }
+                addr := dern.DestroyAddr()
+                key := addr.ContainingResource().String()
 
                 // Add this to the list of nodes that we need to fix up
                 // the edges for (step 2 above in the docs).
-                key := addr.String()
                 destroyMap[key] = append(destroyMap[key], v)
         }
 
@@ -151,13 +229,9 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
                 // dependencies. One day when we limit dependencies more exactly
                 // this will have to change. We have a test case covering this
                 // (depNonCBDCount) so it'll be caught.
-                if addr.Index >= 0 {
-                        addr = addr.Copy() // Copy so that we don't modify any pointers
-                        addr.Index = -1
-                }
+                key := addr.ContainingResource().String()
 
                 // If there is nothing this resource should depend on, ignore it
-                key := addr.String()
                 dns, ok := depMap[key]
                 if !ok {
                         continue
@@ -174,21 +248,21 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *CBDEdgeTransformer) depMap(
-        destroyMap map[string][]dag.Vertex) (map[string][]dag.Vertex, error) {
+func (t *CBDEdgeTransformer) depMap(destroyMap map[string][]dag.Vertex) (map[string][]dag.Vertex, error) {
         // Build the graph of our config, this ensures that all resources
         // are present in the graph.
-        g, err := (&BasicGraphBuilder{
+        g, diags := (&BasicGraphBuilder{
                 Steps: []GraphTransformer{
-                        &FlatConfigTransformer{Module: t.Module},
-                        &AttachResourceConfigTransformer{Module: t.Module},
+                        &FlatConfigTransformer{Config: t.Config},
+                        &AttachResourceConfigTransformer{Config: t.Config},
                         &AttachStateTransformer{State: t.State},
+                        &AttachSchemaTransformer{Schemas: t.Schemas},
                         &ReferenceTransformer{},
                 },
                 Name: "CBDEdgeTransformer",
         }).Build(nil)
-        if err != nil {
-                return nil, err
+        if diags.HasErrors() {
+                return nil, diags.Err()
         }
 
         // Using this graph, build the list of destroy nodes that each resource
@@ -232,26 +306,3 @@ func (t *CBDEdgeTransformer) depMap(
 
         return depMap, nil
 }
-
-// hasCBDAncestor returns true if any ancestor (node that depends on this)
-// has CBD set.
-func (t *CBDEdgeTransformer) hasCBDAncestor(g *Graph, v dag.Vertex) bool {
-        s, _ := g.Ancestors(v)
-        if s == nil {
-                return true
-        }
-
-        for _, v := range s.List() {
-                dn, ok := v.(GraphNodeDestroyerCBD)
-                if !ok {
-                        continue
-                }
-
-                if dn.CreateBeforeDestroy() {
-                        // some ancestor is CreateBeforeDestroy, so we need to follow suit
-                        return true
-                }
-        }
-
-        return false
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
index a06ff29..7fb415b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
@@ -3,7 +3,10 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -11,16 +14,16 @@ import (
 type GraphNodeDestroyer interface {
         dag.Vertex
 
-        // ResourceAddr is the address of the resource that is being
+        // DestroyAddr is the address of the resource that is being
         // destroyed by this node. If this returns nil, then this node
         // is not destroying anything.
-        DestroyAddr() *ResourceAddress
+        DestroyAddr() *addrs.AbsResourceInstance
 }
 
 // GraphNodeCreator must be implemented by nodes that create OR update resources.
 type GraphNodeCreator interface {
-        // ResourceAddr is the address of the resource being created or updated
-        CreateAddr() *ResourceAddress
+        // CreateAddr is the address of the resource being created or updated
+        CreateAddr() *addrs.AbsResourceInstance
 }
 
 // DestroyEdgeTransformer is a GraphTransformer that creates the proper
@@ -40,33 +43,37 @@ type GraphNodeCreator interface {
 type DestroyEdgeTransformer struct {
         // These are needed to properly build the graph of dependencies
         // to determine what a destroy node depends on. Any of these can be nil.
-        Module *module.Tree
-        State  *State
+        Config *configs.Config
+        State  *states.State
+
+        // If configuration is present then Schemas is required in order to
+        // obtain schema information from providers and provisioners in order
+        // to properly resolve implicit dependencies.
+        Schemas *Schemas
 }
 
 func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] DestroyEdgeTransformer: Beginning destroy edge transformation...")
-
         // Build a map of what is being destroyed (by address string) to
-        // the list of destroyers. In general there will only be one destroyer
-        // but to make it more robust we support multiple.
+        // the list of destroyers. Usually there will be at most one destroyer
+        // per node, but we allow multiple if present for completeness.
         destroyers := make(map[string][]GraphNodeDestroyer)
+        destroyerAddrs := make(map[string]addrs.AbsResourceInstance)
         for _, v := range g.Vertices() {
                 dn, ok := v.(GraphNodeDestroyer)
                 if !ok {
                         continue
                 }
 
-                addr := dn.DestroyAddr()
-                if addr == nil {
+                addrP := dn.DestroyAddr()
+                if addrP == nil {
                         continue
                 }
+                addr := *addrP
 
                 key := addr.String()
-                log.Printf(
-                        "[TRACE] DestroyEdgeTransformer: %s destroying %q",
-                        dag.VertexName(dn), key)
+                log.Printf("[TRACE] DestroyEdgeTransformer: %q (%T) destroys %s", dag.VertexName(dn), v, key)
                 destroyers[key] = append(destroyers[key], dn)
+                destroyerAddrs[key] = addr
         }
 
         // If we aren't destroying anything, there will be no edges to make
@@ -100,10 +107,20 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                         a := v
 
                         log.Printf(
-                                "[TRACE] DestroyEdgeTransformer: connecting creator/destroyer: %s, %s",
+                                "[TRACE] DestroyEdgeTransformer: connecting creator %q with destroyer %q",
                                 dag.VertexName(a), dag.VertexName(a_d))
 
                         g.Connect(&DestroyEdge{S: a, T: a_d})
+
+                        // Attach the destroy node to the creator
+                        // There really shouldn't be more than one destroyer, but even if
+                        // there are, any of them will represent the correct
+                        // CreateBeforeDestroy status.
+                        if n, ok := cn.(GraphNodeAttachDestroyer); ok {
+                                if d, ok := d.(GraphNodeDestroyerCBD); ok {
+                                        n.AttachDestroyNode(d)
+                                }
+                        }
                 }
         }
 
@@ -120,20 +137,24 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
         }
         steps := []GraphTransformer{
                 // Add the local values
-                &LocalTransformer{Module: t.Module},
+                &LocalTransformer{Config: t.Config},
 
                 // Add outputs and metadata
-                &OutputTransformer{Module: t.Module},
-                &AttachResourceConfigTransformer{Module: t.Module},
+                &OutputTransformer{Config: t.Config},
+                &AttachResourceConfigTransformer{Config: t.Config},
                 &AttachStateTransformer{State: t.State},
 
-                TransformProviders(nil, providerFn, t.Module),
-
                 // Add all the variables. We can depend on resources through
                 // variables due to module parameters, and we need to properly
                 // determine that.
-                &RootVariableTransformer{Module: t.Module},
-                &ModuleVariableTransformer{Module: t.Module},
+                &RootVariableTransformer{Config: t.Config},
+                &ModuleVariableTransformer{Config: t.Config},
+
+                TransformProviders(nil, providerFn, t.Config),
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: t.Schemas},
 
                 &ReferenceTransformer{},
         }
@@ -146,37 +167,36 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
         //
         var tempG Graph
         var tempDestroyed []dag.Vertex
-        for d, _ := range destroyers {
-                // d is what is being destroyed. We parse the resource address
-                // which it came from it is a panic if this fails.
-                addr, err := ParseResourceAddress(d)
-                if err != nil {
-                        panic(err)
-                }
+        for d := range destroyers {
+                // d is the string key for the resource being destroyed. We actually
+                // want the address value, which we stashed earlier.
+                addr := destroyerAddrs[d]
 
                 // This part is a little bit weird but is the best way to
                 // find the dependencies we need to: build a graph and use the
                 // attach config and state transformers then ask for references.
-                abstract := &NodeAbstractResource{Addr: addr}
+                abstract := NewNodeAbstractResourceInstance(addr)
                 tempG.Add(abstract)
                 tempDestroyed = append(tempDestroyed, abstract)
 
                 // We also add the destroy version here since the destroy can
                 // depend on things that the creation doesn't (destroy provisioners).
-                destroy := &NodeDestroyResource{NodeAbstractResource: abstract}
+                destroy := &NodeDestroyResourceInstance{NodeAbstractResourceInstance: abstract}
                 tempG.Add(destroy)
                 tempDestroyed = append(tempDestroyed, destroy)
         }
 
         // Run the graph transforms so we have the information we need to
         // build references.
+        log.Printf("[TRACE] DestroyEdgeTransformer: constructing temporary graph for analysis of references, starting from:\n%s", tempG.StringWithNodeTypes())
         for _, s := range steps {
+                log.Printf("[TRACE] DestroyEdgeTransformer: running %T on temporary graph", s)
                 if err := s.Transform(&tempG); err != nil {
+                        log.Printf("[TRACE] DestroyEdgeTransformer: %T failed: %s", s, err)
                         return err
                 }
         }
-
-        log.Printf("[TRACE] DestroyEdgeTransformer: reference graph: %s", tempG.String())
+        log.Printf("[TRACE] DestroyEdgeTransformer: temporary reference graph:\n%s", tempG.String())
 
         // Go through all the nodes in the graph and determine what they
         // depend on.
@@ -207,16 +227,13 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
 
                 // Get the destroy node for this. In the example of our struct,
                 // we are currently at B and we're looking for B_d.
-                rn, ok := v.(GraphNodeResource)
+                rn, ok := v.(GraphNodeResourceInstance)
                 if !ok {
+                        log.Printf("[TRACE] DestroyEdgeTransformer: skipping %s, since it's not a resource", dag.VertexName(v))
                         continue
                 }
 
-                addr := rn.ResourceAddr()
-                if addr == nil {
-                        continue
-                }
-
+                addr := rn.ResourceInstanceAddr()
                 dns := destroyers[addr.String()]
 
                 // We have dependencies, check if any are being destroyed
@@ -231,16 +248,12 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                 // to see if A_d exists.
                 var depDestroyers []dag.Vertex
                 for _, v := range refs {
-                        rn, ok := v.(GraphNodeResource)
+                        rn, ok := v.(GraphNodeResourceInstance)
                         if !ok {
                                 continue
                         }
 
-                        addr := rn.ResourceAddr()
-                        if addr == nil {
-                                continue
-                        }
-
+                        addr := rn.ResourceInstanceAddr()
                         key := addr.String()
                         if ds, ok := destroyers[key]; ok {
                                 for _, d := range ds {
@@ -257,6 +270,7 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                 for _, a_d := range dns {
                         for _, b_d := range depDestroyers {
                                 if b_d != a_d {
+                                        log.Printf("[TRACE] DestroyEdgeTransformer: %q depends on %q", dag.VertexName(b_d), dag.VertexName(a_d))
                                         g.Connect(dag.BasicEdge(b_d, a_d))
                                 }
                         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go b/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go
index ad46d3c..6fb915f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go
@@ -4,83 +4,189 @@ import (
         "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// DiffTransformer is a GraphTransformer that adds the elements of
-// the diff to the graph.
-//
-// This transform is used for example by the ApplyGraphBuilder to ensure
-// that only resources that are being modified are represented in the graph.
-//
-// Module and State is still required for the DiffTransformer for annotations
-// since the Diff doesn't contain all the information required to build the
-// complete graph (such as create-before-destroy information). The graph
-// is built based on the diff first, though, ensuring that only resources
-// that are being modified are present in the graph.
+// DiffTransformer is a GraphTransformer that adds graph nodes representing
+// each of the resource changes described in the given Changes object.
 type DiffTransformer struct {
-        Concrete ConcreteResourceNodeFunc
-
-        Diff   *Diff
-        Module *module.Tree
-        State  *State
+        Concrete ConcreteResourceInstanceNodeFunc
+        State    *states.State
+        Changes  *plans.Changes
 }
 
 func (t *DiffTransformer) Transform(g *Graph) error {
-        // If the diff is nil or empty (nil is empty) then do nothing
-        if t.Diff.Empty() {
+        if t.Changes == nil || len(t.Changes.Resources) == 0 {
+                // Nothing to do!
                 return nil
         }
 
         // Go through all the modules in the diff.
-        log.Printf("[TRACE] DiffTransformer: starting")
-        var nodes []dag.Vertex
-        for _, m := range t.Diff.Modules {
-                log.Printf("[TRACE] DiffTransformer: Module: %s", m)
-                // TODO: If this is a destroy diff then add a module destroy node
-
-                // Go through all the resources in this module.
-                for name, inst := range m.Resources {
-                        log.Printf("[TRACE] DiffTransformer: Resource %q: %#v", name, inst)
-
-                        // We have changes! This is a create or update operation.
-                        // First grab the address so we have a unique way to
-                        // reference this resource.
-                        addr, err := parseResourceAddressInternal(name)
-                        if err != nil {
-                                panic(fmt.Sprintf(
-                                        "Error parsing internal name, this is a bug: %q", name))
-                        }
+        log.Printf("[TRACE] DiffTransformer starting")
+
+        var diags tfdiags.Diagnostics
+        state := t.State
+        changes := t.Changes
+
+        // DiffTransformer creates resource _instance_ nodes. If there are any
+        // whole-resource nodes already in the graph, we must ensure that they
+        // get evaluated before any of the corresponding instances by creating
+        // dependency edges, so we'll do some prep work here to ensure we'll only
+        // create connections to nodes that existed before we started here.
+        resourceNodes := map[string][]GraphNodeResource{}
+        for _, node := range g.Vertices() {
+                rn, ok := node.(GraphNodeResource)
+                if !ok {
+                        continue
+                }
+                // We ignore any instances that _also_ implement
+                // GraphNodeResourceInstance, since in the unlikely event that they
+                // do exist we'd probably end up creating cycles by connecting them.
+                if _, ok := node.(GraphNodeResourceInstance); ok {
+                        continue
+                }
+
+                addr := rn.ResourceAddr().String()
+                resourceNodes[addr] = append(resourceNodes[addr], rn)
+        }
+
+        for _, rc := range changes.Resources {
+                addr := rc.Addr
+                dk := rc.DeposedKey
+
+                log.Printf("[TRACE] DiffTransformer: found %s change for %s %s", rc.Action, addr, dk)
+
+                // Depending on the action we'll need some different combinations of
+                // nodes, because destroying uses a special node type separate from
+                // other actions.
+                var update, delete, createBeforeDestroy bool
+                switch rc.Action {
+                case plans.NoOp:
+                        continue
+                case plans.Delete:
+                        delete = true
+                case plans.DeleteThenCreate, plans.CreateThenDelete:
+                        update = true
+                        delete = true
+                        createBeforeDestroy = (rc.Action == plans.CreateThenDelete)
+                default:
+                        update = true
+                }
+
+                if dk != states.NotDeposed && update {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid planned change for deposed object",
+                                fmt.Sprintf("The plan contains a non-delete change for %s deposed object %s. The only valid action for a deposed object is to destroy it, so this is a bug in Terraform.", addr, dk),
+                        ))
+                        continue
+                }
 
-                        // Very important: add the module path for this resource to
-                        // the address. Remove "root" from it.
-                        addr.Path = m.Path[1:]
+                // If we're going to do a create_before_destroy Replace operation then
+                // we need to allocate a DeposedKey to use to retain the
+                // not-yet-destroyed prior object, so that the delete node can destroy
+                // _that_ rather than the newly-created node, which will be current
+                // by the time the delete node is visited.
+                if update && delete && createBeforeDestroy {
+                        // In this case, variable dk will be the _pre-assigned_ DeposedKey
+                        // that must be used if the update graph node deposes the current
+                        // instance, which will then align with the same key we pass
+                        // into the destroy node to ensure we destroy exactly the deposed
+                        // object we expect.
+                        if state != nil {
+                                ris := state.ResourceInstance(addr)
+                                if ris == nil {
+                                        // Should never happen, since we don't plan to replace an
+                                        // instance that doesn't exist yet.
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid planned change",
+                                                fmt.Sprintf("The plan contains a replace change for %s, which doesn't exist yet. This is a bug in Terraform.", addr),
+                                        ))
+                                        continue
+                                }
+
+                                // Allocating a deposed key separately from using it can be racy
+                                // in general, but we assume here that nothing except the apply
+                                // node we instantiate below will actually make new deposed objects
+                                // in practice, and so the set of already-used keys will not change
+                                // between now and then.
+                                dk = ris.FindUnusedDeposedKey()
+                        } else {
+                                // If we have no state at all yet then we can use _any_
+                                // DeposedKey.
+                                dk = states.NewDeposedKey()
+                        }
+                }
 
-                        // If we're destroying, add the destroy node
-                        if inst.Destroy || inst.GetDestroyDeposed() {
-                                abstract := &NodeAbstractResource{Addr: addr}
-                                g.Add(&NodeDestroyResource{NodeAbstractResource: abstract})
+                if update {
+                        // All actions except destroying the node type chosen by t.Concrete
+                        abstract := NewNodeAbstractResourceInstance(addr)
+                        var node dag.Vertex = abstract
+                        if f := t.Concrete; f != nil {
+                                node = f(abstract)
                         }
 
-                        // If we have changes, then add the applyable version
-                        if len(inst.Attributes) > 0 {
-                                // Add the resource to the graph
-                                abstract := &NodeAbstractResource{Addr: addr}
-                                var node dag.Vertex = abstract
-                                if f := t.Concrete; f != nil {
-                                        node = f(abstract)
+                        if createBeforeDestroy {
+                                // We'll attach our pre-allocated DeposedKey to the node if
+                                // it supports that. NodeApplyableResourceInstance is the
+                                // specific concrete node type we are looking for here really,
+                                // since that's the only node type that might depose objects.
+                                if dn, ok := node.(GraphNodeDeposer); ok {
+                                        dn.SetPreallocatedDeposedKey(dk)
                                 }
+                                log.Printf("[TRACE] DiffTransformer: %s will be represented by %s, deposing prior object to %s", addr, dag.VertexName(node), dk)
+                        } else {
+                                log.Printf("[TRACE] DiffTransformer: %s will be represented by %s", addr, dag.VertexName(node))
+                        }
 
-                                nodes = append(nodes, node)
+                        g.Add(node)
+                        rsrcAddr := addr.ContainingResource().String()
+                        for _, rsrcNode := range resourceNodes[rsrcAddr] {
+                                g.Connect(dag.BasicEdge(node, rsrcNode))
+                        }
+                }
+
+                if delete {
+                        // Destroying always uses a destroy-specific node type, though
+                        // which one depends on whether we're destroying a current object
+                        // or a deposed object.
+                        var node GraphNodeResourceInstance
+                        abstract := NewNodeAbstractResourceInstance(addr)
+                        if dk == states.NotDeposed {
+                                node = &NodeDestroyResourceInstance{
+                                        NodeAbstractResourceInstance: abstract,
+                                        DeposedKey:                   dk,
+                                }
+                                node.(*NodeDestroyResourceInstance).ModifyCreateBeforeDestroy(createBeforeDestroy)
+                        } else {
+                                node = &NodeDestroyDeposedResourceInstanceObject{
+                                        NodeAbstractResourceInstance: abstract,
+                                        DeposedKey:                   dk,
+                                }
+                        }
+                        if dk == states.NotDeposed {
+                                log.Printf("[TRACE] DiffTransformer: %s will be represented for destruction by %s", addr, dag.VertexName(node))
+                        } else {
+                                log.Printf("[TRACE] DiffTransformer: %s deposed object %s will be represented for destruction by %s", addr, dk, dag.VertexName(node))
+                        }
+                        g.Add(node)
+                        rsrcAddr := addr.ContainingResource().String()
+                        for _, rsrcNode := range resourceNodes[rsrcAddr] {
+                                // We connect this edge "forwards" (even though destroy dependencies
+                                // are often inverted) because evaluating the resource node
+                                // after the destroy node could cause an unnecessary husk of
+                                // a resource state to be re-added.
+                                g.Connect(dag.BasicEdge(node, rsrcNode))
                         }
                 }
-        }
 
-        // Add all the nodes to the graph
-        for _, n := range nodes {
-                g.Add(n)
         }
 
-        return nil
+        log.Printf("[TRACE] DiffTransformer complete")
+
+        return diags.Err()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go
index 3673771..c1945f0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go
@@ -2,7 +2,10 @@ package terraform
 
 import (
         "fmt"
-        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportProviderValidateTransformer is a GraphTransformer that goes through
@@ -10,6 +13,8 @@ import (
 type ImportProviderValidateTransformer struct{}
 
 func (t *ImportProviderValidateTransformer) Transform(g *Graph) error {
+        var diags tfdiags.Diagnostics
+
         for _, v := range g.Vertices() {
                 // We only care about providers
                 pv, ok := v.(GraphNodeProvider)
@@ -24,15 +29,16 @@ func (t *ImportProviderValidateTransformer) Transform(g *Graph) error {
                 }
 
                 for _, ref := range rn.References() {
-                        if !strings.HasPrefix(ref, "var.") {
-                                return fmt.Errorf(
-                                        "Provider %q depends on non-var %q. Providers for import can currently\n"+
-                                                "only depend on variables or must be hardcoded. You can stop import\n"+
-                                                "from loading configurations by specifying `-config=\"\"`.",
-                                        pv.ProviderName(), ref)
+                        if _, ok := ref.Subject.(addrs.InputVariable); !ok {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid provider dependency for import",
+                                        Detail:   fmt.Sprintf("The configuration for %s depends on %s. Providers used with import must either have literal configuration or refer only to input variables.", pv.ProviderAddr(), ref.Subject.String()),
+                                        Subject:  ref.SourceRange.ToHCL().Ptr(),
+                                })
                         }
                 }
         }
 
-        return nil
+        return diags.Err()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
index fcbff65..ab0ecae 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
@@ -2,6 +2,10 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportStateTransformer is a GraphTransformer that adds nodes to the
@@ -11,64 +15,68 @@ type ImportStateTransformer struct {
 }
 
 func (t *ImportStateTransformer) Transform(g *Graph) error {
-        nodes := make([]*graphNodeImportState, 0, len(t.Targets))
         for _, target := range t.Targets {
-                addr, err := ParseResourceAddress(target.Addr)
-                if err != nil {
-                        return fmt.Errorf(
-                                "failed to parse resource address '%s': %s",
-                                target.Addr, err)
+                // The ProviderAddr may not be supplied for non-aliased providers.
+                // This will be populated if the targets come from the cli, but tests
+                // may not specify implied provider addresses.
+                providerAddr := target.ProviderAddr
+                if providerAddr.ProviderConfig.Type == "" {
+                        providerAddr = target.Addr.Resource.Resource.DefaultProviderConfig().Absolute(target.Addr.Module)
                 }
 
-                nodes = append(nodes, &graphNodeImportState{
-                        Addr:         addr,
+                node := &graphNodeImportState{
+                        Addr:         target.Addr,
                         ID:           target.ID,
-                        ProviderName: target.Provider,
-                })
-        }
-
-        // Build the graph vertices
-        for _, n := range nodes {
-                g.Add(n)
+                        ProviderAddr: providerAddr,
+                }
+                g.Add(node)
         }
-
         return nil
 }
 
 type graphNodeImportState struct {
-        Addr             *ResourceAddress // Addr is the resource address to import to
-        ID               string           // ID is the ID to import as
-        ProviderName     string           // Provider string
-        ResolvedProvider string           // provider node address
+        Addr             addrs.AbsResourceInstance // Addr is the resource address to import into
+        ID               string                    // ID is the ID to import as
+        ProviderAddr     addrs.AbsProviderConfig   // Provider address given by the user, or implied by the resource type
+        ResolvedProvider addrs.AbsProviderConfig   // provider node address after resolution
 
-        states []*InstanceState
+        states []providers.ImportedResource
 }
 
+var (
+        _ GraphNodeSubPath           = (*graphNodeImportState)(nil)
+        _ GraphNodeEvalable          = (*graphNodeImportState)(nil)
+        _ GraphNodeProviderConsumer  = (*graphNodeImportState)(nil)
+        _ GraphNodeDynamicExpandable = (*graphNodeImportState)(nil)
+)
+
 func (n *graphNodeImportState) Name() string {
-        return fmt.Sprintf("%s (import id: %s)", n.Addr, n.ID)
+        return fmt.Sprintf("%s (import id %q)", n.Addr, n.ID)
 }
 
-func (n *graphNodeImportState) ProvidedBy() string {
-        return resourceProvider(n.Addr.Type, n.ProviderName)
+// GraphNodeProviderConsumer
+func (n *graphNodeImportState) ProvidedBy() (addrs.AbsProviderConfig, bool) {
+        // We assume that n.ProviderAddr has been properly populated here.
+        // It's the responsibility of the code creating a graphNodeImportState
+        // to populate this, possibly by calling DefaultProviderConfig() on the
+        // resource address to infer an implied provider from the resource type
+        // name.
+        return n.ProviderAddr, false
 }
 
-func (n *graphNodeImportState) SetProvider(p string) {
-        n.ResolvedProvider = p
+// GraphNodeProviderConsumer
+func (n *graphNodeImportState) SetProvider(addr addrs.AbsProviderConfig) {
+        n.ResolvedProvider = addr
 }
 
 // GraphNodeSubPath
-func (n *graphNodeImportState) Path() []string {
-        return normalizeModulePath(n.Addr.Path)
+func (n *graphNodeImportState) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeEvalable impl.
 func (n *graphNodeImportState) EvalTree() EvalNode {
-        var provider ResourceProvider
-        info := &InstanceInfo{
-                Id:         fmt.Sprintf("%s.%s", n.Addr.Type, n.Addr.Name),
-                ModulePath: n.Path(),
-                Type:       n.Addr.Type,
-        }
+        var provider providers.Interface
 
         // Reset our states
         n.states = nil
@@ -77,13 +85,13 @@ func (n *graphNodeImportState) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalImportState{
+                                Addr:     n.Addr.Resource,
                                 Provider: &provider,
-                                Info:     info,
-                                Id:       n.ID,
+                                ID:       n.ID,
                                 Output:   &n.states,
                         },
                 },
@@ -97,6 +105,8 @@ func (n *graphNodeImportState) EvalTree() EvalNode {
 // resources they don't depend on anything else and refreshes are isolated
 // so this is nearly a perfect use case for dynamic expand.
 func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
+        var diags tfdiags.Diagnostics
+
         g := &Graph{Path: ctx.Path()}
 
         // nameCounter is used to de-dup names in the state.
@@ -105,11 +115,11 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         // Compile the list of addresses that we'll be inserting into the state.
         // We do this ahead of time so we can verify that we aren't importing
         // something that already exists.
-        addrs := make([]*ResourceAddress, len(n.states))
+        addrs := make([]addrs.AbsResourceInstance, len(n.states))
         for i, state := range n.states {
-                addr := *n.Addr
-                if t := state.Ephemeral.Type; t != "" {
-                        addr.Type = t
+                addr := n.Addr
+                if t := state.TypeName; t != "" {
+                        addr.Resource.Resource.Type = t
                 }
 
                 // Determine if we need to suffix the name to de-dup
@@ -117,36 +127,31 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 count, ok := nameCounter[key]
                 if ok {
                         count++
-                        addr.Name += fmt.Sprintf("-%d", count)
+                        addr.Resource.Resource.Name += fmt.Sprintf("-%d", count)
                 }
                 nameCounter[key] = count
 
                 // Add it to our list
-                addrs[i] = &addr
+                addrs[i] = addr
         }
 
         // Verify that all the addresses are clear
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-        filter := &StateFilter{State: state}
+        state := ctx.State()
         for _, addr := range addrs {
-                result, err := filter.Filter(addr.String())
-                if err != nil {
-                        return nil, fmt.Errorf("Error verifying address %s: %s", addr, err)
-                }
-
-                // Go through the filter results and it is an error if we find
-                // a matching InstanceState, meaning that we would have a collision.
-                for _, r := range result {
-                        if _, ok := r.Value.(*InstanceState); ok {
-                                return nil, fmt.Errorf(
-                                        "Can't import %s, would collide with an existing resource.\n\n"+
-                                                "Please remove or rename this resource before continuing.",
-                                        addr)
-                        }
+                existing := state.ResourceInstance(addr)
+                if existing != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Resource already managed by Terraform",
+                                fmt.Sprintf("Terraform is already managing a remote object for %s. To import to this address you must first remove the existing object from the state.", addr),
+                        ))
+                        continue
                 }
         }
+        if diags.HasErrors() {
+                // Bail out early, then.
+                return nil, diags.Err()
+        }
 
         // For each of the states, we add a node to handle the refresh/add to state.
         // "n.states" is populated by our own EvalTree with the result of
@@ -154,10 +159,8 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         // is safe.
         for i, state := range n.states {
                 g.Add(&graphNodeImportStateSub{
-                        Target:           addrs[i],
-                        Path_:            n.Path(),
+                        TargetAddr:       addrs[i],
                         State:            state,
-                        ProviderName:     n.ProviderName,
                         ResolvedProvider: n.ResolvedProvider,
                 })
         }
@@ -169,79 +172,67 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         }
 
         // Done!
-        return g, nil
+        return g, diags.Err()
 }
 
 // graphNodeImportStateSub is the sub-node of graphNodeImportState
 // and is part of the subgraph. This node is responsible for refreshing
 // and adding a resource to the state once it is imported.
 type graphNodeImportStateSub struct {
-        Target           *ResourceAddress
-        State            *InstanceState
-        Path_            []string
-        ProviderName     string
-        ResolvedProvider string
+        TargetAddr       addrs.AbsResourceInstance
+        State            providers.ImportedResource
+        ResolvedProvider addrs.AbsProviderConfig
 }
 
+var (
+        _ GraphNodeSubPath  = (*graphNodeImportStateSub)(nil)
+        _ GraphNodeEvalable = (*graphNodeImportStateSub)(nil)
+)
+
 func (n *graphNodeImportStateSub) Name() string {
-        return fmt.Sprintf("import %s result: %s", n.Target, n.State.ID)
+        return fmt.Sprintf("import %s result", n.TargetAddr)
 }
 
-func (n *graphNodeImportStateSub) Path() []string {
-        return n.Path_
+func (n *graphNodeImportStateSub) Path() addrs.ModuleInstance {
+        return n.TargetAddr.Module
 }
 
 // GraphNodeEvalable impl.
 func (n *graphNodeImportStateSub) EvalTree() EvalNode {
         // If the Ephemeral type isn't set, then it is an error
-        if n.State.Ephemeral.Type == "" {
-                err := fmt.Errorf(
-                        "import of %s didn't set type for %s",
-                        n.Target.String(), n.State.ID)
+        if n.State.TypeName == "" {
+                err := fmt.Errorf("import of %s didn't set type", n.TargetAddr.String())
                 return &EvalReturnError{Error: &err}
         }
 
-        // DeepCopy so we're only modifying our local copy
-        state := n.State.DeepCopy()
+        state := n.State.AsInstanceObject()
 
-        // Build the resource info
-        info := &InstanceInfo{
-                Id:         fmt.Sprintf("%s.%s", n.Target.Type, n.Target.Name),
-                ModulePath: n.Path_,
-                Type:       n.State.Ephemeral.Type,
-        }
-
-        // Key is the resource key
-        key := &ResourceStateKey{
-                Name:  n.Target.Name,
-                Type:  info.Type,
-                Index: n.Target.Index,
-        }
-
-        // The eval sequence
-        var provider ResourceProvider
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
                         &EvalRefresh{
-                                Provider: &provider,
-                                State:    &state,
-                                Info:     info,
-                                Output:   &state,
+                                Addr:           n.TargetAddr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                Output:         &state,
                         },
                         &EvalImportStateVerify{
-                                Info:  info,
-                                Id:    n.State.ID,
+                                Addr:  n.TargetAddr.Resource,
                                 State: &state,
                         },
                         &EvalWriteState{
-                                Name:         key.String(),
-                                ResourceType: info.Type,
-                                Provider:     n.ResolvedProvider,
-                                State:        &state,
+                                Addr:           n.TargetAddr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_local.go b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
index 95ecfc0..84eb26b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
@@ -1,37 +1,45 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // LocalTransformer is a GraphTransformer that adds all the local values
 // from the configuration to the graph.
 type LocalTransformer struct {
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *LocalTransformer) Transform(g *Graph) error {
-        return t.transformModule(g, t.Module)
+        return t.transformModule(g, t.Config)
 }
 
-func (t *LocalTransformer) transformModule(g *Graph, m *module.Tree) error {
-        if m == nil {
+func (t *LocalTransformer) transformModule(g *Graph, c *configs.Config) error {
+        if c == nil {
                 // Can't have any locals if there's no config
                 return nil
         }
 
-        for _, local := range m.Config().Locals {
+        // Our addressing system distinguishes between modules and module instances,
+        // but we're not yet ready to make that distinction here (since we don't
+        // support "count"/"for_each" on modules) and so we just do a naive
+        // transform of the module path into a module instance path, assuming that
+        // no keys are in use. This should be removed when "count" and "for_each"
+        // are implemented for modules.
+        path := c.Path.UnkeyedInstanceShim()
+
+        for _, local := range c.Module.Locals {
+                addr := path.LocalValue(local.Name)
                 node := &NodeLocal{
-                        PathValue: normalizeModulePath(m.Path()),
-                        Config:    local,
+                        Addr:   addr,
+                        Config: local,
                 }
-
                 g.Add(node)
         }
 
         // Also populate locals for child modules
-        for _, c := range m.Children() {
-                if err := t.transformModule(g, c); err != nil {
+        for _, cc := range c.Children {
+                if err := t.transformModule(g, cc); err != nil {
                         return err
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go b/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go
index 467950b..a994bd4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go
@@ -1,46 +1,54 @@
 package terraform
 
 import (
-        "log"
+        "fmt"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // ModuleVariableTransformer is a GraphTransformer that adds all the variables
 // in the configuration to the graph.
 //
-// This only adds variables that are referenced by other things in the graph.
-// If a module variable is not referenced, it won't be added to the graph.
+// Any "variable" block present in any non-root module is included here, even
+// if a particular variable is not referenced from anywhere.
+//
+// The transform will produce errors if a call to a module does not conform
+// to the expected set of arguments, but this transformer is not in a good
+// position to return errors and so the validate walk should include specific
+// steps for validating module blocks, separate from this transform.
 type ModuleVariableTransformer struct {
-        Module *module.Tree
-
-        DisablePrune bool // True if pruning unreferenced should be disabled
+        Config *configs.Config
 }
 
 func (t *ModuleVariableTransformer) Transform(g *Graph) error {
-        return t.transform(g, nil, t.Module)
+        return t.transform(g, nil, t.Config)
 }
 
-func (t *ModuleVariableTransformer) transform(g *Graph, parent, m *module.Tree) error {
-        // If no config, no variables
-        if m == nil {
+func (t *ModuleVariableTransformer) transform(g *Graph, parent, c *configs.Config) error {
+        // We can have no variables if we have no configuration.
+        if c == nil {
                 return nil
         }
 
-        // Transform all the children. This must be done BEFORE the transform
-        // above since child module variables can reference parent module variables.
-        for _, c := range m.Children() {
-                if err := t.transform(g, m, c); err != nil {
+        // Transform all the children first.
+        for _, cc := range c.Children {
+                if err := t.transform(g, c, cc); err != nil {
                         return err
                 }
         }
 
+        // If we're processing anything other than the root module then we'll
+        // add graph nodes for variables defined inside. (Variables for the root
+        // module are dealt with in RootVariableTransformer).
         // If we have a parent, we can determine if a module variable is being
         // used, so we transform this.
         if parent != nil {
-                if err := t.transformSingle(g, parent, m); err != nil {
+                if err := t.transformSingle(g, parent, c); err != nil {
                         return err
                 }
         }
@@ -48,71 +56,69 @@ func (t *ModuleVariableTransformer) transform(g *Graph, parent, m *module.Tree)
         return nil
 }
 
-func (t *ModuleVariableTransformer) transformSingle(g *Graph, parent, m *module.Tree) error {
-        // If we have no vars, we're done!
-        vars := m.Config().Variables
-        if len(vars) == 0 {
-                log.Printf("[TRACE] Module %#v has no variables, skipping.", m.Path())
-                return nil
+func (t *ModuleVariableTransformer) transformSingle(g *Graph, parent, c *configs.Config) error {
+
+        // Our addressing system distinguishes between modules and module instances,
+        // but we're not yet ready to make that distinction here (since we don't
+        // support "count"/"for_each" on modules) and so we just do a naive
+        // transform of the module path into a module instance path, assuming that
+        // no keys are in use. This should be removed when "count" and "for_each"
+        // are implemented for modules.
+        path := c.Path.UnkeyedInstanceShim()
+        _, call := path.Call()
+
+        // Find the call in the parent module configuration, so we can get the
+        // expressions given for each input variable at the call site.
+        callConfig, exists := parent.Module.ModuleCalls[call.Name]
+        if !exists {
+                // This should never happen, since it indicates an improperly-constructed
+                // configuration tree.
+                panic(fmt.Errorf("no module call block found for %s", path))
         }
 
-        // Look for usage of this module
-        var mod *config.Module
-        for _, modUse := range parent.Config().Modules {
-                if modUse.Name == m.Name() {
-                        mod = modUse
-                        break
-                }
+        // We need to construct a schema for the expected call arguments based on
+        // the configured variables in our config, which we can then use to
+        // decode the content of the call block.
+        schema := &hcl.BodySchema{}
+        for _, v := range c.Module.Variables {
+                schema.Attributes = append(schema.Attributes, hcl.AttributeSchema{
+                        Name:     v.Name,
+                        Required: v.Default == cty.NilVal,
+                })
         }
-        if mod == nil {
-                log.Printf("[INFO] Module %#v not used, not adding variables", m.Path())
-                return nil
+
+        content, contentDiags := callConfig.Config.Content(schema)
+        if contentDiags.HasErrors() {
+                // Validation code elsewhere should deal with any errors before we
+                // get in here, but we'll report them out here just in case, to
+                // avoid crashes.
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(contentDiags)
+                return diags.Err()
         }
 
-        // Build the reference map so we can determine if we're referencing things.
-        refMap := NewReferenceMap(g.Vertices())
-
-        // Add all variables here
-        for _, v := range vars {
-                // Determine the value of the variable. If it isn't in the
-                // configuration then it was never set and that's not a problem.
-                var value *config.RawConfig
-                if raw, ok := mod.RawConfig.Raw[v.Name]; ok {
-                        var err error
-                        value, err = config.NewRawConfig(map[string]interface{}{
-                                v.Name: raw,
-                        })
-                        if err != nil {
-                                // This shouldn't happen because it is already in
-                                // a RawConfig above meaning it worked once before.
-                                panic(err)
+        for _, v := range c.Module.Variables {
+                var expr hcl.Expression
+                if attr := content.Attributes[v.Name]; attr != nil {
+                        expr = attr.Expr
+                } else {
+                        // No expression provided for this variable, so we'll make a
+                        // synthetic one using the variable's default value.
+                        expr = &hclsyntax.LiteralValueExpr{
+                                Val:      v.Default,
+                                SrcRange: v.DeclRange, // This is not exact, but close enough
                         }
                 }
 
-                // Build the node.
-                //
-                // NOTE: For now this is just an "applyable" variable. As we build
-                // new graph builders for the other operations I suspect we'll
-                // find a way to parameterize this, require new transforms, etc.
+                // For now we treat all module variables as "applyable", even though
+                // such nodes are valid to use on other walks too. We may specialize
+                // this in future if we find reasons to employ different behaviors
+                // in different scenarios.
                 node := &NodeApplyableModuleVariable{
-                        PathValue: normalizeModulePath(m.Path()),
-                        Config:    v,
-                        Value:     value,
-                        Module:    t.Module,
+                        Addr:   path.InputVariable(v.Name),
+                        Config: v,
+                        Expr:   expr,
                 }
-
-                if !t.DisablePrune {
-                        // If the node is not referenced by anything, then we don't need
-                        // to include it since it won't be used.
-                        if matches := refMap.ReferencedBy(node); len(matches) == 0 {
-                                log.Printf(
-                                        "[INFO] Not including %q in graph, nothing depends on it",
-                                        dag.VertexName(node))
-                                continue
-                        }
-                }
-
-                // Add it!
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
index b256a25..eec762e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
@@ -3,7 +3,9 @@ package terraform
 import (
         "log"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // OrphanResourceCountTransformer is a GraphTransformer that adds orphans
@@ -14,95 +16,106 @@ import (
 // This transform assumes that if an element in the state is within the count
 // bounds given, that it is not an orphan.
 type OrphanResourceCountTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+        Concrete ConcreteResourceInstanceNodeFunc
 
-        Count int              // Actual count of the resource
-        Addr  *ResourceAddress // Addr of the resource to look for orphans
-        State *State           // Full global state
+        Count int               // Actual count of the resource, or -1 if count is not set at all
+        Addr  addrs.AbsResource // Addr of the resource to look for orphans
+        State *states.State     // Full global state
 }
 
 func (t *OrphanResourceCountTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] OrphanResourceCount: Starting...")
+        rs := t.State.Resource(t.Addr)
+        if rs == nil {
+                return nil // Resource doesn't exist in state, so nothing to do!
+        }
 
-        // Grab the module in the state just for this resource address
-        ms := t.State.ModuleByPath(normalizeModulePath(t.Addr.Path))
-        if ms == nil {
-                // If no state, there can't be orphans
-                return nil
+        haveKeys := make(map[addrs.InstanceKey]struct{})
+        for key := range rs.Instances {
+                haveKeys[key] = struct{}{}
         }
 
-        orphanIndex := -1
-        if t.Count == 1 {
-                orphanIndex = 0
+        if t.Count < 0 {
+                return t.transformNoCount(haveKeys, g)
+        }
+        if t.Count == 0 {
+                return t.transformZeroCount(haveKeys, g)
         }
+        return t.transformCount(haveKeys, g)
+}
+
+func (t *OrphanResourceCountTransformer) transformCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        // Due to the logic in Transform, we only get in here if our count is
+        // at least one.
 
-        // Go through the orphans and add them all to the state
-        for key, _ := range ms.Resources {
-                // Build the address
-                addr, err := parseResourceAddressInternal(key)
-                if err != nil {
-                        return err
+        _, have0Key := haveKeys[addrs.IntKey(0)]
+
+        for key := range haveKeys {
+                if key == addrs.NoKey && !have0Key {
+                        // If we have no 0-key then we will accept a no-key instance
+                        // as an alias for it.
+                        continue
                 }
-                addr.Path = ms.Path[1:]
 
-                // Copy the address for comparison. If we aren't looking at
-                // the same resource, then just ignore it.
-                addrCopy := addr.Copy()
-                addrCopy.Index = -1
-                if !addrCopy.Equals(t.Addr) {
+                i, isInt := key.(addrs.IntKey)
+                if isInt && int(i) < t.Count {
                         continue
                 }
 
-                log.Printf("[TRACE] OrphanResourceCount: Checking: %s", addr)
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
+                }
+                log.Printf("[TRACE] OrphanResourceCount(non-zero): adding %s as %T", t.Addr, node)
+                g.Add(node)
+        }
+
+        return nil
+}
 
-                idx := addr.Index
+func (t *OrphanResourceCountTransformer) transformZeroCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        // This case is easy: we need to orphan any keys we have at all.
 
-                // If we have zero and the index here is 0 or 1, then we
-                // change the index to a high number so that we treat it as
-                // an orphan.
-                if t.Count <= 0 && idx <= 0 {
-                        idx = t.Count + 1
+        for key := range haveKeys {
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
                 }
+                log.Printf("[TRACE] OrphanResourceCount(zero): adding %s as %T", t.Addr, node)
+                g.Add(node)
+        }
 
-                // If we have a count greater than 0 and we're at the zero index,
-                // we do a special case check to see if our state also has a
-                // -1 index value. If so, this is an orphan because our rules are
-                // that if both a -1 and 0 are in the state, the 0 is destroyed.
-                if t.Count > 0 && idx == orphanIndex {
-                        // This is a piece of cleverness (beware), but its simple:
-                        // if orphanIndex is 0, then check -1, else check 0.
-                        checkIndex := (orphanIndex + 1) * -1
-
-                        key := &ResourceStateKey{
-                                Name:  addr.Name,
-                                Type:  addr.Type,
-                                Mode:  addr.Mode,
-                                Index: checkIndex,
-                        }
-
-                        if _, ok := ms.Resources[key.String()]; ok {
-                                // We have a -1 index, too. Make an arbitrarily high
-                                // index so that we always mark this as an orphan.
-                                log.Printf(
-                                        "[WARN] OrphanResourceCount: %q both -1 and 0 index found, orphaning %d",
-                                        addr, orphanIndex)
-                                idx = t.Count + 1
-                        }
-                }
+        return nil
+}
 
-                // If the index is within the count bounds, it is not an orphan
-                if idx < t.Count {
+func (t *OrphanResourceCountTransformer) transformNoCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        // Negative count indicates that count is not set at all, in which
+        // case we expect to have a single instance with no key set at all.
+        // However, we'll also accept an instance with key 0 set as an alias
+        // for it, in case the user has just deleted the "count" argument and
+        // so wants to keep the first instance in the set.
+
+        _, haveNoKey := haveKeys[addrs.NoKey]
+        _, have0Key := haveKeys[addrs.IntKey(0)]
+        keepKey := addrs.NoKey
+        if have0Key && !haveNoKey {
+                // If we don't have a no-key instance then we can use the 0-key instance
+                // instead.
+                keepKey = addrs.IntKey(0)
+        }
+
+        for key := range haveKeys {
+                if key == keepKey {
                         continue
                 }
 
-                // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{Addr: addr}
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
                 }
-
-                // Add it to the graph
+                log.Printf("[TRACE] OrphanResourceCount(no-count): adding %s as %T", t.Addr, node)
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
index aea2bd0..c675409 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
@@ -3,16 +3,17 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
 )
 
 // OrphanOutputTransformer finds the outputs that aren't present
 // in the given config that are in the state and adds them to the graph
 // for deletion.
 type OrphanOutputTransformer struct {
-        Module *module.Tree // Root module
-        State  *State       // State is the root state
+        Config *configs.Config // Root of config tree
+        State  *states.State   // State is the root state
 }
 
 func (t *OrphanOutputTransformer) Transform(g *Graph) error {
@@ -29,24 +30,30 @@ func (t *OrphanOutputTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *OrphanOutputTransformer) transform(g *Graph, ms *ModuleState) error {
+func (t *OrphanOutputTransformer) transform(g *Graph, ms *states.Module) error {
         if ms == nil {
                 return nil
         }
 
-        path := normalizeModulePath(ms.Path)
+        moduleAddr := ms.Addr
 
         // Get the config for this path, which is nil if the entire module has been
         // removed.
-        var c *config.Config
-        if m := t.Module.Child(path[1:]); m != nil {
-                c = m.Config()
+        var outputs map[string]*configs.Output
+        if c := t.Config.DescendentForInstance(moduleAddr); c != nil {
+                outputs = c.Module.Outputs
         }
 
-        // add all the orphaned outputs to the graph
-        for _, n := range ms.RemovedOutputs(c) {
-                g.Add(&NodeOutputOrphan{OutputName: n, PathValue: path})
+        // An output is "orphaned" if it's present in the state but not declared
+        // in the configuration.
+        for name := range ms.OutputValues {
+                if _, exists := outputs[name]; exists {
+                        continue
+                }
 
+                g.Add(&NodeOutputOrphan{
+                        Addr: addrs.OutputValue{Name: name}.Absolute(moduleAddr),
+                })
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go
index e42d3c8..50df178 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go
@@ -1,34 +1,43 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "log"
+
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
-// OrphanResourceTransformer is a GraphTransformer that adds resource
-// orphans to the graph. A resource orphan is a resource that is
-// represented in the state but not in the configuration.
-//
-// This only adds orphans that have no representation at all in the
+// OrphanResourceInstanceTransformer is a GraphTransformer that adds orphaned
+// resource instances to the graph. An "orphan" is an instance that is present
+// in the state but belongs to a resource that is no longer present in the
 // configuration.
-type OrphanResourceTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+//
+// This is not the transformer that deals with "count orphans" (instances that
+// are no longer covered by a resource's "count" or "for_each" setting); that's
+// handled instead by OrphanResourceCountTransformer.
+type OrphanResourceInstanceTransformer struct {
+        Concrete ConcreteResourceInstanceNodeFunc
 
         // State is the global state. We require the global state to
         // properly find module orphans at our path.
-        State *State
+        State *states.State
 
-        // Module is the root module. We'll look up the proper configuration
-        // using the graph path.
-        Module *module.Tree
+        // Config is the root node in the configuration tree. We'll look up
+        // the appropriate note in this tree using the path in each node.
+        Config *configs.Config
 }
 
-func (t *OrphanResourceTransformer) Transform(g *Graph) error {
+func (t *OrphanResourceInstanceTransformer) Transform(g *Graph) error {
         if t.State == nil {
                 // If the entire state is nil, there can't be any orphans
                 return nil
         }
+        if t.Config == nil {
+                // Should never happen: we can't be doing any Terraform operations
+                // without at least an empty configuration.
+                panic("OrphanResourceInstanceTransformer used without setting Config")
+        }
 
         // Go through the modules and for each module transform in order
         // to add the orphan.
@@ -41,38 +50,130 @@ func (t *OrphanResourceTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *OrphanResourceTransformer) transform(g *Graph, ms *ModuleState) error {
+func (t *OrphanResourceInstanceTransformer) transform(g *Graph, ms *states.Module) error {
         if ms == nil {
                 return nil
         }
 
-        // Get the configuration for this path. The configuration might be
+        moduleAddr := ms.Addr
+
+        // Get the configuration for this module. The configuration might be
         // nil if the module was removed from the configuration. This is okay,
         // this just means that every resource is an orphan.
-        var c *config.Config
-        if m := t.Module.Child(ms.Path[1:]); m != nil {
-                c = m.Config()
+        var m *configs.Module
+        if c := t.Config.DescendentForInstance(moduleAddr); c != nil {
+                m = c.Module
         }
 
-        // Go through the orphans and add them all to the state
-        for _, key := range ms.Orphans(c) {
-                // Build the abstract resource
-                addr, err := parseResourceAddressInternal(key)
-                if err != nil {
-                        return err
+        // An "orphan" is a resource that is in the state but not the configuration,
+        // so we'll walk the state resources and try to correlate each of them
+        // with a configuration block. Each orphan gets a node in the graph whose
+        // type is decided by t.Concrete.
+        //
+        // We don't handle orphans related to changes in the "count" and "for_each"
+        // pseudo-arguments here. They are handled by OrphanResourceCountTransformer.
+        for _, rs := range ms.Resources {
+                if m != nil {
+                        if r := m.ResourceByAddr(rs.Addr); r != nil {
+                                continue
+                        }
                 }
-                addr.Path = ms.Path[1:]
 
-                // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{Addr: addr}
-                var node dag.Vertex = abstract
-                if f := t.Concrete; f != nil {
-                        node = f(abstract)
+                for key := range rs.Instances {
+                        addr := rs.Addr.Instance(key).Absolute(moduleAddr)
+                        abstract := NewNodeAbstractResourceInstance(addr)
+                        var node dag.Vertex = abstract
+                        if f := t.Concrete; f != nil {
+                                node = f(abstract)
+                        }
+                        log.Printf("[TRACE] OrphanResourceInstanceTransformer: adding single-instance orphan node for %s", addr)
+                        g.Add(node)
                 }
+        }
+
+        return nil
+}
+
+// OrphanResourceTransformer is a GraphTransformer that adds orphaned
+// resources to the graph. An "orphan" is a resource that is present in
+// the state but no longer present in the config.
+//
+// This is separate to OrphanResourceInstanceTransformer in that it deals with
+// whole resources, rather than individual instances of resources. Orphan
+// resource nodes are only used during apply to clean up leftover empty
+// resource state skeletons, after all of the instances inside have been
+// removed.
+//
+// This transformer will also create edges in the graph to any pre-existing
+// node that creates or destroys the entire orphaned resource or any of its
+// instances, to ensure that the "orphan-ness" of a resource is always dealt
+// with after all other aspects of it.
+type OrphanResourceTransformer struct {
+        Concrete ConcreteResourceNodeFunc
+
+        // State is the global state.
+        State *states.State
 
-                // Add it to the graph
-                g.Add(node)
+        // Config is the root node in the configuration tree.
+        Config *configs.Config
+}
+
+func (t *OrphanResourceTransformer) Transform(g *Graph) error {
+        if t.State == nil {
+                // If the entire state is nil, there can't be any orphans
+                return nil
+        }
+        if t.Config == nil {
+                // Should never happen: we can't be doing any Terraform operations
+                // without at least an empty configuration.
+                panic("OrphanResourceTransformer used without setting Config")
+        }
+
+        // We'll first collect up the existing nodes for each resource so we can
+        // create dependency edges for any new nodes we create.
+        deps := map[string][]dag.Vertex{}
+        for _, v := range g.Vertices() {
+                switch tv := v.(type) {
+                case GraphNodeResourceInstance:
+                        k := tv.ResourceInstanceAddr().ContainingResource().String()
+                        deps[k] = append(deps[k], v)
+                case GraphNodeResource:
+                        k := tv.ResourceAddr().String()
+                        deps[k] = append(deps[k], v)
+                case GraphNodeDestroyer:
+                        k := tv.DestroyAddr().ContainingResource().String()
+                        deps[k] = append(deps[k], v)
+                }
+        }
+
+        for _, ms := range t.State.Modules {
+                moduleAddr := ms.Addr
+
+                mc := t.Config.DescendentForInstance(moduleAddr) // might be nil if whole module has been removed
+
+                for _, rs := range ms.Resources {
+                        if mc != nil {
+                                if r := mc.Module.ResourceByAddr(rs.Addr); r != nil {
+                                        // It's in the config, so nothing to do for this one.
+                                        continue
+                                }
+                        }
+
+                        addr := rs.Addr.Absolute(moduleAddr)
+                        abstract := NewNodeAbstractResource(addr)
+                        var node dag.Vertex = abstract
+                        if f := t.Concrete; f != nil {
+                                node = f(abstract)
+                        }
+                        log.Printf("[TRACE] OrphanResourceTransformer: adding whole-resource orphan node for %s", addr)
+                        g.Add(node)
+                        for _, dn := range deps[addr.String()] {
+                                log.Printf("[TRACE] OrphanResourceTransformer: node %q depends on %q", dag.VertexName(node), dag.VertexName(dn))
+                                g.Connect(dag.BasicEdge(node, dn))
+                        }
+                }
         }
 
         return nil
+
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
index faa25e4..ed93cdb 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
@@ -3,7 +3,7 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -14,42 +14,42 @@ import (
 // aren't changing since there is no downside: the state will be available
 // even if the dependent items aren't changing.
 type OutputTransformer struct {
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *OutputTransformer) Transform(g *Graph) error {
-        return t.transform(g, t.Module)
+        return t.transform(g, t.Config)
 }
 
-func (t *OutputTransformer) transform(g *Graph, m *module.Tree) error {
-        // If no config, no outputs
-        if m == nil {
+func (t *OutputTransformer) transform(g *Graph, c *configs.Config) error {
+        // If we have no config then there can be no outputs.
+        if c == nil {
                 return nil
         }
 
         // Transform all the children. We must do this first because
         // we can reference module outputs and they must show up in the
         // reference map.
-        for _, c := range m.Children() {
-                if err := t.transform(g, c); err != nil {
+        for _, cc := range c.Children {
+                if err := t.transform(g, cc); err != nil {
                         return err
                 }
         }
 
-        // If we have no outputs, we're done!
-        os := m.Config().Outputs
-        if len(os) == 0 {
-                return nil
-        }
+        // Our addressing system distinguishes between modules and module instances,
+        // but we're not yet ready to make that distinction here (since we don't
+        // support "count"/"for_each" on modules) and so we just do a naive
+        // transform of the module path into a module instance path, assuming that
+        // no keys are in use. This should be removed when "count" and "for_each"
+        // are implemented for modules.
+        path := c.Path.UnkeyedInstanceShim()
 
-        // Add all outputs here
-        for _, o := range os {
+        for _, o := range c.Module.Outputs {
+                addr := path.OutputValue(o.Name)
                 node := &NodeApplyableOutput{
-                        PathValue: normalizeModulePath(m.Path()),
-                        Config:    o,
+                        Addr:   addr,
+                        Config: o,
                 }
-
-                // Add it!
                 g.Add(node)
         }
 
@@ -71,8 +71,8 @@ func (t *DestroyOutputTransformer) Transform(g *Graph) error {
 
                 // create the destroy node for this output
                 node := &NodeDestroyableOutput{
-                        PathValue: output.PathValue,
-                        Config:    output.Config,
+                        Addr:   output.Addr,
+                        Config: output.Config,
                 }
 
                 log.Printf("[TRACE] creating %s", node.Name())
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
index c4772b4..6a4fb47 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
@@ -1,22 +1,21 @@
 package terraform
 
 import (
-        "errors"
         "fmt"
         "log"
-        "strings"
 
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, mod *module.Tree) GraphTransformer {
+func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, config *configs.Config) GraphTransformer {
         return GraphTransformMulti(
                 // Add providers from the config
                 &ProviderConfigTransformer{
-                        Module:    mod,
+                        Config:    config,
                         Providers: providers,
                         Concrete:  concrete,
                 },
@@ -26,7 +25,9 @@ func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, m
                         Concrete:  concrete,
                 },
                 // Connect the providers
-                &ProviderTransformer{},
+                &ProviderTransformer{
+                        Config: config,
+                },
                 // Remove unused providers and proxies
                 &PruneProviderTransformer{},
                 // Connect provider to their parent provider nodes
@@ -36,10 +37,14 @@ func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, m
 
 // GraphNodeProvider is an interface that nodes that can be a provider
 // must implement.
-// ProviderName returns the name of the provider this satisfies.
+//
+// ProviderAddr returns the address of the provider configuration this
+// satisfies, which is relative to the path returned by method Path().
+//
 // Name returns the full name of the provider in the config.
 type GraphNodeProvider interface {
-        ProviderName() string
+        GraphNodeSubPath
+        ProviderAddr() addrs.AbsProviderConfig
         Name() string
 }
 
@@ -47,62 +52,132 @@ type GraphNodeProvider interface {
 // provider must implement. The CloseProviderName returned is the name of
 // the provider they satisfy.
 type GraphNodeCloseProvider interface {
-        CloseProviderName() string
+        GraphNodeSubPath
+        CloseProviderAddr() addrs.AbsProviderConfig
 }
 
 // GraphNodeProviderConsumer is an interface that nodes that require
-// a provider must implement. ProvidedBy must return the name of the provider
-// to use. This may be a provider by type, type.alias or a fully resolved
-// provider name
+// a provider must implement. ProvidedBy must return the address of the provider
+// to use, which will be resolved to a configuration either in the same module
+// or in an ancestor module, with the resulting absolute address passed to
+// SetProvider.
 type GraphNodeProviderConsumer interface {
-        ProvidedBy() string
+        // ProvidedBy returns the address of the provider configuration the node
+        // refers to. If the returned "exact" value is true, this address will
+        // be taken exactly. If "exact" is false, a provider configuration from
+        // an ancestor module may be selected instead.
+        ProvidedBy() (addr addrs.AbsProviderConfig, exact bool)
         // Set the resolved provider address for this resource.
-        SetProvider(string)
+        SetProvider(addrs.AbsProviderConfig)
 }
 
 // ProviderTransformer is a GraphTransformer that maps resources to
 // providers within the graph. This will error if there are any resources
 // that don't map to proper resources.
-type ProviderTransformer struct{}
+type ProviderTransformer struct {
+        Config *configs.Config
+}
 
 func (t *ProviderTransformer) Transform(g *Graph) error {
-        // Go through the other nodes and match them to providers they need
-        var err error
-        m := providerVertexMap(g)
+        // We need to find a provider configuration address for each resource
+        // either directly represented by a node or referenced by a node in
+        // the graph, and then create graph edges from provider to provider user
+        // so that the providers will get initialized first.
+
+        var diags tfdiags.Diagnostics
+
+        // To start, we'll collect the _requested_ provider addresses for each
+        // node, which we'll then resolve (handling provider inheritence, etc) in
+        // the next step.
+        // Our "requested" map is from graph vertices to string representations of
+        // provider config addresses (for deduping) to requests.
+        type ProviderRequest struct {
+                Addr  addrs.AbsProviderConfig
+                Exact bool // If true, inheritence from parent modules is not attempted
+        }
+        requested := map[dag.Vertex]map[string]ProviderRequest{}
+        needConfigured := map[string]addrs.AbsProviderConfig{}
         for _, v := range g.Vertices() {
+
+                // Does the vertex _directly_ use a provider?
                 if pv, ok := v.(GraphNodeProviderConsumer); ok {
-                        p := pv.ProvidedBy()
+                        requested[v] = make(map[string]ProviderRequest)
 
-                        key := providerMapKey(p, pv)
+                        p, exact := pv.ProvidedBy()
+                        if exact {
+                                log.Printf("[TRACE] ProviderTransformer: %s is provided by %s exactly", dag.VertexName(v), p)
+                        } else {
+                                log.Printf("[TRACE] ProviderTransformer: %s is provided by %s or inherited equivalent", dag.VertexName(v), p)
+                        }
+
+                        requested[v][p.String()] = ProviderRequest{
+                                Addr:  p,
+                                Exact: exact,
+                        }
+
+                        // Direct references need the provider configured as well as initialized
+                        needConfigured[p.String()] = p
+                }
+        }
+
+        // Now we'll go through all the requested addresses we just collected and
+        // figure out which _actual_ config address each belongs to, after resolving
+        // for provider inheritance and passing.
+        m := providerVertexMap(g)
+        for v, reqs := range requested {
+                for key, req := range reqs {
+                        p := req.Addr
                         target := m[key]
 
-                        sp, ok := pv.(GraphNodeSubPath)
+                        _, ok := v.(GraphNodeSubPath)
                         if !ok && target == nil {
-                                // no target, and no path to walk up
-                                err = multierror.Append(err, fmt.Errorf(
-                                        "%s: provider %s couldn't be found",
-                                        dag.VertexName(v), p))
-                                break
+                                // No target and no path to traverse up from
+                                diags = diags.Append(fmt.Errorf("%s: provider %s couldn't be found", dag.VertexName(v), p))
+                                continue
+                        }
+
+                        if target != nil {
+                                log.Printf("[TRACE] ProviderTransformer: exact match for %s serving %s", p, dag.VertexName(v))
                         }
 
-                        // if we don't have a provider at this level, walk up the path looking for one
-                        for i := 1; target == nil; i++ {
-                                path := normalizeModulePath(sp.Path())
-                                if len(path) < i {
-                                        break
+                        // if we don't have a provider at this level, walk up the path looking for one,
+                        // unless we were told to be exact.
+                        if target == nil && !req.Exact {
+                                for pp, ok := p.Inherited(); ok; pp, ok = pp.Inherited() {
+                                        key := pp.String()
+                                        target = m[key]
+                                        if target != nil {
+                                                log.Printf("[TRACE] ProviderTransformer: %s uses inherited configuration %s", dag.VertexName(v), pp)
+                                                break
+                                        }
+                                        log.Printf("[TRACE] ProviderTransformer: looking for %s to serve %s", pp, dag.VertexName(v))
                                 }
+                        }
 
-                                key = ResolveProviderName(p, path[:len(path)-i])
-                                target = m[key]
-                                if target != nil {
-                                        break
+                        // If this provider doesn't need to be configured then we can just
+                        // stub it out with an init-only provider node, which will just
+                        // start up the provider and fetch its schema.
+                        if _, exists := needConfigured[key]; target == nil && !exists {
+                                stubAddr := p.ProviderConfig.Absolute(addrs.RootModuleInstance)
+                                stub := &NodeEvalableProvider{
+                                        &NodeAbstractProvider{
+                                                Addr: stubAddr,
+                                        },
                                 }
+                                m[stubAddr.String()] = stub
+                                log.Printf("[TRACE] ProviderTransformer: creating init-only node for %s", stubAddr)
+                                target = stub
+                                g.Add(target)
                         }
 
                         if target == nil {
-                                err = multierror.Append(err, fmt.Errorf(
-                                        "%s: configuration for %s is not present; a provider configuration block is required for all operations",
-                                        dag.VertexName(v), p,
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider configuration not present",
+                                        fmt.Sprintf(
+                                                "To work with %s its original provider configuration at %s is required, but it has been removed. This occurs when a provider configuration is removed while objects created by that provider still exist in the state. Re-add the provider configuration to destroy %s, after which you can remove the provider configuration again.",
+                                                dag.VertexName(v), p, dag.VertexName(v),
+                                        ),
                                 ))
                                 break
                         }
@@ -111,16 +186,18 @@ func (t *ProviderTransformer) Transform(g *Graph) error {
                         if p, ok := target.(*graphNodeProxyProvider); ok {
                                 g.Remove(p)
                                 target = p.Target()
-                                key = target.(GraphNodeProvider).Name()
+                                key = target.(GraphNodeProvider).ProviderAddr().String()
                         }
 
-                        log.Printf("[DEBUG] resource %s using provider %s", dag.VertexName(pv), key)
-                        pv.SetProvider(key)
+                        log.Printf("[DEBUG] ProviderTransformer: %q (%T) needs %s", dag.VertexName(v), v, dag.VertexName(target))
+                        if pv, ok := v.(GraphNodeProviderConsumer); ok {
+                                pv.SetProvider(target.ProviderAddr())
+                        }
                         g.Connect(dag.BasicEdge(v, target))
                 }
         }
 
-        return err
+        return diags.Err()
 }
 
 // CloseProviderTransformer is a GraphTransformer that adds nodes to the
@@ -136,15 +213,16 @@ func (t *CloseProviderTransformer) Transform(g *Graph) error {
 
         for _, v := range pm {
                 p := v.(GraphNodeProvider)
+                key := p.ProviderAddr().String()
 
                 // get the close provider of this type if we alread created it
-                closer := cpm[p.Name()]
+                closer := cpm[key]
 
                 if closer == nil {
                         // create a closer for this provider type
-                        closer = &graphNodeCloseProvider{ProviderNameValue: p.Name()}
+                        closer = &graphNodeCloseProvider{Addr: p.ProviderAddr()}
                         g.Add(closer)
-                        cpm[p.Name()] = closer
+                        cpm[key] = closer
                 }
 
                 // Close node depends on the provider itself
@@ -164,10 +242,20 @@ func (t *CloseProviderTransformer) Transform(g *Graph) error {
         return err
 }
 
-// MissingProviderTransformer is a GraphTransformer that adds nodes for all
-// required providers into the graph. Specifically, it creates provider
-// configuration nodes for all the providers that we support. These are pruned
-// later during an optimization pass.
+// MissingProviderTransformer is a GraphTransformer that adds to the graph
+// a node for each default provider configuration that is referenced by another
+// node but not already present in the graph.
+//
+// These "default" nodes are always added to the root module, regardless of
+// where they are requested. This is important because our inheritance
+// resolution behavior in ProviderTransformer will then treat these as a
+// last-ditch fallback after walking up the tree, rather than preferring them
+// as it would if they were placed in the same module as the requester.
+//
+// This transformer may create extra nodes that are not needed in practice,
+// due to overriding provider configurations in child modules.
+// PruneProviderTransformer can then remove these once ProviderTransformer
+// has resolved all of the inheritence, etc.
 type MissingProviderTransformer struct {
         // Providers is the list of providers we support.
         Providers []string
@@ -192,34 +280,40 @@ func (t *MissingProviderTransformer) Transform(g *Graph) error {
                         continue
                 }
 
-                p := pv.ProvidedBy()
-                // this may be the resolved provider from the state, so we need to get
-                // the base provider name.
-                parts := strings.SplitAfter(p, "provider.")
-                p = parts[len(parts)-1]
+                // For our work here we actually care only about the provider type and
+                // we plan to place all default providers in the root module, and so
+                // it's safe for us to rely on ProvidedBy here rather than waiting for
+                // the later proper resolution of provider inheritance done by
+                // ProviderTransformer.
+                p, _ := pv.ProvidedBy()
+                if p.ProviderConfig.Alias != "" {
+                        // We do not create default aliased configurations.
+                        log.Println("[TRACE] MissingProviderTransformer: skipping implication of aliased config", p)
+                        continue
+                }
 
-                key := ResolveProviderName(p, nil)
+                // We're going to create an implicit _default_ configuration for the
+                // referenced provider type in the _root_ module, ignoring all other
+                // aspects of the resource's declared provider address.
+                defaultAddr := addrs.RootModuleInstance.ProviderConfigDefault(p.ProviderConfig.Type)
+                key := defaultAddr.String()
                 provider := m[key]
 
-                // we already have it
                 if provider != nil {
+                        // There's already an explicit default configuration for this
+                        // provider type in the root module, so we have nothing to do.
                         continue
                 }
 
-                // we don't implicitly create aliased providers
-                if strings.Contains(p, ".") {
-                        log.Println("[DEBUG] not adding missing provider alias:", p)
-                        continue
-                }
-
-                log.Println("[DEBUG] adding missing provider:", p)
+                log.Printf("[DEBUG] adding implicit provider configuration %s, implied first by %s", defaultAddr, dag.VertexName(v))
 
-                // create the misisng top-level provider
+                // create the missing top-level provider
                 provider = t.Concrete(&NodeAbstractProvider{
-                        NameValue: p,
-                }).(dag.Vertex)
+                        Addr: defaultAddr,
+                }).(GraphNodeProvider)
 
-                m[key] = g.Add(provider)
+                g.Add(provider)
+                m[key] = provider
         }
 
         return err
@@ -237,26 +331,26 @@ func (t *ParentProviderTransformer) Transform(g *Graph) error {
         for _, v := range g.Vertices() {
                 // Only care about providers
                 pn, ok := v.(GraphNodeProvider)
-                if !ok || pn.ProviderName() == "" {
+                if !ok {
                         continue
                 }
 
-                // Also require a subpath, if there is no subpath then we
-                // can't have a parent.
-                if pn, ok := v.(GraphNodeSubPath); ok {
-                        if len(normalizeModulePath(pn.Path())) <= 1 {
-                                continue
-                        }
+                // Also require non-empty path, since otherwise we're in the root
+                // module and so cannot have a parent.
+                if len(pn.Path()) <= 1 {
+                        continue
                 }
 
                 // this provider may be disabled, but we can only get it's name from
                 // the ProviderName string
-                name := ResolveProviderName(strings.SplitN(pn.ProviderName(), " ", 2)[0], nil)
-                parent := pm[name]
-                if parent != nil {
-                        g.Connect(dag.BasicEdge(v, parent))
+                addr := pn.ProviderAddr()
+                parentAddr, ok := addr.Inherited()
+                if ok {
+                        parent := pm[parentAddr.String()]
+                        if parent != nil {
+                                g.Connect(dag.BasicEdge(v, parent))
+                        }
                 }
-
         }
         return nil
 }
@@ -270,20 +364,20 @@ type PruneProviderTransformer struct{}
 func (t *PruneProviderTransformer) Transform(g *Graph) error {
         for _, v := range g.Vertices() {
                 // We only care about providers
-                pn, ok := v.(GraphNodeProvider)
-                if !ok || pn.ProviderName() == "" {
+                _, ok := v.(GraphNodeProvider)
+                if !ok {
                         continue
                 }
 
                 // ProxyProviders will have up edges, but we're now done with them in the graph
                 if _, ok := v.(*graphNodeProxyProvider); ok {
-                        log.Printf("[DEBUG] pruning proxy provider %s", dag.VertexName(v))
+                        log.Printf("[DEBUG] pruning proxy %s", dag.VertexName(v))
                         g.Remove(v)
                 }
 
                 // Remove providers with no dependencies.
                 if g.UpEdges(v).Len() == 0 {
-                        log.Printf("[DEBUG] pruning unused provider %s", dag.VertexName(v))
+                        log.Printf("[DEBUG] pruning unused %s", dag.VertexName(v))
                         g.Remove(v)
                 }
         }
@@ -291,40 +385,24 @@ func (t *PruneProviderTransformer) Transform(g *Graph) error {
         return nil
 }
 
-// providerMapKey is a helper that gives us the key to use for the
-// maps returned by things such as providerVertexMap.
-func providerMapKey(k string, v dag.Vertex) string {
-        if strings.Contains(k, "provider.") {
-                // this is already resolved
-                return k
-        }
-
-        // we create a dummy provider to
-        var path []string
-        if sp, ok := v.(GraphNodeSubPath); ok {
-                path = normalizeModulePath(sp.Path())
-        }
-        return ResolveProviderName(k, path)
-}
-
-func providerVertexMap(g *Graph) map[string]dag.Vertex {
-        m := make(map[string]dag.Vertex)
+func providerVertexMap(g *Graph) map[string]GraphNodeProvider {
+        m := make(map[string]GraphNodeProvider)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeProvider); ok {
-                        // TODO:  The Name may have meta info, like " (disabled)"
-                        name := strings.SplitN(pv.Name(), " ", 2)[0]
-                        m[name] = v
+                        addr := pv.ProviderAddr()
+                        m[addr.String()] = pv
                 }
         }
 
         return m
 }
 
-func closeProviderVertexMap(g *Graph) map[string]dag.Vertex {
-        m := make(map[string]dag.Vertex)
+func closeProviderVertexMap(g *Graph) map[string]GraphNodeCloseProvider {
+        m := make(map[string]GraphNodeCloseProvider)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeCloseProvider); ok {
-                        m[pv.CloseProviderName()] = v
+                        addr := pv.CloseProviderAddr()
+                        m[addr.String()] = pv
                 }
         }
 
@@ -332,16 +410,25 @@ func closeProviderVertexMap(g *Graph) map[string]dag.Vertex {
 }
 
 type graphNodeCloseProvider struct {
-        ProviderNameValue string
+        Addr addrs.AbsProviderConfig
 }
 
+var (
+        _ GraphNodeCloseProvider = (*graphNodeCloseProvider)(nil)
+)
+
 func (n *graphNodeCloseProvider) Name() string {
-        return n.ProviderNameValue + " (close)"
+        return n.Addr.String() + " (close)"
+}
+
+// GraphNodeSubPath impl.
+func (n *graphNodeCloseProvider) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeEvalable impl.
 func (n *graphNodeCloseProvider) EvalTree() EvalNode {
-        return CloseProviderEvalTree(n.ProviderNameValue)
+        return CloseProviderEvalTree(n.Addr)
 }
 
 // GraphNodeDependable impl.
@@ -349,8 +436,8 @@ func (n *graphNodeCloseProvider) DependableName() []string {
         return []string{n.Name()}
 }
 
-func (n *graphNodeCloseProvider) CloseProviderName() string {
-        return n.ProviderNameValue
+func (n *graphNodeCloseProvider) CloseProviderAddr() addrs.AbsProviderConfig {
+        return n.Addr
 }
 
 // GraphNodeDotter impl.
@@ -380,17 +467,24 @@ func (n *graphNodeCloseProvider) RemoveIfNotTargeted() bool {
 // configurations, and are removed after all the resources have been connected
 // to their providers.
 type graphNodeProxyProvider struct {
-        nameValue string
-        path      []string
-        target    GraphNodeProvider
+        addr   addrs.AbsProviderConfig
+        target GraphNodeProvider
+}
+
+var (
+        _ GraphNodeProvider = (*graphNodeProxyProvider)(nil)
+)
+
+func (n *graphNodeProxyProvider) ProviderAddr() addrs.AbsProviderConfig {
+        return n.addr
 }
 
-func (n *graphNodeProxyProvider) ProviderName() string {
-        return n.Target().ProviderName()
+func (n *graphNodeProxyProvider) Path() addrs.ModuleInstance {
+        return n.addr.Module
 }
 
 func (n *graphNodeProxyProvider) Name() string {
-        return ResolveProviderName(n.nameValue, n.path)
+        return n.addr.String() + " (proxy)"
 }
 
 // find the concrete provider instance
@@ -415,26 +509,21 @@ type ProviderConfigTransformer struct {
         // record providers that can be overriden with a proxy
         proxiable map[string]bool
 
-        // Module is the module to add resources from.
-        Module *module.Tree
+        // Config is the root node of the configuration tree to add providers from.
+        Config *configs.Config
 }
 
 func (t *ProviderConfigTransformer) Transform(g *Graph) error {
-        // If no module is given, we don't do anything
-        if t.Module == nil {
+        // If no configuration is given, we don't do anything
+        if t.Config == nil {
                 return nil
         }
 
-        // If the module isn't loaded, that is simply an error
-        if !t.Module.Loaded() {
-                return errors.New("module must be loaded for ProviderConfigTransformer")
-        }
-
         t.providers = make(map[string]GraphNodeProvider)
         t.proxiable = make(map[string]bool)
 
         // Start the transformation process
-        if err := t.transform(g, t.Module); err != nil {
+        if err := t.transform(g, t.Config); err != nil {
                 return err
         }
 
@@ -442,95 +531,126 @@ func (t *ProviderConfigTransformer) Transform(g *Graph) error {
         return t.attachProviderConfigs(g)
 }
 
-func (t *ProviderConfigTransformer) transform(g *Graph, m *module.Tree) error {
+func (t *ProviderConfigTransformer) transform(g *Graph, c *configs.Config) error {
         // If no config, do nothing
-        if m == nil {
+        if c == nil {
                 return nil
         }
 
         // Add our resources
-        if err := t.transformSingle(g, m); err != nil {
+        if err := t.transformSingle(g, c); err != nil {
                 return err
         }
 
         // Transform all the children.
-        for _, c := range m.Children() {
-                if err := t.transform(g, c); err != nil {
+        for _, cc := range c.Children {
+                if err := t.transform(g, cc); err != nil {
                         return err
                 }
         }
         return nil
 }
 
-func (t *ProviderConfigTransformer) transformSingle(g *Graph, m *module.Tree) error {
-        log.Printf("[TRACE] ProviderConfigTransformer: Starting for path: %v", m.Path())
-
-        // Get the configuration for this module
-        conf := m.Config()
-
-        // Build the path we're at
-        path := m.Path()
-        if len(path) > 0 {
-                path = append([]string{RootModuleName}, path...)
+func (t *ProviderConfigTransformer) transformSingle(g *Graph, c *configs.Config) error {
+        // Get the module associated with this configuration tree node
+        mod := c.Module
+        staticPath := c.Path
+
+        // We actually need a dynamic module path here, but we've not yet updated
+        // our graph builders enough to support expansion of module calls with
+        // "count" and "for_each" set, so for now we'll shim this by converting to
+        // a dynamic path with no keys. At the time of writing this is the only
+        // possible kind of dynamic path anyway.
+        path := make(addrs.ModuleInstance, len(staticPath))
+        for i, name := range staticPath {
+                path[i] = addrs.ModuleInstanceStep{
+                        Name: name,
+                }
         }
 
         // add all providers from the configuration
-        for _, p := range conf.ProviderConfigs {
-                name := p.Name
-                if p.Alias != "" {
-                        name += "." + p.Alias
-                }
+        for _, p := range mod.ProviderConfigs {
+                relAddr := p.Addr()
+                addr := relAddr.Absolute(path)
 
-                v := t.Concrete(&NodeAbstractProvider{
-                        NameValue: name,
-                        PathValue: path,
-                })
+                abstract := &NodeAbstractProvider{
+                        Addr: addr,
+                }
+                var v dag.Vertex
+                if t.Concrete != nil {
+                        v = t.Concrete(abstract)
+                } else {
+                        v = abstract
+                }
 
                 // Add it to the graph
                 g.Add(v)
-                fullName := ResolveProviderName(name, path)
-                t.providers[fullName] = v.(GraphNodeProvider)
-                t.proxiable[fullName] = len(p.RawConfig.RawMap()) == 0
+                key := addr.String()
+                t.providers[key] = v.(GraphNodeProvider)
+
+                // A provider configuration is "proxyable" if its configuration is
+                // entirely empty. This means it's standing in for a provider
+                // configuration that must be passed in from the parent module.
+                // We decide this by evaluating the config with an empty schema;
+                // if this succeeds, then we know there's nothing in the body.
+                _, diags := p.Config.Content(&hcl.BodySchema{})
+                t.proxiable[key] = !diags.HasErrors()
         }
 
         // Now replace the provider nodes with proxy nodes if a provider was being
         // passed in, and create implicit proxies if there was no config. Any extra
         // proxies will be removed in the prune step.
-        return t.addProxyProviders(g, m)
+        return t.addProxyProviders(g, c)
 }
 
-func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree) error {
-        path := m.Path()
+func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, c *configs.Config) error {
+        path := c.Path
 
         // can't add proxies at the root
         if len(path) == 0 {
                 return nil
         }
 
-        parentPath := path[:len(path)-1]
-        parent := t.Module.Child(parentPath)
+        parentPath, callAddr := path.Call()
+        parent := c.Parent
         if parent == nil {
                 return nil
         }
 
-        var parentCfg *config.Module
-        for _, mod := range parent.Config().Modules {
-                if mod.Name == m.Name() {
+        callName := callAddr.Name
+        var parentCfg *configs.ModuleCall
+        for name, mod := range parent.Module.ModuleCalls {
+                if name == callName {
                         parentCfg = mod
                         break
                 }
         }
 
+        // We currently don't support count/for_each for modules and so we must
+        // shim our path and parentPath into module instances here so that the
+        // rest of Terraform can behave as if we do. This shimming should be
+        // removed later as part of implementing count/for_each for modules.
+        instPath := make(addrs.ModuleInstance, len(path))
+        for i, name := range path {
+                instPath[i] = addrs.ModuleInstanceStep{Name: name}
+        }
+        parentInstPath := make(addrs.ModuleInstance, len(parentPath))
+        for i, name := range parentPath {
+                parentInstPath[i] = addrs.ModuleInstanceStep{Name: name}
+        }
+
         if parentCfg == nil {
                 // this can't really happen during normal execution.
-                return fmt.Errorf("parent module config not found for %s", m.Name())
+                return fmt.Errorf("parent module config not found for %s", c.Path.String())
         }
 
         // Go through all the providers the parent is passing in, and add proxies to
         // the parent provider nodes.
-        for name, parentName := range parentCfg.Providers {
-                fullName := ResolveProviderName(name, path)
-                fullParentName := ResolveProviderName(parentName, parentPath)
+        for _, pair := range parentCfg.Providers {
+                fullAddr := pair.InChild.Addr().Absolute(instPath)
+                fullParentAddr := pair.InParent.Addr().Absolute(parentInstPath)
+                fullName := fullAddr.String()
+                fullParentName := fullParentAddr.String()
 
                 parentProvider := t.providers[fullParentName]
 
@@ -539,9 +659,8 @@ func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree)
                 }
 
                 proxy := &graphNodeProxyProvider{
-                        nameValue: name,
-                        path:      path,
-                        target:    parentProvider,
+                        addr:   fullAddr,
+                        target: parentProvider,
                 }
 
                 concreteProvider := t.providers[fullName]
@@ -553,8 +672,8 @@ func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree)
                         continue
                 }
 
-                // aliased providers can't be implicitly passed in
-                if strings.Contains(name, ".") {
+                // aliased configurations can't be implicitly passed in
+                if fullAddr.ProviderConfig.Alias != "" {
                         continue
                 }
 
@@ -575,27 +694,19 @@ func (t *ProviderConfigTransformer) attachProviderConfigs(g *Graph) error {
                 }
 
                 // Determine what we're looking for
-                path := normalizeModulePath(apn.Path())[1:]
-                name := apn.ProviderName()
-                log.Printf("[TRACE] Attach provider request: %#v %s", path, name)
+                addr := apn.ProviderAddr()
 
                 // Get the configuration.
-                tree := t.Module.Child(path)
-                if tree == nil {
+                mc := t.Config.DescendentForInstance(addr.Module)
+                if mc == nil {
+                        log.Printf("[TRACE] ProviderConfigTransformer: no configuration available for %s", addr.String())
                         continue
                 }
 
                 // Go through the provider configs to find the matching config
-                for _, p := range tree.Config().ProviderConfigs {
-                        // Build the name, which is "name.alias" if an alias exists
-                        current := p.Name
-                        if p.Alias != "" {
-                                current += "." + p.Alias
-                        }
-
-                        // If the configs match then attach!
-                        if current == name {
-                                log.Printf("[TRACE] Attaching provider config: %#v", p)
+                for _, p := range mc.Module.ProviderConfigs {
+                        if p.Name == addr.ProviderConfig.Type && p.Alias == addr.ProviderConfig.Alias {
+                                log.Printf("[TRACE] ProviderConfigTransformer: attaching to %q provider configuration from %s", dag.VertexName(v), p.DeclRange)
                                 apn.AttachProvider(p)
                                 break
                         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go
index f49d824..fe4cf0e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go
@@ -2,6 +2,9 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/dag"
@@ -22,8 +25,8 @@ type GraphNodeCloseProvisioner interface {
 }
 
 // GraphNodeProvisionerConsumer is an interface that nodes that require
-// a provisioner must implement. ProvisionedBy must return the name of the
-// provisioner to use.
+// a provisioner must implement. ProvisionedBy must return the names of the
+// provisioners to use.
 type GraphNodeProvisionerConsumer interface {
         ProvisionedBy() []string
 }
@@ -48,6 +51,7 @@ func (t *ProvisionerTransformer) Transform(g *Graph) error {
                                         continue
                                 }
 
+                                log.Printf("[TRACE] ProvisionerTransformer: %s is provisioned by %s (%q)", dag.VertexName(v), key, dag.VertexName(m[key]))
                                 g.Connect(dag.BasicEdge(v, m[key]))
                         }
                 }
@@ -83,12 +87,9 @@ func (t *MissingProvisionerTransformer) Transform(g *Graph) error {
 
                 // If this node has a subpath, then we use that as a prefix
                 // into our map to check for an existing provider.
-                var path []string
+                path := addrs.RootModuleInstance
                 if sp, ok := pv.(GraphNodeSubPath); ok {
-                        raw := normalizeModulePath(sp.Path())
-                        if len(raw) > len(rootModulePath) {
-                                path = raw
-                        }
+                        path = sp.Path()
                 }
 
                 for _, p := range pv.ProvisionedBy() {
@@ -101,7 +102,7 @@ func (t *MissingProvisionerTransformer) Transform(g *Graph) error {
                         }
 
                         if _, ok := supported[p]; !ok {
-                                // If we don't support the provisioner type, skip it.
+                                // If we don't support the provisioner type, we skip it.
                                 // Validation later will catch this as an error.
                                 continue
                         }
@@ -114,6 +115,7 @@ func (t *MissingProvisionerTransformer) Transform(g *Graph) error {
 
                         // Add the missing provisioner node to the graph
                         m[key] = g.Add(newV)
+                        log.Printf("[TRACE] MissingProviderTransformer: added implicit provisioner %s, first implied by %s", key, dag.VertexName(v))
                 }
         }
 
@@ -156,10 +158,7 @@ func (t *CloseProvisionerTransformer) Transform(g *Graph) error {
 func provisionerMapKey(k string, v dag.Vertex) string {
         pathPrefix := ""
         if sp, ok := v.(GraphNodeSubPath); ok {
-                raw := normalizeModulePath(sp.Path())
-                if len(raw) > len(rootModulePath) {
-                        pathPrefix = modulePrefixStr(raw) + "."
-                }
+                pathPrefix = sp.Path().String() + "."
         }
 
         return pathPrefix + k
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
index be8c7f9..23bc8cd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
@@ -3,8 +3,12 @@ package terraform
 import (
         "fmt"
         "log"
-        "strings"
 
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/dag"
 )
@@ -17,35 +21,46 @@ import (
 // be referenced and other methods of referencing may still be possible (such
 // as by path!)
 type GraphNodeReferenceable interface {
-        // ReferenceableName is the name by which this can be referenced.
-        // This can be either just the type, or include the field. Example:
-        // "aws_instance.bar" or "aws_instance.bar.id".
-        ReferenceableName() []string
+        GraphNodeSubPath
+
+        // ReferenceableAddrs returns a list of addresses through which this can be
+        // referenced.
+        ReferenceableAddrs() []addrs.Referenceable
 }
 
 // GraphNodeReferencer must be implemented by nodes that reference other
 // Terraform items and therefore depend on them.
 type GraphNodeReferencer interface {
-        // References are the list of things that this node references. This
-        // can include fields or just the type, just like GraphNodeReferenceable
-        // above.
-        References() []string
+        GraphNodeSubPath
+
+        // References returns a list of references made by this node, which
+        // include both a referenced address and source location information for
+        // the reference.
+        References() []*addrs.Reference
 }
 
-// GraphNodeReferenceGlobal is an interface that can optionally be
-// implemented. If ReferenceGlobal returns true, then the References()
-// and ReferenceableName() must be _fully qualified_ with "module.foo.bar"
-// etc.
+// GraphNodeReferenceOutside is an interface that can optionally be implemented.
+// A node that implements it can specify that its own referenceable addresses
+// and/or the addresses it references are in a different module than the
+// node itself.
+//
+// Any referenceable addresses returned by ReferenceableAddrs are interpreted
+// relative to the returned selfPath.
 //
-// This allows a node to reference and be referenced by a specific name
-// that may cross module boundaries. This can be very dangerous so use
-// this wisely.
+// Any references returned by References are interpreted relative to the
+// returned referencePath.
 //
-// The primary use case for this is module boundaries (variables coming in).
-type GraphNodeReferenceGlobal interface {
-        // Set to true to signal that references and name are fully
-        // qualified. See the above docs for more information.
-        ReferenceGlobal() bool
+// It is valid but not required for either of these paths to match what is
+// returned by method Path, though if both match the main Path then there
+// is no reason to implement this method.
+//
+// The primary use-case for this is the nodes representing module input
+// variables, since their expressions are resolved in terms of their calling
+// module, but they are still referenced from their own module.
+type GraphNodeReferenceOutside interface {
+        // ReferenceOutside returns a path in which any references from this node
+        // are resolved.
+        ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance)
 }
 
 // ReferenceTransformer is a GraphTransformer that connects all the
@@ -158,75 +173,91 @@ func (t *PruneUnusedValuesTransformer) Transform(g *Graph) error {
 // ReferenceMap is a structure that can be used to efficiently check
 // for references on a graph.
 type ReferenceMap struct {
-        // m is the mapping of referenceable name to list of verticies that
-        // implement that name. This is built on initialization.
-        references   map[string][]dag.Vertex
-        referencedBy map[string][]dag.Vertex
+        // vertices is a map from internal reference keys (as produced by the
+        // mapKey method) to one or more vertices that are identified by each key.
+        //
+        // A particular reference key might actually identify multiple vertices,
+        // e.g. in situations where one object is contained inside another.
+        vertices map[string][]dag.Vertex
+
+        // edges is a map whose keys are a subset of the internal reference keys
+        // from "vertices", and whose values are the nodes that refer to each
+        // key. The values in this map are the referrers, while values in
+        // "verticies" are the referents. The keys in both cases are referents.
+        edges map[string][]dag.Vertex
 }
 
-// References returns the list of vertices that this vertex
-// references along with any missing references.
-func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []string) {
+// References returns the set of vertices that the given vertex refers to,
+// and any referenced addresses that do not have corresponding vertices.
+func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []addrs.Referenceable) {
         rn, ok := v.(GraphNodeReferencer)
         if !ok {
                 return nil, nil
         }
+        if _, ok := v.(GraphNodeSubPath); !ok {
+                return nil, nil
+        }
 
         var matches []dag.Vertex
-        var missing []string
-        prefix := m.prefix(v)
-
-        for _, ns := range rn.References() {
-                found := false
-                for _, n := range strings.Split(ns, "/") {
-                        n = prefix + n
-                        parents, ok := m.references[n]
-                        if !ok {
-                                continue
+        var missing []addrs.Referenceable
+
+        for _, ref := range rn.References() {
+                subject := ref.Subject
+
+                key := m.referenceMapKey(v, subject)
+                if _, exists := m.vertices[key]; !exists {
+                        // If what we were looking for was a ResourceInstance then we
+                        // might be in a resource-oriented graph rather than an
+                        // instance-oriented graph, and so we'll see if we have the
+                        // resource itself instead.
+                        switch ri := subject.(type) {
+                        case addrs.ResourceInstance:
+                                subject = ri.ContainingResource()
+                        case addrs.ResourceInstancePhase:
+                                subject = ri.ContainingResource()
                         }
+                        key = m.referenceMapKey(v, subject)
+                }
 
-                        // Mark that we found a match
-                        found = true
-
-                        for _, p := range parents {
-                                // don't include self-references
-                                if p == v {
-                                        continue
-                                }
-                                matches = append(matches, p)
+                vertices := m.vertices[key]
+                for _, rv := range vertices {
+                        // don't include self-references
+                        if rv == v {
+                                continue
                         }
-
-                        break
+                        matches = append(matches, rv)
                 }
-
-                if !found {
-                        missing = append(missing, ns)
+                if len(vertices) == 0 {
+                        missing = append(missing, ref.Subject)
                 }
         }
 
         return matches, missing
 }
 
-// ReferencedBy returns the list of vertices that reference the
-// vertex passed in.
-func (m *ReferenceMap) ReferencedBy(v dag.Vertex) []dag.Vertex {
+// Referrers returns the set of vertices that refer to the given vertex.
+func (m *ReferenceMap) Referrers(v dag.Vertex) []dag.Vertex {
         rn, ok := v.(GraphNodeReferenceable)
         if !ok {
                 return nil
         }
+        sp, ok := v.(GraphNodeSubPath)
+        if !ok {
+                return nil
+        }
 
         var matches []dag.Vertex
-        prefix := m.prefix(v)
-        for _, n := range rn.ReferenceableName() {
-                n = prefix + n
-                children, ok := m.referencedBy[n]
+        for _, addr := range rn.ReferenceableAddrs() {
+                key := m.mapKey(sp.Path(), addr)
+                referrers, ok := m.edges[key]
                 if !ok {
                         continue
                 }
 
-                // Make sure this isn't a self reference, which isn't included
+                // If the referrer set includes our own given vertex then we skip,
+                // since we don't want to return self-references.
                 selfRef := false
-                for _, p := range children {
+                for _, p := range referrers {
                         if p == v {
                                 selfRef = true
                                 break
@@ -236,28 +267,77 @@ func (m *ReferenceMap) ReferencedBy(v dag.Vertex) []dag.Vertex {
                         continue
                 }
 
-                matches = append(matches, children...)
+                matches = append(matches, referrers...)
         }
 
         return matches
 }
 
-func (m *ReferenceMap) prefix(v dag.Vertex) string {
-        // If the node is stating it is already fully qualified then
-        // we don't have to create the prefix!
-        if gn, ok := v.(GraphNodeReferenceGlobal); ok && gn.ReferenceGlobal() {
-                return ""
+func (m *ReferenceMap) mapKey(path addrs.ModuleInstance, addr addrs.Referenceable) string {
+        return fmt.Sprintf("%s|%s", path.String(), addr.String())
+}
+
+// vertexReferenceablePath returns the path in which the given vertex can be
+// referenced. This is the path that its results from ReferenceableAddrs
+// are considered to be relative to.
+//
+// Only GraphNodeSubPath implementations can be referenced, so this method will
+// panic if the given vertex does not implement that interface.
+func (m *ReferenceMap) vertexReferenceablePath(v dag.Vertex) addrs.ModuleInstance {
+        sp, ok := v.(GraphNodeSubPath)
+        if !ok {
+                // Only nodes with paths can participate in a reference map.
+                panic(fmt.Errorf("vertexMapKey on vertex type %T which doesn't implement GraphNodeSubPath", sp))
         }
 
-        // Create the prefix based on the path
-        var prefix string
-        if pn, ok := v.(GraphNodeSubPath); ok {
-                if path := normalizeModulePath(pn.Path()); len(path) > 1 {
-                        prefix = modulePrefixStr(path) + "."
-                }
+        if outside, ok := v.(GraphNodeReferenceOutside); ok {
+                // Vertex is referenced from a different module than where it was
+                // declared.
+                path, _ := outside.ReferenceOutside()
+                return path
+        }
+
+        // Vertex is referenced from the same module as where it was declared.
+        return sp.Path()
+}
+
+// vertexReferencePath returns the path in which references _from_ the given
+// vertex must be interpreted.
+//
+// Only GraphNodeSubPath implementations can have references, so this method
+// will panic if the given vertex does not implement that interface.
+func vertexReferencePath(referrer dag.Vertex) addrs.ModuleInstance {
+        sp, ok := referrer.(GraphNodeSubPath)
+        if !ok {
+                // Only nodes with paths can participate in a reference map.
+                panic(fmt.Errorf("vertexReferencePath on vertex type %T which doesn't implement GraphNodeSubPath", sp))
+        }
+
+        var path addrs.ModuleInstance
+        if outside, ok := referrer.(GraphNodeReferenceOutside); ok {
+                // Vertex makes references to objects in a different module than where
+                // it was declared.
+                _, path = outside.ReferenceOutside()
+                return path
         }
 
-        return prefix
+        // Vertex makes references to objects in the same module as where it
+        // was declared.
+        return sp.Path()
+}
+
+// referenceMapKey produces keys for the "edges" map. "referrer" is the vertex
+// that the reference is from, and "addr" is the address of the object being
+// referenced.
+//
+// The result is an opaque string that includes both the address of the given
+// object and the address of the module instance that object belongs to.
+//
+// Only GraphNodeSubPath implementations can be referrers, so this method will
+// panic if the given vertex does not implement that interface.
+func (m *ReferenceMap) referenceMapKey(referrer dag.Vertex, addr addrs.Referenceable) string {
+        path := vertexReferencePath(referrer)
+        return m.mapKey(path, addr)
 }
 
 // NewReferenceMap is used to create a new reference map for the
@@ -266,83 +346,82 @@ func NewReferenceMap(vs []dag.Vertex) *ReferenceMap {
         var m ReferenceMap
 
         // Build the lookup table
-        refMap := make(map[string][]dag.Vertex)
+        vertices := make(map[string][]dag.Vertex)
         for _, v := range vs {
+                _, ok := v.(GraphNodeSubPath)
+                if !ok {
+                        // Only nodes with paths can participate in a reference map.
+                        continue
+                }
+
                 // We're only looking for referenceable nodes
                 rn, ok := v.(GraphNodeReferenceable)
                 if !ok {
                         continue
                 }
 
+                path := m.vertexReferenceablePath(v)
+
                 // Go through and cache them
-                prefix := m.prefix(v)
-                for _, n := range rn.ReferenceableName() {
-                        n = prefix + n
-                        refMap[n] = append(refMap[n], v)
+                for _, addr := range rn.ReferenceableAddrs() {
+                        key := m.mapKey(path, addr)
+                        vertices[key] = append(vertices[key], v)
                 }
 
-                // If there is a path, it is always referenceable by that. For
-                // example, if this is a referenceable thing at path []string{"foo"},
-                // then it can be referenced at "module.foo"
-                if pn, ok := v.(GraphNodeSubPath); ok {
-                        for _, p := range ReferenceModulePath(pn.Path()) {
-                                refMap[p] = append(refMap[p], v)
-                        }
+                // Any node can be referenced by the address of the module it belongs
+                // to or any of that module's ancestors.
+                for _, addr := range path.Ancestors()[1:] {
+                        // Can be referenced either as the specific call instance (with
+                        // an instance key) or as the bare module call itself (the "module"
+                        // block in the parent module that created the instance).
+                        callPath, call := addr.Call()
+                        callInstPath, callInst := addr.CallInstance()
+                        callKey := m.mapKey(callPath, call)
+                        callInstKey := m.mapKey(callInstPath, callInst)
+                        vertices[callKey] = append(vertices[callKey], v)
+                        vertices[callInstKey] = append(vertices[callInstKey], v)
                 }
         }
 
         // Build the lookup table for referenced by
-        refByMap := make(map[string][]dag.Vertex)
+        edges := make(map[string][]dag.Vertex)
         for _, v := range vs {
-                // We're only looking for referenceable nodes
+                _, ok := v.(GraphNodeSubPath)
+                if !ok {
+                        // Only nodes with paths can participate in a reference map.
+                        continue
+                }
+
                 rn, ok := v.(GraphNodeReferencer)
                 if !ok {
+                        // We're only looking for referenceable nodes
                         continue
                 }
 
                 // Go through and cache them
-                prefix := m.prefix(v)
-                for _, n := range rn.References() {
-                        n = prefix + n
-                        refByMap[n] = append(refByMap[n], v)
+                for _, ref := range rn.References() {
+                        if ref.Subject == nil {
+                                // Should never happen
+                                panic(fmt.Sprintf("%T.References returned reference with nil subject", rn))
+                        }
+                        key := m.referenceMapKey(v, ref.Subject)
+                        edges[key] = append(edges[key], v)
                 }
         }
 
-        m.references = refMap
-        m.referencedBy = refByMap
+        m.vertices = vertices
+        m.edges = edges
         return &m
 }
 
-// Returns the reference name for a module path. The path "foo" would return
-// "module.foo". If this is a deeply nested module, it will be every parent
-// as well. For example: ["foo", "bar"] would return both "module.foo" and
-// "module.foo.module.bar"
-func ReferenceModulePath(p []string) []string {
-        p = normalizeModulePath(p)
-        if len(p) == 1 {
-                // Root, no name
-                return nil
-        }
-
-        result := make([]string, 0, len(p)-1)
-        for i := len(p); i > 1; i-- {
-                result = append(result, modulePrefixStr(p[:i]))
-        }
-
-        return result
-}
-
 // ReferencesFromConfig returns the references that a configuration has
 // based on the interpolated variables in a configuration.
-func ReferencesFromConfig(c *config.RawConfig) []string {
-        var result []string
-        for _, v := range c.Variables {
-                if r := ReferenceFromInterpolatedVar(v); len(r) > 0 {
-                        result = append(result, r...)
-                }
+func ReferencesFromConfig(body hcl.Body, schema *configschema.Block) []*addrs.Reference {
+        if body == nil {
+                return nil
         }
-
-        return result
+        refs, _ := lang.ReferencesInBlock(body, schema)
+        return refs
 }
 
 // ReferenceFromInterpolatedVar returns the reference from this variable,
@@ -378,18 +457,31 @@ func ReferenceFromInterpolatedVar(v config.InterpolatedVariable) []string {
         }
 }
 
-func modulePrefixStr(p []string) string {
-        // strip "root"
-        if len(p) > 0 && p[0] == rootModulePath[0] {
-                p = p[1:]
-        }
-
-        parts := make([]string, 0, len(p)*2)
-        for _, p := range p {
-                parts = append(parts, "module", p)
+// appendResourceDestroyReferences identifies resource and resource instance
+// references in the given slice and appends to it the "destroy-phase"
+// equivalents of those references, returning the result.
+//
+// This can be used in the References implementation for a node which must also
+// depend on the destruction of anything it references.
+func appendResourceDestroyReferences(refs []*addrs.Reference) []*addrs.Reference {
+        given := refs
+        for _, ref := range given {
+                switch tr := ref.Subject.(type) {
+                case addrs.Resource:
+                        newRef := *ref // shallow copy
+                        newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                        refs = append(refs, &newRef)
+                case addrs.ResourceInstance:
+                        newRef := *ref // shallow copy
+                        newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                        refs = append(refs, &newRef)
+                }
         }
+        return refs
+}
 
-        return strings.Join(parts, ".")
+func modulePrefixStr(p addrs.ModuleInstance) string {
+        return p.String()
 }
 
 func modulePrefixList(result []string, prefix string) []string {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
index 2e05edb..ee71387 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
@@ -3,14 +3,15 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
 )
 
-// RemoveModuleTransformer implements GraphTransformer to add nodes indicating
+// RemovedModuleTransformer implements GraphTransformer to add nodes indicating
 // when a module was removed from the configuration.
 type RemovedModuleTransformer struct {
-        Module *module.Tree // root module
-        State  *State
+        Config *configs.Config // root node in the config tree
+        State  *states.State
 }
 
 func (t *RemovedModuleTransformer) Transform(g *Graph) error {
@@ -20,13 +21,13 @@ func (t *RemovedModuleTransformer) Transform(g *Graph) error {
         }
 
         for _, m := range t.State.Modules {
-                c := t.Module.Child(m.Path[1:])
-                if c != nil {
+                cc := t.Config.DescendentForInstance(m.Addr)
+                if cc != nil {
                         continue
                 }
 
-                log.Printf("[DEBUG] module %s no longer in config\n", modulePrefixStr(m.Path))
-                g.Add(&NodeModuleRemoved{PathValue: m.Path})
+                log.Printf("[DEBUG] %s is no longer in configuration\n", m.Addr)
+                g.Add(&NodeModuleRemoved{Addr: m.Addr})
         }
         return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
index e528b37..1123790 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
@@ -1,8 +1,8 @@
 package terraform
 
 import (
-        "fmt"
-
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -11,41 +11,44 @@ import (
 //
 // This assumes that the count is already interpolated.
 type ResourceCountTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+        Concrete ConcreteResourceInstanceNodeFunc
+        Schema   *configschema.Block
 
+        // Count is either the number of indexed instances to create, or -1 to
+        // indicate that count is not set at all and thus a no-key instance should
+        // be created.
         Count int
-        Addr  *ResourceAddress
+        Addr  addrs.AbsResource
 }
 
 func (t *ResourceCountTransformer) Transform(g *Graph) error {
-        // Don't allow the count to be negative
         if t.Count < 0 {
-                return fmt.Errorf("negative count: %d", t.Count)
+                // Negative count indicates that count is not set at all.
+                addr := t.Addr.Instance(addrs.NoKey)
+
+                abstract := NewNodeAbstractResourceInstance(addr)
+                abstract.Schema = t.Schema
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
+                }
+
+                g.Add(node)
+                return nil
         }
 
         // For each count, build and add the node
         for i := 0; i < t.Count; i++ {
-                // Set the index. If our count is 1 we special case it so that
-                // we handle the "resource.0" and "resource" boundary properly.
-                index := i
-                if t.Count == 1 {
-                        index = -1
-                }
+                key := addrs.IntKey(i)
+                addr := t.Addr.Instance(key)
 
-                // Build the resource address
-                addr := t.Addr.Copy()
-                addr.Index = index
-
-                // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{
-                        Addr: addr,
-                }
+                abstract := NewNodeAbstractResourceInstance(addr)
+                abstract.Schema = t.Schema
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
                 }
 
-                // Add it to the graph
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_state.go
index 471cd74..0b52347 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_state.go
@@ -1,10 +1,9 @@
 package terraform
 
 import (
-        "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // StateTransformer is a GraphTransformer that adds the elements of
@@ -13,53 +12,63 @@ import (
 // This transform is used for example by the DestroyPlanGraphBuilder to ensure
 // that only resources that are in the state are represented in the graph.
 type StateTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+        // ConcreteCurrent and ConcreteDeposed are used to specialize the abstract
+        // resource instance nodes that this transformer will create.
+        //
+        // If either of these is nil, the objects of that type will be skipped and
+        // not added to the graph at all. It doesn't make sense to use this
+        // transformer without setting at least one of these, since that would
+        // skip everything and thus be a no-op.
+        ConcreteCurrent ConcreteResourceInstanceNodeFunc
+        ConcreteDeposed ConcreteResourceInstanceDeposedNodeFunc
 
-        State *State
+        State *states.State
 }
 
 func (t *StateTransformer) Transform(g *Graph) error {
-        // If the state is nil or empty (nil is empty) then do nothing
-        if t.State.Empty() {
+        if !t.State.HasResources() {
+                log.Printf("[TRACE] StateTransformer: state is empty, so nothing to do")
                 return nil
         }
 
-        // Go through all the modules in the diff.
-        log.Printf("[TRACE] StateTransformer: starting")
-        var nodes []dag.Vertex
+        switch {
+        case t.ConcreteCurrent != nil && t.ConcreteDeposed != nil:
+                log.Printf("[TRACE] StateTransformer: creating nodes for both current and deposed instance objects")
+        case t.ConcreteCurrent != nil:
+                log.Printf("[TRACE] StateTransformer: creating nodes for current instance objects only")
+        case t.ConcreteDeposed != nil:
+                log.Printf("[TRACE] StateTransformer: creating nodes for deposed instance objects only")
+        default:
+                log.Printf("[TRACE] StateTransformer: pointless no-op call, creating no nodes at all")
+        }
+
         for _, ms := range t.State.Modules {
-                log.Printf("[TRACE] StateTransformer: Module: %v", ms.Path)
+                moduleAddr := ms.Addr
 
-                // Go through all the resources in this module.
-                for name, rs := range ms.Resources {
-                        log.Printf("[TRACE] StateTransformer: Resource %q: %#v", name, rs)
+                for _, rs := range ms.Resources {
+                        resourceAddr := rs.Addr.Absolute(moduleAddr)
 
-                        // Add the resource to the graph
-                        addr, err := parseResourceAddressInternal(name)
-                        if err != nil {
-                                panic(fmt.Sprintf(
-                                        "Error parsing internal name, this is a bug: %q", name))
-                        }
+                        for key, is := range rs.Instances {
+                                addr := resourceAddr.Instance(key)
 
-                        // Very important: add the module path for this resource to
-                        // the address. Remove "root" from it.
-                        addr.Path = ms.Path[1:]
+                                if obj := is.Current; obj != nil && t.ConcreteCurrent != nil {
+                                        abstract := NewNodeAbstractResourceInstance(addr)
+                                        node := t.ConcreteCurrent(abstract)
+                                        g.Add(node)
+                                        log.Printf("[TRACE] StateTransformer: added %T for %s current object", node, addr)
+                                }
 
-                        // Add the resource to the graph
-                        abstract := &NodeAbstractResource{Addr: addr}
-                        var node dag.Vertex = abstract
-                        if f := t.Concrete; f != nil {
-                                node = f(abstract)
+                                if t.ConcreteDeposed != nil {
+                                        for dk := range is.Deposed {
+                                                abstract := NewNodeAbstractResourceInstance(addr)
+                                                node := t.ConcreteDeposed(abstract, dk)
+                                                g.Add(node)
+                                                log.Printf("[TRACE] StateTransformer: added %T for %s deposed object %s", node, addr, dk)
+                                        }
+                                }
                         }
-
-                        nodes = append(nodes, node)
                 }
         }
 
-        // Add all the nodes to the graph
-        for _, n := range nodes {
-                g.Add(n)
-        }
-
         return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
index af6defe..d25274e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
@@ -3,6 +3,7 @@ package terraform
 import (
         "log"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -12,7 +13,7 @@ import (
 // provided will contain every target provided, and each implementing graph
 // node must filter this list to targets considered relevant.
 type GraphNodeTargetable interface {
-        SetTargets([]ResourceAddress)
+        SetTargets([]addrs.Targetable)
 }
 
 // GraphNodeTargetDownstream is an interface for graph nodes that need to
@@ -35,11 +36,7 @@ type GraphNodeTargetDownstream interface {
 // their dependencies.
 type TargetsTransformer struct {
         // List of targeted resource names specified by the user
-        Targets []string
-
-        // List of parsed targets, provided by callers like ResourceCountTransform
-        // that already have the targets parsed
-        ParsedTargets []ResourceAddress
+        Targets []addrs.Targetable
 
         // If set, the index portions of resource addresses will be ignored
         // for comparison. This is used when transforming a graph where
@@ -53,17 +50,8 @@ type TargetsTransformer struct {
 }
 
 func (t *TargetsTransformer) Transform(g *Graph) error {
-        if len(t.Targets) > 0 && len(t.ParsedTargets) == 0 {
-                addrs, err := t.parseTargetAddresses()
-                if err != nil {
-                        return err
-                }
-
-                t.ParsedTargets = addrs
-        }
-
-        if len(t.ParsedTargets) > 0 {
-                targetedNodes, err := t.selectTargetedNodes(g, t.ParsedTargets)
+        if len(t.Targets) > 0 {
+                targetedNodes, err := t.selectTargetedNodes(g, t.Targets)
                 if err != nil {
                         return err
                 }
@@ -88,24 +76,10 @@ func (t *TargetsTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *TargetsTransformer) parseTargetAddresses() ([]ResourceAddress, error) {
-        addrs := make([]ResourceAddress, len(t.Targets))
-        for i, target := range t.Targets {
-                ta, err := ParseResourceAddress(target)
-                if err != nil {
-                        return nil, err
-                }
-                addrs[i] = *ta
-        }
-
-        return addrs, nil
-}
-
-// Returns the list of targeted nodes. A targeted node is either addressed
-// directly, or is an Ancestor of a targeted node. Destroy mode keeps
-// Descendents instead of Ancestors.
-func (t *TargetsTransformer) selectTargetedNodes(
-        g *Graph, addrs []ResourceAddress) (*dag.Set, error) {
+// Returns a set of targeted nodes. A targeted node is either addressed
+// directly, address indirectly via its container, or it's a dependency of a
+// targeted node. Destroy mode keeps dependents instead of dependencies.
+func (t *TargetsTransformer) selectTargetedNodes(g *Graph, addrs []addrs.Targetable) (*dag.Set, error) {
         targetedNodes := new(dag.Set)
 
         vertices := g.Vertices()
@@ -154,6 +128,12 @@ func (t *TargetsTransformer) addDependencies(targetedNodes *dag.Set, g *Graph) (
                 vertices := queue
                 queue = nil // ready to append for next iteration if neccessary
                 for _, v := range vertices {
+                        // providers don't cause transitive dependencies, so don't target
+                        // downstream from them.
+                        if _, ok := v.(GraphNodeProvider); ok {
+                                continue
+                        }
+
                         dependers := g.UpEdges(v)
                         if dependers == nil {
                                 // indicates that there are no up edges for this node, so
@@ -240,21 +220,34 @@ func filterPartialOutputs(v interface{}, targetedNodes *dag.Set, g *Graph) bool
         return true
 }
 
-func (t *TargetsTransformer) nodeIsTarget(
-        v dag.Vertex, addrs []ResourceAddress) bool {
-        r, ok := v.(GraphNodeResource)
+func (t *TargetsTransformer) nodeIsTarget(v dag.Vertex, targets []addrs.Targetable) bool {
+        var vertexAddr addrs.Targetable
+        switch r := v.(type) {
+        case GraphNodeResourceInstance:
+                vertexAddr = r.ResourceInstanceAddr()
+        case GraphNodeResource:
+                vertexAddr = r.ResourceAddr()
+        default:
+                // Only resource and resource instance nodes can be targeted.
+                return false
+        }
+        _, ok := v.(GraphNodeResource)
         if !ok {
                 return false
         }
 
-        addr := r.ResourceAddr()
-        for _, targetAddr := range addrs {
+        for _, targetAddr := range targets {
                 if t.IgnoreIndices {
-                        // targetAddr is not a pointer, so we can safely mutate it without
-                        // interfering with references elsewhere.
-                        targetAddr.Index = -1
+                        // If we're ignoring indices then we'll convert any resource instance
+                        // addresses into resource addresses. We don't need to convert
+                        // vertexAddr because instance addresses are contained within
+                        // their associated resources, and so .TargetContains will take
+                        // care of this for us.
+                        if instance, isInstance := targetAddr.(addrs.AbsResourceInstance); isInstance {
+                                targetAddr = instance.ContainingResource()
+                        }
                 }
-                if targetAddr.Contains(addr) {
+                if targetAddr.TargetContains(vertexAddr) {
                         return true
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go b/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go
index b31e2c7..05daa51 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go
@@ -1,7 +1,8 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // RootVariableTransformer is a GraphTransformer that adds all the root
@@ -11,28 +12,27 @@ import (
 // graph since downstream things that depend on them must be able to
 // reach them.
 type RootVariableTransformer struct {
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *RootVariableTransformer) Transform(g *Graph) error {
-        // If no config, no variables
-        if t.Module == nil {
+        // We can have no variables if we have no config.
+        if t.Config == nil {
                 return nil
         }
 
-        // If we have no vars, we're done!
-        vars := t.Module.Config().Variables
-        if len(vars) == 0 {
-                return nil
-        }
+        // We're only considering root module variables here, since child
+        // module variables are handled by ModuleVariableTransformer.
+        vars := t.Config.Module.Variables
 
         // Add all variables here
         for _, v := range vars {
                 node := &NodeRootVariable{
+                        Addr: addrs.InputVariable{
+                                Name: v.Name,
+                        },
                         Config: v,
                 }
-
-                // Add it!
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_input.go b/vendor/github.com/hashicorp/terraform/terraform/ui_input.go
index 7c87459..f6790d9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_input.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_input.go
@@ -1,10 +1,12 @@
 package terraform
 
+import "context"
+
 // UIInput is the interface that must be implemented to ask for input
 // from this user. This should forward the request to wherever the user
 // inputs things to ask for values.
 type UIInput interface {
-        Input(*InputOpts) (string, error)
+        Input(context.Context, *InputOpts) (string, error)
 }
 
 // InputOpts are options for asking for input.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go b/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go
index e3a07ef..e2d9c38 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go
@@ -1,5 +1,7 @@
 package terraform
 
+import "context"
+
 // MockUIInput is an implementation of UIInput that can be used for tests.
 type MockUIInput struct {
         InputCalled       bool
@@ -10,7 +12,7 @@ type MockUIInput struct {
         InputFn           func(*InputOpts) (string, error)
 }
 
-func (i *MockUIInput) Input(opts *InputOpts) (string, error) {
+func (i *MockUIInput) Input(ctx context.Context, opts *InputOpts) (string, error) {
         i.InputCalled = true
         i.InputOpts = opts
         if i.InputFn != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go b/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go
index 2207d1d..b5d32b1 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go
@@ -1,6 +1,7 @@
 package terraform
 
 import (
+        "context"
         "fmt"
 )
 
@@ -12,8 +13,8 @@ type PrefixUIInput struct {
         UIInput     UIInput
 }
 
-func (i *PrefixUIInput) Input(opts *InputOpts) (string, error) {
+func (i *PrefixUIInput) Input(ctx context.Context, opts *InputOpts) (string, error) {
         opts.Id = fmt.Sprintf("%s.%s", i.IdPrefix, opts.Id)
         opts.Query = fmt.Sprintf("%s%s", i.QueryPrefix, opts.Query)
-        return i.UIInput.Input(opts)
+        return i.UIInput.Input(ctx, opts)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go
index 878a031..fff964f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go
@@ -1,15 +1,19 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/addrs"
+)
+
 // ProvisionerUIOutput is an implementation of UIOutput that calls a hook
 // for the output so that the hooks can handle it.
 type ProvisionerUIOutput struct {
-        Info  *InstanceInfo
-        Type  string
-        Hooks []Hook
+        InstanceAddr    addrs.AbsResourceInstance
+        ProvisionerType string
+        Hooks           []Hook
 }
 
 func (o *ProvisionerUIOutput) Output(msg string) {
         for _, h := range o.Hooks {
-                h.ProvisionOutput(o.Info, o.Type, msg)
+                h.ProvisionOutput(o.InstanceAddr, o.ProvisionerType, msg)
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/valuesourcetype_string.go b/vendor/github.com/hashicorp/terraform/terraform/valuesourcetype_string.go
new file mode 100644
index 0000000..627593d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/valuesourcetype_string.go
@@ -0,0 +1,59 @@
+// Code generated by "stringer -type ValueSourceType"; DO NOT EDIT.
+
+package terraform
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ValueFromUnknown-0]
+        _ = x[ValueFromConfig-67]
+        _ = x[ValueFromAutoFile-70]
+        _ = x[ValueFromNamedFile-78]
+        _ = x[ValueFromCLIArg-65]
+        _ = x[ValueFromEnvVar-69]
+        _ = x[ValueFromInput-73]
+        _ = x[ValueFromPlan-80]
+        _ = x[ValueFromCaller-83]
+}
+
+const (
+        _ValueSourceType_name_0 = "ValueFromUnknown"
+        _ValueSourceType_name_1 = "ValueFromCLIArg"
+        _ValueSourceType_name_2 = "ValueFromConfig"
+        _ValueSourceType_name_3 = "ValueFromEnvVarValueFromAutoFile"
+        _ValueSourceType_name_4 = "ValueFromInput"
+        _ValueSourceType_name_5 = "ValueFromNamedFile"
+        _ValueSourceType_name_6 = "ValueFromPlan"
+        _ValueSourceType_name_7 = "ValueFromCaller"
+)
+
+var (
+        _ValueSourceType_index_3 = [...]uint8{0, 15, 32}
+)
+
+func (i ValueSourceType) String() string {
+        switch {
+        case i == 0:
+                return _ValueSourceType_name_0
+        case i == 65:
+                return _ValueSourceType_name_1
+        case i == 67:
+                return _ValueSourceType_name_2
+        case 69 <= i && i <= 70:
+                i -= 69
+                return _ValueSourceType_name_3[_ValueSourceType_index_3[i]:_ValueSourceType_index_3[i+1]]
+        case i == 73:
+                return _ValueSourceType_name_4
+        case i == 78:
+                return _ValueSourceType_name_5
+        case i == 80:
+                return _ValueSourceType_name_6
+        case i == 83:
+                return _ValueSourceType_name_7
+        default:
+                return "ValueSourceType(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/variables.go b/vendor/github.com/hashicorp/terraform/terraform/variables.go
index 300f2ad..75531b2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/variables.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/variables.go
@@ -2,165 +2,312 @@ package terraform
 
 import (
         "fmt"
-        "os"
-        "strings"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/helper/hilmapstructure"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// InputValue represents a value for a variable in the root module, provided
+// as part of the definition of an operation.
+type InputValue struct {
+        Value      cty.Value
+        SourceType ValueSourceType
+
+        // SourceRange provides source location information for values whose
+        // SourceType is either ValueFromConfig or ValueFromFile. It is not
+        // populated for other source types, and so should not be used.
+        SourceRange tfdiags.SourceRange
+}
+
+// ValueSourceType describes what broad category of source location provided
+// a particular value.
+type ValueSourceType rune
+
+const (
+        // ValueFromUnknown is the zero value of ValueSourceType and is not valid.
+        ValueFromUnknown ValueSourceType = 0
+
+        // ValueFromConfig indicates that a value came from a .tf or .tf.json file,
+        // e.g. the default value defined for a variable.
+        ValueFromConfig ValueSourceType = 'C'
+
+        // ValueFromAutoFile indicates that a value came from a "values file", like
+        // a .tfvars file, that was implicitly loaded by naming convention.
+        ValueFromAutoFile ValueSourceType = 'F'
+
+        // ValueFromNamedFile indicates that a value came from a named "values file",
+        // like a .tfvars file, that was passed explicitly on the command line (e.g.
+        // -var-file=foo.tfvars).
+        ValueFromNamedFile ValueSourceType = 'N'
+
+        // ValueFromCLIArg indicates that the value was provided directly in
+        // a CLI argument. The name of this argument is not recorded and so it must
+        // be inferred from context.
+        ValueFromCLIArg ValueSourceType = 'A'
+
+        // ValueFromEnvVar indicates that the value was provided via an environment
+        // variable. The name of the variable is not recorded and so it must be
+        // inferred from context.
+        ValueFromEnvVar ValueSourceType = 'E'
+
+        // ValueFromInput indicates that the value was provided at an interactive
+        // input prompt.
+        ValueFromInput ValueSourceType = 'I'
+
+        // ValueFromPlan indicates that the value was retrieved from a stored plan.
+        ValueFromPlan ValueSourceType = 'P'
+
+        // ValueFromCaller indicates that the value was explicitly overridden by
+        // a caller to Context.SetVariable after the context was constructed.
+        ValueFromCaller ValueSourceType = 'S'
 )
 
-// Variables returns the fully loaded set of variables to use with
-// ContextOpts and NewContext, loading any additional variables from
-// the environment or any other sources.
+func (v *InputValue) GoString() string {
+        if (v.SourceRange != tfdiags.SourceRange{}) {
+                return fmt.Sprintf("&terraform.InputValue{Value: %#v, SourceType: %#v, SourceRange: %#v}", v.Value, v.SourceType, v.SourceRange)
+        } else {
+                return fmt.Sprintf("&terraform.InputValue{Value: %#v, SourceType: %#v}", v.Value, v.SourceType)
+        }
+}
+
+func (v ValueSourceType) GoString() string {
+        return fmt.Sprintf("terraform.%s", v)
+}
+
+//go:generate stringer -type ValueSourceType
+
+// InputValues is a map of InputValue instances.
+type InputValues map[string]*InputValue
+
+// InputValuesFromCaller turns the given map of naked values into an
+// InputValues that attributes each value to "a caller", using the source
+// type ValueFromCaller. This is primarily useful for testing purposes.
 //
-// The given module tree doesn't need to be loaded.
-func Variables(
-        m *module.Tree,
-        override map[string]interface{}) (map[string]interface{}, error) {
-        result := make(map[string]interface{})
-
-        // Variables are loaded in the following sequence. Each additional step
-        // will override conflicting variable keys from prior steps:
-        //
-        //   * Take default values from config
-        //   * Take values from TF_VAR_x env vars
-        //   * Take values specified in the "override" param which is usually
-        //     from -var, -var-file, etc.
-        //
-
-        // First load from the config
-        for _, v := range m.Config().Variables {
-                // If the var has no default, ignore
-                if v.Default == nil {
-                        continue
+// This should not be used as a general way to convert map[string]cty.Value
+// into InputValues, since in most real cases we want to set a suitable
+// other SourceType and possibly SourceRange value.
+func InputValuesFromCaller(vals map[string]cty.Value) InputValues {
+        ret := make(InputValues, len(vals))
+        for k, v := range vals {
+                ret[k] = &InputValue{
+                        Value:      v,
+                        SourceType: ValueFromCaller,
                 }
+        }
+        return ret
+}
 
-                // If the type isn't a string, we use it as-is since it is a rich type
-                if v.Type() != config.VariableTypeString {
-                        result[v.Name] = v.Default
-                        continue
+// Override merges the given value maps with the receiver, overriding any
+// conflicting keys so that the latest definition wins.
+func (vv InputValues) Override(others ...InputValues) InputValues {
+        // FIXME: This should check to see if any of the values are maps and
+        // merge them if so, in order to preserve the behavior from prior to
+        // Terraform 0.12.
+        ret := make(InputValues)
+        for k, v := range vv {
+                ret[k] = v
+        }
+        for _, other := range others {
+                for k, v := range other {
+                        ret[k] = v
                 }
+        }
+        return ret
+}
 
-                // v.Default has already been parsed as HCL but it may be an int type
-                switch typedDefault := v.Default.(type) {
-                case string:
-                        if typedDefault == "" {
-                                continue
-                        }
-                        result[v.Name] = typedDefault
-                case int, int64:
-                        result[v.Name] = fmt.Sprintf("%d", typedDefault)
-                case float32, float64:
-                        result[v.Name] = fmt.Sprintf("%f", typedDefault)
-                case bool:
-                        result[v.Name] = fmt.Sprintf("%t", typedDefault)
-                default:
-                        panic(fmt.Sprintf(
-                                "Unknown default var type: %T\n\n"+
-                                        "THIS IS A BUG. Please report it.",
-                                v.Default))
-                }
+// JustValues returns a map that just includes the values, discarding the
+// source information.
+func (vv InputValues) JustValues() map[string]cty.Value {
+        ret := make(map[string]cty.Value, len(vv))
+        for k, v := range vv {
+                ret[k] = v.Value
         }
+        return ret
+}
 
-        // Load from env vars
-        for _, v := range os.Environ() {
-                if !strings.HasPrefix(v, VarEnvPrefix) {
+// DefaultVariableValues returns an InputValues map representing the default
+// values specified for variables in the given configuration map.
+func DefaultVariableValues(configs map[string]*configs.Variable) InputValues {
+        ret := make(InputValues)
+        for k, c := range configs {
+                if c.Default == cty.NilVal {
                         continue
                 }
+                ret[k] = &InputValue{
+                        Value:       c.Default,
+                        SourceType:  ValueFromConfig,
+                        SourceRange: tfdiags.SourceRangeFromHCL(c.DeclRange),
+                }
+        }
+        return ret
+}
 
-                // Strip off the prefix and get the value after the first "="
-                idx := strings.Index(v, "=")
-                k := v[len(VarEnvPrefix):idx]
-                v = v[idx+1:]
-
-                // Override the configuration-default values. Note that *not* finding the variable
-                // in configuration is OK, as we don't want to preclude people from having multiple
-                // sets of TF_VAR_whatever in their environment even if it is a little weird.
-                for _, schema := range m.Config().Variables {
-                        if schema.Name != k {
-                                continue
-                        }
-
-                        varType := schema.Type()
-                        varVal, err := parseVariableAsHCL(k, v, varType)
-                        if err != nil {
-                                return nil, err
-                        }
+// SameValues returns true if the given InputValues has the same values as
+// the receiever, disregarding the source types and source ranges.
+//
+// Values are compared using the cty "RawEquals" method, which means that
+// unknown values can be considered equal to one another if they are of the
+// same type.
+func (vv InputValues) SameValues(other InputValues) bool {
+        if len(vv) != len(other) {
+                return false
+        }
 
-                        switch varType {
-                        case config.VariableTypeMap:
-                                if err := varSetMap(result, k, varVal); err != nil {
-                                        return nil, err
-                                }
-                        default:
-                                result[k] = varVal
-                        }
+        for k, v := range vv {
+                ov, exists := other[k]
+                if !exists {
+                        return false
+                }
+                if !v.Value.RawEquals(ov.Value) {
+                        return false
                 }
         }
 
-        // Load from overrides
-        for k, v := range override {
-                for _, schema := range m.Config().Variables {
-                        if schema.Name != k {
-                                continue
-                        }
+        return true
+}
 
-                        switch schema.Type() {
-                        case config.VariableTypeList:
-                                result[k] = v
-                        case config.VariableTypeMap:
-                                if err := varSetMap(result, k, v); err != nil {
-                                        return nil, err
-                                }
-                        case config.VariableTypeString:
-                                // Convert to a string and set. We don't catch any errors
-                                // here because the validation step later should catch
-                                // any type errors.
-                                var strVal string
-                                if err := hilmapstructure.WeakDecode(v, &strVal); err == nil {
-                                        result[k] = strVal
-                                } else {
-                                        result[k] = v
-                                }
-                        default:
-                                panic(fmt.Sprintf(
-                                        "Unhandled var type: %T\n\n"+
-                                                "THIS IS A BUG. Please report it.",
-                                        schema.Type()))
-                        }
+// HasValues returns true if the reciever has the same values as in the given
+// map, disregarding the source types and source ranges.
+//
+// Values are compared using the cty "RawEquals" method, which means that
+// unknown values can be considered equal to one another if they are of the
+// same type.
+func (vv InputValues) HasValues(vals map[string]cty.Value) bool {
+        if len(vv) != len(vals) {
+                return false
+        }
+
+        for k, v := range vv {
+                oVal, exists := vals[k]
+                if !exists {
+                        return false
+                }
+                if !v.Value.RawEquals(oVal) {
+                        return false
                 }
         }
 
-        return result, nil
+        return true
 }
 
-// varSetMap sets or merges the map in "v" with the key "k" in the
-// "current" set of variables. This is just a private function to remove
-// duplicate logic in Variables
-func varSetMap(current map[string]interface{}, k string, v interface{}) error {
-        existing, ok := current[k]
-        if !ok {
-                current[k] = v
-                return nil
+// Identical returns true if the given InputValues has the same values,
+// source types, and source ranges as the receiver.
+//
+// Values are compared using the cty "RawEquals" method, which means that
+// unknown values can be considered equal to one another if they are of the
+// same type.
+//
+// This method is primarily for testing. For most practical purposes, it's
+// better to use SameValues or HasValues.
+func (vv InputValues) Identical(other InputValues) bool {
+        if len(vv) != len(other) {
+                return false
         }
 
-        existingMap, ok := existing.(map[string]interface{})
-        if !ok {
-                panic(fmt.Sprintf("%q is not a map, this is a bug in Terraform.", k))
+        for k, v := range vv {
+                ov, exists := other[k]
+                if !exists {
+                        return false
+                }
+                if !v.Value.RawEquals(ov.Value) {
+                        return false
+                }
+                if v.SourceType != ov.SourceType {
+                        return false
+                }
+                if v.SourceRange != ov.SourceRange {
+                        return false
+                }
         }
 
-        switch typedV := v.(type) {
-        case []map[string]interface{}:
-                for newKey, newVal := range typedV[0] {
-                        existingMap[newKey] = newVal
+        return true
+}
+
+// checkInputVariables ensures that variable values supplied at the UI conform
+// to their corresponding declarations in configuration.
+//
+// The set of values is considered valid only if the returned diagnostics
+// does not contain errors. A valid set of values may still produce warnings,
+// which should be returned to the user.
+func checkInputVariables(vcs map[string]*configs.Variable, vs InputValues) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        for name, vc := range vcs {
+                val, isSet := vs[name]
+                if !isSet {
+                        // Always an error, since the caller should already have included
+                        // default values from the configuration in the values map.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Unassigned variable",
+                                fmt.Sprintf("The input variable %q has not been assigned a value. This is a bug in Terraform; please report it in a GitHub issue.", name),
+                        ))
+                        continue
                 }
-        case map[string]interface{}:
-                for newKey, newVal := range typedV {
-                        existingMap[newKey] = newVal
+
+                wantType := vc.Type
+
+                // A given value is valid if it can convert to the desired type.
+                _, err := convert.Convert(val.Value, wantType)
+                if err != nil {
+                        switch val.SourceType {
+                        case ValueFromConfig, ValueFromAutoFile, ValueFromNamedFile:
+                                // We have source location information for these.
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid value for input variable",
+                                        Detail:   fmt.Sprintf("The given value is not valid for variable %q: %s.", name, err),
+                                        Subject:  val.SourceRange.ToHCL().Ptr(),
+                                })
+                        case ValueFromEnvVar:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The environment variable TF_VAR_%s does not contain a valid value for variable %q: %s.", name, name, err),
+                                ))
+                        case ValueFromCLIArg:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The argument -var=\"%s=...\" does not contain a valid value for variable %q: %s.", name, name, err),
+                                ))
+                        case ValueFromInput:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The value entered for variable %q is not valid: %s.", name, err),
+                                ))
+                        default:
+                                // The above gets us good coverage for the situations users
+                                // are likely to encounter with their own inputs. The other
+                                // cases are generally implementation bugs, so we'll just
+                                // use a generic error for these.
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The value provided for variable %q is not valid: %s.", name, err),
+                                ))
+                        }
                 }
-        default:
-                return fmt.Errorf("variable %q should be type map, got %s", k, hclTypeName(v))
         }
-        return nil
+
+        // Check for any variables that are assigned without being configured.
+        // This is always an implementation error in the caller, because we
+        // expect undefined variables to be caught during context construction
+        // where there is better context to report it well.
+        for name := range vs {
+                if _, defined := vcs[name]; !defined {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Value assigned to undeclared variable",
+                                fmt.Sprintf("A value was assigned to an undeclared input variable %q.", name),
+                        ))
+                }
+        }
+
+        return diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/version_required.go b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
index 1f43045..61423c2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/version_required.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
@@ -3,69 +3,60 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/go-version"
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/configs"
 
         tfversion "github.com/hashicorp/terraform/version"
 )
 
-// CheckRequiredVersion verifies that any version requirements specified by
-// the configuration are met.
-//
-// This checks the root module as well as any additional version requirements
-// from child modules.
+// CheckCoreVersionRequirements visits each of the modules in the given
+// configuration tree and verifies that any given Core version constraints
+// match with the version of Terraform Core that is being used.
 //
-// This is tested in context_test.go.
-func CheckRequiredVersion(m *module.Tree) error {
-        // Check any children
-        for _, c := range m.Children() {
-                if err := CheckRequiredVersion(c); err != nil {
-                        return err
-                }
-        }
-
-        var tf *config.Terraform
-        if c := m.Config(); c != nil {
-                tf = c.Terraform
-        }
-
-        // If there is no Terraform config or the required version isn't set,
-        // we move on.
-        if tf == nil || tf.RequiredVersion == "" {
+// The returned diagnostics will contain errors if any constraints do not match.
+// The returned diagnostics might also return warnings, which should be
+// displayed to the user.
+func CheckCoreVersionRequirements(config *configs.Config) tfdiags.Diagnostics {
+        if config == nil {
                 return nil
         }
 
-        // Path for errors
-        module := "root"
-        if path := normalizeModulePath(m.Path()); len(path) > 1 {
-                module = modulePrefixStr(path)
-        }
-
-        // Check this version requirement of this module
-        cs, err := version.NewConstraint(tf.RequiredVersion)
-        if err != nil {
-                return fmt.Errorf(
-                        "%s: terraform.required_version %q syntax error: %s",
-                        module,
-                        tf.RequiredVersion, err)
+        var diags tfdiags.Diagnostics
+        module := config.Module
+
+        for _, constraint := range module.CoreVersionConstraints {
+                if !constraint.Required.Check(tfversion.SemVer) {
+                        switch {
+                        case len(config.Path) == 0:
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unsupported Terraform Core version",
+                                        Detail: fmt.Sprintf(
+                                                "This configuration does not support Terraform version %s. To proceed, either choose another supported Terraform version or update this version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                                tfversion.String(),
+                                        ),
+                                        Subject: &constraint.DeclRange,
+                                })
+                        default:
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unsupported Terraform Core version",
+                                        Detail: fmt.Sprintf(
+                                                "Module %s (from %s) does not support Terraform version %s. To proceed, either choose another supported Terraform version or update this version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                                config.Path, config.SourceAddr, tfversion.String(),
+                                        ),
+                                        Subject: &constraint.DeclRange,
+                                })
+                        }
+                }
         }
 
-        if !cs.Check(tfversion.SemVer) {
-                return fmt.Errorf(
-                        "The currently running version of Terraform doesn't meet the\n"+
-                                "version requirements explicitly specified by the configuration.\n"+
-                                "Please use the required version or update the configuration.\n"+
-                                "Note that version requirements are usually set for a reason, so\n"+
-                                "we recommend verifying with whoever set the version requirements\n"+
-                                "prior to making any manual changes.\n\n"+
-                                "  Module: %s\n"+
-                                "  Required version: %s\n"+
-                                "  Current version: %s",
-                        module,
-                        tf.RequiredVersion,
-                        tfversion.SemVer)
+        for _, c := range config.Children {
+                childDiags := CheckCoreVersionRequirements(c)
+                diags = diags.Append(childDiags)
         }
 
-        return nil
+        return diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
index 4cfc528..0666aa5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
@@ -4,9 +4,24 @@ package terraform
 
 import "strconv"
 
-const _walkOperation_name = "walkInvalidwalkInputwalkApplywalkPlanwalkPlanDestroywalkRefreshwalkValidatewalkDestroywalkImport"
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[walkInvalid-0]
+        _ = x[walkApply-1]
+        _ = x[walkPlan-2]
+        _ = x[walkPlanDestroy-3]
+        _ = x[walkRefresh-4]
+        _ = x[walkValidate-5]
+        _ = x[walkDestroy-6]
+        _ = x[walkImport-7]
+        _ = x[walkEval-8]
+}
+
+const _walkOperation_name = "walkInvalidwalkApplywalkPlanwalkPlanDestroywalkRefreshwalkValidatewalkDestroywalkImportwalkEval"
 
-var _walkOperation_index = [...]uint8{0, 11, 20, 29, 37, 52, 63, 75, 86, 96}
+var _walkOperation_index = [...]uint8{0, 11, 20, 28, 43, 54, 66, 77, 87, 95}
 
 func (i walkOperation) String() string {
         if i >= walkOperation(len(_walkOperation_index)-1) {
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/config_traversals.go b/vendor/github.com/hashicorp/terraform/tfdiags/config_traversals.go
new file mode 100644
index 0000000..8e41f46
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/config_traversals.go
@@ -0,0 +1,68 @@
+package tfdiags
+
+import (
+        "bytes"
+        "fmt"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// FormatCtyPath is a helper function to produce a user-friendly string
+// representation of a cty.Path. The result uses a syntax similar to the
+// HCL expression language in the hope of it being familiar to users.
+func FormatCtyPath(path cty.Path) string {
+        var buf bytes.Buffer
+        for _, step := range path {
+                switch ts := step.(type) {
+                case cty.GetAttrStep:
+                        fmt.Fprintf(&buf, ".%s", ts.Name)
+                case cty.IndexStep:
+                        buf.WriteByte('[')
+                        key := ts.Key
+                        keyTy := key.Type()
+                        switch {
+                        case key.IsNull():
+                                buf.WriteString("null")
+                        case !key.IsKnown():
+                                buf.WriteString("(not yet known)")
+                        case keyTy == cty.Number:
+                                bf := key.AsBigFloat()
+                                buf.WriteString(bf.Text('g', -1))
+                        case keyTy == cty.String:
+                                buf.WriteString(strconv.Quote(key.AsString()))
+                        default:
+                                buf.WriteString("...")
+                        }
+                        buf.WriteByte(']')
+                }
+        }
+        return buf.String()
+}
+
+// FormatError is a helper function to produce a user-friendly string
+// representation of certain special error types that we might want to
+// include in diagnostic messages.
+//
+// This currently has special behavior only for cty.PathError, where a
+// non-empty path is rendered in a HCL-like syntax as context.
+func FormatError(err error) string {
+        perr, ok := err.(cty.PathError)
+        if !ok || len(perr.Path) == 0 {
+                return err.Error()
+        }
+
+        return fmt.Sprintf("%s: %s", FormatCtyPath(perr.Path), perr.Error())
+}
+
+// FormatErrorPrefixed is like FormatError except that it presents any path
+// information after the given prefix string, which is assumed to contain
+// an HCL syntax representation of the value that errors are relative to.
+func FormatErrorPrefixed(err error, prefix string) string {
+        perr, ok := err.(cty.PathError)
+        if !ok || len(perr.Path) == 0 {
+                return fmt.Sprintf("%s: %s", prefix, err.Error())
+        }
+
+        return fmt.Sprintf("%s%s: %s", prefix, FormatCtyPath(perr.Path), perr.Error())
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/contextual.go b/vendor/github.com/hashicorp/terraform/tfdiags/contextual.go
new file mode 100644
index 0000000..25b2140
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/contextual.go
@@ -0,0 +1,372 @@
+package tfdiags
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// The "contextual" family of diagnostics are designed to allow separating
+// the detection of a problem from placing that problem in context. For
+// example, some code that is validating an object extracted from configuration
+// may not have access to the configuration that generated it, but can still
+// report problems within that object which the caller can then place in
+// context by calling IsConfigBody on the returned diagnostics.
+//
+// When contextual diagnostics are used, the documentation for a method must
+// be very explicit about what context is implied for any diagnostics returned,
+// to help ensure the expected result.
+
+// contextualFromConfig is an interface type implemented by diagnostic types
+// that can elaborate themselves when given information about the configuration
+// body they are embedded in.
+//
+// Usually this entails extracting source location information in order to
+// populate the "Subject" range.
+type contextualFromConfigBody interface {
+        ElaborateFromConfigBody(hcl.Body) Diagnostic
+}
+
+// InConfigBody returns a copy of the receiver with any config-contextual
+// diagnostics elaborated in the context of the given body.
+func (d Diagnostics) InConfigBody(body hcl.Body) Diagnostics {
+        if len(d) == 0 {
+                return nil
+        }
+
+        ret := make(Diagnostics, len(d))
+        for i, srcDiag := range d {
+                if cd, isCD := srcDiag.(contextualFromConfigBody); isCD {
+                        ret[i] = cd.ElaborateFromConfigBody(body)
+                } else {
+                        ret[i] = srcDiag
+                }
+        }
+
+        return ret
+}
+
+// AttributeValue returns a diagnostic about an attribute value in an implied current
+// configuration context. This should be returned only from functions whose
+// interface specifies a clear configuration context that this will be
+// resolved in.
+//
+// The given path is relative to the implied configuration context. To describe
+// a top-level attribute, it should be a single-element cty.Path with a
+// cty.GetAttrStep. It's assumed that the path is returning into a structure
+// that would be produced by our conventions in the configschema package; it
+// may return unexpected results for structures that can't be represented by
+// configschema.
+//
+// Since mapping attribute paths back onto configuration is an imprecise
+// operation (e.g. dynamic block generation may cause the same block to be
+// evaluated multiple times) the diagnostic detail should include the attribute
+// name and other context required to help the user understand what is being
+// referenced in case the identified source range is not unique.
+//
+// The returned attribute will not have source location information until
+// context is applied to the containing diagnostics using diags.InConfigBody.
+// After context is applied, the source location is the value assigned to the
+// named attribute, or the containing body's "missing item range" if no
+// value is present.
+func AttributeValue(severity Severity, summary, detail string, attrPath cty.Path) Diagnostic {
+        return &attributeDiagnostic{
+                diagnosticBase: diagnosticBase{
+                        severity: severity,
+                        summary:  summary,
+                        detail:   detail,
+                },
+                attrPath: attrPath,
+        }
+}
+
+// GetAttribute extracts an attribute cty.Path from a diagnostic if it contains
+// one. Normally this is not accessed directly, and instead the config body is
+// added to the Diagnostic to create a more complete message for the user. In
+// some cases however, we may want to know just the name of the attribute that
+// generated the Diagnostic message.
+// This returns a nil cty.Path if it does not exist in the Diagnostic.
+func GetAttribute(d Diagnostic) cty.Path {
+        if d, ok := d.(*attributeDiagnostic); ok {
+                return d.attrPath
+        }
+        return nil
+}
+
+type attributeDiagnostic struct {
+        diagnosticBase
+        attrPath cty.Path
+        subject  *SourceRange // populated only after ElaborateFromConfigBody
+}
+
+// ElaborateFromConfigBody finds the most accurate possible source location
+// for a diagnostic's attribute path within the given body.
+//
+// Backing out from a path back to a source location is not always entirely
+// possible because we lose some information in the decoding process, so
+// if an exact position cannot be found then the returned diagnostic will
+// refer to a position somewhere within the containing body, which is assumed
+// to be better than no location at all.
+//
+// If possible it is generally better to report an error at a layer where
+// source location information is still available, for more accuracy. This
+// is not always possible due to system architecture, so this serves as a
+// "best effort" fallback behavior for such situations.
+func (d *attributeDiagnostic) ElaborateFromConfigBody(body hcl.Body) Diagnostic {
+        if len(d.attrPath) < 1 {
+                // Should never happen, but we'll allow it rather than crashing.
+                return d
+        }
+
+        if d.subject != nil {
+                // Don't modify an already-elaborated diagnostic.
+                return d
+        }
+
+        ret := *d
+
+        // This function will often end up re-decoding values that were already
+        // decoded by an earlier step. This is non-ideal but is architecturally
+        // more convenient than arranging for source location information to be
+        // propagated to every place in Terraform, and this happens only in the
+        // presence of errors where performance isn't a concern.
+
+        traverse := d.attrPath[:]
+        final := d.attrPath[len(d.attrPath)-1]
+
+        // Index should never be the first step
+        // as indexing of top blocks (such as resources & data sources)
+        // is handled elsewhere
+        if _, isIdxStep := traverse[0].(cty.IndexStep); isIdxStep {
+                subject := SourceRangeFromHCL(body.MissingItemRange())
+                ret.subject = &subject
+                return &ret
+        }
+
+        // Process index separately
+        idxStep, hasIdx := final.(cty.IndexStep)
+        if hasIdx {
+                final = d.attrPath[len(d.attrPath)-2]
+                traverse = d.attrPath[:len(d.attrPath)-1]
+        }
+
+        // If we have more than one step after removing index
+        // then we'll first try to traverse to a child body
+        // corresponding to the requested path.
+        if len(traverse) > 1 {
+                body = traversePathSteps(traverse, body)
+        }
+
+        // Default is to indicate a missing item in the deepest body we reached
+        // while traversing.
+        subject := SourceRangeFromHCL(body.MissingItemRange())
+        ret.subject = &subject
+
+        // Once we get here, "final" should be a GetAttr step that maps to an
+        // attribute in our current body.
+        finalStep, isAttr := final.(cty.GetAttrStep)
+        if !isAttr {
+                return &ret
+        }
+
+        content, _, contentDiags := body.PartialContent(&hcl.BodySchema{
+                Attributes: []hcl.AttributeSchema{
+                        {
+                                Name:     finalStep.Name,
+                                Required: true,
+                        },
+                },
+        })
+        if contentDiags.HasErrors() {
+                return &ret
+        }
+
+        if attr, ok := content.Attributes[finalStep.Name]; ok {
+                hclRange := attr.Expr.Range()
+                if hasIdx {
+                        // Try to be more precise by finding index range
+                        hclRange = hclRangeFromIndexStepAndAttribute(idxStep, attr)
+                }
+                subject = SourceRangeFromHCL(hclRange)
+                ret.subject = &subject
+        }
+
+        return &ret
+}
+
+func traversePathSteps(traverse []cty.PathStep, body hcl.Body) hcl.Body {
+        for i := 0; i < len(traverse); i++ {
+                step := traverse[i]
+
+                switch tStep := step.(type) {
+                case cty.GetAttrStep:
+
+                        var next cty.PathStep
+                        if i < (len(traverse) - 1) {
+                                next = traverse[i+1]
+                        }
+
+                        // Will be indexing into our result here?
+                        var indexType cty.Type
+                        var indexVal cty.Value
+                        if nextIndex, ok := next.(cty.IndexStep); ok {
+                                indexVal = nextIndex.Key
+                                indexType = indexVal.Type()
+                                i++ // skip over the index on subsequent iterations
+                        }
+
+                        var blockLabelNames []string
+                        if indexType == cty.String {
+                                // Map traversal means we expect one label for the key.
+                                blockLabelNames = []string{"key"}
+                        }
+
+                        // For intermediate steps we expect to be referring to a child
+                        // block, so we'll attempt decoding under that assumption.
+                        content, _, contentDiags := body.PartialContent(&hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type:       tStep.Name,
+                                                LabelNames: blockLabelNames,
+                                        },
+                                },
+                        })
+                        if contentDiags.HasErrors() {
+                                return body
+                        }
+                        filtered := make([]*hcl.Block, 0, len(content.Blocks))
+                        for _, block := range content.Blocks {
+                                if block.Type == tStep.Name {
+                                        filtered = append(filtered, block)
+                                }
+                        }
+                        if len(filtered) == 0 {
+                                // Step doesn't refer to a block
+                                continue
+                        }
+
+                        switch indexType {
+                        case cty.NilType: // no index at all
+                                if len(filtered) != 1 {
+                                        return body
+                                }
+                                body = filtered[0].Body
+                        case cty.Number:
+                                var idx int
+                                err := gocty.FromCtyValue(indexVal, &idx)
+                                if err != nil || idx >= len(filtered) {
+                                        return body
+                                }
+                                body = filtered[idx].Body
+                        case cty.String:
+                                key := indexVal.AsString()
+                                var block *hcl.Block
+                                for _, candidate := range filtered {
+                                        if candidate.Labels[0] == key {
+                                                block = candidate
+                                                break
+                                        }
+                                }
+                                if block == nil {
+                                        // No block with this key, so we'll just indicate a
+                                        // missing item in the containing block.
+                                        return body
+                                }
+                                body = block.Body
+                        default:
+                                // Should never happen, because only string and numeric indices
+                                // are supported by cty collections.
+                                return body
+                        }
+
+                default:
+                        // For any other kind of step, we'll just return our current body
+                        // as the subject and accept that this is a little inaccurate.
+                        return body
+                }
+        }
+        return body
+}
+
+func hclRangeFromIndexStepAndAttribute(idxStep cty.IndexStep, attr *hcl.Attribute) hcl.Range {
+        switch idxStep.Key.Type() {
+        case cty.Number:
+                var idx int
+                err := gocty.FromCtyValue(idxStep.Key, &idx)
+                items, diags := hcl.ExprList(attr.Expr)
+                if diags.HasErrors() {
+                        return attr.Expr.Range()
+                }
+                if err != nil || idx >= len(items) {
+                        return attr.NameRange
+                }
+                return items[idx].Range()
+        case cty.String:
+                pairs, diags := hcl.ExprMap(attr.Expr)
+                if diags.HasErrors() {
+                        return attr.Expr.Range()
+                }
+                stepKey := idxStep.Key.AsString()
+                for _, kvPair := range pairs {
+                        key, err := kvPair.Key.Value(nil)
+                        if err != nil {
+                                return attr.Expr.Range()
+                        }
+                        if key.AsString() == stepKey {
+                                startRng := kvPair.Value.StartRange()
+                                return startRng
+                        }
+                }
+                return attr.NameRange
+        }
+        return attr.Expr.Range()
+}
+
+func (d *attributeDiagnostic) Source() Source {
+        return Source{
+                Subject: d.subject,
+        }
+}
+
+// WholeContainingBody returns a diagnostic about the body that is an implied
+// current configuration context. This should be returned only from
+// functions whose interface specifies a clear configuration context that this
+// will be resolved in.
+//
+// The returned attribute will not have source location information until
+// context is applied to the containing diagnostics using diags.InConfigBody.
+// After context is applied, the source location is currently the missing item
+// range of the body. In future, this may change to some other suitable
+// part of the containing body.
+func WholeContainingBody(severity Severity, summary, detail string) Diagnostic {
+        return &wholeBodyDiagnostic{
+                diagnosticBase: diagnosticBase{
+                        severity: severity,
+                        summary:  summary,
+                        detail:   detail,
+                },
+        }
+}
+
+type wholeBodyDiagnostic struct {
+        diagnosticBase
+        subject *SourceRange // populated only after ElaborateFromConfigBody
+}
+
+func (d *wholeBodyDiagnostic) ElaborateFromConfigBody(body hcl.Body) Diagnostic {
+        if d.subject != nil {
+                // Don't modify an already-elaborated diagnostic.
+                return d
+        }
+
+        ret := *d
+        rng := SourceRangeFromHCL(body.MissingItemRange())
+        ret.subject = &rng
+        return &ret
+}
+
+func (d *wholeBodyDiagnostic) Source() Source {
+        return Source{
+                Subject: d.subject,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
index 2c23f76..c91ba9a 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
@@ -1,9 +1,18 @@
 package tfdiags
 
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
 type Diagnostic interface {
         Severity() Severity
         Description() Description
         Source() Source
+
+        // FromExpr returns the expression-related context for the diagnostic, if
+        // available. Returns nil if the diagnostic is not related to an
+        // expression evaluation.
+        FromExpr() *FromExpr
 }
 
 type Severity rune
@@ -24,3 +33,8 @@ type Source struct {
         Subject *SourceRange
         Context *SourceRange
 }
+
+type FromExpr struct {
+        Expression  hcl.Expression
+        EvalContext *hcl.EvalContext
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic_base.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic_base.go
new file mode 100644
index 0000000..50bf9d8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic_base.go
@@ -0,0 +1,31 @@
+package tfdiags
+
+// diagnosticBase can be embedded in other diagnostic structs to get
+// default implementations of Severity and Description. This type also
+// has default implementations of Source and FromExpr that return no source
+// location or expression-related information, so embedders should generally
+// override those method to return more useful results where possible.
+type diagnosticBase struct {
+        severity Severity
+        summary  string
+        detail   string
+}
+
+func (d diagnosticBase) Severity() Severity {
+        return d.severity
+}
+
+func (d diagnosticBase) Description() Description {
+        return Description{
+                Summary: d.summary,
+                Detail:  d.detail,
+        }
+}
+
+func (d diagnosticBase) Source() Source {
+        return Source{}
+}
+
+func (d diagnosticBase) FromExpr() *FromExpr {
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
index 667ba80..465b230 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
@@ -3,6 +3,9 @@ package tfdiags
 import (
         "bytes"
         "fmt"
+        "path/filepath"
+        "sort"
+        "strings"
 
         "github.com/hashicorp/errwrap"
         multierror "github.com/hashicorp/go-multierror"
@@ -54,6 +57,8 @@ func (diags Diagnostics) Append(new ...interface{}) Diagnostics {
                         diags = append(diags, ti...) // flatten
                 case diagnosticsAsError:
                         diags = diags.Append(ti.Diagnostics) // unwrap
+                case NonFatalError:
+                        diags = diags.Append(ti.Diagnostics) // unwrap
                 case hcl.Diagnostics:
                         for _, hclDiag := range ti {
                                 diags = append(diags, hclDiagnostic{hclDiag})
@@ -136,6 +141,54 @@ func (diags Diagnostics) Err() error {
         return diagnosticsAsError{diags}
 }
 
+// ErrWithWarnings is similar to Err except that it will also return a non-nil
+// error if the receiver contains only warnings.
+//
+// In the warnings-only situation, the result is guaranteed to be of dynamic
+// type NonFatalError, allowing diagnostics-aware callers to type-assert
+// and unwrap it, treating it as non-fatal.
+//
+// This should be used only in contexts where the caller is able to recognize
+// and handle NonFatalError. For normal callers that expect a lack of errors
+// to be signaled by nil, use just Diagnostics.Err.
+func (diags Diagnostics) ErrWithWarnings() error {
+        if len(diags) == 0 {
+                return nil
+        }
+        if diags.HasErrors() {
+                return diags.Err()
+        }
+        return NonFatalError{diags}
+}
+
+// NonFatalErr is similar to Err except that it always returns either nil
+// (if there are no diagnostics at all) or NonFatalError.
+//
+// This allows diagnostics to be returned over an error return channel while
+// being explicit that the diagnostics should not halt processing.
+//
+// This should be used only in contexts where the caller is able to recognize
+// and handle NonFatalError. For normal callers that expect a lack of errors
+// to be signaled by nil, use just Diagnostics.Err.
+func (diags Diagnostics) NonFatalErr() error {
+        if len(diags) == 0 {
+                return nil
+        }
+        return NonFatalError{diags}
+}
+
+// Sort applies an ordering to the diagnostics in the receiver in-place.
+//
+// The ordering is: warnings before errors, sourceless before sourced,
+// short source paths before long source paths, and then ordering by
+// position within each file.
+//
+// Diagnostics that do not differ by any of these sortable characteristics
+// will remain in the same relative order after this method returns.
+func (diags Diagnostics) Sort() {
+        sort.Stable(sortDiagnostics(diags))
+}
+
 type diagnosticsAsError struct {
         Diagnostics
 }
@@ -179,3 +232,99 @@ func (dae diagnosticsAsError) WrappedErrors() []error {
         }
         return errs
 }
+
+// NonFatalError is a special error type, returned by
+// Diagnostics.ErrWithWarnings and Diagnostics.NonFatalErr,
+// that indicates that the wrapped diagnostics should be treated as non-fatal.
+// Callers can conditionally type-assert an error to this type in order to
+// detect the non-fatal scenario and handle it in a different way.
+type NonFatalError struct {
+        Diagnostics
+}
+
+func (woe NonFatalError) Error() string {
+        diags := woe.Diagnostics
+        switch {
+        case len(diags) == 0:
+                // should never happen, since we don't create this wrapper if
+                // there are no diagnostics in the list.
+                return "no errors or warnings"
+        case len(diags) == 1:
+                desc := diags[0].Description()
+                if desc.Detail == "" {
+                        return desc.Summary
+                }
+                return fmt.Sprintf("%s: %s", desc.Summary, desc.Detail)
+        default:
+                var ret bytes.Buffer
+                if diags.HasErrors() {
+                        fmt.Fprintf(&ret, "%d problems:\n", len(diags))
+                } else {
+                        fmt.Fprintf(&ret, "%d warnings:\n", len(diags))
+                }
+                for _, diag := range woe.Diagnostics {
+                        desc := diag.Description()
+                        if desc.Detail == "" {
+                                fmt.Fprintf(&ret, "\n- %s", desc.Summary)
+                        } else {
+                                fmt.Fprintf(&ret, "\n- %s: %s", desc.Summary, desc.Detail)
+                        }
+                }
+                return ret.String()
+        }
+}
+
+// sortDiagnostics is an implementation of sort.Interface
+type sortDiagnostics []Diagnostic
+
+var _ sort.Interface = sortDiagnostics(nil)
+
+func (sd sortDiagnostics) Len() int {
+        return len(sd)
+}
+
+func (sd sortDiagnostics) Less(i, j int) bool {
+        iD, jD := sd[i], sd[j]
+        iSev, jSev := iD.Severity(), jD.Severity()
+        iSrc, jSrc := iD.Source(), jD.Source()
+
+        switch {
+
+        case iSev != jSev:
+                return iSev == Warning
+
+        case (iSrc.Subject == nil) != (jSrc.Subject == nil):
+                return iSrc.Subject == nil
+
+        case iSrc.Subject != nil && *iSrc.Subject != *jSrc.Subject:
+                iSubj := iSrc.Subject
+                jSubj := jSrc.Subject
+                switch {
+                case iSubj.Filename != jSubj.Filename:
+                        // Path with fewer segments goes first if they are different lengths
+                        sep := string(filepath.Separator)
+                        iCount := strings.Count(iSubj.Filename, sep)
+                        jCount := strings.Count(jSubj.Filename, sep)
+                        if iCount != jCount {
+                                return iCount < jCount
+                        }
+                        return iSubj.Filename < jSubj.Filename
+                case iSubj.Start.Byte != jSubj.Start.Byte:
+                        return iSubj.Start.Byte < jSubj.Start.Byte
+                case iSubj.End.Byte != jSubj.End.Byte:
+                        return iSubj.End.Byte < jSubj.End.Byte
+                }
+                fallthrough
+
+        default:
+                // The remaining properties do not have a defined ordering, so
+                // we'll leave it unspecified. Since we use sort.Stable in
+                // the caller of this, the ordering of remaining items will
+                // be preserved.
+                return false
+        }
+}
+
+func (sd sortDiagnostics) Swap(i, j int) {
+        sd[i], sd[j] = sd[j], sd[i]
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/error.go b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
index 35edc30..13f7a71 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/error.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
@@ -13,7 +13,7 @@ func (e nativeError) Severity() Severity {
 
 func (e nativeError) Description() Description {
         return Description{
-                Summary: e.err.Error(),
+                Summary: FormatError(e.err),
         }
 }
 
@@ -21,3 +21,8 @@ func (e nativeError) Source() Source {
         // No source information available for a native error
         return Source{}
 }
+
+func (e nativeError) FromExpr() *FromExpr {
+        // Native errors are not expression-related
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
index 24851f4..f9aec41 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
@@ -40,6 +40,16 @@ func (d hclDiagnostic) Source() Source {
         return ret
 }
 
+func (d hclDiagnostic) FromExpr() *FromExpr {
+        if d.diag.Expression == nil || d.diag.EvalContext == nil {
+                return nil
+        }
+        return &FromExpr{
+                Expression:  d.diag.Expression,
+                EvalContext: d.diag.EvalContext,
+        }
+}
+
 // SourceRangeFromHCL constructs a SourceRange from the corresponding range
 // type within the HCL package.
 func SourceRangeFromHCL(hclRange hcl.Range) SourceRange {
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
index 6cc95cc..485063b 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
@@ -48,6 +48,12 @@ func (d *rpcFriendlyDiag) Source() Source {
         }
 }
 
+func (d rpcFriendlyDiag) FromExpr() *FromExpr {
+        // RPC-friendly diagnostics cannot preserve expression information because
+        // expressions themselves are not RPC-friendly.
+        return nil
+}
+
 func init() {
         gob.Register((*rpcFriendlyDiag)(nil))
 }
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
index 0b1249b..78a7210 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
@@ -4,6 +4,14 @@ package tfdiags
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[Error-69]
+        _ = x[Warning-87]
+}
+
 const (
         _Severity_name_0 = "Error"
         _Severity_name_1 = "Warning"
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
index fb3ac98..b0f1ecd 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
@@ -20,6 +20,11 @@ func (e simpleWarning) Description() Description {
 }
 
 func (e simpleWarning) Source() Source {
-        // No source information available for a native error
+        // No source information available for a simple warning
         return Source{}
 }
+
+func (e simpleWarning) FromExpr() *FromExpr {
+        // Simple warnings are not expression-related
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/sourceless.go b/vendor/github.com/hashicorp/terraform/tfdiags/sourceless.go
new file mode 100644
index 0000000..eaa2737
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/sourceless.go
@@ -0,0 +1,13 @@
+package tfdiags
+
+// Sourceless creates and returns a diagnostic with no source location
+// information. This is generally used for operational-type errors that are
+// caused by or relate to the environment where Terraform is running rather
+// than to the provided configuration.
+func Sourceless(severity Severity, summary, detail string) Diagnostic {
+        return diagnosticBase{
+                severity: severity,
+                summary:  summary,
+                detail:   detail,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/version/version.go b/vendor/github.com/hashicorp/terraform/version/version.go
index b21b297..30d7284 100644
--- a/vendor/github.com/hashicorp/terraform/version/version.go
+++ b/vendor/github.com/hashicorp/terraform/version/version.go
@@ -11,17 +11,21 @@ import (
 )
 
 // The main version number that is being run at the moment.
-var Version = "0.11.12"
+var Version = "0.12.0"
 
 // A pre-release marker for the version. If this is "" (empty string)
 // then it means that it is a final release. Otherwise, this is a pre-release
 // such as "dev" (in development), "beta", "rc1", etc.
-var Prerelease = "dev"
+var Prerelease = ""
 
 // SemVer is an instance of version.Version. This has the secondary
 // benefit of verifying during tests and init time that our version is a
 // proper semantic version, which should always be the case.
-var SemVer = version.Must(version.NewVersion(Version))
+var SemVer *version.Version
+
+func init() {
+        SemVer = version.Must(version.NewVersion(Version))
+}
 
 // Header is the header name used to send the current terraform version
 // in http requests.
diff --git a/vendor/github.com/hashicorp/yamux/session.go b/vendor/github.com/hashicorp/yamux/session.go
index e179818..32ba02e 100644
--- a/vendor/github.com/hashicorp/yamux/session.go
+++ b/vendor/github.com/hashicorp/yamux/session.go
@@ -123,6 +123,12 @@ func (s *Session) IsClosed() bool {
         }
 }
 
+// CloseChan returns a read-only channel which is closed as
+// soon as the session is closed.
+func (s *Session) CloseChan() <-chan struct{} {
+        return s.shutdownCh
+}
+
 // NumStreams returns the number of currently open streams
 func (s *Session) NumStreams() int {
         s.streamLock.Lock()
@@ -303,8 +309,10 @@ func (s *Session) keepalive() {
                 case <-time.After(s.config.KeepAliveInterval):
                         _, err := s.Ping()
                         if err != nil {
-                                s.logger.Printf("[ERR] yamux: keepalive failed: %v", err)
-                                s.exitErr(ErrKeepAliveTimeout)
+                                if err != ErrSessionShutdown {
+                                        s.logger.Printf("[ERR] yamux: keepalive failed: %v", err)
+                                        s.exitErr(ErrKeepAliveTimeout)
+                                }
                                 return
                         }
                 case <-s.shutdownCh:
@@ -323,8 +331,17 @@ func (s *Session) waitForSend(hdr header, body io.Reader) error {
 // potential shutdown. Since there's the expectation that sends can happen
 // in a timely manner, we enforce the connection write timeout here.
 func (s *Session) waitForSendErr(hdr header, body io.Reader, errCh chan error) error {
-        timer := time.NewTimer(s.config.ConnectionWriteTimeout)
-        defer timer.Stop()
+        t := timerPool.Get()
+        timer := t.(*time.Timer)
+        timer.Reset(s.config.ConnectionWriteTimeout)
+        defer func() {
+                timer.Stop()
+                select {
+                case <-timer.C:
+                default:
+                }
+                timerPool.Put(t)
+        }()
 
         ready := sendReady{Hdr: hdr, Body: body, Err: errCh}
         select {
@@ -349,8 +366,17 @@ func (s *Session) waitForSendErr(hdr header, body io.Reader, errCh chan error) e
 // the send happens right here, we enforce the connection write timeout if we
 // can't queue the header to be sent.
 func (s *Session) sendNoWait(hdr header) error {
-        timer := time.NewTimer(s.config.ConnectionWriteTimeout)
-        defer timer.Stop()
+        t := timerPool.Get()
+        timer := t.(*time.Timer)
+        timer.Reset(s.config.ConnectionWriteTimeout)
+        defer func() {
+                timer.Stop()
+                select {
+                case <-timer.C:
+                default:
+                }
+                timerPool.Put(t)
+        }()
 
         select {
         case s.sendCh <- sendReady{Hdr: hdr}:
@@ -408,11 +434,20 @@ func (s *Session) recv() {
         }
 }
 
+// Ensure that the index of the handler (typeData/typeWindowUpdate/etc) matches the message type
+var (
+        handlers = []func(*Session, header) error{
+                typeData:         (*Session).handleStreamMessage,
+                typeWindowUpdate: (*Session).handleStreamMessage,
+                typePing:         (*Session).handlePing,
+                typeGoAway:       (*Session).handleGoAway,
+        }
+)
+
 // recvLoop continues to receive data until a fatal error is encountered
 func (s *Session) recvLoop() error {
         defer close(s.recvDoneCh)
         hdr := header(make([]byte, headerSize))
-        var handler func(header) error
         for {
                 // Read the header
                 if _, err := io.ReadFull(s.bufRead, hdr); err != nil {
@@ -428,22 +463,12 @@ func (s *Session) recvLoop() error {
                         return ErrInvalidVersion
                 }
 
-                // Switch on the type
-                switch hdr.MsgType() {
-                case typeData:
-                        handler = s.handleStreamMessage
-                case typeWindowUpdate:
-                        handler = s.handleStreamMessage
-                case typeGoAway:
-                        handler = s.handleGoAway
-                case typePing:
-                        handler = s.handlePing
-                default:
+                mt := hdr.MsgType()
+                if mt < typeData || mt > typeGoAway {
                         return ErrInvalidMsgType
                 }
 
-                // Invoke the handler
-                if err := handler(hdr); err != nil {
+                if err := handlers[mt](s, hdr); err != nil {
                         return err
                 }
         }
diff --git a/vendor/github.com/hashicorp/yamux/stream.go b/vendor/github.com/hashicorp/yamux/stream.go
index d216e28..aa23919 100644
--- a/vendor/github.com/hashicorp/yamux/stream.go
+++ b/vendor/github.com/hashicorp/yamux/stream.go
@@ -47,8 +47,8 @@ type Stream struct {
         recvNotifyCh chan struct{}
         sendNotifyCh chan struct{}
 
-        readDeadline  time.Time
-        writeDeadline time.Time
+        readDeadline  atomic.Value // time.Time
+        writeDeadline atomic.Value // time.Time
 }
 
 // newStream is used to construct a new stream within
@@ -67,6 +67,8 @@ func newStream(session *Session, id uint32, state streamState) *Stream {
                 recvNotifyCh: make(chan struct{}, 1),
                 sendNotifyCh: make(chan struct{}, 1),
         }
+        s.readDeadline.Store(time.Time{})
+        s.writeDeadline.Store(time.Time{})
         return s
 }
 
@@ -122,8 +124,9 @@ START:
 WAIT:
         var timeout <-chan time.Time
         var timer *time.Timer
-        if !s.readDeadline.IsZero() {
-                delay := s.readDeadline.Sub(time.Now())
+        readDeadline := s.readDeadline.Load().(time.Time)
+        if !readDeadline.IsZero() {
+                delay := readDeadline.Sub(time.Now())
                 timer = time.NewTimer(delay)
                 timeout = timer.C
         }
@@ -188,7 +191,7 @@ START:
 
         // Send the header
         s.sendHdr.encode(typeData, flags, s.id, max)
-        if err := s.session.waitForSendErr(s.sendHdr, body, s.sendErr); err != nil {
+        if err = s.session.waitForSendErr(s.sendHdr, body, s.sendErr); err != nil {
                 return 0, err
         }
 
@@ -200,8 +203,9 @@ START:
 
 WAIT:
         var timeout <-chan time.Time
-        if !s.writeDeadline.IsZero() {
-                delay := s.writeDeadline.Sub(time.Now())
+        writeDeadline := s.writeDeadline.Load().(time.Time)
+        if !writeDeadline.IsZero() {
+                delay := writeDeadline.Sub(time.Now())
                 timeout = time.After(delay)
         }
         select {
@@ -238,18 +242,25 @@ func (s *Stream) sendWindowUpdate() error {
 
         // Determine the delta update
         max := s.session.config.MaxStreamWindowSize
-        delta := max - atomic.LoadUint32(&s.recvWindow)
+        var bufLen uint32
+        s.recvLock.Lock()
+        if s.recvBuf != nil {
+                bufLen = uint32(s.recvBuf.Len())
+        }
+        delta := (max - bufLen) - s.recvWindow
 
         // Determine the flags if any
         flags := s.sendFlags()
 
         // Check if we can omit the update
         if delta < (max/2) && flags == 0 {
+                s.recvLock.Unlock()
                 return nil
         }
 
         // Update our window
-        atomic.AddUint32(&s.recvWindow, delta)
+        s.recvWindow += delta
+        s.recvLock.Unlock()
 
         // Send the header
         s.controlHdr.encode(typeWindowUpdate, flags, s.id, delta)
@@ -392,16 +403,18 @@ func (s *Stream) readData(hdr header, flags uint16, conn io.Reader) error {
         if length == 0 {
                 return nil
         }
-        if remain := atomic.LoadUint32(&s.recvWindow); length > remain {
-                s.session.logger.Printf("[ERR] yamux: receive window exceeded (stream: %d, remain: %d, recv: %d)", s.id, remain, length)
-                return ErrRecvWindowExceeded
-        }
 
         // Wrap in a limited reader
         conn = &io.LimitedReader{R: conn, N: int64(length)}
 
         // Copy into buffer
         s.recvLock.Lock()
+
+        if length > s.recvWindow {
+                s.session.logger.Printf("[ERR] yamux: receive window exceeded (stream: %d, remain: %d, recv: %d)", s.id, s.recvWindow, length)
+                return ErrRecvWindowExceeded
+        }
+
         if s.recvBuf == nil {
                 // Allocate the receive buffer just-in-time to fit the full data frame.
                 // This way we can read in the whole packet without further allocations.
@@ -414,7 +427,7 @@ func (s *Stream) readData(hdr header, flags uint16, conn io.Reader) error {
         }
 
         // Decrement the receive window
-        atomic.AddUint32(&s.recvWindow, ^uint32(length-1))
+        s.recvWindow -= length
         s.recvLock.Unlock()
 
         // Unblock any readers
@@ -435,13 +448,13 @@ func (s *Stream) SetDeadline(t time.Time) error {
 
 // SetReadDeadline sets the deadline for future Read calls.
 func (s *Stream) SetReadDeadline(t time.Time) error {
-        s.readDeadline = t
+        s.readDeadline.Store(t)
         return nil
 }
 
 // SetWriteDeadline sets the deadline for future Write calls
 func (s *Stream) SetWriteDeadline(t time.Time) error {
-        s.writeDeadline = t
+        s.writeDeadline.Store(t)
         return nil
 }
 
diff --git a/vendor/github.com/hashicorp/yamux/util.go b/vendor/github.com/hashicorp/yamux/util.go
index 5fe45af..8a73e92 100644
--- a/vendor/github.com/hashicorp/yamux/util.go
+++ b/vendor/github.com/hashicorp/yamux/util.go
@@ -1,5 +1,20 @@
 package yamux
 
+import (
+        "sync"
+        "time"
+)
+
+var (
+        timerPool = &sync.Pool{
+                New: func() interface{} {
+                        timer := time.NewTimer(time.Hour * 1e6)
+                        timer.Stop()
+                        return timer
+                },
+        }
+)
+
 // asyncSendErr is used to try an async send of an error
 func asyncSendErr(ch chan error, err error) {
         if ch == nil {
diff --git a/vendor/github.com/jmespath/go-jmespath/api.go b/vendor/github.com/jmespath/go-jmespath/api.go
index 9cfa988..8e26ffe 100644
--- a/vendor/github.com/jmespath/go-jmespath/api.go
+++ b/vendor/github.com/jmespath/go-jmespath/api.go
@@ -2,7 +2,7 @@ package jmespath
 
 import "strconv"
 
-// JmesPath is the epresentation of a compiled JMES path query. A JmesPath is
+// JMESPath is the epresentation of a compiled JMES path query. A JMESPath is
 // safe for concurrent use by multiple goroutines.
 type JMESPath struct {
         ast  ASTNode
diff --git a/vendor/github.com/mattn/go-colorable/.travis.yml b/vendor/github.com/mattn/go-colorable/.travis.yml
new file mode 100644
index 0000000..98db8f0
--- /dev/null
+++ b/vendor/github.com/mattn/go-colorable/.travis.yml
@@ -0,0 +1,9 @@
+language: go
+go:
+  - tip
+
+before_install:
+  - go get github.com/mattn/goveralls
+  - go get golang.org/x/tools/cmd/cover
+script:
+  - $HOME/gopath/bin/goveralls -repotoken xnXqRGwgW3SXIguzxf90ZSK1GPYZPaGrw
diff --git a/vendor/github.com/mattn/go-colorable/LICENSE b/vendor/github.com/mattn/go-colorable/LICENSE
new file mode 100644
index 0000000..91b5cef
--- /dev/null
+++ b/vendor/github.com/mattn/go-colorable/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Yasuhiro Matsumoto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/vendor/github.com/mattn/go-colorable/README.md b/vendor/github.com/mattn/go-colorable/README.md
new file mode 100644
index 0000000..56729a9
--- /dev/null
+++ b/vendor/github.com/mattn/go-colorable/README.md
@@ -0,0 +1,48 @@
+# go-colorable
+
+[![Godoc Reference](https://godoc.org/github.com/mattn/go-colorable?status.svg)](http://godoc.org/github.com/mattn/go-colorable)
+[![Build Status](https://travis-ci.org/mattn/go-colorable.svg?branch=master)](https://travis-ci.org/mattn/go-colorable)
+[![Coverage Status](https://coveralls.io/repos/github/mattn/go-colorable/badge.svg?branch=master)](https://coveralls.io/github/mattn/go-colorable?branch=master)
+[![Go Report Card](https://goreportcard.com/badge/mattn/go-colorable)](https://goreportcard.com/report/mattn/go-colorable)
+
+Colorable writer for windows.
+
+For example, most of logger packages doesn't show colors on windows. (I know we can do it with ansicon. But I don't want.)
+This package is possible to handle escape sequence for ansi color on windows.
+
+## Too Bad!
+
+![](https://raw.githubusercontent.com/mattn/go-colorable/gh-pages/bad.png)
+
+
+## So Good!
+
+![](https://raw.githubusercontent.com/mattn/go-colorable/gh-pages/good.png)
+
+## Usage
+
+```go
+logrus.SetFormatter(&logrus.TextFormatter{ForceColors: true})
+logrus.SetOutput(colorable.NewColorableStdout())
+
+logrus.Info("succeeded")
+logrus.Warn("not correct")
+logrus.Error("something error")
+logrus.Fatal("panic")
+```
+
+You can compile above code on non-windows OSs.
+
+## Installation
+
+```
+$ go get github.com/mattn/go-colorable
+```
+
+# License
+
+MIT
+
+# Author
+
+Yasuhiro Matsumoto (a.k.a mattn)
diff --git a/vendor/github.com/mattn/go-colorable/colorable_appengine.go b/vendor/github.com/mattn/go-colorable/colorable_appengine.go
new file mode 100644
index 0000000..1f28d77
--- /dev/null
+++ b/vendor/github.com/mattn/go-colorable/colorable_appengine.go
@@ -0,0 +1,29 @@
+// +build appengine
+
+package colorable
+
+import (
+        "io"
+        "os"
+
+        _ "github.com/mattn/go-isatty"
+)
+
+// NewColorable return new instance of Writer which handle escape sequence.
+func NewColorable(file *os.File) io.Writer {
+        if file == nil {
+                panic("nil passed instead of *os.File to NewColorable()")
+        }
+
+        return file
+}
+
+// NewColorableStdout return new instance of Writer which handle escape sequence for stdout.
+func NewColorableStdout() io.Writer {
+        return os.Stdout
+}
+
+// NewColorableStderr return new instance of Writer which handle escape sequence for stderr.
+func NewColorableStderr() io.Writer {
+        return os.Stderr
+}
diff --git a/vendor/github.com/mattn/go-colorable/colorable_others.go b/vendor/github.com/mattn/go-colorable/colorable_others.go
new file mode 100644
index 0000000..887f203
--- /dev/null
+++ b/vendor/github.com/mattn/go-colorable/colorable_others.go
@@ -0,0 +1,30 @@
+// +build !windows
+// +build !appengine
+
+package colorable
+
+import (
+        "io"
+        "os"
+
+        _ "github.com/mattn/go-isatty"
+)
+
+// NewColorable return new instance of Writer which handle escape sequence.
+func NewColorable(file *os.File) io.Writer {
+        if file == nil {
+                panic("nil passed instead of *os.File to NewColorable()")
+        }
+
+        return file
+}
+
+// NewColorableStdout return new instance of Writer which handle escape sequence for stdout.
+func NewColorableStdout() io.Writer {
+        return os.Stdout
+}
+
+// NewColorableStderr return new instance of Writer which handle escape sequence for stderr.
+func NewColorableStderr() io.Writer {
+        return os.Stderr
+}
diff --git a/vendor/github.com/mattn/go-colorable/colorable_windows.go b/vendor/github.com/mattn/go-colorable/colorable_windows.go
new file mode 100644
index 0000000..404e10c
--- /dev/null
+++ b/vendor/github.com/mattn/go-colorable/colorable_windows.go
@@ -0,0 +1,980 @@
+// +build windows
+// +build !appengine
+
+package colorable
+
+import (
+        "bytes"
+        "io"
+        "math"
+        "os"
+        "strconv"
+        "strings"
+        "syscall"
+        "unsafe"
+
+        "github.com/mattn/go-isatty"
+)
+
+const (
+        foregroundBlue      = 0x1
+        foregroundGreen     = 0x2
+        foregroundRed       = 0x4
+        foregroundIntensity = 0x8
+        foregroundMask      = (foregroundRed | foregroundBlue | foregroundGreen | foregroundIntensity)
+        backgroundBlue      = 0x10
+        backgroundGreen     = 0x20
+        backgroundRed       = 0x40
+        backgroundIntensity = 0x80
+        backgroundMask      = (backgroundRed | backgroundBlue | backgroundGreen | backgroundIntensity)
+)
+
+const (
+        genericRead  = 0x80000000
+        genericWrite = 0x40000000
+)
+
+const (
+        consoleTextmodeBuffer = 0x1
+)
+
+type wchar uint16
+type short int16
+type dword uint32
+type word uint16
+
+type coord struct {
+        x short
+        y short
+}
+
+type smallRect struct {
+        left   short
+        top    short
+        right  short
+        bottom short
+}
+
+type consoleScreenBufferInfo struct {
+        size              coord
+        cursorPosition    coord
+        attributes        word
+        window            smallRect
+        maximumWindowSize coord
+}
+
+type consoleCursorInfo struct {
+        size    dword
+        visible int32
+}
+
+var (
+        kernel32                       = syscall.NewLazyDLL("kernel32.dll")
+        procGetConsoleScreenBufferInfo = kernel32.NewProc("GetConsoleScreenBufferInfo")
+        procSetConsoleTextAttribute    = kernel32.NewProc("SetConsoleTextAttribute")
+        procSetConsoleCursorPosition   = kernel32.NewProc("SetConsoleCursorPosition")
+        procFillConsoleOutputCharacter = kernel32.NewProc("FillConsoleOutputCharacterW")
+        procFillConsoleOutputAttribute = kernel32.NewProc("FillConsoleOutputAttribute")
+        procGetConsoleCursorInfo       = kernel32.NewProc("GetConsoleCursorInfo")
+        procSetConsoleCursorInfo       = kernel32.NewProc("SetConsoleCursorInfo")
+        procSetConsoleTitle            = kernel32.NewProc("SetConsoleTitleW")
+        procCreateConsoleScreenBuffer  = kernel32.NewProc("CreateConsoleScreenBuffer")
+)
+
+// Writer provide colorable Writer to the console
+type Writer struct {
+        out       io.Writer
+        handle    syscall.Handle
+        althandle syscall.Handle
+        oldattr   word
+        oldpos    coord
+        rest      bytes.Buffer
+}
+
+// NewColorable return new instance of Writer which handle escape sequence from File.
+func NewColorable(file *os.File) io.Writer {
+        if file == nil {
+                panic("nil passed instead of *os.File to NewColorable()")
+        }
+
+        if isatty.IsTerminal(file.Fd()) {
+                var csbi consoleScreenBufferInfo
+                handle := syscall.Handle(file.Fd())
+                procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                return &Writer{out: file, handle: handle, oldattr: csbi.attributes, oldpos: coord{0, 0}}
+        }
+        return file
+}
+
+// NewColorableStdout return new instance of Writer which handle escape sequence for stdout.
+func NewColorableStdout() io.Writer {
+        return NewColorable(os.Stdout)
+}
+
+// NewColorableStderr return new instance of Writer which handle escape sequence for stderr.
+func NewColorableStderr() io.Writer {
+        return NewColorable(os.Stderr)
+}
+
+var color256 = map[int]int{
+        0:   0x000000,
+        1:   0x800000,
+        2:   0x008000,
+        3:   0x808000,
+        4:   0x000080,
+        5:   0x800080,
+        6:   0x008080,
+        7:   0xc0c0c0,
+        8:   0x808080,
+        9:   0xff0000,
+        10:  0x00ff00,
+        11:  0xffff00,
+        12:  0x0000ff,
+        13:  0xff00ff,
+        14:  0x00ffff,
+        15:  0xffffff,
+        16:  0x000000,
+        17:  0x00005f,
+        18:  0x000087,
+        19:  0x0000af,
+        20:  0x0000d7,
+        21:  0x0000ff,
+        22:  0x005f00,
+        23:  0x005f5f,
+        24:  0x005f87,
+        25:  0x005faf,
+        26:  0x005fd7,
+        27:  0x005fff,
+        28:  0x008700,
+        29:  0x00875f,
+        30:  0x008787,
+        31:  0x0087af,
+        32:  0x0087d7,
+        33:  0x0087ff,
+        34:  0x00af00,
+        35:  0x00af5f,
+        36:  0x00af87,
+        37:  0x00afaf,
+        38:  0x00afd7,
+        39:  0x00afff,
+        40:  0x00d700,
+        41:  0x00d75f,
+        42:  0x00d787,
+        43:  0x00d7af,
+        44:  0x00d7d7,
+        45:  0x00d7ff,
+        46:  0x00ff00,
+        47:  0x00ff5f,
+        48:  0x00ff87,
+        49:  0x00ffaf,
+        50:  0x00ffd7,
+        51:  0x00ffff,
+        52:  0x5f0000,
+        53:  0x5f005f,
+        54:  0x5f0087,
+        55:  0x5f00af,
+        56:  0x5f00d7,
+        57:  0x5f00ff,
+        58:  0x5f5f00,
+        59:  0x5f5f5f,
+        60:  0x5f5f87,
+        61:  0x5f5faf,
+        62:  0x5f5fd7,
+        63:  0x5f5fff,
+        64:  0x5f8700,
+        65:  0x5f875f,
+        66:  0x5f8787,
+        67:  0x5f87af,
+        68:  0x5f87d7,
+        69:  0x5f87ff,
+        70:  0x5faf00,
+        71:  0x5faf5f,
+        72:  0x5faf87,
+        73:  0x5fafaf,
+        74:  0x5fafd7,
+        75:  0x5fafff,
+        76:  0x5fd700,
+        77:  0x5fd75f,
+        78:  0x5fd787,
+        79:  0x5fd7af,
+        80:  0x5fd7d7,
+        81:  0x5fd7ff,
+        82:  0x5fff00,
+        83:  0x5fff5f,
+        84:  0x5fff87,
+        85:  0x5fffaf,
+        86:  0x5fffd7,
+        87:  0x5fffff,
+        88:  0x870000,
+        89:  0x87005f,
+        90:  0x870087,
+        91:  0x8700af,
+        92:  0x8700d7,
+        93:  0x8700ff,
+        94:  0x875f00,
+        95:  0x875f5f,
+        96:  0x875f87,
+        97:  0x875faf,
+        98:  0x875fd7,
+        99:  0x875fff,
+        100: 0x878700,
+        101: 0x87875f,
+        102: 0x878787,
+        103: 0x8787af,
+        104: 0x8787d7,
+        105: 0x8787ff,
+        106: 0x87af00,
+        107: 0x87af5f,
+        108: 0x87af87,
+        109: 0x87afaf,
+        110: 0x87afd7,
+        111: 0x87afff,
+        112: 0x87d700,
+        113: 0x87d75f,
+        114: 0x87d787,
+        115: 0x87d7af,
+        116: 0x87d7d7,
+        117: 0x87d7ff,
+        118: 0x87ff00,
+        119: 0x87ff5f,
+        120: 0x87ff87,
+        121: 0x87ffaf,
+        122: 0x87ffd7,
+        123: 0x87ffff,
+        124: 0xaf0000,
+        125: 0xaf005f,
+        126: 0xaf0087,
+        127: 0xaf00af,
+        128: 0xaf00d7,
+        129: 0xaf00ff,
+        130: 0xaf5f00,
+        131: 0xaf5f5f,
+        132: 0xaf5f87,
+        133: 0xaf5faf,
+        134: 0xaf5fd7,
+        135: 0xaf5fff,
+        136: 0xaf8700,
+        137: 0xaf875f,
+        138: 0xaf8787,
+        139: 0xaf87af,
+        140: 0xaf87d7,
+        141: 0xaf87ff,
+        142: 0xafaf00,
+        143: 0xafaf5f,
+        144: 0xafaf87,
+        145: 0xafafaf,
+        146: 0xafafd7,
+        147: 0xafafff,
+        148: 0xafd700,
+        149: 0xafd75f,
+        150: 0xafd787,
+        151: 0xafd7af,
+        152: 0xafd7d7,
+        153: 0xafd7ff,
+        154: 0xafff00,
+        155: 0xafff5f,
+        156: 0xafff87,
+        157: 0xafffaf,
+        158: 0xafffd7,
+        159: 0xafffff,
+        160: 0xd70000,
+        161: 0xd7005f,
+        162: 0xd70087,
+        163: 0xd700af,
+        164: 0xd700d7,
+        165: 0xd700ff,
+        166: 0xd75f00,
+        167: 0xd75f5f,
+        168: 0xd75f87,
+        169: 0xd75faf,
+        170: 0xd75fd7,
+        171: 0xd75fff,
+        172: 0xd78700,
+        173: 0xd7875f,
+        174: 0xd78787,
+        175: 0xd787af,
+        176: 0xd787d7,
+        177: 0xd787ff,
+        178: 0xd7af00,
+        179: 0xd7af5f,
+        180: 0xd7af87,
+        181: 0xd7afaf,
+        182: 0xd7afd7,
+        183: 0xd7afff,
+        184: 0xd7d700,
+        185: 0xd7d75f,
+        186: 0xd7d787,
+        187: 0xd7d7af,
+        188: 0xd7d7d7,
+        189: 0xd7d7ff,
+        190: 0xd7ff00,
+        191: 0xd7ff5f,
+        192: 0xd7ff87,
+        193: 0xd7ffaf,
+        194: 0xd7ffd7,
+        195: 0xd7ffff,
+        196: 0xff0000,
+        197: 0xff005f,
+        198: 0xff0087,
+        199: 0xff00af,
+        200: 0xff00d7,
+        201: 0xff00ff,
+        202: 0xff5f00,
+        203: 0xff5f5f,
+        204: 0xff5f87,
+        205: 0xff5faf,
+        206: 0xff5fd7,
+        207: 0xff5fff,
+        208: 0xff8700,
+        209: 0xff875f,
+        210: 0xff8787,
+        211: 0xff87af,
+        212: 0xff87d7,
+        213: 0xff87ff,
+        214: 0xffaf00,
+        215: 0xffaf5f,
+        216: 0xffaf87,
+        217: 0xffafaf,
+        218: 0xffafd7,
+        219: 0xffafff,
+        220: 0xffd700,
+        221: 0xffd75f,
+        222: 0xffd787,
+        223: 0xffd7af,
+        224: 0xffd7d7,
+        225: 0xffd7ff,
+        226: 0xffff00,
+        227: 0xffff5f,
+        228: 0xffff87,
+        229: 0xffffaf,
+        230: 0xffffd7,
+        231: 0xffffff,
+        232: 0x080808,
+        233: 0x121212,
+        234: 0x1c1c1c,
+        235: 0x262626,
+        236: 0x303030,
+        237: 0x3a3a3a,
+        238: 0x444444,
+        239: 0x4e4e4e,
+        240: 0x585858,
+        241: 0x626262,
+        242: 0x6c6c6c,
+        243: 0x767676,
+        244: 0x808080,
+        245: 0x8a8a8a,
+        246: 0x949494,
+        247: 0x9e9e9e,
+        248: 0xa8a8a8,
+        249: 0xb2b2b2,
+        250: 0xbcbcbc,
+        251: 0xc6c6c6,
+        252: 0xd0d0d0,
+        253: 0xdadada,
+        254: 0xe4e4e4,
+        255: 0xeeeeee,
+}
+
+// `\033]0;TITLESTR\007`
+func doTitleSequence(er *bytes.Reader) error {
+        var c byte
+        var err error
+
+        c, err = er.ReadByte()
+        if err != nil {
+                return err
+        }
+        if c != '0' && c != '2' {
+                return nil
+        }
+        c, err = er.ReadByte()
+        if err != nil {
+                return err
+        }
+        if c != ';' {
+                return nil
+        }
+        title := make([]byte, 0, 80)
+        for {
+                c, err = er.ReadByte()
+                if err != nil {
+                        return err
+                }
+                if c == 0x07 || c == '\n' {
+                        break
+                }
+                title = append(title, c)
+        }
+        if len(title) > 0 {
+                title8, err := syscall.UTF16PtrFromString(string(title))
+                if err == nil {
+                        procSetConsoleTitle.Call(uintptr(unsafe.Pointer(title8)))
+                }
+        }
+        return nil
+}
+
+// Write write data on console
+func (w *Writer) Write(data []byte) (n int, err error) {
+        var csbi consoleScreenBufferInfo
+        procGetConsoleScreenBufferInfo.Call(uintptr(w.handle), uintptr(unsafe.Pointer(&csbi)))
+
+        handle := w.handle
+
+        var er *bytes.Reader
+        if w.rest.Len() > 0 {
+                var rest bytes.Buffer
+                w.rest.WriteTo(&rest)
+                w.rest.Reset()
+                rest.Write(data)
+                er = bytes.NewReader(rest.Bytes())
+        } else {
+                er = bytes.NewReader(data)
+        }
+        var bw [1]byte
+loop:
+        for {
+                c1, err := er.ReadByte()
+                if err != nil {
+                        break loop
+                }
+                if c1 != 0x1b {
+                        bw[0] = c1
+                        w.out.Write(bw[:])
+                        continue
+                }
+                c2, err := er.ReadByte()
+                if err != nil {
+                        break loop
+                }
+
+                switch c2 {
+                case '>':
+                        continue
+                case ']':
+                        w.rest.WriteByte(c1)
+                        w.rest.WriteByte(c2)
+                        er.WriteTo(&w.rest)
+                        if bytes.IndexByte(w.rest.Bytes(), 0x07) == -1 {
+                                break loop
+                        }
+                        er = bytes.NewReader(w.rest.Bytes()[2:])
+                        err := doTitleSequence(er)
+                        if err != nil {
+                                break loop
+                        }
+                        w.rest.Reset()
+                        continue
+                // https://github.com/mattn/go-colorable/issues/27
+                case '7':
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        w.oldpos = csbi.cursorPosition
+                        continue
+                case '8':
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&w.oldpos)))
+                        continue
+                case 0x5b:
+                        // execute part after switch
+                default:
+                        continue
+                }
+
+                w.rest.WriteByte(c1)
+                w.rest.WriteByte(c2)
+                er.WriteTo(&w.rest)
+
+                var buf bytes.Buffer
+                var m byte
+                for i, c := range w.rest.Bytes()[2:] {
+                        if ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z') || c == '@' {
+                                m = c
+                                er = bytes.NewReader(w.rest.Bytes()[2+i+1:])
+                                w.rest.Reset()
+                                break
+                        }
+                        buf.Write([]byte(string(c)))
+                }
+                if m == 0 {
+                        break loop
+                }
+
+                switch m {
+                case 'A':
+                        n, err = strconv.Atoi(buf.String())
+                        if err != nil {
+                                continue
+                        }
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        csbi.cursorPosition.y -= short(n)
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&csbi.cursorPosition)))
+                case 'B':
+                        n, err = strconv.Atoi(buf.String())
+                        if err != nil {
+                                continue
+                        }
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        csbi.cursorPosition.y += short(n)
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&csbi.cursorPosition)))
+                case 'C':
+                        n, err = strconv.Atoi(buf.String())
+                        if err != nil {
+                                continue
+                        }
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        csbi.cursorPosition.x += short(n)
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&csbi.cursorPosition)))
+                case 'D':
+                        n, err = strconv.Atoi(buf.String())
+                        if err != nil {
+                                continue
+                        }
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        csbi.cursorPosition.x -= short(n)
+                        if csbi.cursorPosition.x < 0 {
+                                csbi.cursorPosition.x = 0
+                        }
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&csbi.cursorPosition)))
+                case 'E':
+                        n, err = strconv.Atoi(buf.String())
+                        if err != nil {
+                                continue
+                        }
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        csbi.cursorPosition.x = 0
+                        csbi.cursorPosition.y += short(n)
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&csbi.cursorPosition)))
+                case 'F':
+                        n, err = strconv.Atoi(buf.String())
+                        if err != nil {
+                                continue
+                        }
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        csbi.cursorPosition.x = 0
+                        csbi.cursorPosition.y -= short(n)
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&csbi.cursorPosition)))
+                case 'G':
+                        n, err = strconv.Atoi(buf.String())
+                        if err != nil {
+                                continue
+                        }
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        csbi.cursorPosition.x = short(n - 1)
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&csbi.cursorPosition)))
+                case 'H', 'f':
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        if buf.Len() > 0 {
+                                token := strings.Split(buf.String(), ";")
+                                switch len(token) {
+                                case 1:
+                                        n1, err := strconv.Atoi(token[0])
+                                        if err != nil {
+                                                continue
+                                        }
+                                        csbi.cursorPosition.y = short(n1 - 1)
+                                case 2:
+                                        n1, err := strconv.Atoi(token[0])
+                                        if err != nil {
+                                                continue
+                                        }
+                                        n2, err := strconv.Atoi(token[1])
+                                        if err != nil {
+                                                continue
+                                        }
+                                        csbi.cursorPosition.x = short(n2 - 1)
+                                        csbi.cursorPosition.y = short(n1 - 1)
+                                }
+                        } else {
+                                csbi.cursorPosition.y = 0
+                        }
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&csbi.cursorPosition)))
+                case 'J':
+                        n := 0
+                        if buf.Len() > 0 {
+                                n, err = strconv.Atoi(buf.String())
+                                if err != nil {
+                                        continue
+                                }
+                        }
+                        var count, written dword
+                        var cursor coord
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        switch n {
+                        case 0:
+                                cursor = coord{x: csbi.cursorPosition.x, y: csbi.cursorPosition.y}
+                                count = dword(csbi.size.x) - dword(csbi.cursorPosition.x) + dword(csbi.size.y-csbi.cursorPosition.y)*dword(csbi.size.x)
+                        case 1:
+                                cursor = coord{x: csbi.window.left, y: csbi.window.top}
+                                count = dword(csbi.size.x) - dword(csbi.cursorPosition.x) + dword(csbi.window.top-csbi.cursorPosition.y)*dword(csbi.size.x)
+                        case 2:
+                                cursor = coord{x: csbi.window.left, y: csbi.window.top}
+                                count = dword(csbi.size.x) - dword(csbi.cursorPosition.x) + dword(csbi.size.y-csbi.cursorPosition.y)*dword(csbi.size.x)
+                        }
+                        procFillConsoleOutputCharacter.Call(uintptr(handle), uintptr(' '), uintptr(count), *(*uintptr)(unsafe.Pointer(&cursor)), uintptr(unsafe.Pointer(&written)))
+                        procFillConsoleOutputAttribute.Call(uintptr(handle), uintptr(csbi.attributes), uintptr(count), *(*uintptr)(unsafe.Pointer(&cursor)), uintptr(unsafe.Pointer(&written)))
+                case 'K':
+                        n := 0
+                        if buf.Len() > 0 {
+                                n, err = strconv.Atoi(buf.String())
+                                if err != nil {
+                                        continue
+                                }
+                        }
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        var cursor coord
+                        var count, written dword
+                        switch n {
+                        case 0:
+                                cursor = coord{x: csbi.cursorPosition.x, y: csbi.cursorPosition.y}
+                                count = dword(csbi.size.x - csbi.cursorPosition.x)
+                        case 1:
+                                cursor = coord{x: csbi.window.left, y: csbi.cursorPosition.y}
+                                count = dword(csbi.size.x - csbi.cursorPosition.x)
+                        case 2:
+                                cursor = coord{x: csbi.window.left, y: csbi.cursorPosition.y}
+                                count = dword(csbi.size.x)
+                        }
+                        procFillConsoleOutputCharacter.Call(uintptr(handle), uintptr(' '), uintptr(count), *(*uintptr)(unsafe.Pointer(&cursor)), uintptr(unsafe.Pointer(&written)))
+                        procFillConsoleOutputAttribute.Call(uintptr(handle), uintptr(csbi.attributes), uintptr(count), *(*uintptr)(unsafe.Pointer(&cursor)), uintptr(unsafe.Pointer(&written)))
+                case 'm':
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        attr := csbi.attributes
+                        cs := buf.String()
+                        if cs == "" {
+                                procSetConsoleTextAttribute.Call(uintptr(handle), uintptr(w.oldattr))
+                                continue
+                        }
+                        token := strings.Split(cs, ";")
+                        for i := 0; i < len(token); i++ {
+                                ns := token[i]
+                                if n, err = strconv.Atoi(ns); err == nil {
+                                        switch {
+                                        case n == 0 || n == 100:
+                                                attr = w.oldattr
+                                        case 1 <= n && n <= 5:
+                                                attr |= foregroundIntensity
+                                        case n == 7:
+                                                attr = ((attr & foregroundMask) << 4) | ((attr & backgroundMask) >> 4)
+                                        case n == 22 || n == 25:
+                                                attr |= foregroundIntensity
+                                        case n == 27:
+                                                attr = ((attr & foregroundMask) << 4) | ((attr & backgroundMask) >> 4)
+                                        case 30 <= n && n <= 37:
+                                                attr &= backgroundMask
+                                                if (n-30)&1 != 0 {
+                                                        attr |= foregroundRed
+                                                }
+                                                if (n-30)&2 != 0 {
+                                                        attr |= foregroundGreen
+                                                }
+                                                if (n-30)&4 != 0 {
+                                                        attr |= foregroundBlue
+                                                }
+                                        case n == 38: // set foreground color.
+                                                if i < len(token)-2 && (token[i+1] == "5" || token[i+1] == "05") {
+                                                        if n256, err := strconv.Atoi(token[i+2]); err == nil {
+                                                                if n256foreAttr == nil {
+                                                                        n256setup()
+                                                                }
+                                                                attr &= backgroundMask
+                                                                attr |= n256foreAttr[n256]
+                                                                i += 2
+                                                        }
+                                                } else if len(token) == 5 && token[i+1] == "2" {
+                                                        var r, g, b int
+                                                        r, _ = strconv.Atoi(token[i+2])
+                                                        g, _ = strconv.Atoi(token[i+3])
+                                                        b, _ = strconv.Atoi(token[i+4])
+                                                        i += 4
+                                                        if r > 127 {
+                                                                attr |= foregroundRed
+                                                        }
+                                                        if g > 127 {
+                                                                attr |= foregroundGreen
+                                                        }
+                                                        if b > 127 {
+                                                                attr |= foregroundBlue
+                                                        }
+                                                } else {
+                                                        attr = attr & (w.oldattr & backgroundMask)
+                                                }
+                                        case n == 39: // reset foreground color.
+                                                attr &= backgroundMask
+                                                attr |= w.oldattr & foregroundMask
+                                        case 40 <= n && n <= 47:
+                                                attr &= foregroundMask
+                                                if (n-40)&1 != 0 {
+                                                        attr |= backgroundRed
+                                                }
+                                                if (n-40)&2 != 0 {
+                                                        attr |= backgroundGreen
+                                                }
+                                                if (n-40)&4 != 0 {
+                                                        attr |= backgroundBlue
+                                                }
+                                        case n == 48: // set background color.
+                                                if i < len(token)-2 && token[i+1] == "5" {
+                                                        if n256, err := strconv.Atoi(token[i+2]); err == nil {
+                                                                if n256backAttr == nil {
+                                                                        n256setup()
+                                                                }
+                                                                attr &= foregroundMask
+                                                                attr |= n256backAttr[n256]
+                                                                i += 2
+                                                        }
+                                                } else if len(token) == 5 && token[i+1] == "2" {
+                                                        var r, g, b int
+                                                        r, _ = strconv.Atoi(token[i+2])
+                                                        g, _ = strconv.Atoi(token[i+3])
+                                                        b, _ = strconv.Atoi(token[i+4])
+                                                        i += 4
+                                                        if r > 127 {
+                                                                attr |= backgroundRed
+                                                        }
+                                                        if g > 127 {
+                                                                attr |= backgroundGreen
+                                                        }
+                                                        if b > 127 {
+                                                                attr |= backgroundBlue
+                                                        }
+                                                } else {
+                                                        attr = attr & (w.oldattr & foregroundMask)
+                                                }
+                                        case n == 49: // reset foreground color.
+                                                attr &= foregroundMask
+                                                attr |= w.oldattr & backgroundMask
+                                        case 90 <= n && n <= 97:
+                                                attr = (attr & backgroundMask)
+                                                attr |= foregroundIntensity
+                                                if (n-90)&1 != 0 {
+                                                        attr |= foregroundRed
+                                                }
+                                                if (n-90)&2 != 0 {
+                                                        attr |= foregroundGreen
+                                                }
+                                                if (n-90)&4 != 0 {
+                                                        attr |= foregroundBlue
+                                                }
+                                        case 100 <= n && n <= 107:
+                                                attr = (attr & foregroundMask)
+                                                attr |= backgroundIntensity
+                                                if (n-100)&1 != 0 {
+                                                        attr |= backgroundRed
+                                                }
+                                                if (n-100)&2 != 0 {
+                                                        attr |= backgroundGreen
+                                                }
+                                                if (n-100)&4 != 0 {
+                                                        attr |= backgroundBlue
+                                                }
+                                        }
+                                        procSetConsoleTextAttribute.Call(uintptr(handle), uintptr(attr))
+                                }
+                        }
+                case 'h':
+                        var ci consoleCursorInfo
+                        cs := buf.String()
+                        if cs == "5>" {
+                                procGetConsoleCursorInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&ci)))
+                                ci.visible = 0
+                                procSetConsoleCursorInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&ci)))
+                        } else if cs == "?25" {
+                                procGetConsoleCursorInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&ci)))
+                                ci.visible = 1
+                                procSetConsoleCursorInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&ci)))
+                        } else if cs == "?1049" {
+                                if w.althandle == 0 {
+                                        h, _, _ := procCreateConsoleScreenBuffer.Call(uintptr(genericRead|genericWrite), 0, 0, uintptr(consoleTextmodeBuffer), 0, 0)
+                                        w.althandle = syscall.Handle(h)
+                                        if w.althandle != 0 {
+                                                handle = w.althandle
+                                        }
+                                }
+                        }
+                case 'l':
+                        var ci consoleCursorInfo
+                        cs := buf.String()
+                        if cs == "5>" {
+                                procGetConsoleCursorInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&ci)))
+                                ci.visible = 1
+                                procSetConsoleCursorInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&ci)))
+                        } else if cs == "?25" {
+                                procGetConsoleCursorInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&ci)))
+                                ci.visible = 0
+                                procSetConsoleCursorInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&ci)))
+                        } else if cs == "?1049" {
+                                if w.althandle != 0 {
+                                        syscall.CloseHandle(w.althandle)
+                                        w.althandle = 0
+                                        handle = w.handle
+                                }
+                        }
+                case 's':
+                        procGetConsoleScreenBufferInfo.Call(uintptr(handle), uintptr(unsafe.Pointer(&csbi)))
+                        w.oldpos = csbi.cursorPosition
+                case 'u':
+                        procSetConsoleCursorPosition.Call(uintptr(handle), *(*uintptr)(unsafe.Pointer(&w.oldpos)))
+                }
+        }
+
+        return len(data), nil
+}
+
+type consoleColor struct {
+        rgb       int
+        red       bool
+        green     bool
+        blue      bool
+        intensity bool
+}
+
+func (c consoleColor) foregroundAttr() (attr word) {
+        if c.red {
+                attr |= foregroundRed
+        }
+        if c.green {
+                attr |= foregroundGreen
+        }
+        if c.blue {
+                attr |= foregroundBlue
+        }
+        if c.intensity {
+                attr |= foregroundIntensity
+        }
+        return
+}
+
+func (c consoleColor) backgroundAttr() (attr word) {
+        if c.red {
+                attr |= backgroundRed
+        }
+        if c.green {
+                attr |= backgroundGreen
+        }
+        if c.blue {
+                attr |= backgroundBlue
+        }
+        if c.intensity {
+                attr |= backgroundIntensity
+        }
+        return
+}
+
+var color16 = []consoleColor{
+        {0x000000, false, false, false, false},
+        {0x000080, false, false, true, false},
+        {0x008000, false, true, false, false},
+        {0x008080, false, true, true, false},
+        {0x800000, true, false, false, false},
+        {0x800080, true, false, true, false},
+        {0x808000, true, true, false, false},
+        {0xc0c0c0, true, true, true, false},
+        {0x808080, false, false, false, true},
+        {0x0000ff, false, false, true, true},
+        {0x00ff00, false, true, false, true},
+        {0x00ffff, false, true, true, true},
+        {0xff0000, true, false, false, true},
+        {0xff00ff, true, false, true, true},
+        {0xffff00, true, true, false, true},
+        {0xffffff, true, true, true, true},
+}
+
+type hsv struct {
+        h, s, v float32
+}
+
+func (a hsv) dist(b hsv) float32 {
+        dh := a.h - b.h
+        switch {
+        case dh > 0.5:
+                dh = 1 - dh
+        case dh < -0.5:
+                dh = -1 - dh
+        }
+        ds := a.s - b.s
+        dv := a.v - b.v
+        return float32(math.Sqrt(float64(dh*dh + ds*ds + dv*dv)))
+}
+
+func toHSV(rgb int) hsv {
+        r, g, b := float32((rgb&0xFF0000)>>16)/256.0,
+                float32((rgb&0x00FF00)>>8)/256.0,
+                float32(rgb&0x0000FF)/256.0
+        min, max := minmax3f(r, g, b)
+        h := max - min
+        if h > 0 {
+                if max == r {
+                        h = (g - b) / h
+                        if h < 0 {
+                                h += 6
+                        }
+                } else if max == g {
+                        h = 2 + (b-r)/h
+                } else {
+                        h = 4 + (r-g)/h
+                }
+        }
+        h /= 6.0
+        s := max - min
+        if max != 0 {
+                s /= max
+        }
+        v := max
+        return hsv{h: h, s: s, v: v}
+}
+
+type hsvTable []hsv
+
+func toHSVTable(rgbTable []consoleColor) hsvTable {
+        t := make(hsvTable, len(rgbTable))
+        for i, c := range rgbTable {
+                t[i] = toHSV(c.rgb)
+        }
+        return t
+}
+
+func (t hsvTable) find(rgb int) consoleColor {
+        hsv := toHSV(rgb)
+        n := 7
+        l := float32(5.0)
+        for i, p := range t {
+                d := hsv.dist(p)
+                if d < l {
+                        l, n = d, i
+                }
+        }
+        return color16[n]
+}
+
+func minmax3f(a, b, c float32) (min, max float32) {
+        if a < b {
+                if b < c {
+                        return a, c
+                } else if a < c {
+                        return a, b
+                } else {
+                        return c, b
+                }
+        } else {
+                if a < c {
+                        return b, c
+                } else if b < c {
+                        return b, a
+                } else {
+                        return c, a
+                }
+        }
+}
+
+var n256foreAttr []word
+var n256backAttr []word
+
+func n256setup() {
+        n256foreAttr = make([]word, 256)
+        n256backAttr = make([]word, 256)
+        t := toHSVTable(color16)
+        for i, rgb := range color256 {
+                c := t.find(rgb)
+                n256foreAttr[i] = c.foregroundAttr()
+                n256backAttr[i] = c.backgroundAttr()
+        }
+}
diff --git a/vendor/github.com/mattn/go-colorable/go.mod b/vendor/github.com/mattn/go-colorable/go.mod
new file mode 100644
index 0000000..9d9f424
--- /dev/null
+++ b/vendor/github.com/mattn/go-colorable/go.mod
@@ -0,0 +1,3 @@
+module github.com/mattn/go-colorable
+
+require github.com/mattn/go-isatty v0.0.5
diff --git a/vendor/github.com/mattn/go-colorable/go.sum b/vendor/github.com/mattn/go-colorable/go.sum
new file mode 100644
index 0000000..2c12960
--- /dev/null
+++ b/vendor/github.com/mattn/go-colorable/go.sum
@@ -0,0 +1,4 @@
+github.com/mattn/go-isatty v0.0.5 h1:tHXDdz1cpzGaovsTB+TVB8q90WEokoVmfMqoVcrLUgw=
+github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223 h1:DH4skfRX4EBpamg7iV4ZlCpblAHI6s6TDM39bFZumv8=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
diff --git a/vendor/github.com/mattn/go-colorable/noncolorable.go b/vendor/github.com/mattn/go-colorable/noncolorable.go
new file mode 100644
index 0000000..9721e16
--- /dev/null
+++ b/vendor/github.com/mattn/go-colorable/noncolorable.go
@@ -0,0 +1,55 @@
+package colorable
+
+import (
+        "bytes"
+        "io"
+)
+
+// NonColorable hold writer but remove escape sequence.
+type NonColorable struct {
+        out io.Writer
+}
+
+// NewNonColorable return new instance of Writer which remove escape sequence from Writer.
+func NewNonColorable(w io.Writer) io.Writer {
+        return &NonColorable{out: w}
+}
+
+// Write write data on console
+func (w *NonColorable) Write(data []byte) (n int, err error) {
+        er := bytes.NewReader(data)
+        var bw [1]byte
+loop:
+        for {
+                c1, err := er.ReadByte()
+                if err != nil {
+                        break loop
+                }
+                if c1 != 0x1b {
+                        bw[0] = c1
+                        w.out.Write(bw[:])
+                        continue
+                }
+                c2, err := er.ReadByte()
+                if err != nil {
+                        break loop
+                }
+                if c2 != 0x5b {
+                        continue
+                }
+
+                var buf bytes.Buffer
+                for {
+                        c, err := er.ReadByte()
+                        if err != nil {
+                                break loop
+                        }
+                        if ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z') || c == '@' {
+                                break
+                        }
+                        buf.Write([]byte(string(c)))
+                }
+        }
+
+        return len(data), nil
+}
diff --git a/vendor/github.com/mattn/go-isatty/.travis.yml b/vendor/github.com/mattn/go-isatty/.travis.yml
new file mode 100644
index 0000000..5597e02
--- /dev/null
+++ b/vendor/github.com/mattn/go-isatty/.travis.yml
@@ -0,0 +1,13 @@
+language: go
+go:
+  - tip
+
+os:
+  - linux
+  - osx
+
+before_install:
+  - go get github.com/mattn/goveralls
+  - go get golang.org/x/tools/cmd/cover
+script:
+  - $HOME/gopath/bin/goveralls -repotoken 3gHdORO5k5ziZcWMBxnd9LrMZaJs8m9x5
diff --git a/vendor/github.com/mattn/go-isatty/README.md b/vendor/github.com/mattn/go-isatty/README.md
index 74845de..1e69004 100644
--- a/vendor/github.com/mattn/go-isatty/README.md
+++ b/vendor/github.com/mattn/go-isatty/README.md
@@ -1,5 +1,10 @@
 # go-isatty
 
+[![Godoc Reference](https://godoc.org/github.com/mattn/go-isatty?status.svg)](http://godoc.org/github.com/mattn/go-isatty)
+[![Build Status](https://travis-ci.org/mattn/go-isatty.svg?branch=master)](https://travis-ci.org/mattn/go-isatty)
+[![Coverage Status](https://coveralls.io/repos/github/mattn/go-isatty/badge.svg?branch=master)](https://coveralls.io/github/mattn/go-isatty?branch=master)
+[![Go Report Card](https://goreportcard.com/badge/mattn/go-isatty)](https://goreportcard.com/report/mattn/go-isatty)
+
 isatty for golang
 
 ## Usage
@@ -16,6 +21,8 @@ import (
 func main() {
         if isatty.IsTerminal(os.Stdout.Fd()) {
                 fmt.Println("Is Terminal")
+        } else if isatty.IsCygwinTerminal(os.Stdout.Fd()) {
+                fmt.Println("Is Cygwin/MSYS2 Terminal")
         } else {
                 fmt.Println("Is Not Terminal")
         }
@@ -28,10 +35,16 @@ func main() {
 $ go get github.com/mattn/go-isatty
 ```
 
-# License
+## License
 
 MIT
 
-# Author
+## Author
 
 Yasuhiro Matsumoto (a.k.a mattn)
+
+## Thanks
+
+* k-takata: base idea for IsCygwinTerminal
+
+    https://github.com/k-takata/go-iscygpty
diff --git a/vendor/github.com/mattn/go-isatty/go.mod b/vendor/github.com/mattn/go-isatty/go.mod
new file mode 100644
index 0000000..f310320
--- /dev/null
+++ b/vendor/github.com/mattn/go-isatty/go.mod
@@ -0,0 +1,3 @@
+module github.com/mattn/go-isatty
+
+require golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223
diff --git a/vendor/github.com/mattn/go-isatty/go.sum b/vendor/github.com/mattn/go-isatty/go.sum
new file mode 100644
index 0000000..426c897
--- /dev/null
+++ b/vendor/github.com/mattn/go-isatty/go.sum
@@ -0,0 +1,2 @@
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223 h1:DH4skfRX4EBpamg7iV4ZlCpblAHI6s6TDM39bFZumv8=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
diff --git a/vendor/github.com/mattn/go-isatty/isatty_appengine.go b/vendor/github.com/mattn/go-isatty/isatty_appengine.go
deleted file mode 100644
index 83c5887..0000000
--- a/vendor/github.com/mattn/go-isatty/isatty_appengine.go
+++ /dev/null
@@ -1,9 +0,0 @@
-// +build appengine
-
-package isatty
-
-// IsTerminal returns true if the file descriptor is terminal which
-// is always false on on appengine classic which is a sandboxed PaaS.
-func IsTerminal(fd uintptr) bool {
-        return false
-}
diff --git a/vendor/github.com/mattn/go-isatty/isatty_bsd.go b/vendor/github.com/mattn/go-isatty/isatty_bsd.go
index 42f2514..07e9303 100644
--- a/vendor/github.com/mattn/go-isatty/isatty_bsd.go
+++ b/vendor/github.com/mattn/go-isatty/isatty_bsd.go
@@ -16,3 +16,9 @@ func IsTerminal(fd uintptr) bool {
         _, _, err := syscall.Syscall6(syscall.SYS_IOCTL, fd, ioctlReadTermios, uintptr(unsafe.Pointer(&termios)), 0, 0, 0)
         return err == 0
 }
+
+// IsCygwinTerminal return true if the file descriptor is a cygwin or msys2
+// terminal. This is also always false on this environment.
+func IsCygwinTerminal(fd uintptr) bool {
+        return false
+}
diff --git a/vendor/github.com/mattn/go-isatty/isatty_linux.go b/vendor/github.com/mattn/go-isatty/isatty_linux.go
index 9d24bac..e004038 100644
--- a/vendor/github.com/mattn/go-isatty/isatty_linux.go
+++ b/vendor/github.com/mattn/go-isatty/isatty_linux.go
@@ -3,16 +3,16 @@
 
 package isatty
 
-import (
-        "syscall"
-        "unsafe"
-)
-
-const ioctlReadTermios = syscall.TCGETS
+import "golang.org/x/sys/unix"
 
 // IsTerminal return true if the file descriptor is terminal.
 func IsTerminal(fd uintptr) bool {
-        var termios syscall.Termios
-        _, _, err := syscall.Syscall6(syscall.SYS_IOCTL, fd, ioctlReadTermios, uintptr(unsafe.Pointer(&termios)), 0, 0, 0)
-        return err == 0
+        _, err := unix.IoctlGetTermios(int(fd), unix.TCGETS)
+        return err == nil
+}
+
+// IsCygwinTerminal return true if the file descriptor is a cygwin or msys2
+// terminal. This is also always false on this environment.
+func IsCygwinTerminal(fd uintptr) bool {
+        return false
 }
diff --git a/vendor/github.com/mattn/go-isatty/isatty_others.go b/vendor/github.com/mattn/go-isatty/isatty_others.go
new file mode 100644
index 0000000..f02849c
--- /dev/null
+++ b/vendor/github.com/mattn/go-isatty/isatty_others.go
@@ -0,0 +1,15 @@
+// +build appengine js
+
+package isatty
+
+// IsTerminal returns true if the file descriptor is terminal which
+// is always false on js and appengine classic which is a sandboxed PaaS.
+func IsTerminal(fd uintptr) bool {
+        return false
+}
+
+// IsCygwinTerminal() return true if the file descriptor is a cygwin or msys2
+// terminal. This is also always false on this environment.
+func IsCygwinTerminal(fd uintptr) bool {
+        return false
+}
diff --git a/vendor/github.com/mattn/go-isatty/isatty_solaris.go b/vendor/github.com/mattn/go-isatty/isatty_solaris.go
index 1f0c6bf..bdd5c79 100644
--- a/vendor/github.com/mattn/go-isatty/isatty_solaris.go
+++ b/vendor/github.com/mattn/go-isatty/isatty_solaris.go
@@ -14,3 +14,9 @@ func IsTerminal(fd uintptr) bool {
         err := unix.IoctlSetTermio(int(fd), unix.TCGETA, &termio)
         return err == nil
 }
+
+// IsCygwinTerminal return true if the file descriptor is a cygwin or msys2
+// terminal. This is also always false on this environment.
+func IsCygwinTerminal(fd uintptr) bool {
+        return false
+}
diff --git a/vendor/github.com/mattn/go-isatty/isatty_windows.go b/vendor/github.com/mattn/go-isatty/isatty_windows.go
index 83c398b..af51cbc 100644
--- a/vendor/github.com/mattn/go-isatty/isatty_windows.go
+++ b/vendor/github.com/mattn/go-isatty/isatty_windows.go
@@ -4,12 +4,30 @@
 package isatty
 
 import (
+        "strings"
         "syscall"
+        "unicode/utf16"
         "unsafe"
 )
 
-var kernel32 = syscall.NewLazyDLL("kernel32.dll")
-var procGetConsoleMode = kernel32.NewProc("GetConsoleMode")
+const (
+        fileNameInfo uintptr = 2
+        fileTypePipe         = 3
+)
+
+var (
+        kernel32                         = syscall.NewLazyDLL("kernel32.dll")
+        procGetConsoleMode               = kernel32.NewProc("GetConsoleMode")
+        procGetFileInformationByHandleEx = kernel32.NewProc("GetFileInformationByHandleEx")
+        procGetFileType                  = kernel32.NewProc("GetFileType")
+)
+
+func init() {
+        // Check if GetFileInformationByHandleEx is available.
+        if procGetFileInformationByHandleEx.Find() != nil {
+                procGetFileInformationByHandleEx = nil
+        }
+}
 
 // IsTerminal return true if the file descriptor is terminal.
 func IsTerminal(fd uintptr) bool {
@@ -17,3 +35,60 @@ func IsTerminal(fd uintptr) bool {
         r, _, e := syscall.Syscall(procGetConsoleMode.Addr(), 2, fd, uintptr(unsafe.Pointer(&st)), 0)
         return r != 0 && e == 0
 }
+
+// Check pipe name is used for cygwin/msys2 pty.
+// Cygwin/MSYS2 PTY has a name like:
+//   \{cygwin,msys}-XXXXXXXXXXXXXXXX-ptyN-{from,to}-master
+func isCygwinPipeName(name string) bool {
+        token := strings.Split(name, "-")
+        if len(token) < 5 {
+                return false
+        }
+
+        if token[0] != `\msys` && token[0] != `\cygwin` {
+                return false
+        }
+
+        if token[1] == "" {
+                return false
+        }
+
+        if !strings.HasPrefix(token[2], "pty") {
+                return false
+        }
+
+        if token[3] != `from` && token[3] != `to` {
+                return false
+        }
+
+        if token[4] != "master" {
+                return false
+        }
+
+        return true
+}
+
+// IsCygwinTerminal() return true if the file descriptor is a cygwin or msys2
+// terminal.
+func IsCygwinTerminal(fd uintptr) bool {
+        if procGetFileInformationByHandleEx == nil {
+                return false
+        }
+
+        // Cygwin/msys's pty is a pipe.
+        ft, _, e := syscall.Syscall(procGetFileType.Addr(), 1, fd, 0, 0)
+        if ft != fileTypePipe || e != 0 {
+                return false
+        }
+
+        var buf [2 + syscall.MAX_PATH]uint16
+        r, _, e := syscall.Syscall6(procGetFileInformationByHandleEx.Addr(),
+                4, fd, fileNameInfo, uintptr(unsafe.Pointer(&buf)),
+                uintptr(len(buf)*2), 0, 0)
+        if r == 0 || e != 0 {
+                return false
+        }
+
+        l := *(*uint32)(unsafe.Pointer(&buf))
+        return isCygwinPipeName(string(utf16.Decode(buf[2 : 2+l/2])))
+}
diff --git a/vendor/github.com/mitchellh/cli/.travis.yml b/vendor/github.com/mitchellh/cli/.travis.yml
index 974234b..b8599b3 100644
--- a/vendor/github.com/mitchellh/cli/.travis.yml
+++ b/vendor/github.com/mitchellh/cli/.travis.yml
@@ -3,8 +3,9 @@ sudo: false
 language: go
 
 go:
-  - 1.8
-  - 1.9
+  - "1.8"
+  - "1.9"
+  - "1.10"
 
 branches:
   only:
diff --git a/vendor/github.com/mitchellh/cli/cli.go b/vendor/github.com/mitchellh/cli/cli.go
index a25a582..c2dbe55 100644
--- a/vendor/github.com/mitchellh/cli/cli.go
+++ b/vendor/github.com/mitchellh/cli/cli.go
@@ -87,7 +87,7 @@ type CLI struct {
         // should be set exactly to the binary name that is autocompleted.
         //
         // Autocompletion is supported via the github.com/posener/complete
-        // library. This library supports both bash and zsh. To add support
+        // library. This library supports bash, zsh and fish. To add support
         // for other shells, please see that library.
         //
         // AutocompleteInstall and AutocompleteUninstall are the global flag
@@ -419,6 +419,11 @@ func (c *CLI) initAutocomplete() {
 func (c *CLI) initAutocompleteSub(prefix string) complete.Command {
         var cmd complete.Command
         walkFn := func(k string, raw interface{}) bool {
+                // Ignore the empty key which can be present for default commands.
+                if k == "" {
+                        return false
+                }
+
                 // Keep track of the full key so that we can nest further if necessary
                 fullKey := k
 
diff --git a/vendor/github.com/mitchellh/cli/go.mod b/vendor/github.com/mitchellh/cli/go.mod
new file mode 100644
index 0000000..675325f
--- /dev/null
+++ b/vendor/github.com/mitchellh/cli/go.mod
@@ -0,0 +1,12 @@
+module github.com/mitchellh/cli
+
+require (
+        github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310
+        github.com/bgentry/speakeasy v0.1.0
+        github.com/fatih/color v1.7.0
+        github.com/hashicorp/go-multierror v1.0.0 // indirect
+        github.com/mattn/go-colorable v0.0.9 // indirect
+        github.com/mattn/go-isatty v0.0.3
+        github.com/posener/complete v1.1.1
+        golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc // indirect
+)
diff --git a/vendor/github.com/mitchellh/cli/go.sum b/vendor/github.com/mitchellh/cli/go.sum
new file mode 100644
index 0000000..0370875
--- /dev/null
+++ b/vendor/github.com/mitchellh/cli/go.sum
@@ -0,0 +1,22 @@
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310 h1:BUAU3CGlLvorLI26FmByPp2eC2qla6E1Tw+scpcg/to=
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
+github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/hashicorp/errwrap v0.0.0-20180715044906-d6c0cd880357 h1:Rem2+U35z1QtPQc6r+WolF7yXiefXqDKyk+lN2pE164=
+github.com/hashicorp/errwrap v0.0.0-20180715044906-d6c0cd880357/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v0.0.0-20180717150148-3d5d8f294aa0 h1:j30noezaCfvNLcdMYSvHLv81DxYRSt1grlpseG67vhU=
+github.com/hashicorp/go-multierror v0.0.0-20180717150148-3d5d8f294aa0/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
+github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
+github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.3 h1:ns/ykhmWi7G9O+8a448SecJU3nSMBXJfqQkl0upE1jI=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/posener/complete v1.1.1 h1:ccV59UEOTzVDnDUEFdT95ZzHVZ+5+158q8+SJb2QV5w=
+github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc h1:MeuS1UDyZyFH++6vVy44PuufTeFF0d0nfI6XB87YGSk=
+golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
diff --git a/vendor/github.com/mitchellh/cli/ui_colored.go b/vendor/github.com/mitchellh/cli/ui_colored.go
index e3d5131..b0ec448 100644
--- a/vendor/github.com/mitchellh/cli/ui_colored.go
+++ b/vendor/github.com/mitchellh/cli/ui_colored.go
@@ -1,7 +1,11 @@
 package cli
 
 import (
-        "fmt"
+        "github.com/fatih/color"
+)
+
+const (
+        noColor = -1
 )
 
 // UiColor is a posix shell color code to use.
@@ -12,13 +16,13 @@ type UiColor struct {
 
 // A list of colors that are useful. These are all non-bolded by default.
 var (
-        UiColorNone    UiColor = UiColor{-1, false}
-        UiColorRed             = UiColor{31, false}
-        UiColorGreen           = UiColor{32, false}
-        UiColorYellow          = UiColor{33, false}
-        UiColorBlue            = UiColor{34, false}
-        UiColorMagenta         = UiColor{35, false}
-        UiColorCyan            = UiColor{36, false}
+        UiColorNone    UiColor = UiColor{noColor, false}
+        UiColorRed             = UiColor{int(color.FgHiRed), false}
+        UiColorGreen           = UiColor{int(color.FgHiGreen), false}
+        UiColorYellow          = UiColor{int(color.FgHiYellow), false}
+        UiColorBlue            = UiColor{int(color.FgHiBlue), false}
+        UiColorMagenta         = UiColor{int(color.FgHiMagenta), false}
+        UiColorCyan            = UiColor{int(color.FgHiCyan), false}
 )
 
 // ColoredUi is a Ui implementation that colors its output according
@@ -55,15 +59,15 @@ func (u *ColoredUi) Warn(message string) {
         u.Ui.Warn(u.colorize(message, u.WarnColor))
 }
 
-func (u *ColoredUi) colorize(message string, color UiColor) string {
-        if color.Code == -1 {
+func (u *ColoredUi) colorize(message string, uc UiColor) string {
+        if uc.Code == noColor {
                 return message
         }
 
-        attr := 0
-        if color.Bold {
-                attr = 1
+        attr := []color.Attribute{color.Attribute(uc.Code)}
+        if uc.Bold {
+                attr = append(attr, color.Bold)
         }
 
-        return fmt.Sprintf("\033[%d;%dm%s\033[0m", attr, color.Code, message)
+        return color.New(attr...).SprintFunc()(message)
 }
diff --git a/vendor/github.com/mitchellh/colorstring/.travis.yml b/vendor/github.com/mitchellh/colorstring/.travis.yml
new file mode 100644
index 0000000..74e286a
--- /dev/null
+++ b/vendor/github.com/mitchellh/colorstring/.travis.yml
@@ -0,0 +1,15 @@
+language: go
+
+go:
+    - 1.0
+    - 1.1
+    - 1.2
+    - 1.3
+    - tip
+
+script:
+    - go test
+
+matrix:
+    allow_failures:
+        - go: tip
diff --git a/vendor/github.com/mitchellh/colorstring/LICENSE b/vendor/github.com/mitchellh/colorstring/LICENSE
new file mode 100644
index 0000000..2298515
--- /dev/null
+++ b/vendor/github.com/mitchellh/colorstring/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Mitchell Hashimoto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/vendor/github.com/mitchellh/colorstring/README.md b/vendor/github.com/mitchellh/colorstring/README.md
new file mode 100644
index 0000000..0654d45
--- /dev/null
+++ b/vendor/github.com/mitchellh/colorstring/README.md
@@ -0,0 +1,30 @@
+# colorstring [![Build Status](https://travis-ci.org/mitchellh/colorstring.svg)](https://travis-ci.org/mitchellh/colorstring)
+
+colorstring is a [Go](http://www.golang.org) library for outputting colored
+strings to a console using a simple inline syntax in your string to specify
+the color to print as.
+
+For example, the string `[blue]hello [red]world` would output the text
+"hello world" in two colors. The API of colorstring allows for easily disabling
+colors, adding aliases, etc.
+
+## Installation
+
+Standard `go get`:
+
+```
+$ go get github.com/mitchellh/colorstring
+```
+
+## Usage & Example
+
+For usage and examples see the [Godoc](http://godoc.org/github.com/mitchellh/colorstring).
+
+Usage is easy enough:
+
+```go
+colorstring.Println("[blue]Hello [red]World!")
+```
+
+Additionally, the `Colorize` struct can be used to set options such as
+custom colors, color disabling, etc.
diff --git a/vendor/github.com/mitchellh/colorstring/colorstring.go b/vendor/github.com/mitchellh/colorstring/colorstring.go
new file mode 100644
index 0000000..3de5b24
--- /dev/null
+++ b/vendor/github.com/mitchellh/colorstring/colorstring.go
@@ -0,0 +1,244 @@
+// colorstring provides functions for colorizing strings for terminal
+// output.
+package colorstring
+
+import (
+        "bytes"
+        "fmt"
+        "io"
+        "regexp"
+        "strings"
+)
+
+// Color colorizes your strings using the default settings.
+//
+// Strings given to Color should use the syntax `[color]` to specify the
+// color for text following. For example: `[blue]Hello` will return "Hello"
+// in blue. See DefaultColors for all the supported colors and attributes.
+//
+// If an unrecognized color is given, it is ignored and assumed to be part
+// of the string. For example: `[hi]world` will result in "[hi]world".
+//
+// A color reset is appended to the end of every string. This will reset
+// the color of following strings when you output this text to the same
+// terminal session.
+//
+// If you want to customize any of this behavior, use the Colorize struct.
+func Color(v string) string {
+        return def.Color(v)
+}
+
+// ColorPrefix returns the color sequence that prefixes the given text.
+//
+// This is useful when wrapping text if you want to inherit the color
+// of the wrapped text. For example, "[green]foo" will return "[green]".
+// If there is no color sequence, then this will return "".
+func ColorPrefix(v string) string {
+        return def.ColorPrefix(v)
+}
+
+// Colorize colorizes your strings, giving you the ability to customize
+// some of the colorization process.
+//
+// The options in Colorize can be set to customize colorization. If you're
+// only interested in the defaults, just use the top Color function directly,
+// which creates a default Colorize.
+type Colorize struct {
+        // Colors maps a color string to the code for that color. The code
+        // is a string so that you can use more complex colors to set foreground,
+        // background, attributes, etc. For example, "boldblue" might be
+        // "1;34"
+        Colors map[string]string
+
+        // If true, color attributes will be ignored. This is useful if you're
+        // outputting to a location that doesn't support colors and you just
+        // want the strings returned.
+        Disable bool
+
+        // Reset, if true, will reset the color after each colorization by
+        // adding a reset code at the end.
+        Reset bool
+}
+
+// Color colorizes a string according to the settings setup in the struct.
+//
+// For more details on the syntax, see the top-level Color function.
+func (c *Colorize) Color(v string) string {
+        matches := parseRe.FindAllStringIndex(v, -1)
+        if len(matches) == 0 {
+                return v
+        }
+
+        result := new(bytes.Buffer)
+        colored := false
+        m := []int{0, 0}
+        for _, nm := range matches {
+                // Write the text in between this match and the last
+                result.WriteString(v[m[1]:nm[0]])
+                m = nm
+
+                var replace string
+                if code, ok := c.Colors[v[m[0]+1:m[1]-1]]; ok {
+                        colored = true
+
+                        if !c.Disable {
+                                replace = fmt.Sprintf("\033[%sm", code)
+                        }
+                } else {
+                        replace = v[m[0]:m[1]]
+                }
+
+                result.WriteString(replace)
+        }
+        result.WriteString(v[m[1]:])
+
+        if colored && c.Reset && !c.Disable {
+                // Write the clear byte at the end
+                result.WriteString("\033[0m")
+        }
+
+        return result.String()
+}
+
+// ColorPrefix returns the first color sequence that exists in this string.
+//
+// For example: "[green]foo" would return "[green]". If no color sequence
+// exists, then "" is returned. This is especially useful when wrapping
+// colored texts to inherit the color of the wrapped text.
+func (c *Colorize) ColorPrefix(v string) string {
+        return prefixRe.FindString(strings.TrimSpace(v))
+}
+
+// DefaultColors are the default colors used when colorizing.
+//
+// If the color is surrounded in underscores, such as "_blue_", then that
+// color will be used for the background color.
+var DefaultColors map[string]string
+
+func init() {
+        DefaultColors = map[string]string{
+                // Default foreground/background colors
+                "default":   "39",
+                "_default_": "49",
+
+                // Foreground colors
+                "black":         "30",
+                "red":           "31",
+                "green":         "32",
+                "yellow":        "33",
+                "blue":          "34",
+                "magenta":       "35",
+                "cyan":          "36",
+                "light_gray":    "37",
+                "dark_gray":     "90",
+                "light_red":     "91",
+                "light_green":   "92",
+                "light_yellow":  "93",
+                "light_blue":    "94",
+                "light_magenta": "95",
+                "light_cyan":    "96",
+                "white":         "97",
+
+                // Background colors
+                "_black_":         "40",
+                "_red_":           "41",
+                "_green_":         "42",
+                "_yellow_":        "43",
+                "_blue_":          "44",
+                "_magenta_":       "45",
+                "_cyan_":          "46",
+                "_light_gray_":    "47",
+                "_dark_gray_":     "100",
+                "_light_red_":     "101",
+                "_light_green_":   "102",
+                "_light_yellow_":  "103",
+                "_light_blue_":    "104",
+                "_light_magenta_": "105",
+                "_light_cyan_":    "106",
+                "_white_":         "107",
+
+                // Attributes
+                "bold":       "1",
+                "dim":        "2",
+                "underline":  "4",
+                "blink_slow": "5",
+                "blink_fast": "6",
+                "invert":     "7",
+                "hidden":     "8",
+
+                // Reset to reset everything to their defaults
+                "reset":      "0",
+                "reset_bold": "21",
+        }
+
+        def = Colorize{
+                Colors: DefaultColors,
+                Reset:  true,
+        }
+}
+
+var def Colorize
+var parseReRaw = `\[[a-z0-9_-]+\]`
+var parseRe = regexp.MustCompile(`(?i)` + parseReRaw)
+var prefixRe = regexp.MustCompile(`^(?i)(` + parseReRaw + `)+`)
+
+// Print is a convenience wrapper for fmt.Print with support for color codes.
+//
+// Print formats using the default formats for its operands and writes to
+// standard output with support for color codes. Spaces are added between
+// operands when neither is a string. It returns the number of bytes written
+// and any write error encountered.
+func Print(a string) (n int, err error) {
+        return fmt.Print(Color(a))
+}
+
+// Println is a convenience wrapper for fmt.Println with support for color
+// codes.
+//
+// Println formats using the default formats for its operands and writes to
+// standard output with support for color codes. Spaces are always added
+// between operands and a newline is appended. It returns the number of bytes
+// written and any write error encountered.
+func Println(a string) (n int, err error) {
+        return fmt.Println(Color(a))
+}
+
+// Printf is a convenience wrapper for fmt.Printf with support for color codes.
+//
+// Printf formats according to a format specifier and writes to standard output
+// with support for color codes. It returns the number of bytes written and any
+// write error encountered.
+func Printf(format string, a ...interface{}) (n int, err error) {
+        return fmt.Printf(Color(format), a...)
+}
+
+// Fprint is a convenience wrapper for fmt.Fprint with support for color codes.
+//
+// Fprint formats using the default formats for its operands and writes to w
+// with support for color codes. Spaces are added between operands when neither
+// is a string. It returns the number of bytes written and any write error
+// encountered.
+func Fprint(w io.Writer, a string) (n int, err error) {
+        return fmt.Fprint(w, Color(a))
+}
+
+// Fprintln is a convenience wrapper for fmt.Fprintln with support for color
+// codes.
+//
+// Fprintln formats using the default formats for its operands and writes to w
+// with support for color codes. Spaces are always added between operands and a
+// newline is appended. It returns the number of bytes written and any write
+// error encountered.
+func Fprintln(w io.Writer, a string) (n int, err error) {
+        return fmt.Fprintln(w, Color(a))
+}
+
+// Fprintf is a convenience wrapper for fmt.Fprintf with support for color
+// codes.
+//
+// Fprintf formats according to a format specifier and writes to w with support
+// for color codes. It returns the number of bytes written and any write error
+// encountered.
+func Fprintf(w io.Writer, format string, a ...interface{}) (n int, err error) {
+        return fmt.Fprintf(w, Color(format), a...)
+}
diff --git a/vendor/github.com/mitchellh/colorstring/go.mod b/vendor/github.com/mitchellh/colorstring/go.mod
new file mode 100644
index 0000000..446ff8d
--- /dev/null
+++ b/vendor/github.com/mitchellh/colorstring/go.mod
@@ -0,0 +1 @@
+module github.com/mitchellh/colorstring
diff --git a/vendor/github.com/mitchellh/copystructure/go.mod b/vendor/github.com/mitchellh/copystructure/go.mod
new file mode 100644
index 0000000..d018643
--- /dev/null
+++ b/vendor/github.com/mitchellh/copystructure/go.mod
@@ -0,0 +1,3 @@
+module github.com/mitchellh/copystructure
+
+require github.com/mitchellh/reflectwalk v1.0.0
diff --git a/vendor/github.com/mitchellh/copystructure/go.sum b/vendor/github.com/mitchellh/copystructure/go.sum
new file mode 100644
index 0000000..be57245
--- /dev/null
+++ b/vendor/github.com/mitchellh/copystructure/go.sum
@@ -0,0 +1,2 @@
+github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
+github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
diff --git a/vendor/github.com/mitchellh/go-homedir/go.mod b/vendor/github.com/mitchellh/go-homedir/go.mod
new file mode 100644
index 0000000..7efa09a
--- /dev/null
+++ b/vendor/github.com/mitchellh/go-homedir/go.mod
@@ -0,0 +1 @@
+module github.com/mitchellh/go-homedir
diff --git a/vendor/github.com/mitchellh/go-homedir/homedir.go b/vendor/github.com/mitchellh/go-homedir/homedir.go
index 47e1f9e..fb87bef 100644
--- a/vendor/github.com/mitchellh/go-homedir/homedir.go
+++ b/vendor/github.com/mitchellh/go-homedir/homedir.go
@@ -77,33 +77,51 @@ func Expand(path string) (string, error) {
 }
 
 func dirUnix() (string, error) {
+        homeEnv := "HOME"
+        if runtime.GOOS == "plan9" {
+                // On plan9, env vars are lowercase.
+                homeEnv = "home"
+        }
+
         // First prefer the HOME environmental variable
-        if home := os.Getenv("HOME"); home != "" {
+        if home := os.Getenv(homeEnv); home != "" {
                 return home, nil
         }
 
-        // If that fails, try getent
         var stdout bytes.Buffer
-        cmd := exec.Command("getent", "passwd", strconv.Itoa(os.Getuid()))
-        cmd.Stdout = &stdout
-        if err := cmd.Run(); err != nil {
-                // If the error is ErrNotFound, we ignore it. Otherwise, return it.
-                if err != exec.ErrNotFound {
-                        return "", err
+
+        // If that fails, try OS specific commands
+        if runtime.GOOS == "darwin" {
+                cmd := exec.Command("sh", "-c", `dscl -q . -read /Users/"$(whoami)" NFSHomeDirectory | sed 's/^[^ ]*: //'`)
+                cmd.Stdout = &stdout
+                if err := cmd.Run(); err == nil {
+                        result := strings.TrimSpace(stdout.String())
+                        if result != "" {
+                                return result, nil
+                        }
                 }
         } else {
-                if passwd := strings.TrimSpace(stdout.String()); passwd != "" {
-                        // username:password:uid:gid:gecos:home:shell
-                        passwdParts := strings.SplitN(passwd, ":", 7)
-                        if len(passwdParts) > 5 {
-                                return passwdParts[5], nil
+                cmd := exec.Command("getent", "passwd", strconv.Itoa(os.Getuid()))
+                cmd.Stdout = &stdout
+                if err := cmd.Run(); err != nil {
+                        // If the error is ErrNotFound, we ignore it. Otherwise, return it.
+                        if err != exec.ErrNotFound {
+                                return "", err
+                        }
+                } else {
+                        if passwd := strings.TrimSpace(stdout.String()); passwd != "" {
+                                // username:password:uid:gid:gecos:home:shell
+                                passwdParts := strings.SplitN(passwd, ":", 7)
+                                if len(passwdParts) > 5 {
+                                        return passwdParts[5], nil
+                                }
                         }
                 }
         }
 
         // If all else fails, try the shell
         stdout.Reset()
-        cmd = exec.Command("sh", "-c", "cd && pwd")
+        cmd := exec.Command("sh", "-c", "cd && pwd")
         cmd.Stdout = &stdout
         if err := cmd.Run(); err != nil {
                 return "", err
@@ -123,14 +141,16 @@ func dirWindows() (string, error) {
                 return home, nil
         }
 
+        // Prefer standard environment variable USERPROFILE
+        if home := os.Getenv("USERPROFILE"); home != "" {
+                return home, nil
+        }
+
         drive := os.Getenv("HOMEDRIVE")
         path := os.Getenv("HOMEPATH")
         home := drive + path
         if drive == "" || path == "" {
-                home = os.Getenv("USERPROFILE")
-        }
-        if home == "" {
-                return "", errors.New("HOMEDRIVE, HOMEPATH, and USERPROFILE are blank")
+                return "", errors.New("HOMEDRIVE, HOMEPATH, or USERPROFILE are blank")
         }
 
         return home, nil
diff --git a/vendor/github.com/mitchellh/go-testing-interface/.travis.yml b/vendor/github.com/mitchellh/go-testing-interface/.travis.yml
index 4c83109..928d000 100644
--- a/vendor/github.com/mitchellh/go-testing-interface/.travis.yml
+++ b/vendor/github.com/mitchellh/go-testing-interface/.travis.yml
@@ -2,6 +2,7 @@ language: go
 
 go:
     - 1.8
+    - 1.x
     - tip
 
 script:
diff --git a/vendor/github.com/mitchellh/go-testing-interface/go.mod b/vendor/github.com/mitchellh/go-testing-interface/go.mod
new file mode 100644
index 0000000..062796d
--- /dev/null
+++ b/vendor/github.com/mitchellh/go-testing-interface/go.mod
@@ -0,0 +1 @@
+module github.com/mitchellh/go-testing-interface
diff --git a/vendor/github.com/mitchellh/go-testing-interface/testing_go19.go b/vendor/github.com/mitchellh/go-testing-interface/testing_go19.go
index 07fbcb5..31b42ca 100644
--- a/vendor/github.com/mitchellh/go-testing-interface/testing_go19.go
+++ b/vendor/github.com/mitchellh/go-testing-interface/testing_go19.go
@@ -19,14 +19,19 @@ import (
 type T interface {
         Error(args ...interface{})
         Errorf(format string, args ...interface{})
-        Fatal(args ...interface{})
-        Fatalf(format string, args ...interface{})
         Fail()
         FailNow()
         Failed() bool
-        Helper()
+        Fatal(args ...interface{})
+        Fatalf(format string, args ...interface{})
         Log(args ...interface{})
         Logf(format string, args ...interface{})
+        Name() string
+        Skip(args ...interface{})
+        SkipNow()
+        Skipf(format string, args ...interface{})
+        Skipped() bool
+        Helper()
 }
 
 // RuntimeT implements T and can be instantiated and run at runtime to
@@ -34,7 +39,8 @@ type T interface {
 // for calls to Fatal. For calls to Error, you'll have to check the errors
 // list to determine whether to exit yourself.
 type RuntimeT struct {
-        failed bool
+        skipped bool
+        failed  bool
 }
 
 func (t *RuntimeT) Error(args ...interface{}) {
@@ -43,20 +49,10 @@ func (t *RuntimeT) Error(args ...interface{}) {
 }
 
 func (t *RuntimeT) Errorf(format string, args ...interface{}) {
-        log.Println(fmt.Sprintf(format, args...))
+        log.Printf(format, args...)
         t.Fail()
 }
 
-func (t *RuntimeT) Fatal(args ...interface{}) {
-        log.Println(fmt.Sprintln(args...))
-        t.FailNow()
-}
-
-func (t *RuntimeT) Fatalf(format string, args ...interface{}) {
-        log.Println(fmt.Sprintf(format, args...))
-        t.FailNow()
-}
-
 func (t *RuntimeT) Fail() {
         t.failed = true
 }
@@ -69,7 +65,15 @@ func (t *RuntimeT) Failed() bool {
         return t.failed
 }
 
-func (t *RuntimeT) Helper() {}
+func (t *RuntimeT) Fatal(args ...interface{}) {
+        log.Print(args...)
+        t.FailNow()
+}
+
+func (t *RuntimeT) Fatalf(format string, args ...interface{}) {
+        log.Printf(format, args...)
+        t.FailNow()
+}
 
 func (t *RuntimeT) Log(args ...interface{}) {
         log.Println(fmt.Sprintln(args...))
@@ -78,3 +82,27 @@ func (t *RuntimeT) Log(args ...interface{}) {
 func (t *RuntimeT) Logf(format string, args ...interface{}) {
         log.Println(fmt.Sprintf(format, args...))
 }
+
+func (t *RuntimeT) Name() string {
+        return ""
+}
+
+func (t *RuntimeT) Skip(args ...interface{}) {
+        log.Print(args...)
+        t.SkipNow()
+}
+
+func (t *RuntimeT) SkipNow() {
+        t.skipped = true
+}
+
+func (t *RuntimeT) Skipf(format string, args ...interface{}) {
+        log.Printf(format, args...)
+        t.SkipNow()
+}
+
+func (t *RuntimeT) Skipped() bool {
+        return t.skipped
+}
+
+func (t *RuntimeT) Helper() {}
diff --git a/vendor/github.com/mitchellh/go-wordwrap/go.mod b/vendor/github.com/mitchellh/go-wordwrap/go.mod
new file mode 100644
index 0000000..2ae411b
--- /dev/null
+++ b/vendor/github.com/mitchellh/go-wordwrap/go.mod
@@ -0,0 +1 @@
+module github.com/mitchellh/go-wordwrap
diff --git a/vendor/github.com/mitchellh/hashstructure/README.md b/vendor/github.com/mitchellh/hashstructure/README.md
index 7d0de5b..28ce45a 100644
--- a/vendor/github.com/mitchellh/hashstructure/README.md
+++ b/vendor/github.com/mitchellh/hashstructure/README.md
@@ -1,4 +1,4 @@
-# hashstructure
+# hashstructure [![GoDoc](https://godoc.org/github.com/mitchellh/hashstructure?status.svg)](https://godoc.org/github.com/mitchellh/hashstructure)
 
 hashstructure is a Go library for creating a unique hash value
 for arbitrary values in Go.
@@ -19,6 +19,9 @@ sending data across the network, caching values locally (de-dup), and so on.
 
   * Optionally specify a custom hash function to optimize for speed, collision
     avoidance for your data set, etc.
+  
+  * Optionally hash the output of `.String()` on structs that implement fmt.Stringer,
+    allowing effective hashing of time.Time
 
 ## Installation
 
@@ -34,28 +37,29 @@ For usage and examples see the [Godoc](http://godoc.org/github.com/mitchellh/has
 
 A quick code example is shown below:
 
-
-        type ComplexStruct struct {
-                Name     string
-                Age      uint
-                Metadata map[string]interface{}
-        }
-
-        v := ComplexStruct{
-                Name: "mitchellh",
-                Age:  64,
-                Metadata: map[string]interface{}{
-                        "car":      true,
-                        "location": "California",
-                        "siblings": []string{"Bob", "John"},
-                },
-        }
-
-        hash, err := hashstructure.Hash(v, nil)
-        if err != nil {
-                panic(err)
-        }
-
-        fmt.Printf("%d", hash)
-        // Output:
-        // 2307517237273902113
+```go
+type ComplexStruct struct {
+    Name     string
+    Age      uint
+    Metadata map[string]interface{}
+}
+
+v := ComplexStruct{
+    Name: "mitchellh",
+    Age:  64,
+    Metadata: map[string]interface{}{
+        "car":      true,
+        "location": "California",
+        "siblings": []string{"Bob", "John"},
+    },
+}
+
+hash, err := hashstructure.Hash(v, nil)
+if err != nil {
+    panic(err)
+}
+
+fmt.Printf("%d", hash)
+// Output:
+// 2307517237273902113
+```
diff --git a/vendor/github.com/mitchellh/hashstructure/go.mod b/vendor/github.com/mitchellh/hashstructure/go.mod
new file mode 100644
index 0000000..966582a
--- /dev/null
+++ b/vendor/github.com/mitchellh/hashstructure/go.mod
@@ -0,0 +1 @@
+module github.com/mitchellh/hashstructure
diff --git a/vendor/github.com/mitchellh/hashstructure/hashstructure.go b/vendor/github.com/mitchellh/hashstructure/hashstructure.go
index 6f586fa..ea13a15 100644
--- a/vendor/github.com/mitchellh/hashstructure/hashstructure.go
+++ b/vendor/github.com/mitchellh/hashstructure/hashstructure.go
@@ -8,6 +8,16 @@ import (
         "reflect"
 )
 
+// ErrNotStringer is returned when there's an error with hash:"string"
+type ErrNotStringer struct {
+        Field string
+}
+
+// Error implements error for ErrNotStringer
+func (ens *ErrNotStringer) Error() string {
+        return fmt.Sprintf("hashstructure: %s has hash:\"string\" set, but does not implement fmt.Stringer", ens.Field)
+}
+
 // HashOptions are options that are available for hashing.
 type HashOptions struct {
         // Hasher is the hash function to use. If this isn't set, it will
@@ -17,12 +27,18 @@ type HashOptions struct {
         // TagName is the struct tag to look at when hashing the structure.
         // By default this is "hash".
         TagName string
+
+        // ZeroNil is flag determining if nil pointer should be treated equal
+        // to a zero value of pointed type. By default this is false.
+        ZeroNil bool
 }
 
 // Hash returns the hash value of an arbitrary value.
 //
 // If opts is nil, then default options will be used. See HashOptions
-// for the default values.
+// for the default values. The same *HashOptions value cannot be used
+// concurrently. None of the values within a *HashOptions struct are
+// safe to read/write while hashing is being done.
 //
 // Notes on the value:
 //
@@ -41,11 +57,14 @@ type HashOptions struct {
 //
 // The available tag values are:
 //
-//   * "ignore" - The field will be ignored and not affect the hash code.
+//   * "ignore" or "-" - The field will be ignored and not affect the hash code.
 //
 //   * "set" - The field will be treated as a set, where ordering doesn't
 //             affect the hash code. This only works for slices.
 //
+//   * "string" - The field will be hashed as a string, only works when the
+//                field implements fmt.Stringer
+//
 func Hash(v interface{}, opts *HashOptions) (uint64, error) {
         // Create default options
         if opts == nil {
@@ -63,15 +82,17 @@ func Hash(v interface{}, opts *HashOptions) (uint64, error) {
 
         // Create our walker and walk the structure
         w := &walker{
-                h:   opts.Hasher,
-                tag: opts.TagName,
+                h:       opts.Hasher,
+                tag:     opts.TagName,
+                zeronil: opts.ZeroNil,
         }
         return w.visit(reflect.ValueOf(v), nil)
 }
 
 type walker struct {
-        h   hash.Hash64
-        tag string
+        h       hash.Hash64
+        tag     string
+        zeronil bool
 }
 
 type visitOpts struct {
@@ -84,6 +105,8 @@ type visitOpts struct {
 }
 
 func (w *walker) visit(v reflect.Value, opts *visitOpts) (uint64, error) {
+        t := reflect.TypeOf(0)
+
         // Loop since these can be wrapped in multiple layers of pointers
         // and interfaces.
         for {
@@ -96,6 +119,9 @@ func (w *walker) visit(v reflect.Value, opts *visitOpts) (uint64, error) {
                 }
 
                 if v.Kind() == reflect.Ptr {
+                        if w.zeronil {
+                                t = v.Type().Elem()
+                        }
                         v = reflect.Indirect(v)
                         continue
                 }
@@ -105,8 +131,7 @@ func (w *walker) visit(v reflect.Value, opts *visitOpts) (uint64, error) {
 
         // If it is nil, treat it like a zero.
         if !v.IsValid() {
-                var tmp int8
-                v = reflect.ValueOf(tmp)
+                v = reflect.Zero(t)
         }
 
         // Binary writing can use raw ints, we have to convert to
@@ -189,8 +214,8 @@ func (w *walker) visit(v reflect.Value, opts *visitOpts) (uint64, error) {
                 return h, nil
 
         case reflect.Struct:
-                var include Includable
                 parent := v.Interface()
+                var include Includable
                 if impl, ok := parent.(Includable); ok {
                         include = impl
                 }
@@ -203,7 +228,7 @@ func (w *walker) visit(v reflect.Value, opts *visitOpts) (uint64, error) {
 
                 l := v.NumField()
                 for i := 0; i < l; i++ {
-                        if v := v.Field(i); v.CanSet() || t.Field(i).Name != "_" {
+                        if innerV := v.Field(i); v.CanSet() || t.Field(i).Name != "_" {
                                 var f visitFlag
                                 fieldType := t.Field(i)
                                 if fieldType.PkgPath != "" {
@@ -212,14 +237,25 @@ func (w *walker) visit(v reflect.Value, opts *visitOpts) (uint64, error) {
                                 }
 
                                 tag := fieldType.Tag.Get(w.tag)
-                                if tag == "ignore" {
+                                if tag == "ignore" || tag == "-" {
                                         // Ignore this field
                                         continue
                                 }
 
+                                // if string is set, use the string value
+                                if tag == "string" {
+                                        if impl, ok := innerV.Interface().(fmt.Stringer); ok {
+                                                innerV = reflect.ValueOf(impl.String())
+                                        } else {
+                                                return 0, &ErrNotStringer{
+                                                        Field: v.Type().Field(i).Name,
+                                                }
+                                        }
+                                }
+
                                 // Check if we implement includable and check it
                                 if include != nil {
-                                        incl, err := include.HashInclude(fieldType.Name, v)
+                                        incl, err := include.HashInclude(fieldType.Name, innerV)
                                         if err != nil {
                                                 return 0, err
                                         }
@@ -238,7 +274,7 @@ func (w *walker) visit(v reflect.Value, opts *visitOpts) (uint64, error) {
                                         return 0, err
                                 }
 
-                                vh, err := w.visit(v, &visitOpts{
+                                vh, err := w.visit(innerV, &visitOpts{
                                         Flags:       f,
                                         Struct:      parent,
                                         StructField: fieldType.Name,
@@ -289,7 +325,6 @@ func (w *walker) visit(v reflect.Value, opts *visitOpts) (uint64, error) {
                 return 0, fmt.Errorf("unknown kind to hash: %s", k)
         }
 
-        return 0, nil
 }
 
 func hashUpdateOrdered(h hash.Hash64, a, b uint64) uint64 {
diff --git a/vendor/github.com/mitchellh/mapstructure/.travis.yml b/vendor/github.com/mitchellh/mapstructure/.travis.yml
index 7f3fe9a..1689c7d 100644
--- a/vendor/github.com/mitchellh/mapstructure/.travis.yml
+++ b/vendor/github.com/mitchellh/mapstructure/.travis.yml
@@ -1,7 +1,8 @@
-language: go 
+language: go
+
+go:
+  - "1.11.x"
+  - tip
 
-go: 
-  - 1.4
-  
 script:
-  - go test 
+  - go test
diff --git a/vendor/github.com/mitchellh/mapstructure/CHANGELOG.md b/vendor/github.com/mitchellh/mapstructure/CHANGELOG.md
new file mode 100644
index 0000000..3b3cb72
--- /dev/null
+++ b/vendor/github.com/mitchellh/mapstructure/CHANGELOG.md
@@ -0,0 +1,21 @@
+## 1.1.2
+
+* Fix error when decode hook decodes interface implementation into interface
+  type. [GH-140]
+
+## 1.1.1
+
+* Fix panic that can happen in `decodePtr`
+
+## 1.1.0
+
+* Added `StringToIPHookFunc` to convert `string` to `net.IP` and `net.IPNet` [GH-133]
+* Support struct to struct decoding [GH-137]
+* If source map value is nil, then destination map value is nil (instead of empty)
+* If source slice value is nil, then destination slice value is nil (instead of empty)
+* If source pointer is nil, then destination pointer is set to nil (instead of
+  allocated zero value of type)
+
+## 1.0.0
+
+* Initial tagged stable release.
diff --git a/vendor/github.com/mitchellh/mapstructure/README.md b/vendor/github.com/mitchellh/mapstructure/README.md
index 659d688..0018dc7 100644
--- a/vendor/github.com/mitchellh/mapstructure/README.md
+++ b/vendor/github.com/mitchellh/mapstructure/README.md
@@ -1,4 +1,4 @@
-# mapstructure
+# mapstructure [![Godoc](https://godoc.org/github.com/mitchellh/mapstructure?status.svg)](https://godoc.org/github.com/mitchellh/mapstructure)
 
 mapstructure is a Go library for decoding generic map values to structures
 and vice versa, while providing helpful error handling.
diff --git a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
index 115ae67..1f0abc6 100644
--- a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
+++ b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
@@ -2,6 +2,8 @@ package mapstructure
 
 import (
         "errors"
+        "fmt"
+        "net"
         "reflect"
         "strconv"
         "strings"
@@ -38,12 +40,6 @@ func DecodeHookExec(
         raw DecodeHookFunc,
         from reflect.Type, to reflect.Type,
         data interface{}) (interface{}, error) {
-        // Build our arguments that reflect expects
-        argVals := make([]reflect.Value, 3)
-        argVals[0] = reflect.ValueOf(from)
-        argVals[1] = reflect.ValueOf(to)
-        argVals[2] = reflect.ValueOf(data)
-
         switch f := typedDecodeHook(raw).(type) {
         case DecodeHookFuncType:
                 return f(from, to, data)
@@ -121,6 +117,74 @@ func StringToTimeDurationHookFunc() DecodeHookFunc {
         }
 }
 
+// StringToIPHookFunc returns a DecodeHookFunc that converts
+// strings to net.IP
+func StringToIPHookFunc() DecodeHookFunc {
+        return func(
+                f reflect.Type,
+                t reflect.Type,
+                data interface{}) (interface{}, error) {
+                if f.Kind() != reflect.String {
+                        return data, nil
+                }
+                if t != reflect.TypeOf(net.IP{}) {
+                        return data, nil
+                }
+
+                // Convert it by parsing
+                ip := net.ParseIP(data.(string))
+                if ip == nil {
+                        return net.IP{}, fmt.Errorf("failed parsing ip %v", data)
+                }
+
+                return ip, nil
+        }
+}
+
+// StringToIPNetHookFunc returns a DecodeHookFunc that converts
+// strings to net.IPNet
+func StringToIPNetHookFunc() DecodeHookFunc {
+        return func(
+                f reflect.Type,
+                t reflect.Type,
+                data interface{}) (interface{}, error) {
+                if f.Kind() != reflect.String {
+                        return data, nil
+                }
+                if t != reflect.TypeOf(net.IPNet{}) {
+                        return data, nil
+                }
+
+                // Convert it by parsing
+                _, net, err := net.ParseCIDR(data.(string))
+                return net, err
+        }
+}
+
+// StringToTimeHookFunc returns a DecodeHookFunc that converts
+// strings to time.Time.
+func StringToTimeHookFunc(layout string) DecodeHookFunc {
+        return func(
+                f reflect.Type,
+                t reflect.Type,
+                data interface{}) (interface{}, error) {
+                if f.Kind() != reflect.String {
+                        return data, nil
+                }
+                if t != reflect.TypeOf(time.Time{}) {
+                        return data, nil
+                }
+
+                // Convert it by parsing
+                return time.Parse(layout, data.(string))
+        }
+}
+
+// WeaklyTypedHook is a DecodeHookFunc which adds support for weak typing to
+// the decoder.
+//
+// Note that this is significantly different from the WeaklyTypedInput option
+// of the DecoderConfig.
 func WeaklyTypedHook(
         f reflect.Kind,
         t reflect.Kind,
@@ -132,9 +196,8 @@ func WeaklyTypedHook(
                 case reflect.Bool:
                         if dataVal.Bool() {
                                 return "1", nil
-                        } else {
-                                return "0", nil
                         }
+                        return "0", nil
                 case reflect.Float32:
                         return strconv.FormatFloat(dataVal.Float(), 'f', -1, 64), nil
                 case reflect.Int:
diff --git a/vendor/github.com/mitchellh/mapstructure/go.mod b/vendor/github.com/mitchellh/mapstructure/go.mod
new file mode 100644
index 0000000..d2a7125
--- /dev/null
+++ b/vendor/github.com/mitchellh/mapstructure/go.mod
@@ -0,0 +1 @@
+module github.com/mitchellh/mapstructure
diff --git a/vendor/github.com/mitchellh/mapstructure/mapstructure.go b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
index 6dee0ef..256ee63 100644
--- a/vendor/github.com/mitchellh/mapstructure/mapstructure.go
+++ b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
@@ -1,5 +1,5 @@
-// The mapstructure package exposes functionality to convert an
-// arbitrary map[string]interface{} into a native Go structure.
+// Package mapstructure exposes functionality to convert an arbitrary
+// map[string]interface{} into a native Go structure.
 //
 // The Go structure can be arbitrarily complex, containing slices,
 // other structs, etc. and the decoder will properly decode nested
@@ -32,7 +32,12 @@ import (
 // both.
 type DecodeHookFunc interface{}
 
+// DecodeHookFuncType is a DecodeHookFunc which has complete information about
+// the source and target types.
 type DecodeHookFuncType func(reflect.Type, reflect.Type, interface{}) (interface{}, error)
+
+// DecodeHookFuncKind is a DecodeHookFunc which knows only the Kinds of the
+// source and target types.
 type DecodeHookFuncKind func(reflect.Kind, reflect.Kind, interface{}) (interface{}, error)
 
 // DecoderConfig is the configuration that is used to create a new decoder
@@ -109,12 +114,12 @@ type Metadata struct {
         Unused []string
 }
 
-// Decode takes a map and uses reflection to convert it into the
-// given Go native structure. val must be a pointer to a struct.
-func Decode(m interface{}, rawVal interface{}) error {
+// Decode takes an input structure and uses reflection to translate it to
+// the output structure. output must be a pointer to a map or struct.
+func Decode(input interface{}, output interface{}) error {
         config := &DecoderConfig{
                 Metadata: nil,
-                Result:   rawVal,
+                Result:   output,
         }
 
         decoder, err := NewDecoder(config)
@@ -122,7 +127,7 @@ func Decode(m interface{}, rawVal interface{}) error {
                 return err
         }
 
-        return decoder.Decode(m)
+        return decoder.Decode(input)
 }
 
 // WeakDecode is the same as Decode but is shorthand to enable
@@ -142,6 +147,40 @@ func WeakDecode(input, output interface{}) error {
         return decoder.Decode(input)
 }
 
+// DecodeMetadata is the same as Decode, but is shorthand to
+// enable metadata collection. See DecoderConfig for more info.
+func DecodeMetadata(input interface{}, output interface{}, metadata *Metadata) error {
+        config := &DecoderConfig{
+                Metadata: metadata,
+                Result:   output,
+        }
+
+        decoder, err := NewDecoder(config)
+        if err != nil {
+                return err
+        }
+
+        return decoder.Decode(input)
+}
+
+// WeakDecodeMetadata is the same as Decode, but is shorthand to
+// enable both WeaklyTypedInput and metadata collection. See
+// DecoderConfig for more info.
+func WeakDecodeMetadata(input interface{}, output interface{}, metadata *Metadata) error {
+        config := &DecoderConfig{
+                Metadata:         metadata,
+                Result:           output,
+                WeaklyTypedInput: true,
+        }
+
+        decoder, err := NewDecoder(config)
+        if err != nil {
+                return err
+        }
+
+        return decoder.Decode(input)
+}
+
 // NewDecoder returns a new decoder for the given configuration. Once
 // a decoder has been returned, the same configuration must not be used
 // again.
@@ -179,68 +218,91 @@ func NewDecoder(config *DecoderConfig) (*Decoder, error) {
 
 // Decode decodes the given raw interface to the target pointer specified
 // by the configuration.
-func (d *Decoder) Decode(raw interface{}) error {
-        return d.decode("", raw, reflect.ValueOf(d.config.Result).Elem())
+func (d *Decoder) Decode(input interface{}) error {
+        return d.decode("", input, reflect.ValueOf(d.config.Result).Elem())
 }
 
 // Decodes an unknown data type into a specific reflection value.
-func (d *Decoder) decode(name string, data interface{}, val reflect.Value) error {
-        if data == nil {
-                // If the data is nil, then we don't set anything.
+func (d *Decoder) decode(name string, input interface{}, outVal reflect.Value) error {
+        var inputVal reflect.Value
+        if input != nil {
+                inputVal = reflect.ValueOf(input)
+
+                // We need to check here if input is a typed nil. Typed nils won't
+                // match the "input == nil" below so we check that here.
+                if inputVal.Kind() == reflect.Ptr && inputVal.IsNil() {
+                        input = nil
+                }
+        }
+
+        if input == nil {
+                // If the data is nil, then we don't set anything, unless ZeroFields is set
+                // to true.
+                if d.config.ZeroFields {
+                        outVal.Set(reflect.Zero(outVal.Type()))
+
+                        if d.config.Metadata != nil && name != "" {
+                                d.config.Metadata.Keys = append(d.config.Metadata.Keys, name)
+                        }
+                }
                 return nil
         }
 
-        dataVal := reflect.ValueOf(data)
-        if !dataVal.IsValid() {
-                // If the data value is invalid, then we just set the value
+        if !inputVal.IsValid() {
+                // If the input value is invalid, then we just set the value
                 // to be the zero value.
-                val.Set(reflect.Zero(val.Type()))
+                outVal.Set(reflect.Zero(outVal.Type()))
+                if d.config.Metadata != nil && name != "" {
+                        d.config.Metadata.Keys = append(d.config.Metadata.Keys, name)
+                }
                 return nil
         }
 
         if d.config.DecodeHook != nil {
-                // We have a DecodeHook, so let's pre-process the data.
+                // We have a DecodeHook, so let's pre-process the input.
                 var err error
-                data, err = DecodeHookExec(
+                input, err = DecodeHookExec(
                         d.config.DecodeHook,
-                        dataVal.Type(), val.Type(), data)
+                        inputVal.Type(), outVal.Type(), input)
                 if err != nil {
                         return fmt.Errorf("error decoding '%s': %s", name, err)
                 }
         }
 
         var err error
-        dataKind := getKind(val)
-        switch dataKind {
+        outputKind := getKind(outVal)
+        switch outputKind {
         case reflect.Bool:
-                err = d.decodeBool(name, data, val)
+                err = d.decodeBool(name, input, outVal)
         case reflect.Interface:
-                err = d.decodeBasic(name, data, val)
+                err = d.decodeBasic(name, input, outVal)
         case reflect.String:
-                err = d.decodeString(name, data, val)
+                err = d.decodeString(name, input, outVal)
         case reflect.Int:
-                err = d.decodeInt(name, data, val)
+                err = d.decodeInt(name, input, outVal)
         case reflect.Uint:
-                err = d.decodeUint(name, data, val)
+                err = d.decodeUint(name, input, outVal)
         case reflect.Float32:
-                err = d.decodeFloat(name, data, val)
+                err = d.decodeFloat(name, input, outVal)
         case reflect.Struct:
-                err = d.decodeStruct(name, data, val)
+                err = d.decodeStruct(name, input, outVal)
         case reflect.Map:
-                err = d.decodeMap(name, data, val)
+                err = d.decodeMap(name, input, outVal)
         case reflect.Ptr:
-                err = d.decodePtr(name, data, val)
+                err = d.decodePtr(name, input, outVal)
         case reflect.Slice:
-                err = d.decodeSlice(name, data, val)
+                err = d.decodeSlice(name, input, outVal)
+        case reflect.Array:
+                err = d.decodeArray(name, input, outVal)
         case reflect.Func:
-                err = d.decodeFunc(name, data, val)
+                err = d.decodeFunc(name, input, outVal)
         default:
                 // If we reached this point then we weren't able to decode it
-                return fmt.Errorf("%s: unsupported type: %s", name, dataKind)
+                return fmt.Errorf("%s: unsupported type: %s", name, outputKind)
         }
 
         // If we reached here, then we successfully decoded SOMETHING, so
-        // mark the key as used if we're tracking metadata.
+        // mark the key as used if we're tracking metainput.
         if d.config.Metadata != nil && name != "" {
                 d.config.Metadata.Keys = append(d.config.Metadata.Keys, name)
         }
@@ -251,7 +313,19 @@ func (d *Decoder) decode(name string, data interface{}, val reflect.Value) error
 // This decodes a basic type (bool, int, string, etc.) and sets the
 // value to "data" of that type.
 func (d *Decoder) decodeBasic(name string, data interface{}, val reflect.Value) error {
+        if val.IsValid() && val.Elem().IsValid() {
+                return d.decode(name, data, val.Elem())
+        }
+
         dataVal := reflect.ValueOf(data)
+
+        // If the input data is a pointer, and the assigned type is the dereference
+        // of that exact pointer, then indirect it so that we can assign it.
+        // Example: *string to string
+        if dataVal.Kind() == reflect.Ptr && dataVal.Type().Elem() == val.Type() {
+                dataVal = reflect.Indirect(dataVal)
+        }
+
         if !dataVal.IsValid() {
                 dataVal = reflect.Zero(val.Type())
         }
@@ -268,7 +342,7 @@ func (d *Decoder) decodeBasic(name string, data interface{}, val reflect.Value)
 }
 
 func (d *Decoder) decodeString(name string, data interface{}, val reflect.Value) error {
-        dataVal := reflect.ValueOf(data)
+        dataVal := reflect.Indirect(reflect.ValueOf(data))
         dataKind := getKind(dataVal)
 
         converted := true
@@ -287,12 +361,22 @@ func (d *Decoder) decodeString(name string, data interface{}, val reflect.Value)
                 val.SetString(strconv.FormatUint(dataVal.Uint(), 10))
         case dataKind == reflect.Float32 && d.config.WeaklyTypedInput:
                 val.SetString(strconv.FormatFloat(dataVal.Float(), 'f', -1, 64))
-        case dataKind == reflect.Slice && d.config.WeaklyTypedInput:
+        case dataKind == reflect.Slice && d.config.WeaklyTypedInput,
+                dataKind == reflect.Array && d.config.WeaklyTypedInput:
                 dataType := dataVal.Type()
                 elemKind := dataType.Elem().Kind()
-                switch {
-                case elemKind == reflect.Uint8:
-                        val.SetString(string(dataVal.Interface().([]uint8)))
+                switch elemKind {
+                case reflect.Uint8:
+                        var uints []uint8
+                        if dataKind == reflect.Array {
+                                uints = make([]uint8, dataVal.Len(), dataVal.Len())
+                                for i := range uints {
+                                        uints[i] = dataVal.Index(i).Interface().(uint8)
+                                }
+                        } else {
+                                uints = dataVal.Interface().([]uint8)
+                        }
+                        val.SetString(string(uints))
                 default:
                         converted = false
                 }
@@ -310,7 +394,7 @@ func (d *Decoder) decodeString(name string, data interface{}, val reflect.Value)
 }
 
 func (d *Decoder) decodeInt(name string, data interface{}, val reflect.Value) error {
-        dataVal := reflect.ValueOf(data)
+        dataVal := reflect.Indirect(reflect.ValueOf(data))
         dataKind := getKind(dataVal)
         dataType := dataVal.Type()
 
@@ -352,7 +436,7 @@ func (d *Decoder) decodeInt(name string, data interface{}, val reflect.Value) er
 }
 
 func (d *Decoder) decodeUint(name string, data interface{}, val reflect.Value) error {
-        dataVal := reflect.ValueOf(data)
+        dataVal := reflect.Indirect(reflect.ValueOf(data))
         dataKind := getKind(dataVal)
 
         switch {
@@ -395,7 +479,7 @@ func (d *Decoder) decodeUint(name string, data interface{}, val reflect.Value) e
 }
 
 func (d *Decoder) decodeBool(name string, data interface{}, val reflect.Value) error {
-        dataVal := reflect.ValueOf(data)
+        dataVal := reflect.Indirect(reflect.ValueOf(data))
         dataKind := getKind(dataVal)
 
         switch {
@@ -426,7 +510,7 @@ func (d *Decoder) decodeBool(name string, data interface{}, val reflect.Value) e
 }
 
 func (d *Decoder) decodeFloat(name string, data interface{}, val reflect.Value) error {
-        dataVal := reflect.ValueOf(data)
+        dataVal := reflect.Indirect(reflect.ValueOf(data))
         dataKind := getKind(dataVal)
         dataType := dataVal.Type()
 
@@ -436,7 +520,7 @@ func (d *Decoder) decodeFloat(name string, data interface{}, val reflect.Value)
         case dataKind == reflect.Uint:
                 val.SetFloat(float64(dataVal.Uint()))
         case dataKind == reflect.Float32:
-                val.SetFloat(float64(dataVal.Float()))
+                val.SetFloat(dataVal.Float())
         case dataKind == reflect.Bool && d.config.WeaklyTypedInput:
                 if dataVal.Bool() {
                         val.SetFloat(1)
@@ -482,38 +566,68 @@ func (d *Decoder) decodeMap(name string, data interface{}, val reflect.Value) er
                 valMap = reflect.MakeMap(mapType)
         }
 
-        // Check input type
+        // Check input type and based on the input type jump to the proper func
         dataVal := reflect.Indirect(reflect.ValueOf(data))
-        if dataVal.Kind() != reflect.Map {
-                // In weak mode, we accept a slice of maps as an input...
-                if d.config.WeaklyTypedInput {
-                        switch dataVal.Kind() {
-                        case reflect.Array, reflect.Slice:
-                                // Special case for BC reasons (covered by tests)
-                                if dataVal.Len() == 0 {
-                                        val.Set(valMap)
-                                        return nil
-                                }
+        switch dataVal.Kind() {
+        case reflect.Map:
+                return d.decodeMapFromMap(name, dataVal, val, valMap)
 
-                                for i := 0; i < dataVal.Len(); i++ {
-                                        err := d.decode(
-                                                fmt.Sprintf("%s[%d]", name, i),
-                                                dataVal.Index(i).Interface(), val)
-                                        if err != nil {
-                                                return err
-                                        }
-                                }
+        case reflect.Struct:
+                return d.decodeMapFromStruct(name, dataVal, val, valMap)
 
-                                return nil
-                        }
+        case reflect.Array, reflect.Slice:
+                if d.config.WeaklyTypedInput {
+                        return d.decodeMapFromSlice(name, dataVal, val, valMap)
                 }
 
+                fallthrough
+
+        default:
                 return fmt.Errorf("'%s' expected a map, got '%s'", name, dataVal.Kind())
         }
+}
+
+func (d *Decoder) decodeMapFromSlice(name string, dataVal reflect.Value, val reflect.Value, valMap reflect.Value) error {
+        // Special case for BC reasons (covered by tests)
+        if dataVal.Len() == 0 {
+                val.Set(valMap)
+                return nil
+        }
+
+        for i := 0; i < dataVal.Len(); i++ {
+                err := d.decode(
+                        fmt.Sprintf("%s[%d]", name, i),
+                        dataVal.Index(i).Interface(), val)
+                if err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func (d *Decoder) decodeMapFromMap(name string, dataVal reflect.Value, val reflect.Value, valMap reflect.Value) error {
+        valType := val.Type()
+        valKeyType := valType.Key()
+        valElemType := valType.Elem()
 
         // Accumulate errors
         errors := make([]string, 0)
 
+        // If the input data is empty, then we just match what the input data is.
+        if dataVal.Len() == 0 {
+                if dataVal.IsNil() {
+                        if !val.IsNil() {
+                                val.Set(dataVal)
+                        }
+                } else {
+                        // Set to empty allocated value
+                        val.Set(valMap)
+                }
+
+                return nil
+        }
+
         for _, k := range dataVal.MapKeys() {
                 fieldName := fmt.Sprintf("%s[%s]", name, k)
 
@@ -546,22 +660,128 @@ func (d *Decoder) decodeMap(name string, data interface{}, val reflect.Value) er
         return nil
 }
 
+func (d *Decoder) decodeMapFromStruct(name string, dataVal reflect.Value, val reflect.Value, valMap reflect.Value) error {
+        typ := dataVal.Type()
+        for i := 0; i < typ.NumField(); i++ {
+                // Get the StructField first since this is a cheap operation. If the
+                // field is unexported, then ignore it.
+                f := typ.Field(i)
+                if f.PkgPath != "" {
+                        continue
+                }
+
+                // Next get the actual value of this field and verify it is assignable
+                // to the map value.
+                v := dataVal.Field(i)
+                if !v.Type().AssignableTo(valMap.Type().Elem()) {
+                        return fmt.Errorf("cannot assign type '%s' to map value field of type '%s'", v.Type(), valMap.Type().Elem())
+                }
+
+                tagValue := f.Tag.Get(d.config.TagName)
+                tagParts := strings.Split(tagValue, ",")
+
+                // Determine the name of the key in the map
+                keyName := f.Name
+                if tagParts[0] != "" {
+                        if tagParts[0] == "-" {
+                                continue
+                        }
+                        keyName = tagParts[0]
+                }
+
+                // If "squash" is specified in the tag, we squash the field down.
+                squash := false
+                for _, tag := range tagParts[1:] {
+                        if tag == "squash" {
+                                squash = true
+                                break
+                        }
+                }
+                if squash && v.Kind() != reflect.Struct {
+                        return fmt.Errorf("cannot squash non-struct type '%s'", v.Type())
+                }
+
+                switch v.Kind() {
+                // this is an embedded struct, so handle it differently
+                case reflect.Struct:
+                        x := reflect.New(v.Type())
+                        x.Elem().Set(v)
+
+                        vType := valMap.Type()
+                        vKeyType := vType.Key()
+                        vElemType := vType.Elem()
+                        mType := reflect.MapOf(vKeyType, vElemType)
+                        vMap := reflect.MakeMap(mType)
+
+                        err := d.decode(keyName, x.Interface(), vMap)
+                        if err != nil {
+                                return err
+                        }
+
+                        if squash {
+                                for _, k := range vMap.MapKeys() {
+                                        valMap.SetMapIndex(k, vMap.MapIndex(k))
+                                }
+                        } else {
+                                valMap.SetMapIndex(reflect.ValueOf(keyName), vMap)
+                        }
+
+                default:
+                        valMap.SetMapIndex(reflect.ValueOf(keyName), v)
+                }
+        }
+
+        if val.CanAddr() {
+                val.Set(valMap)
+        }
+
+        return nil
+}
+
 func (d *Decoder) decodePtr(name string, data interface{}, val reflect.Value) error {
+        // If the input data is nil, then we want to just set the output
+        // pointer to be nil as well.
+        isNil := data == nil
+        if !isNil {
+                switch v := reflect.Indirect(reflect.ValueOf(data)); v.Kind() {
+                case reflect.Chan,
+                        reflect.Func,
+                        reflect.Interface,
+                        reflect.Map,
+                        reflect.Ptr,
+                        reflect.Slice:
+                        isNil = v.IsNil()
+                }
+        }
+        if isNil {
+                if !val.IsNil() && val.CanSet() {
+                        nilValue := reflect.New(val.Type()).Elem()
+                        val.Set(nilValue)
+                }
+
+                return nil
+        }
+
         // Create an element of the concrete (non pointer) type and decode
         // into that. Then set the value of the pointer to this type.
         valType := val.Type()
         valElemType := valType.Elem()
+        if val.CanSet() {
+                realVal := val
+                if realVal.IsNil() || d.config.ZeroFields {
+                        realVal = reflect.New(valElemType)
+                }
 
-        realVal := val
-        if realVal.IsNil() || d.config.ZeroFields {
-                realVal = reflect.New(valElemType)
-        }
+                if err := d.decode(name, data, reflect.Indirect(realVal)); err != nil {
+                        return err
+                }
 
-        if err := d.decode(name, data, reflect.Indirect(realVal)); err != nil {
-                return err
+                val.Set(realVal)
+        } else {
+                if err := d.decode(name, data, reflect.Indirect(val)); err != nil {
+                        return err
+                }
         }
-
-        val.Set(realVal)
         return nil
 }
 
@@ -587,22 +807,101 @@ func (d *Decoder) decodeSlice(name string, data interface{}, val reflect.Value)
 
         valSlice := val
         if valSlice.IsNil() || d.config.ZeroFields {
+                if d.config.WeaklyTypedInput {
+                        switch {
+                        // Slice and array we use the normal logic
+                        case dataValKind == reflect.Slice, dataValKind == reflect.Array:
+                                break
+
+                        // Empty maps turn into empty slices
+                        case dataValKind == reflect.Map:
+                                if dataVal.Len() == 0 {
+                                        val.Set(reflect.MakeSlice(sliceType, 0, 0))
+                                        return nil
+                                }
+                                // Create slice of maps of other sizes
+                                return d.decodeSlice(name, []interface{}{data}, val)
+
+                        case dataValKind == reflect.String && valElemType.Kind() == reflect.Uint8:
+                                return d.decodeSlice(name, []byte(dataVal.String()), val)
+
+                        // All other types we try to convert to the slice type
+                        // and "lift" it into it. i.e. a string becomes a string slice.
+                        default:
+                                // Just re-try this function with data as a slice.
+                                return d.decodeSlice(name, []interface{}{data}, val)
+                        }
+                }
+
+                // Check input type
+                if dataValKind != reflect.Array && dataValKind != reflect.Slice {
+                        return fmt.Errorf(
+                                "'%s': source data must be an array or slice, got %s", name, dataValKind)
+
+                }
+
+                // If the input value is empty, then don't allocate since non-nil != nil
+                if dataVal.Len() == 0 {
+                        return nil
+                }
+
+                // Make a new slice to hold our result, same size as the original data.
+                valSlice = reflect.MakeSlice(sliceType, dataVal.Len(), dataVal.Len())
+        }
+
+        // Accumulate any errors
+        errors := make([]string, 0)
+
+        for i := 0; i < dataVal.Len(); i++ {
+                currentData := dataVal.Index(i).Interface()
+                for valSlice.Len() <= i {
+                        valSlice = reflect.Append(valSlice, reflect.Zero(valElemType))
+                }
+                currentField := valSlice.Index(i)
+
+                fieldName := fmt.Sprintf("%s[%d]", name, i)
+                if err := d.decode(fieldName, currentData, currentField); err != nil {
+                        errors = appendErrors(errors, err)
+                }
+        }
+
+        // Finally, set the value to the slice we built up
+        val.Set(valSlice)
+
+        // If there were errors, we return those
+        if len(errors) > 0 {
+                return &Error{errors}
+        }
+
+        return nil
+}
+
+func (d *Decoder) decodeArray(name string, data interface{}, val reflect.Value) error {
+        dataVal := reflect.Indirect(reflect.ValueOf(data))
+        dataValKind := dataVal.Kind()
+        valType := val.Type()
+        valElemType := valType.Elem()
+        arrayType := reflect.ArrayOf(valType.Len(), valElemType)
+
+        valArray := val
+
+        if valArray.Interface() == reflect.Zero(valArray.Type()).Interface() || d.config.ZeroFields {
                 // Check input type
                 if dataValKind != reflect.Array && dataValKind != reflect.Slice {
                         if d.config.WeaklyTypedInput {
                                 switch {
-                                // Empty maps turn into empty slices
+                                // Empty maps turn into empty arrays
                                 case dataValKind == reflect.Map:
                                         if dataVal.Len() == 0 {
-                                                val.Set(reflect.MakeSlice(sliceType, 0, 0))
+                                                val.Set(reflect.Zero(arrayType))
                                                 return nil
                                         }
 
-                                // All other types we try to convert to the slice type
-                                // and "lift" it into it. i.e. a string becomes a string slice.
+                                // All other types we try to convert to the array type
+                                // and "lift" it into it. i.e. a string becomes a string array.
                                 default:
                                         // Just re-try this function with data as a slice.
-                                        return d.decodeSlice(name, []interface{}{data}, val)
+                                        return d.decodeArray(name, []interface{}{data}, val)
                                 }
                         }
 
@@ -610,9 +909,14 @@ func (d *Decoder) decodeSlice(name string, data interface{}, val reflect.Value)
                                 "'%s': source data must be an array or slice, got %s", name, dataValKind)
 
                 }
+                if dataVal.Len() > arrayType.Len() {
+                        return fmt.Errorf(
+                                "'%s': expected source data to have length less or equal to %d, got %d", name, arrayType.Len(), dataVal.Len())
 
-                // Make a new slice to hold our result, same size as the original data.
-                valSlice = reflect.MakeSlice(sliceType, dataVal.Len(), dataVal.Len())
+                }
+
+                // Make a new array to hold our result, same size as the original data.
+                valArray = reflect.New(arrayType).Elem()
         }
 
         // Accumulate any errors
@@ -620,10 +924,7 @@ func (d *Decoder) decodeSlice(name string, data interface{}, val reflect.Value)
 
         for i := 0; i < dataVal.Len(); i++ {
                 currentData := dataVal.Index(i).Interface()
-                for valSlice.Len() <= i {
-                        valSlice = reflect.Append(valSlice, reflect.Zero(valElemType))
-                }
-                currentField := valSlice.Index(i)
+                currentField := valArray.Index(i)
 
                 fieldName := fmt.Sprintf("%s[%d]", name, i)
                 if err := d.decode(fieldName, currentData, currentField); err != nil {
@@ -631,8 +932,8 @@ func (d *Decoder) decodeSlice(name string, data interface{}, val reflect.Value)
                 }
         }
 
-        // Finally, set the value to the slice we built up
-        val.Set(valSlice)
+        // Finally, set the value to the array we built up
+        val.Set(valArray)
 
         // If there were errors, we return those
         if len(errors) > 0 {
@@ -653,10 +954,29 @@ func (d *Decoder) decodeStruct(name string, data interface{}, val reflect.Value)
         }
 
         dataValKind := dataVal.Kind()
-        if dataValKind != reflect.Map {
-                return fmt.Errorf("'%s' expected a map, got '%s'", name, dataValKind)
+        switch dataValKind {
+        case reflect.Map:
+                return d.decodeStructFromMap(name, dataVal, val)
+
+        case reflect.Struct:
+                // Not the most efficient way to do this but we can optimize later if
+                // we want to. To convert from struct to struct we go to map first
+                // as an intermediary.
+                m := make(map[string]interface{})
+                mval := reflect.Indirect(reflect.ValueOf(&m))
+                if err := d.decodeMapFromStruct(name, dataVal, mval, mval); err != nil {
+                        return err
+                }
+
+                result := d.decodeStructFromMap(name, mval, val)
+                return result
+
+        default:
+                return fmt.Errorf("'%s' expected a map, got '%s'", name, dataVal.Kind())
         }
+}
 
+func (d *Decoder) decodeStructFromMap(name string, dataVal, val reflect.Value) error {
         dataValType := dataVal.Type()
         if kind := dataValType.Key().Kind(); kind != reflect.String && kind != reflect.Interface {
                 return fmt.Errorf(
@@ -681,7 +1001,11 @@ func (d *Decoder) decodeStruct(name string, data interface{}, val reflect.Value)
 
         // Compile the list of all the fields that we're going to be decoding
         // from all the structs.
-        fields := make(map[*reflect.StructField]reflect.Value)
+        type field struct {
+                field reflect.StructField
+                val   reflect.Value
+        }
+        fields := []field{}
         for len(structs) > 0 {
                 structVal := structs[0]
                 structs = structs[1:]
@@ -707,20 +1031,22 @@ func (d *Decoder) decodeStruct(name string, data interface{}, val reflect.Value)
                                         errors = appendErrors(errors,
                                                 fmt.Errorf("%s: unsupported type for squash: %s", fieldType.Name, fieldKind))
                                 } else {
-                                        structs = append(structs, val.FieldByName(fieldType.Name))
+                                        structs = append(structs, structVal.FieldByName(fieldType.Name))
                                 }
                                 continue
                         }
 
                         // Normal struct field, store it away
-                        fields[&fieldType] = structVal.Field(i)
+                        fields = append(fields, field{fieldType, structVal.Field(i)})
                 }
         }
 
-        for fieldType, field := range fields {
-                fieldName := fieldType.Name
+        // for fieldType, field := range fields {
+        for _, f := range fields {
+                field, fieldValue := f.field, f.val
+                fieldName := field.Name
 
-                tagValue := fieldType.Tag.Get(d.config.TagName)
+                tagValue := field.Tag.Get(d.config.TagName)
                 tagValue = strings.SplitN(tagValue, ",", 2)[0]
                 if tagValue != "" {
                         fieldName = tagValue
@@ -755,14 +1081,14 @@ func (d *Decoder) decodeStruct(name string, data interface{}, val reflect.Value)
                 // Delete the key we're using from the unused map so we stop tracking
                 delete(dataValKeysUnused, rawMapKey.Interface())
 
-                if !field.IsValid() {
+                if !fieldValue.IsValid() {
                         // This should never happen
                         panic("field is not valid")
                 }
 
                 // If we can't set the field, then it is unexported or something,
                 // and we just continue onwards.
-                if !field.CanSet() {
+                if !fieldValue.CanSet() {
                         continue
                 }
 
@@ -772,7 +1098,7 @@ func (d *Decoder) decodeStruct(name string, data interface{}, val reflect.Value)
                         fieldName = fmt.Sprintf("%s.%s", name, fieldName)
                 }
 
-                if err := d.decode(fieldName, rawMapVal.Interface(), field); err != nil {
+                if err := d.decode(fieldName, rawMapVal.Interface(), fieldValue); err != nil {
                         errors = appendErrors(errors, err)
                 }
         }
diff --git a/vendor/github.com/mitchellh/reflectwalk/go.mod b/vendor/github.com/mitchellh/reflectwalk/go.mod
new file mode 100644
index 0000000..52bb7c4
--- /dev/null
+++ b/vendor/github.com/mitchellh/reflectwalk/go.mod
@@ -0,0 +1 @@
+module github.com/mitchellh/reflectwalk
diff --git a/vendor/github.com/posener/complete/.gitignore b/vendor/github.com/posener/complete/.gitignore
index 1363720..293955f 100644
--- a/vendor/github.com/posener/complete/.gitignore
+++ b/vendor/github.com/posener/complete/.gitignore
@@ -1,2 +1,4 @@
 .idea
 coverage.txt
+gocomplete/gocomplete
+example/self/self
diff --git a/vendor/github.com/posener/complete/.travis.yml b/vendor/github.com/posener/complete/.travis.yml
index c2798f8..2fae945 100644
--- a/vendor/github.com/posener/complete/.travis.yml
+++ b/vendor/github.com/posener/complete/.travis.yml
@@ -1,17 +1,16 @@
 language: go
 sudo: false
 go:
+  - 1.11
+  - 1.10.x
   - 1.9
   - 1.8
 
 before_install:
   - go get -u -t ./...
-  - go get -u gopkg.in/alecthomas/gometalinter.v1
-  - gometalinter.v1 --install
 
 script:
-  - gometalinter.v1 --config metalinter.json ./...
-  - ./test.sh
+  - GO111MODULE=on ./test.sh
 
 after_success:
   - bash <(curl -s https://codecov.io/bash)
diff --git a/vendor/github.com/posener/complete/args.go b/vendor/github.com/posener/complete/args.go
index 1ba4d69..17ab2c6 100644
--- a/vendor/github.com/posener/complete/args.go
+++ b/vendor/github.com/posener/complete/args.go
@@ -57,11 +57,20 @@ func newArgs(line string) Args {
         }
 }
 
+// splitFields returns a list of fields from the given command line.
+// If the last character is space, it appends an empty field in the end
+// indicating that the field before it was completed.
+// If the last field is of the form "a=b", it splits it to two fields: "a", "b",
+// So it can be completed.
 func splitFields(line string) []string {
         parts := strings.Fields(line)
+
+        // Add empty field if the last field was completed.
         if len(line) > 0 && unicode.IsSpace(rune(line[len(line)-1])) {
                 parts = append(parts, "")
         }
+
+        // Treat the last field if it is of the form "a=b"
         parts = splitLastEqual(parts)
         return parts
 }
diff --git a/vendor/github.com/posener/complete/cmd/cmd.go b/vendor/github.com/posener/complete/cmd/cmd.go
index 7137dee..b99fe52 100644
--- a/vendor/github.com/posener/complete/cmd/cmd.go
+++ b/vendor/github.com/posener/complete/cmd/cmd.go
@@ -103,7 +103,7 @@ func (f *CLI) AddFlags(flags *flag.FlagSet) {
                         fmt.Sprintf("Uninstall completion for %s command", f.Name))
         }
         if flags.Lookup("y") == nil {
-                flags.BoolVar(&f.yes, "y", false, "Don't prompt user for typing 'yes'")
+                flags.BoolVar(&f.yes, "y", false, "Don't prompt user for typing 'yes' when installing completion")
         }
 }
 
diff --git a/vendor/github.com/posener/complete/cmd/install/fish.go b/vendor/github.com/posener/complete/cmd/install/fish.go
new file mode 100644
index 0000000..6467196
--- /dev/null
+++ b/vendor/github.com/posener/complete/cmd/install/fish.go
@@ -0,0 +1,56 @@
+package install
+
+import (
+        "bytes"
+        "fmt"
+        "os"
+        "path/filepath"
+        "text/template"
+)
+
+// (un)install in fish
+
+type fish struct {
+        configDir string
+}
+
+func (f fish) Install(cmd, bin string) error {
+        completionFile := filepath.Join(f.configDir, "completions", fmt.Sprintf("%s.fish", cmd))
+        completeCmd, err := f.cmd(cmd, bin)
+        if err != nil {
+                return err
+        }
+        if _, err := os.Stat(completionFile); err == nil {
+                return fmt.Errorf("already installed at %s", completionFile)
+        }
+
+        return createFile(completionFile, completeCmd)
+}
+
+func (f fish) Uninstall(cmd, bin string) error {
+        completionFile := filepath.Join(f.configDir, "completions", fmt.Sprintf("%s.fish", cmd))
+        if _, err := os.Stat(completionFile); err != nil {
+                return fmt.Errorf("does not installed in %s", f.configDir)
+        }
+
+        return os.Remove(completionFile)
+}
+
+func (f fish) cmd(cmd, bin string) (string, error) {
+        var buf bytes.Buffer
+        params := struct{ Cmd, Bin string }{cmd, bin}
+        tmpl := template.Must(template.New("cmd").Parse(`
+function __complete_{{.Cmd}}
+    set -lx COMP_LINE (string join ' ' (commandline -o))
+    test (commandline -ct) = ""
+    and set COMP_LINE "$COMP_LINE "
+    {{.Bin}}
+end
+complete -c {{.Cmd}} -a "(__complete_{{.Cmd}})"
+`))
+        err := tmpl.Execute(&buf, params)
+        if err != nil {
+                return "", err
+        }
+        return buf.String(), nil
+}
diff --git a/vendor/github.com/posener/complete/cmd/install/install.go b/vendor/github.com/posener/complete/cmd/install/install.go
index 082a226..dfa1963 100644
--- a/vendor/github.com/posener/complete/cmd/install/install.go
+++ b/vendor/github.com/posener/complete/cmd/install/install.go
@@ -51,7 +51,7 @@ func Uninstall(cmd string) error {
         for _, i := range is {
                 errI := i.Uninstall(cmd, bin)
                 if errI != nil {
-                        multierror.Append(err, errI)
+                        err = multierror.Append(err, errI)
                 }
         }
 
@@ -68,9 +68,36 @@ func installers() (i []installer) {
         if f := rcFile(".zshrc"); f != "" {
                 i = append(i, zsh{f})
         }
+        if d := fishConfigDir(); d != "" {
+                i = append(i, fish{d})
+        }
         return
 }
 
+func fishConfigDir() string {
+        configDir := filepath.Join(getConfigHomePath(), "fish")
+        if configDir == "" {
+                return ""
+        }
+        if info, err := os.Stat(configDir); err != nil || !info.IsDir() {
+                return ""
+        }
+        return configDir
+}
+
+func getConfigHomePath() string {
+        u, err := user.Current()
+        if err != nil {
+                return ""
+        }
+
+        configHome := os.Getenv("XDG_CONFIG_HOME")
+        if configHome == "" {
+                return filepath.Join(u.HomeDir, ".config")
+        }
+        return configHome
+}
+
 func getBinaryPath() (string, error) {
         bin, err := os.Executable()
         if err != nil {
diff --git a/vendor/github.com/posener/complete/cmd/install/utils.go b/vendor/github.com/posener/complete/cmd/install/utils.go
index 2c8b44c..d34ac8c 100644
--- a/vendor/github.com/posener/complete/cmd/install/utils.go
+++ b/vendor/github.com/posener/complete/cmd/install/utils.go
@@ -6,6 +6,7 @@ import (
         "io"
         "io/ioutil"
         "os"
+        "path/filepath"
 )
 
 func lineInFile(name string, lookFor string) bool {
@@ -36,6 +37,24 @@ func lineInFile(name string, lookFor string) bool {
         }
 }
 
+func createFile(name string, content string) error {
+        // make sure file directory exists
+        if err := os.MkdirAll(filepath.Dir(name), 0775); err != nil {
+                return err
+        }
+
+        // create the file
+        f, err := os.Create(name)
+        if err != nil {
+                return err
+        }
+        defer f.Close()
+
+        // write file content
+        _, err = f.WriteString(fmt.Sprintf("%s\n", content))
+        return err
+}
+
 func appendToFile(name string, content string) error {
         f, err := os.OpenFile(name, os.O_RDWR|os.O_APPEND, 0)
         if err != nil {
@@ -96,7 +115,10 @@ func removeContentToTempFile(name, content string) (string, error) {
                 if str == content {
                         continue
                 }
-                wf.WriteString(str + "\n")
+                _, err = wf.WriteString(str + "\n")
+                if err != nil {
+                        return "", err
+                }
                 prefix = prefix[:0]
         }
         return wf.Name(), nil
diff --git a/vendor/github.com/posener/complete/complete.go b/vendor/github.com/posener/complete/complete.go
index 185d1e8..725c4de 100644
--- a/vendor/github.com/posener/complete/complete.go
+++ b/vendor/github.com/posener/complete/complete.go
@@ -10,14 +10,16 @@ import (
         "fmt"
         "io"
         "os"
+        "strconv"
 
         "github.com/posener/complete/cmd"
         "github.com/posener/complete/match"
 )
 
 const (
-        envComplete = "COMP_LINE"
-        envDebug    = "COMP_DEBUG"
+        envLine  = "COMP_LINE"
+        envPoint = "COMP_POINT"
+        envDebug = "COMP_DEBUG"
 )
 
 // Complete structs define completion for a command with CLI options
@@ -55,13 +57,18 @@ func (c *Complete) Run() bool {
 // For installation: it assumes that flags were added and parsed before
 // it was called.
 func (c *Complete) Complete() bool {
-        line, ok := getLine()
+        line, point, ok := getEnv()
         if !ok {
                 // make sure flags parsed,
                 // in case they were not added in the main program
                 return c.CLI.Run()
         }
-        Log("Completing line: %s", line)
+
+        if point >= 0 && point < len(line) {
+                line = line[:point]
+        }
+
+        Log("Completing phrase: %s", line)
         a := newArgs(line)
         Log("Completing last field: %s", a.Last)
         options := c.Command.Predict(a)
@@ -79,12 +86,19 @@ func (c *Complete) Complete() bool {
         return true
 }
 
-func getLine() (string, bool) {
-        line := os.Getenv(envComplete)
+func getEnv() (line string, point int, ok bool) {
+        line = os.Getenv(envLine)
         if line == "" {
-                return "", false
+                return
+        }
+        point, err := strconv.Atoi(os.Getenv(envPoint))
+        if err != nil {
+                // If failed parsing point for some reason, set it to point
+                // on the end of the line.
+                Log("Failed parsing point %s: %v", os.Getenv(envPoint), err)
+                point = len(line)
         }
-        return line, true
+        return line, point, true
 }
 
 func (c *Complete) output(options []string) {
diff --git a/vendor/github.com/posener/complete/go.mod b/vendor/github.com/posener/complete/go.mod
new file mode 100644
index 0000000..fef0c44
--- /dev/null
+++ b/vendor/github.com/posener/complete/go.mod
@@ -0,0 +1,3 @@
+module github.com/posener/complete
+
+require github.com/hashicorp/go-multierror v1.0.0
diff --git a/vendor/github.com/posener/complete/go.sum b/vendor/github.com/posener/complete/go.sum
new file mode 100644
index 0000000..d2f1330
--- /dev/null
+++ b/vendor/github.com/posener/complete/go.sum
@@ -0,0 +1,4 @@
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
+github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
diff --git a/vendor/github.com/posener/complete/log.go b/vendor/github.com/posener/complete/log.go
index 797a80c..c302955 100644
--- a/vendor/github.com/posener/complete/log.go
+++ b/vendor/github.com/posener/complete/log.go
@@ -1,7 +1,6 @@
 package complete
 
 import (
-        "io"
         "io/ioutil"
         "log"
         "os"
@@ -15,7 +14,7 @@ import (
 var Log = getLogger()
 
 func getLogger() func(format string, args ...interface{}) {
-        var logfile io.Writer = ioutil.Discard
+        var logfile = ioutil.Discard
         if os.Getenv(envDebug) != "" {
                 logfile = os.Stderr
         }
diff --git a/vendor/github.com/posener/complete/metalinter.json b/vendor/github.com/posener/complete/metalinter.json
deleted file mode 100644
index 799c1d0..0000000
--- a/vendor/github.com/posener/complete/metalinter.json
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-    "Vendor": true,
-    "DisableAll": true,
-    "Enable": [
-        "gofmt",
-        "goimports",
-        "interfacer",
-        "goconst",
-        "misspell",
-        "unconvert",
-        "gosimple",
-        "golint",
-        "structcheck",
-        "deadcode",
-        "vet"
-    ],
-    "Exclude": [
-        "initTests is unused"
-    ],
-    "Deadline": "2m"
-}
diff --git a/vendor/github.com/posener/complete/readme.md b/vendor/github.com/posener/complete/readme.md
index 74077e3..6d757ef 100644
--- a/vendor/github.com/posener/complete/readme.md
+++ b/vendor/github.com/posener/complete/readme.md
@@ -1,12 +1,13 @@
 # complete
 
+A tool for bash writing bash completion in go, and bash completion for the go command line.
+
 [![Build Status](https://travis-ci.org/posener/complete.svg?branch=master)](https://travis-ci.org/posener/complete)
 [![codecov](https://codecov.io/gh/posener/complete/branch/master/graph/badge.svg)](https://codecov.io/gh/posener/complete)
+[![golangci](https://golangci.com/badges/github.com/posener/complete.svg)](https://golangci.com/r/github.com/posener/complete)
 [![GoDoc](https://godoc.org/github.com/posener/complete?status.svg)](http://godoc.org/github.com/posener/complete)
 [![Go Report Card](https://goreportcard.com/badge/github.com/posener/complete)](https://goreportcard.com/report/github.com/posener/complete)
 
-A tool for bash writing bash completion in go.
-
 Writing bash completion scripts is a hard work. This package provides an easy way
 to create bash completion scripts for any command, and also an easy way to install/uninstall
 the completion of the command.
@@ -42,6 +43,7 @@ Supported shells:
 
 - [x] bash
 - [x] zsh
+- [x] fish
 
 ### Usage
 
diff --git a/vendor/github.com/spf13/afero/.travis.yml b/vendor/github.com/spf13/afero/.travis.yml
new file mode 100644
index 0000000..0637db7
--- /dev/null
+++ b/vendor/github.com/spf13/afero/.travis.yml
@@ -0,0 +1,21 @@
+sudo: false

+language: go

+

+go:

+  - 1.9

+  - "1.10"

+  - tip

+

+os:

+  - linux

+  - osx

+

+matrix:

+  allow_failures:

+    - go: tip

+  fast_finish: true

+

+script:

+  - go build

+  - go test -race -v ./...

+

diff --git a/vendor/github.com/spf13/afero/LICENSE.txt b/vendor/github.com/spf13/afero/LICENSE.txt
new file mode 100644
index 0000000..298f0e2
--- /dev/null
+++ b/vendor/github.com/spf13/afero/LICENSE.txt
@@ -0,0 +1,174 @@
+                                Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
diff --git a/vendor/github.com/spf13/afero/README.md b/vendor/github.com/spf13/afero/README.md
new file mode 100644
index 0000000..0c9b04b
--- /dev/null
+++ b/vendor/github.com/spf13/afero/README.md
@@ -0,0 +1,452 @@
+![afero logo-sm](https://cloud.githubusercontent.com/assets/173412/11490338/d50e16dc-97a5-11e5-8b12-019a300d0fcb.png)
+
+A FileSystem Abstraction System for Go
+
+[![Build Status](https://travis-ci.org/spf13/afero.svg)](https://travis-ci.org/spf13/afero) [![Build status](https://ci.appveyor.com/api/projects/status/github/spf13/afero?branch=master&svg=true)](https://ci.appveyor.com/project/spf13/afero) [![GoDoc](https://godoc.org/github.com/spf13/afero?status.svg)](https://godoc.org/github.com/spf13/afero) [![Join the chat at https://gitter.im/spf13/afero](https://badges.gitter.im/Dev%20Chat.svg)](https://gitter.im/spf13/afero?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+
+# Overview
+
+Afero is an filesystem framework providing a simple, uniform and universal API
+interacting with any filesystem, as an abstraction layer providing interfaces,
+types and methods. Afero has an exceptionally clean interface and simple design
+without needless constructors or initialization methods.
+
+Afero is also a library providing a base set of interoperable backend
+filesystems that make it easy to work with afero while retaining all the power
+and benefit of the os and ioutil packages.
+
+Afero provides significant improvements over using the os package alone, most
+notably the ability to create mock and testing filesystems without relying on the disk.
+
+It is suitable for use in a any situation where you would consider using the OS
+package as it provides an additional abstraction that makes it easy to use a
+memory backed file system during testing. It also adds support for the http
+filesystem for full interoperability.
+
+
+## Afero Features
+
+* A single consistent API for accessing a variety of filesystems
+* Interoperation between a variety of file system types
+* A set of interfaces to encourage and enforce interoperability between backends
+* An atomic cross platform memory backed file system
+* Support for compositional (union) file systems by combining multiple file systems acting as one
+* Specialized backends which modify existing filesystems (Read Only, Regexp filtered)
+* A set of utility functions ported from io, ioutil & hugo to be afero aware
+
+
+# Using Afero
+
+Afero is easy to use and easier to adopt.
+
+A few different ways you could use Afero:
+
+* Use the interfaces alone to define you own file system.
+* Wrap for the OS packages.
+* Define different filesystems for different parts of your application.
+* Use Afero for mock filesystems while testing
+
+## Step 1: Install Afero
+
+First use go get to install the latest version of the library.
+
+    $ go get github.com/spf13/afero
+
+Next include Afero in your application.
+```go
+import "github.com/spf13/afero"
+```
+
+## Step 2: Declare a backend
+
+First define a package variable and set it to a pointer to a filesystem.
+```go
+var AppFs = afero.NewMemMapFs()
+
+or
+
+var AppFs = afero.NewOsFs()
+```
+It is important to note that if you repeat the composite literal you
+will be using a completely new and isolated filesystem. In the case of
+OsFs it will still use the same underlying filesystem but will reduce
+the ability to drop in other filesystems as desired.
+
+## Step 3: Use it like you would the OS package
+
+Throughout your application use any function and method like you normally
+would.
+
+So if my application before had:
+```go
+os.Open('/tmp/foo')
+```
+We would replace it with:
+```go
+AppFs.Open('/tmp/foo')
+```
+
+`AppFs` being the variable we defined above.
+
+
+## List of all available functions
+
+File System Methods Available:
+```go
+Chmod(name string, mode os.FileMode) : error
+Chtimes(name string, atime time.Time, mtime time.Time) : error
+Create(name string) : File, error
+Mkdir(name string, perm os.FileMode) : error
+MkdirAll(path string, perm os.FileMode) : error
+Name() : string
+Open(name string) : File, error
+OpenFile(name string, flag int, perm os.FileMode) : File, error
+Remove(name string) : error
+RemoveAll(path string) : error
+Rename(oldname, newname string) : error
+Stat(name string) : os.FileInfo, error
+```
+File Interfaces and Methods Available:
+```go
+io.Closer
+io.Reader
+io.ReaderAt
+io.Seeker
+io.Writer
+io.WriterAt
+
+Name() : string
+Readdir(count int) : []os.FileInfo, error
+Readdirnames(n int) : []string, error
+Stat() : os.FileInfo, error
+Sync() : error
+Truncate(size int64) : error
+WriteString(s string) : ret int, err error
+```
+In some applications it may make sense to define a new package that
+simply exports the file system variable for easy access from anywhere.
+
+## Using Afero's utility functions
+
+Afero provides a set of functions to make it easier to use the underlying file systems.
+These functions have been primarily ported from io & ioutil with some developed for Hugo.
+
+The afero utilities support all afero compatible backends.
+
+The list of utilities includes:
+
+```go
+DirExists(path string) (bool, error)
+Exists(path string) (bool, error)
+FileContainsBytes(filename string, subslice []byte) (bool, error)
+GetTempDir(subPath string) string
+IsDir(path string) (bool, error)
+IsEmpty(path string) (bool, error)
+ReadDir(dirname string) ([]os.FileInfo, error)
+ReadFile(filename string) ([]byte, error)
+SafeWriteReader(path string, r io.Reader) (err error)
+TempDir(dir, prefix string) (name string, err error)
+TempFile(dir, prefix string) (f File, err error)
+Walk(root string, walkFn filepath.WalkFunc) error
+WriteFile(filename string, data []byte, perm os.FileMode) error
+WriteReader(path string, r io.Reader) (err error)
+```
+For a complete list see [Afero's GoDoc](https://godoc.org/github.com/spf13/afero)
+
+They are available under two different approaches to use. You can either call
+them directly where the first parameter of each function will be the file
+system, or you can declare a new `Afero`, a custom type used to bind these
+functions as methods to a given filesystem.
+
+### Calling utilities directly
+
+```go
+fs := new(afero.MemMapFs)
+f, err := afero.TempFile(fs,"", "ioutil-test")
+
+```
+
+### Calling via Afero
+
+```go
+fs := afero.NewMemMapFs()
+afs := &afero.Afero{Fs: fs}
+f, err := afs.TempFile("", "ioutil-test")
+```
+
+## Using Afero for Testing
+
+There is a large benefit to using a mock filesystem for testing. It has a
+completely blank state every time it is initialized and can be easily
+reproducible regardless of OS. You could create files to your heart’s content
+and the file access would be fast while also saving you from all the annoying
+issues with deleting temporary files, Windows file locking, etc. The MemMapFs
+backend is perfect for testing.
+
+* Much faster than performing I/O operations on disk
+* Avoid security issues and permissions
+* Far more control. 'rm -rf /' with confidence
+* Test setup is far more easier to do
+* No test cleanup needed
+
+One way to accomplish this is to define a variable as mentioned above.
+In your application this will be set to afero.NewOsFs() during testing you
+can set it to afero.NewMemMapFs().
+
+It wouldn't be uncommon to have each test initialize a blank slate memory
+backend. To do this I would define my `appFS = afero.NewOsFs()` somewhere
+appropriate in my application code. This approach ensures that Tests are order
+independent, with no test relying on the state left by an earlier test.
+
+Then in my tests I would initialize a new MemMapFs for each test:
+```go
+func TestExist(t *testing.T) {
+        appFS := afero.NewMemMapFs()
+        // create test files and directories
+        appFS.MkdirAll("src/a", 0755)
+        afero.WriteFile(appFS, "src/a/b", []byte("file b"), 0644)
+        afero.WriteFile(appFS, "src/c", []byte("file c"), 0644)
+        name := "src/c"
+        _, err := appFS.Stat(name)
+        if os.IsNotExist(err) {
+                t.Errorf("file \"%s\" does not exist.\n", name)
+        }
+}
+```
+
+# Available Backends
+
+## Operating System Native
+
+### OsFs
+
+The first is simply a wrapper around the native OS calls. This makes it
+very easy to use as all of the calls are the same as the existing OS
+calls. It also makes it trivial to have your code use the OS during
+operation and a mock filesystem during testing or as needed.
+
+```go
+appfs := afero.NewOsFs()
+appfs.MkdirAll("src/a", 0755))
+```
+
+## Memory Backed Storage
+
+### MemMapFs
+
+Afero also provides a fully atomic memory backed filesystem perfect for use in
+mocking and to speed up unnecessary disk io when persistence isn’t
+necessary. It is fully concurrent and will work within go routines
+safely.
+
+```go
+mm := afero.NewMemMapFs()
+mm.MkdirAll("src/a", 0755))
+```
+
+#### InMemoryFile
+
+As part of MemMapFs, Afero also provides an atomic, fully concurrent memory
+backed file implementation. This can be used in other memory backed file
+systems with ease. Plans are to add a radix tree memory stored file
+system using InMemoryFile.
+
+## Network Interfaces
+
+### SftpFs
+
+Afero has experimental support for secure file transfer protocol (sftp). Which can
+be used to perform file operations over a encrypted channel.
+
+## Filtering Backends
+
+### BasePathFs
+
+The BasePathFs restricts all operations to a given path within an Fs.
+The given file name to the operations on this Fs will be prepended with
+the base path before calling the source Fs.
+
+```go
+bp := afero.NewBasePathFs(afero.NewOsFs(), "/base/path")
+```
+
+### ReadOnlyFs
+
+A thin wrapper around the source Fs providing a read only view.
+
+```go
+fs := afero.NewReadOnlyFs(afero.NewOsFs())
+_, err := fs.Create("/file.txt")
+// err = syscall.EPERM
+```
+
+# RegexpFs
+
+A filtered view on file names, any file NOT matching
+the passed regexp will be treated as non-existing.
+Files not matching the regexp provided will not be created.
+Directories are not filtered.
+
+```go
+fs := afero.NewRegexpFs(afero.NewMemMapFs(), regexp.MustCompile(`\.txt$`))
+_, err := fs.Create("/file.html")
+// err = syscall.ENOENT
+```
+
+### HttpFs
+
+Afero provides an http compatible backend which can wrap any of the existing
+backends.
+
+The Http package requires a slightly specific version of Open which
+returns an http.File type.
+
+Afero provides an httpFs file system which satisfies this requirement.
+Any Afero FileSystem can be used as an httpFs.
+
+```go
+httpFs := afero.NewHttpFs(<ExistingFS>)
+fileserver := http.FileServer(httpFs.Dir(<PATH>)))
+http.Handle("/", fileserver)
+```
+
+## Composite Backends
+
+Afero provides the ability have two filesystems (or more) act as a single
+file system.
+
+### CacheOnReadFs
+
+The CacheOnReadFs will lazily make copies of any accessed files from the base
+layer into the overlay. Subsequent reads will be pulled from the overlay
+directly permitting the request is within the cache duration of when it was
+created in the overlay.
+
+If the base filesystem is writeable, any changes to files will be
+done first to the base, then to the overlay layer. Write calls to open file
+handles like `Write()` or `Truncate()` to the overlay first.
+
+To writing files to the overlay only, you can use the overlay Fs directly (not
+via the union Fs).
+
+Cache files in the layer for the given time.Duration, a cache duration of 0
+means "forever" meaning the file will not be re-requested from the base ever.
+
+A read-only base will make the overlay also read-only but still copy files
+from the base to the overlay when they're not present (or outdated) in the
+caching layer.
+
+```go
+base := afero.NewOsFs()
+layer := afero.NewMemMapFs()
+ufs := afero.NewCacheOnReadFs(base, layer, 100 * time.Second)
+```
+
+### CopyOnWriteFs()
+
+The CopyOnWriteFs is a read only base file system with a potentially
+writeable layer on top.
+
+Read operations will first look in the overlay and if not found there, will
+serve the file from the base.
+
+Changes to the file system will only be made in the overlay.
+
+Any attempt to modify a file found only in the base will copy the file to the
+overlay layer before modification (including opening a file with a writable
+handle).
+
+Removing and Renaming files present only in the base layer is not currently
+permitted. If a file is present in the base layer and the overlay, only the
+overlay will be removed/renamed.
+
+```go
+        base := afero.NewOsFs()
+        roBase := afero.NewReadOnlyFs(base)
+        ufs := afero.NewCopyOnWriteFs(roBase, afero.NewMemMapFs())
+
+        fh, _ = ufs.Create("/home/test/file2.txt")
+        fh.WriteString("This is a test")
+        fh.Close()
+```
+
+In this example all write operations will only occur in memory (MemMapFs)
+leaving the base filesystem (OsFs) untouched.
+
+
+## Desired/possible backends
+
+The following is a short list of possible backends we hope someone will
+implement:
+
+* SSH
+* ZIP
+* TAR
+* S3
+
+# About the project
+
+## What's in the name
+
+Afero comes from the latin roots Ad-Facere.
+
+**"Ad"** is a prefix meaning "to".
+
+**"Facere"** is a form of the root "faciō" making "make or do".
+
+The literal meaning of afero is "to make" or "to do" which seems very fitting
+for a library that allows one to make files and directories and do things with them.
+
+The English word that shares the same roots as Afero is "affair". Affair shares
+the same concept but as a noun it means "something that is made or done" or "an
+object of a particular type".
+
+It's also nice that unlike some of my other libraries (hugo, cobra, viper) it
+Googles very well.
+
+## Release Notes
+
+* **0.10.0** 2015.12.10
+  * Full compatibility with Windows
+  * Introduction of afero utilities
+  * Test suite rewritten to work cross platform
+  * Normalize paths for MemMapFs
+  * Adding Sync to the file interface
+  * **Breaking Change** Walk and ReadDir have changed parameter order
+  * Moving types used by MemMapFs to a subpackage
+  * General bugfixes and improvements
+* **0.9.0** 2015.11.05
+  * New Walk function similar to filepath.Walk
+  * MemMapFs.OpenFile handles O_CREATE, O_APPEND, O_TRUNC
+  * MemMapFs.Remove now really deletes the file
+  * InMemoryFile.Readdir and Readdirnames work correctly
+  * InMemoryFile functions lock it for concurrent access
+  * Test suite improvements
+* **0.8.0** 2014.10.28
+  * First public version
+  * Interfaces feel ready for people to build using
+  * Interfaces satisfy all known uses
+  * MemMapFs passes the majority of the OS test suite
+  * OsFs passes the majority of the OS test suite
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+## Contributors
+
+Names in no particular order:
+
+* [spf13](https://github.com/spf13)
+* [jaqx0r](https://github.com/jaqx0r)
+* [mbertschler](https://github.com/mbertschler)
+* [xor-gate](https://github.com/xor-gate)
+
+## License
+
+Afero is released under the Apache 2.0 license. See
+[LICENSE.txt](https://github.com/spf13/afero/blob/master/LICENSE.txt)
diff --git a/vendor/github.com/spf13/afero/afero.go b/vendor/github.com/spf13/afero/afero.go
new file mode 100644
index 0000000..f5b5e12
--- /dev/null
+++ b/vendor/github.com/spf13/afero/afero.go
@@ -0,0 +1,108 @@
+// Copyright © 2014 Steve Francia <spf@spf13.com>.
+// Copyright 2013 tsuru authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package afero provides types and methods for interacting with the filesystem,
+// as an abstraction layer.
+
+// Afero also provides a few implementations that are mostly interoperable. One that
+// uses the operating system filesystem, one that uses memory to store files
+// (cross platform) and an interface that should be implemented if you want to
+// provide your own filesystem.
+
+package afero
+
+import (
+        "errors"
+        "io"
+        "os"
+        "time"
+)
+
+type Afero struct {
+        Fs
+}
+
+// File represents a file in the filesystem.
+type File interface {
+        io.Closer
+        io.Reader
+        io.ReaderAt
+        io.Seeker
+        io.Writer
+        io.WriterAt
+
+        Name() string
+        Readdir(count int) ([]os.FileInfo, error)
+        Readdirnames(n int) ([]string, error)
+        Stat() (os.FileInfo, error)
+        Sync() error
+        Truncate(size int64) error
+        WriteString(s string) (ret int, err error)
+}
+
+// Fs is the filesystem interface.
+//
+// Any simulated or real filesystem should implement this interface.
+type Fs interface {
+        // Create creates a file in the filesystem, returning the file and an
+        // error, if any happens.
+        Create(name string) (File, error)
+
+        // Mkdir creates a directory in the filesystem, return an error if any
+        // happens.
+        Mkdir(name string, perm os.FileMode) error
+
+        // MkdirAll creates a directory path and all parents that does not exist
+        // yet.
+        MkdirAll(path string, perm os.FileMode) error
+
+        // Open opens a file, returning it or an error, if any happens.
+        Open(name string) (File, error)
+
+        // OpenFile opens a file using the given flags and the given mode.
+        OpenFile(name string, flag int, perm os.FileMode) (File, error)
+
+        // Remove removes a file identified by name, returning an error, if any
+        // happens.
+        Remove(name string) error
+
+        // RemoveAll removes a directory path and any children it contains. It
+        // does not fail if the path does not exist (return nil).
+        RemoveAll(path string) error
+
+        // Rename renames a file.
+        Rename(oldname, newname string) error
+
+        // Stat returns a FileInfo describing the named file, or an error, if any
+        // happens.
+        Stat(name string) (os.FileInfo, error)
+
+        // The name of this FileSystem
+        Name() string
+
+        //Chmod changes the mode of the named file to mode.
+        Chmod(name string, mode os.FileMode) error
+
+        //Chtimes changes the access and modification times of the named file
+        Chtimes(name string, atime time.Time, mtime time.Time) error
+}
+
+var (
+        ErrFileClosed        = errors.New("File is closed")
+        ErrOutOfRange        = errors.New("Out of range")
+        ErrTooLarge          = errors.New("Too large")
+        ErrFileNotFound      = os.ErrNotExist
+        ErrFileExists        = os.ErrExist
+        ErrDestinationExists = os.ErrExist
+)
diff --git a/vendor/github.com/spf13/afero/appveyor.yml b/vendor/github.com/spf13/afero/appveyor.yml
new file mode 100644
index 0000000..a633ad5
--- /dev/null
+++ b/vendor/github.com/spf13/afero/appveyor.yml
@@ -0,0 +1,15 @@
+version: '{build}'
+clone_folder: C:\gopath\src\github.com\spf13\afero
+environment:
+  GOPATH: C:\gopath
+build_script:
+- cmd: >-
+    go version
+
+    go env
+
+    go get -v github.com/spf13/afero/...
+
+    go build github.com/spf13/afero
+test_script:
+- cmd: go test -race -v github.com/spf13/afero/...
diff --git a/vendor/github.com/spf13/afero/basepath.go b/vendor/github.com/spf13/afero/basepath.go
new file mode 100644
index 0000000..616ff8f
--- /dev/null
+++ b/vendor/github.com/spf13/afero/basepath.go
@@ -0,0 +1,180 @@
+package afero
+
+import (
+        "os"
+        "path/filepath"
+        "runtime"
+        "strings"
+        "time"
+)
+
+var _ Lstater = (*BasePathFs)(nil)
+
+// The BasePathFs restricts all operations to a given path within an Fs.
+// The given file name to the operations on this Fs will be prepended with
+// the base path before calling the base Fs.
+// Any file name (after filepath.Clean()) outside this base path will be
+// treated as non existing file.
+//
+// Note that it does not clean the error messages on return, so you may
+// reveal the real path on errors.
+type BasePathFs struct {
+        source Fs
+        path   string
+}
+
+type BasePathFile struct {
+        File
+        path string
+}
+
+func (f *BasePathFile) Name() string {
+        sourcename := f.File.Name()
+        return strings.TrimPrefix(sourcename, filepath.Clean(f.path))
+}
+
+func NewBasePathFs(source Fs, path string) Fs {
+        return &BasePathFs{source: source, path: path}
+}
+
+// on a file outside the base path it returns the given file name and an error,
+// else the given file with the base path prepended
+func (b *BasePathFs) RealPath(name string) (path string, err error) {
+        if err := validateBasePathName(name); err != nil {
+                return name, err
+        }
+
+        bpath := filepath.Clean(b.path)
+        path = filepath.Clean(filepath.Join(bpath, name))
+        if !strings.HasPrefix(path, bpath) {
+                return name, os.ErrNotExist
+        }
+
+        return path, nil
+}
+
+func validateBasePathName(name string) error {
+        if runtime.GOOS != "windows" {
+                // Not much to do here;
+                // the virtual file paths all look absolute on *nix.
+                return nil
+        }
+
+        // On Windows a common mistake would be to provide an absolute OS path
+        // We could strip out the base part, but that would not be very portable.
+        if filepath.IsAbs(name) {
+                return os.ErrNotExist
+        }
+
+        return nil
+}
+
+func (b *BasePathFs) Chtimes(name string, atime, mtime time.Time) (err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return &os.PathError{Op: "chtimes", Path: name, Err: err}
+        }
+        return b.source.Chtimes(name, atime, mtime)
+}
+
+func (b *BasePathFs) Chmod(name string, mode os.FileMode) (err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return &os.PathError{Op: "chmod", Path: name, Err: err}
+        }
+        return b.source.Chmod(name, mode)
+}
+
+func (b *BasePathFs) Name() string {
+        return "BasePathFs"
+}
+
+func (b *BasePathFs) Stat(name string) (fi os.FileInfo, err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return nil, &os.PathError{Op: "stat", Path: name, Err: err}
+        }
+        return b.source.Stat(name)
+}
+
+func (b *BasePathFs) Rename(oldname, newname string) (err error) {
+        if oldname, err = b.RealPath(oldname); err != nil {
+                return &os.PathError{Op: "rename", Path: oldname, Err: err}
+        }
+        if newname, err = b.RealPath(newname); err != nil {
+                return &os.PathError{Op: "rename", Path: newname, Err: err}
+        }
+        return b.source.Rename(oldname, newname)
+}
+
+func (b *BasePathFs) RemoveAll(name string) (err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return &os.PathError{Op: "remove_all", Path: name, Err: err}
+        }
+        return b.source.RemoveAll(name)
+}
+
+func (b *BasePathFs) Remove(name string) (err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return &os.PathError{Op: "remove", Path: name, Err: err}
+        }
+        return b.source.Remove(name)
+}
+
+func (b *BasePathFs) OpenFile(name string, flag int, mode os.FileMode) (f File, err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return nil, &os.PathError{Op: "openfile", Path: name, Err: err}
+        }
+        sourcef, err := b.source.OpenFile(name, flag, mode)
+        if err != nil {
+                return nil, err
+        }
+        return &BasePathFile{sourcef, b.path}, nil
+}
+
+func (b *BasePathFs) Open(name string) (f File, err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return nil, &os.PathError{Op: "open", Path: name, Err: err}
+        }
+        sourcef, err := b.source.Open(name)
+        if err != nil {
+                return nil, err
+        }
+        return &BasePathFile{File: sourcef, path: b.path}, nil
+}
+
+func (b *BasePathFs) Mkdir(name string, mode os.FileMode) (err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return &os.PathError{Op: "mkdir", Path: name, Err: err}
+        }
+        return b.source.Mkdir(name, mode)
+}
+
+func (b *BasePathFs) MkdirAll(name string, mode os.FileMode) (err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return &os.PathError{Op: "mkdir", Path: name, Err: err}
+        }
+        return b.source.MkdirAll(name, mode)
+}
+
+func (b *BasePathFs) Create(name string) (f File, err error) {
+        if name, err = b.RealPath(name); err != nil {
+                return nil, &os.PathError{Op: "create", Path: name, Err: err}
+        }
+        sourcef, err := b.source.Create(name)
+        if err != nil {
+                return nil, err
+        }
+        return &BasePathFile{File: sourcef, path: b.path}, nil
+}
+
+func (b *BasePathFs) LstatIfPossible(name string) (os.FileInfo, bool, error) {
+        name, err := b.RealPath(name)
+        if err != nil {
+                return nil, false, &os.PathError{Op: "lstat", Path: name, Err: err}
+        }
+        if lstater, ok := b.source.(Lstater); ok {
+                return lstater.LstatIfPossible(name)
+        }
+        fi, err := b.source.Stat(name)
+        return fi, false, err
+}
+
+// vim: ts=4 sw=4 noexpandtab nolist syn=go
diff --git a/vendor/github.com/spf13/afero/cacheOnReadFs.go b/vendor/github.com/spf13/afero/cacheOnReadFs.go
new file mode 100644
index 0000000..29a26c6
--- /dev/null
+++ b/vendor/github.com/spf13/afero/cacheOnReadFs.go
@@ -0,0 +1,290 @@
+package afero
+
+import (
+        "os"
+        "syscall"
+        "time"
+)
+
+// If the cache duration is 0, cache time will be unlimited, i.e. once
+// a file is in the layer, the base will never be read again for this file.
+//
+// For cache times greater than 0, the modification time of a file is
+// checked. Note that a lot of file system implementations only allow a
+// resolution of a second for timestamps... or as the godoc for os.Chtimes()
+// states: "The underlying filesystem may truncate or round the values to a
+// less precise time unit."
+//
+// This caching union will forward all write calls also to the base file
+// system first. To prevent writing to the base Fs, wrap it in a read-only
+// filter - Note: this will also make the overlay read-only, for writing files
+// in the overlay, use the overlay Fs directly, not via the union Fs.
+type CacheOnReadFs struct {
+        base      Fs
+        layer     Fs
+        cacheTime time.Duration
+}
+
+func NewCacheOnReadFs(base Fs, layer Fs, cacheTime time.Duration) Fs {
+        return &CacheOnReadFs{base: base, layer: layer, cacheTime: cacheTime}
+}
+
+type cacheState int
+
+const (
+        // not present in the overlay, unknown if it exists in the base:
+        cacheMiss cacheState = iota
+        // present in the overlay and in base, base file is newer:
+        cacheStale
+        // present in the overlay - with cache time == 0 it may exist in the base,
+        // with cacheTime > 0 it exists in the base and is same age or newer in the
+        // overlay
+        cacheHit
+        // happens if someone writes directly to the overlay without
+        // going through this union
+        cacheLocal
+)
+
+func (u *CacheOnReadFs) cacheStatus(name string) (state cacheState, fi os.FileInfo, err error) {
+        var lfi, bfi os.FileInfo
+        lfi, err = u.layer.Stat(name)
+        if err == nil {
+                if u.cacheTime == 0 {
+                        return cacheHit, lfi, nil
+                }
+                if lfi.ModTime().Add(u.cacheTime).Before(time.Now()) {
+                        bfi, err = u.base.Stat(name)
+                        if err != nil {
+                                return cacheLocal, lfi, nil
+                        }
+                        if bfi.ModTime().After(lfi.ModTime()) {
+                                return cacheStale, bfi, nil
+                        }
+                }
+                return cacheHit, lfi, nil
+        }
+
+        if err == syscall.ENOENT || os.IsNotExist(err) {
+                return cacheMiss, nil, nil
+        }
+
+        return cacheMiss, nil, err
+}
+
+func (u *CacheOnReadFs) copyToLayer(name string) error {
+        return copyToLayer(u.base, u.layer, name)
+}
+
+func (u *CacheOnReadFs) Chtimes(name string, atime, mtime time.Time) error {
+        st, _, err := u.cacheStatus(name)
+        if err != nil {
+                return err
+        }
+        switch st {
+        case cacheLocal:
+        case cacheHit:
+                err = u.base.Chtimes(name, atime, mtime)
+        case cacheStale, cacheMiss:
+                if err := u.copyToLayer(name); err != nil {
+                        return err
+                }
+                err = u.base.Chtimes(name, atime, mtime)
+        }
+        if err != nil {
+                return err
+        }
+        return u.layer.Chtimes(name, atime, mtime)
+}
+
+func (u *CacheOnReadFs) Chmod(name string, mode os.FileMode) error {
+        st, _, err := u.cacheStatus(name)
+        if err != nil {
+                return err
+        }
+        switch st {
+        case cacheLocal:
+        case cacheHit:
+                err = u.base.Chmod(name, mode)
+        case cacheStale, cacheMiss:
+                if err := u.copyToLayer(name); err != nil {
+                        return err
+                }
+                err = u.base.Chmod(name, mode)
+        }
+        if err != nil {
+                return err
+        }
+        return u.layer.Chmod(name, mode)
+}
+
+func (u *CacheOnReadFs) Stat(name string) (os.FileInfo, error) {
+        st, fi, err := u.cacheStatus(name)
+        if err != nil {
+                return nil, err
+        }
+        switch st {
+        case cacheMiss:
+                return u.base.Stat(name)
+        default: // cacheStale has base, cacheHit and cacheLocal the layer os.FileInfo
+                return fi, nil
+        }
+}
+
+func (u *CacheOnReadFs) Rename(oldname, newname string) error {
+        st, _, err := u.cacheStatus(oldname)
+        if err != nil {
+                return err
+        }
+        switch st {
+        case cacheLocal:
+        case cacheHit:
+                err = u.base.Rename(oldname, newname)
+        case cacheStale, cacheMiss:
+                if err := u.copyToLayer(oldname); err != nil {
+                        return err
+                }
+                err = u.base.Rename(oldname, newname)
+        }
+        if err != nil {
+                return err
+        }
+        return u.layer.Rename(oldname, newname)
+}
+
+func (u *CacheOnReadFs) Remove(name string) error {
+        st, _, err := u.cacheStatus(name)
+        if err != nil {
+                return err
+        }
+        switch st {
+        case cacheLocal:
+        case cacheHit, cacheStale, cacheMiss:
+                err = u.base.Remove(name)
+        }
+        if err != nil {
+                return err
+        }
+        return u.layer.Remove(name)
+}
+
+func (u *CacheOnReadFs) RemoveAll(name string) error {
+        st, _, err := u.cacheStatus(name)
+        if err != nil {
+                return err
+        }
+        switch st {
+        case cacheLocal:
+        case cacheHit, cacheStale, cacheMiss:
+                err = u.base.RemoveAll(name)
+        }
+        if err != nil {
+                return err
+        }
+        return u.layer.RemoveAll(name)
+}
+
+func (u *CacheOnReadFs) OpenFile(name string, flag int, perm os.FileMode) (File, error) {
+        st, _, err := u.cacheStatus(name)
+        if err != nil {
+                return nil, err
+        }
+        switch st {
+        case cacheLocal, cacheHit:
+        default:
+                if err := u.copyToLayer(name); err != nil {
+                        return nil, err
+                }
+        }
+        if flag&(os.O_WRONLY|syscall.O_RDWR|os.O_APPEND|os.O_CREATE|os.O_TRUNC) != 0 {
+                bfi, err := u.base.OpenFile(name, flag, perm)
+                if err != nil {
+                        return nil, err
+                }
+                lfi, err := u.layer.OpenFile(name, flag, perm)
+                if err != nil {
+                        bfi.Close() // oops, what if O_TRUNC was set and file opening in the layer failed...?
+                        return nil, err
+                }
+                return &UnionFile{Base: bfi, Layer: lfi}, nil
+        }
+        return u.layer.OpenFile(name, flag, perm)
+}
+
+func (u *CacheOnReadFs) Open(name string) (File, error) {
+        st, fi, err := u.cacheStatus(name)
+        if err != nil {
+                return nil, err
+        }
+
+        switch st {
+        case cacheLocal:
+                return u.layer.Open(name)
+
+        case cacheMiss:
+                bfi, err := u.base.Stat(name)
+                if err != nil {
+                        return nil, err
+                }
+                if bfi.IsDir() {
+                        return u.base.Open(name)
+                }
+                if err := u.copyToLayer(name); err != nil {
+                        return nil, err
+                }
+                return u.layer.Open(name)
+
+        case cacheStale:
+                if !fi.IsDir() {
+                        if err := u.copyToLayer(name); err != nil {
+                                return nil, err
+                        }
+                        return u.layer.Open(name)
+                }
+        case cacheHit:
+                if !fi.IsDir() {
+                        return u.layer.Open(name)
+                }
+        }
+        // the dirs from cacheHit, cacheStale fall down here:
+        bfile, _ := u.base.Open(name)
+        lfile, err := u.layer.Open(name)
+        if err != nil && bfile == nil {
+                return nil, err
+        }
+        return &UnionFile{Base: bfile, Layer: lfile}, nil
+}
+
+func (u *CacheOnReadFs) Mkdir(name string, perm os.FileMode) error {
+        err := u.base.Mkdir(name, perm)
+        if err != nil {
+                return err
+        }
+        return u.layer.MkdirAll(name, perm) // yes, MkdirAll... we cannot assume it exists in the cache
+}
+
+func (u *CacheOnReadFs) Name() string {
+        return "CacheOnReadFs"
+}
+
+func (u *CacheOnReadFs) MkdirAll(name string, perm os.FileMode) error {
+        err := u.base.MkdirAll(name, perm)
+        if err != nil {
+                return err
+        }
+        return u.layer.MkdirAll(name, perm)
+}
+
+func (u *CacheOnReadFs) Create(name string) (File, error) {
+        bfh, err := u.base.Create(name)
+        if err != nil {
+                return nil, err
+        }
+        lfh, err := u.layer.Create(name)
+        if err != nil {
+                // oops, see comment about OS_TRUNC above, should we remove? then we have to
+                // remember if the file did not exist before
+                bfh.Close()
+                return nil, err
+        }
+        return &UnionFile{Base: bfh, Layer: lfh}, nil
+}
diff --git a/vendor/github.com/spf13/afero/const_bsds.go b/vendor/github.com/spf13/afero/const_bsds.go
new file mode 100644
index 0000000..5728243
--- /dev/null
+++ b/vendor/github.com/spf13/afero/const_bsds.go
@@ -0,0 +1,22 @@
+// Copyright © 2016 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +build darwin openbsd freebsd netbsd dragonfly
+
+package afero
+
+import (
+        "syscall"
+)
+
+const BADFD = syscall.EBADF
diff --git a/vendor/github.com/spf13/afero/const_win_unix.go b/vendor/github.com/spf13/afero/const_win_unix.go
new file mode 100644
index 0000000..968fc27
--- /dev/null
+++ b/vendor/github.com/spf13/afero/const_win_unix.go
@@ -0,0 +1,25 @@
+// Copyright © 2016 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// +build !darwin
+// +build !openbsd
+// +build !freebsd
+// +build !dragonfly
+// +build !netbsd
+
+package afero
+
+import (
+        "syscall"
+)
+
+const BADFD = syscall.EBADFD
diff --git a/vendor/github.com/spf13/afero/copyOnWriteFs.go b/vendor/github.com/spf13/afero/copyOnWriteFs.go
new file mode 100644
index 0000000..e8108a8
--- /dev/null
+++ b/vendor/github.com/spf13/afero/copyOnWriteFs.go
@@ -0,0 +1,293 @@
+package afero
+
+import (
+        "fmt"
+        "os"
+        "path/filepath"
+        "syscall"
+        "time"
+)
+
+var _ Lstater = (*CopyOnWriteFs)(nil)
+
+// The CopyOnWriteFs is a union filesystem: a read only base file system with
+// a possibly writeable layer on top. Changes to the file system will only
+// be made in the overlay: Changing an existing file in the base layer which
+// is not present in the overlay will copy the file to the overlay ("changing"
+// includes also calls to e.g. Chtimes() and Chmod()).
+//
+// Reading directories is currently only supported via Open(), not OpenFile().
+type CopyOnWriteFs struct {
+        base  Fs
+        layer Fs
+}
+
+func NewCopyOnWriteFs(base Fs, layer Fs) Fs {
+        return &CopyOnWriteFs{base: base, layer: layer}
+}
+
+// Returns true if the file is not in the overlay
+func (u *CopyOnWriteFs) isBaseFile(name string) (bool, error) {
+        if _, err := u.layer.Stat(name); err == nil {
+                return false, nil
+        }
+        _, err := u.base.Stat(name)
+        if err != nil {
+                if oerr, ok := err.(*os.PathError); ok {
+                        if oerr.Err == os.ErrNotExist || oerr.Err == syscall.ENOENT || oerr.Err == syscall.ENOTDIR {
+                                return false, nil
+                        }
+                }
+                if err == syscall.ENOENT {
+                        return false, nil
+                }
+        }
+        return true, err
+}
+
+func (u *CopyOnWriteFs) copyToLayer(name string) error {
+        return copyToLayer(u.base, u.layer, name)
+}
+
+func (u *CopyOnWriteFs) Chtimes(name string, atime, mtime time.Time) error {
+        b, err := u.isBaseFile(name)
+        if err != nil {
+                return err
+        }
+        if b {
+                if err := u.copyToLayer(name); err != nil {
+                        return err
+                }
+        }
+        return u.layer.Chtimes(name, atime, mtime)
+}
+
+func (u *CopyOnWriteFs) Chmod(name string, mode os.FileMode) error {
+        b, err := u.isBaseFile(name)
+        if err != nil {
+                return err
+        }
+        if b {
+                if err := u.copyToLayer(name); err != nil {
+                        return err
+                }
+        }
+        return u.layer.Chmod(name, mode)
+}
+
+func (u *CopyOnWriteFs) Stat(name string) (os.FileInfo, error) {
+        fi, err := u.layer.Stat(name)
+        if err != nil {
+                isNotExist := u.isNotExist(err)
+                if isNotExist {
+                        return u.base.Stat(name)
+                }
+                return nil, err
+        }
+        return fi, nil
+}
+
+func (u *CopyOnWriteFs) LstatIfPossible(name string) (os.FileInfo, bool, error) {
+        llayer, ok1 := u.layer.(Lstater)
+        lbase, ok2 := u.base.(Lstater)
+
+        if ok1 {
+                fi, b, err := llayer.LstatIfPossible(name)
+                if err == nil {
+                        return fi, b, nil
+                }
+
+                if !u.isNotExist(err) {
+                        return nil, b, err
+                }
+        }
+
+        if ok2 {
+                fi, b, err := lbase.LstatIfPossible(name)
+                if err == nil {
+                        return fi, b, nil
+                }
+                if !u.isNotExist(err) {
+                        return nil, b, err
+                }
+        }
+
+        fi, err := u.Stat(name)
+
+        return fi, false, err
+}
+
+func (u *CopyOnWriteFs) isNotExist(err error) bool {
+        if e, ok := err.(*os.PathError); ok {
+                err = e.Err
+        }
+        if err == os.ErrNotExist || err == syscall.ENOENT || err == syscall.ENOTDIR {
+                return true
+        }
+        return false
+}
+
+// Renaming files present only in the base layer is not permitted
+func (u *CopyOnWriteFs) Rename(oldname, newname string) error {
+        b, err := u.isBaseFile(oldname)
+        if err != nil {
+                return err
+        }
+        if b {
+                return syscall.EPERM
+        }
+        return u.layer.Rename(oldname, newname)
+}
+
+// Removing files present only in the base layer is not permitted. If
+// a file is present in the base layer and the overlay, only the overlay
+// will be removed.
+func (u *CopyOnWriteFs) Remove(name string) error {
+        err := u.layer.Remove(name)
+        switch err {
+        case syscall.ENOENT:
+                _, err = u.base.Stat(name)
+                if err == nil {
+                        return syscall.EPERM
+                }
+                return syscall.ENOENT
+        default:
+                return err
+        }
+}
+
+func (u *CopyOnWriteFs) RemoveAll(name string) error {
+        err := u.layer.RemoveAll(name)
+        switch err {
+        case syscall.ENOENT:
+                _, err = u.base.Stat(name)
+                if err == nil {
+                        return syscall.EPERM
+                }
+                return syscall.ENOENT
+        default:
+                return err
+        }
+}
+
+func (u *CopyOnWriteFs) OpenFile(name string, flag int, perm os.FileMode) (File, error) {
+        b, err := u.isBaseFile(name)
+        if err != nil {
+                return nil, err
+        }
+
+        if flag&(os.O_WRONLY|os.O_RDWR|os.O_APPEND|os.O_CREATE|os.O_TRUNC) != 0 {
+                if b {
+                        if err = u.copyToLayer(name); err != nil {
+                                return nil, err
+                        }
+                        return u.layer.OpenFile(name, flag, perm)
+                }
+
+                dir := filepath.Dir(name)
+                isaDir, err := IsDir(u.base, dir)
+                if err != nil && !os.IsNotExist(err) {
+                        return nil, err
+                }
+                if isaDir {
+                        if err = u.layer.MkdirAll(dir, 0777); err != nil {
+                                return nil, err
+                        }
+                        return u.layer.OpenFile(name, flag, perm)
+                }
+
+                isaDir, err = IsDir(u.layer, dir)
+                if err != nil {
+                        return nil, err
+                }
+                if isaDir {
+                        return u.layer.OpenFile(name, flag, perm)
+                }
+
+                return nil, &os.PathError{Op: "open", Path: name, Err: syscall.ENOTDIR} // ...or os.ErrNotExist?
+        }
+        if b {
+                return u.base.OpenFile(name, flag, perm)
+        }
+        return u.layer.OpenFile(name, flag, perm)
+}
+
+// This function handles the 9 different possibilities caused
+// by the union which are the intersection of the following...
+//  layer: doesn't exist, exists as a file, and exists as a directory
+//  base:  doesn't exist, exists as a file, and exists as a directory
+func (u *CopyOnWriteFs) Open(name string) (File, error) {
+        // Since the overlay overrides the base we check that first
+        b, err := u.isBaseFile(name)
+        if err != nil {
+                return nil, err
+        }
+
+        // If overlay doesn't exist, return the base (base state irrelevant)
+        if b {
+                return u.base.Open(name)
+        }
+
+        // If overlay is a file, return it (base state irrelevant)
+        dir, err := IsDir(u.layer, name)
+        if err != nil {
+                return nil, err
+        }
+        if !dir {
+                return u.layer.Open(name)
+        }
+
+        // Overlay is a directory, base state now matters.
+        // Base state has 3 states to check but 2 outcomes:
+        // A. It's a file or non-readable in the base (return just the overlay)
+        // B. It's an accessible directory in the base (return a UnionFile)
+
+        // If base is file or nonreadable, return overlay
+        dir, err = IsDir(u.base, name)
+        if !dir || err != nil {
+                return u.layer.Open(name)
+        }
+
+        // Both base & layer are directories
+        // Return union file (if opens are without error)
+        bfile, bErr := u.base.Open(name)
+        lfile, lErr := u.layer.Open(name)
+
+        // If either have errors at this point something is very wrong. Return nil and the errors
+        if bErr != nil || lErr != nil {
+                return nil, fmt.Errorf("BaseErr: %v\nOverlayErr: %v", bErr, lErr)
+        }
+
+        return &UnionFile{Base: bfile, Layer: lfile}, nil
+}
+
+func (u *CopyOnWriteFs) Mkdir(name string, perm os.FileMode) error {
+        dir, err := IsDir(u.base, name)
+        if err != nil {
+                return u.layer.MkdirAll(name, perm)
+        }
+        if dir {
+                return ErrFileExists
+        }
+        return u.layer.MkdirAll(name, perm)
+}
+
+func (u *CopyOnWriteFs) Name() string {
+        return "CopyOnWriteFs"
+}
+
+func (u *CopyOnWriteFs) MkdirAll(name string, perm os.FileMode) error {
+        dir, err := IsDir(u.base, name)
+        if err != nil {
+                return u.layer.MkdirAll(name, perm)
+        }
+        if dir {
+                // This is in line with how os.MkdirAll behaves.
+                return nil
+        }
+        return u.layer.MkdirAll(name, perm)
+}
+
+func (u *CopyOnWriteFs) Create(name string) (File, error) {
+        return u.OpenFile(name, os.O_CREATE|os.O_TRUNC|os.O_RDWR, 0666)
+}
diff --git a/vendor/github.com/spf13/afero/go.mod b/vendor/github.com/spf13/afero/go.mod
new file mode 100644
index 0000000..0868550
--- /dev/null
+++ b/vendor/github.com/spf13/afero/go.mod
@@ -0,0 +1,3 @@
+module github.com/spf13/afero
+
+require golang.org/x/text v0.3.0
diff --git a/vendor/github.com/spf13/afero/go.sum b/vendor/github.com/spf13/afero/go.sum
new file mode 100644
index 0000000..6bad37b
--- /dev/null
+++ b/vendor/github.com/spf13/afero/go.sum
@@ -0,0 +1,2 @@
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/vendor/github.com/spf13/afero/httpFs.go b/vendor/github.com/spf13/afero/httpFs.go
new file mode 100644
index 0000000..c421936
--- /dev/null
+++ b/vendor/github.com/spf13/afero/httpFs.go
@@ -0,0 +1,110 @@
+// Copyright © 2014 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package afero
+
+import (
+        "errors"
+        "net/http"
+        "os"
+        "path"
+        "path/filepath"
+        "strings"
+        "time"
+)
+
+type httpDir struct {
+        basePath string
+        fs       HttpFs
+}
+
+func (d httpDir) Open(name string) (http.File, error) {
+        if filepath.Separator != '/' && strings.IndexRune(name, filepath.Separator) >= 0 ||
+                strings.Contains(name, "\x00") {
+                return nil, errors.New("http: invalid character in file path")
+        }
+        dir := string(d.basePath)
+        if dir == "" {
+                dir = "."
+        }
+
+        f, err := d.fs.Open(filepath.Join(dir, filepath.FromSlash(path.Clean("/"+name))))
+        if err != nil {
+                return nil, err
+        }
+        return f, nil
+}
+
+type HttpFs struct {
+        source Fs
+}
+
+func NewHttpFs(source Fs) *HttpFs {
+        return &HttpFs{source: source}
+}
+
+func (h HttpFs) Dir(s string) *httpDir {
+        return &httpDir{basePath: s, fs: h}
+}
+
+func (h HttpFs) Name() string { return "h HttpFs" }
+
+func (h HttpFs) Create(name string) (File, error) {
+        return h.source.Create(name)
+}
+
+func (h HttpFs) Chmod(name string, mode os.FileMode) error {
+        return h.source.Chmod(name, mode)
+}
+
+func (h HttpFs) Chtimes(name string, atime time.Time, mtime time.Time) error {
+        return h.source.Chtimes(name, atime, mtime)
+}
+
+func (h HttpFs) Mkdir(name string, perm os.FileMode) error {
+        return h.source.Mkdir(name, perm)
+}
+
+func (h HttpFs) MkdirAll(path string, perm os.FileMode) error {
+        return h.source.MkdirAll(path, perm)
+}
+
+func (h HttpFs) Open(name string) (http.File, error) {
+        f, err := h.source.Open(name)
+        if err == nil {
+                if httpfile, ok := f.(http.File); ok {
+                        return httpfile, nil
+                }
+        }
+        return nil, err
+}
+
+func (h HttpFs) OpenFile(name string, flag int, perm os.FileMode) (File, error) {
+        return h.source.OpenFile(name, flag, perm)
+}
+
+func (h HttpFs) Remove(name string) error {
+        return h.source.Remove(name)
+}
+
+func (h HttpFs) RemoveAll(path string) error {
+        return h.source.RemoveAll(path)
+}
+
+func (h HttpFs) Rename(oldname, newname string) error {
+        return h.source.Rename(oldname, newname)
+}
+
+func (h HttpFs) Stat(name string) (os.FileInfo, error) {
+        return h.source.Stat(name)
+}
diff --git a/vendor/github.com/spf13/afero/ioutil.go b/vendor/github.com/spf13/afero/ioutil.go
new file mode 100644
index 0000000..5c3a3d8
--- /dev/null
+++ b/vendor/github.com/spf13/afero/ioutil.go
@@ -0,0 +1,230 @@
+// Copyright ©2015 The Go Authors
+// Copyright ©2015 Steve Francia <spf@spf13.com>
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package afero
+
+import (
+        "bytes"
+        "io"
+        "os"
+        "path/filepath"
+        "sort"
+        "strconv"
+        "sync"
+        "time"
+)
+
+// byName implements sort.Interface.
+type byName []os.FileInfo
+
+func (f byName) Len() int           { return len(f) }
+func (f byName) Less(i, j int) bool { return f[i].Name() < f[j].Name() }
+func (f byName) Swap(i, j int)      { f[i], f[j] = f[j], f[i] }
+
+// ReadDir reads the directory named by dirname and returns
+// a list of sorted directory entries.
+func (a Afero) ReadDir(dirname string) ([]os.FileInfo, error) {
+        return ReadDir(a.Fs, dirname)
+}
+
+func ReadDir(fs Fs, dirname string) ([]os.FileInfo, error) {
+        f, err := fs.Open(dirname)
+        if err != nil {
+                return nil, err
+        }
+        list, err := f.Readdir(-1)
+        f.Close()
+        if err != nil {
+                return nil, err
+        }
+        sort.Sort(byName(list))
+        return list, nil
+}
+
+// ReadFile reads the file named by filename and returns the contents.
+// A successful call returns err == nil, not err == EOF. Because ReadFile
+// reads the whole file, it does not treat an EOF from Read as an error
+// to be reported.
+func (a Afero) ReadFile(filename string) ([]byte, error) {
+        return ReadFile(a.Fs, filename)
+}
+
+func ReadFile(fs Fs, filename string) ([]byte, error) {
+        f, err := fs.Open(filename)
+        if err != nil {
+                return nil, err
+        }
+        defer f.Close()
+        // It's a good but not certain bet that FileInfo will tell us exactly how much to
+        // read, so let's try it but be prepared for the answer to be wrong.
+        var n int64
+
+        if fi, err := f.Stat(); err == nil {
+                // Don't preallocate a huge buffer, just in case.
+                if size := fi.Size(); size < 1e9 {
+                        n = size
+                }
+        }
+        // As initial capacity for readAll, use n + a little extra in case Size is zero,
+        // and to avoid another allocation after Read has filled the buffer.  The readAll
+        // call will read into its allocated internal buffer cheaply.  If the size was
+        // wrong, we'll either waste some space off the end or reallocate as needed, but
+        // in the overwhelmingly common case we'll get it just right.
+        return readAll(f, n+bytes.MinRead)
+}
+
+// readAll reads from r until an error or EOF and returns the data it read
+// from the internal buffer allocated with a specified capacity.
+func readAll(r io.Reader, capacity int64) (b []byte, err error) {
+        buf := bytes.NewBuffer(make([]byte, 0, capacity))
+        // If the buffer overflows, we will get bytes.ErrTooLarge.
+        // Return that as an error. Any other panic remains.
+        defer func() {
+                e := recover()
+                if e == nil {
+                        return
+                }
+                if panicErr, ok := e.(error); ok && panicErr == bytes.ErrTooLarge {
+                        err = panicErr
+                } else {
+                        panic(e)
+                }
+        }()
+        _, err = buf.ReadFrom(r)
+        return buf.Bytes(), err
+}
+
+// ReadAll reads from r until an error or EOF and returns the data it read.
+// A successful call returns err == nil, not err == EOF. Because ReadAll is
+// defined to read from src until EOF, it does not treat an EOF from Read
+// as an error to be reported.
+func ReadAll(r io.Reader) ([]byte, error) {
+        return readAll(r, bytes.MinRead)
+}
+
+// WriteFile writes data to a file named by filename.
+// If the file does not exist, WriteFile creates it with permissions perm;
+// otherwise WriteFile truncates it before writing.
+func (a Afero) WriteFile(filename string, data []byte, perm os.FileMode) error {
+        return WriteFile(a.Fs, filename, data, perm)
+}
+
+func WriteFile(fs Fs, filename string, data []byte, perm os.FileMode) error {
+        f, err := fs.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)
+        if err != nil {
+                return err
+        }
+        n, err := f.Write(data)
+        if err == nil && n < len(data) {
+                err = io.ErrShortWrite
+        }
+        if err1 := f.Close(); err == nil {
+                err = err1
+        }
+        return err
+}
+
+// Random number state.
+// We generate random temporary file names so that there's a good
+// chance the file doesn't exist yet - keeps the number of tries in
+// TempFile to a minimum.
+var rand uint32
+var randmu sync.Mutex
+
+func reseed() uint32 {
+        return uint32(time.Now().UnixNano() + int64(os.Getpid()))
+}
+
+func nextSuffix() string {
+        randmu.Lock()
+        r := rand
+        if r == 0 {
+                r = reseed()
+        }
+        r = r*1664525 + 1013904223 // constants from Numerical Recipes
+        rand = r
+        randmu.Unlock()
+        return strconv.Itoa(int(1e9 + r%1e9))[1:]
+}
+
+// TempFile creates a new temporary file in the directory dir
+// with a name beginning with prefix, opens the file for reading
+// and writing, and returns the resulting *File.
+// If dir is the empty string, TempFile uses the default directory
+// for temporary files (see os.TempDir).
+// Multiple programs calling TempFile simultaneously
+// will not choose the same file.  The caller can use f.Name()
+// to find the pathname of the file.  It is the caller's responsibility
+// to remove the file when no longer needed.
+func (a Afero) TempFile(dir, prefix string) (f File, err error) {
+        return TempFile(a.Fs, dir, prefix)
+}
+
+func TempFile(fs Fs, dir, prefix string) (f File, err error) {
+        if dir == "" {
+                dir = os.TempDir()
+        }
+
+        nconflict := 0
+        for i := 0; i < 10000; i++ {
+                name := filepath.Join(dir, prefix+nextSuffix())
+                f, err = fs.OpenFile(name, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0600)
+                if os.IsExist(err) {
+                        if nconflict++; nconflict > 10 {
+                                randmu.Lock()
+                                rand = reseed()
+                                randmu.Unlock()
+                        }
+                        continue
+                }
+                break
+        }
+        return
+}
+
+// TempDir creates a new temporary directory in the directory dir
+// with a name beginning with prefix and returns the path of the
+// new directory.  If dir is the empty string, TempDir uses the
+// default directory for temporary files (see os.TempDir).
+// Multiple programs calling TempDir simultaneously
+// will not choose the same directory.  It is the caller's responsibility
+// to remove the directory when no longer needed.
+func (a Afero) TempDir(dir, prefix string) (name string, err error) {
+        return TempDir(a.Fs, dir, prefix)
+}
+func TempDir(fs Fs, dir, prefix string) (name string, err error) {
+        if dir == "" {
+                dir = os.TempDir()
+        }
+
+        nconflict := 0
+        for i := 0; i < 10000; i++ {
+                try := filepath.Join(dir, prefix+nextSuffix())
+                err = fs.Mkdir(try, 0700)
+                if os.IsExist(err) {
+                        if nconflict++; nconflict > 10 {
+                                randmu.Lock()
+                                rand = reseed()
+                                randmu.Unlock()
+                        }
+                        continue
+                }
+                if err == nil {
+                        name = try
+                }
+                break
+        }
+        return
+}
diff --git a/vendor/github.com/spf13/afero/lstater.go b/vendor/github.com/spf13/afero/lstater.go
new file mode 100644
index 0000000..89c1bfc
--- /dev/null
+++ b/vendor/github.com/spf13/afero/lstater.go
@@ -0,0 +1,27 @@
+// Copyright © 2018 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package afero
+
+import (
+        "os"
+)
+
+// Lstater is an optional interface in Afero. It is only implemented by the
+// filesystems saying so.
+// It will call Lstat if the filesystem iself is, or it delegates to, the os filesystem.
+// Else it will call Stat.
+// In addtion to the FileInfo, it will return a boolean telling whether Lstat was called or not.
+type Lstater interface {
+        LstatIfPossible(name string) (os.FileInfo, bool, error)
+}
diff --git a/vendor/github.com/spf13/afero/match.go b/vendor/github.com/spf13/afero/match.go
new file mode 100644
index 0000000..c18a87f
--- /dev/null
+++ b/vendor/github.com/spf13/afero/match.go
@@ -0,0 +1,110 @@
+// Copyright © 2014 Steve Francia <spf@spf13.com>.
+// Copyright 2009 The Go Authors. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package afero
+
+import (
+        "path/filepath"
+        "sort"
+        "strings"
+)
+
+// Glob returns the names of all files matching pattern or nil
+// if there is no matching file. The syntax of patterns is the same
+// as in Match. The pattern may describe hierarchical names such as
+// /usr/*/bin/ed (assuming the Separator is '/').
+//
+// Glob ignores file system errors such as I/O errors reading directories.
+// The only possible returned error is ErrBadPattern, when pattern
+// is malformed.
+//
+// This was adapted from (http://golang.org/pkg/path/filepath) and uses several
+// built-ins from that package.
+func Glob(fs Fs, pattern string) (matches []string, err error) {
+        if !hasMeta(pattern) {
+                // Lstat not supported by a ll filesystems.
+                if _, err = lstatIfPossible(fs, pattern); err != nil {
+                        return nil, nil
+                }
+                return []string{pattern}, nil
+        }
+
+        dir, file := filepath.Split(pattern)
+        switch dir {
+        case "":
+                dir = "."
+        case string(filepath.Separator):
+        // nothing
+        default:
+                dir = dir[0 : len(dir)-1] // chop off trailing separator
+        }
+
+        if !hasMeta(dir) {
+                return glob(fs, dir, file, nil)
+        }
+
+        var m []string
+        m, err = Glob(fs, dir)
+        if err != nil {
+                return
+        }
+        for _, d := range m {
+                matches, err = glob(fs, d, file, matches)
+                if err != nil {
+                        return
+                }
+        }
+        return
+}
+
+// glob searches for files matching pattern in the directory dir
+// and appends them to matches. If the directory cannot be
+// opened, it returns the existing matches. New matches are
+// added in lexicographical order.
+func glob(fs Fs, dir, pattern string, matches []string) (m []string, e error) {
+        m = matches
+        fi, err := fs.Stat(dir)
+        if err != nil {
+                return
+        }
+        if !fi.IsDir() {
+                return
+        }
+        d, err := fs.Open(dir)
+        if err != nil {
+                return
+        }
+        defer d.Close()
+
+        names, _ := d.Readdirnames(-1)
+        sort.Strings(names)
+
+        for _, n := range names {
+                matched, err := filepath.Match(pattern, n)
+                if err != nil {
+                        return m, err
+                }
+                if matched {
+                        m = append(m, filepath.Join(dir, n))
+                }
+        }
+        return
+}
+
+// hasMeta reports whether path contains any of the magic characters
+// recognized by Match.
+func hasMeta(path string) bool {
+        // TODO(niemeyer): Should other magic characters be added here?
+        return strings.IndexAny(path, "*?[") >= 0
+}
diff --git a/vendor/github.com/spf13/afero/mem/dir.go b/vendor/github.com/spf13/afero/mem/dir.go
new file mode 100644
index 0000000..e104013
--- /dev/null
+++ b/vendor/github.com/spf13/afero/mem/dir.go
@@ -0,0 +1,37 @@
+// Copyright © 2014 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package mem
+
+type Dir interface {
+        Len() int
+        Names() []string
+        Files() []*FileData
+        Add(*FileData)
+        Remove(*FileData)
+}
+
+func RemoveFromMemDir(dir *FileData, f *FileData) {
+        dir.memDir.Remove(f)
+}
+
+func AddToMemDir(dir *FileData, f *FileData) {
+        dir.memDir.Add(f)
+}
+
+func InitializeDir(d *FileData) {
+        if d.memDir == nil {
+                d.dir = true
+                d.memDir = &DirMap{}
+        }
+}
diff --git a/vendor/github.com/spf13/afero/mem/dirmap.go b/vendor/github.com/spf13/afero/mem/dirmap.go
new file mode 100644
index 0000000..03a57ee
--- /dev/null
+++ b/vendor/github.com/spf13/afero/mem/dirmap.go
@@ -0,0 +1,43 @@
+// Copyright © 2015 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package mem
+
+import "sort"
+
+type DirMap map[string]*FileData
+
+func (m DirMap) Len() int           { return len(m) }
+func (m DirMap) Add(f *FileData)    { m[f.name] = f }
+func (m DirMap) Remove(f *FileData) { delete(m, f.name) }
+func (m DirMap) Files() (files []*FileData) {
+        for _, f := range m {
+                files = append(files, f)
+        }
+        sort.Sort(filesSorter(files))
+        return files
+}
+
+// implement sort.Interface for []*FileData
+type filesSorter []*FileData
+
+func (s filesSorter) Len() int           { return len(s) }
+func (s filesSorter) Swap(i, j int)      { s[i], s[j] = s[j], s[i] }
+func (s filesSorter) Less(i, j int) bool { return s[i].name < s[j].name }
+
+func (m DirMap) Names() (names []string) {
+        for x := range m {
+                names = append(names, x)
+        }
+        return names
+}
diff --git a/vendor/github.com/spf13/afero/mem/file.go b/vendor/github.com/spf13/afero/mem/file.go
new file mode 100644
index 0000000..7af2fb5
--- /dev/null
+++ b/vendor/github.com/spf13/afero/mem/file.go
@@ -0,0 +1,317 @@
+// Copyright © 2015 Steve Francia <spf@spf13.com>.
+// Copyright 2013 tsuru authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package mem
+
+import (
+        "bytes"
+        "errors"
+        "io"
+        "os"
+        "path/filepath"
+        "sync"
+        "sync/atomic"
+)
+
+import "time"
+
+const FilePathSeparator = string(filepath.Separator)
+
+type File struct {
+        // atomic requires 64-bit alignment for struct field access
+        at           int64
+        readDirCount int64
+        closed       bool
+        readOnly     bool
+        fileData     *FileData
+}
+
+func NewFileHandle(data *FileData) *File {
+        return &File{fileData: data}
+}
+
+func NewReadOnlyFileHandle(data *FileData) *File {
+        return &File{fileData: data, readOnly: true}
+}
+
+func (f File) Data() *FileData {
+        return f.fileData
+}
+
+type FileData struct {
+        sync.Mutex
+        name    string
+        data    []byte
+        memDir  Dir
+        dir     bool
+        mode    os.FileMode
+        modtime time.Time
+}
+
+func (d *FileData) Name() string {
+        d.Lock()
+        defer d.Unlock()
+        return d.name
+}
+
+func CreateFile(name string) *FileData {
+        return &FileData{name: name, mode: os.ModeTemporary, modtime: time.Now()}
+}
+
+func CreateDir(name string) *FileData {
+        return &FileData{name: name, memDir: &DirMap{}, dir: true}
+}
+
+func ChangeFileName(f *FileData, newname string) {
+        f.Lock()
+        f.name = newname
+        f.Unlock()
+}
+
+func SetMode(f *FileData, mode os.FileMode) {
+        f.Lock()
+        f.mode = mode
+        f.Unlock()
+}
+
+func SetModTime(f *FileData, mtime time.Time) {
+        f.Lock()
+        setModTime(f, mtime)
+        f.Unlock()
+}
+
+func setModTime(f *FileData, mtime time.Time) {
+        f.modtime = mtime
+}
+
+func GetFileInfo(f *FileData) *FileInfo {
+        return &FileInfo{f}
+}
+
+func (f *File) Open() error {
+        atomic.StoreInt64(&f.at, 0)
+        atomic.StoreInt64(&f.readDirCount, 0)
+        f.fileData.Lock()
+        f.closed = false
+        f.fileData.Unlock()
+        return nil
+}
+
+func (f *File) Close() error {
+        f.fileData.Lock()
+        f.closed = true
+        if !f.readOnly {
+                setModTime(f.fileData, time.Now())
+        }
+        f.fileData.Unlock()
+        return nil
+}
+
+func (f *File) Name() string {
+        return f.fileData.Name()
+}
+
+func (f *File) Stat() (os.FileInfo, error) {
+        return &FileInfo{f.fileData}, nil
+}
+
+func (f *File) Sync() error {
+        return nil
+}
+
+func (f *File) Readdir(count int) (res []os.FileInfo, err error) {
+        if !f.fileData.dir {
+                return nil, &os.PathError{Op: "readdir", Path: f.fileData.name, Err: errors.New("not a dir")}
+        }
+        var outLength int64
+
+        f.fileData.Lock()
+        files := f.fileData.memDir.Files()[f.readDirCount:]
+        if count > 0 {
+                if len(files) < count {
+                        outLength = int64(len(files))
+                } else {
+                        outLength = int64(count)
+                }
+                if len(files) == 0 {
+                        err = io.EOF
+                }
+        } else {
+                outLength = int64(len(files))
+        }
+        f.readDirCount += outLength
+        f.fileData.Unlock()
+
+        res = make([]os.FileInfo, outLength)
+        for i := range res {
+                res[i] = &FileInfo{files[i]}
+        }
+
+        return res, err
+}
+
+func (f *File) Readdirnames(n int) (names []string, err error) {
+        fi, err := f.Readdir(n)
+        names = make([]string, len(fi))
+        for i, f := range fi {
+                _, names[i] = filepath.Split(f.Name())
+        }
+        return names, err
+}
+
+func (f *File) Read(b []byte) (n int, err error) {
+        f.fileData.Lock()
+        defer f.fileData.Unlock()
+        if f.closed == true {
+                return 0, ErrFileClosed
+        }
+        if len(b) > 0 && int(f.at) == len(f.fileData.data) {
+                return 0, io.EOF
+        }
+        if int(f.at) > len(f.fileData.data) {
+                return 0, io.ErrUnexpectedEOF
+        }
+        if len(f.fileData.data)-int(f.at) >= len(b) {
+                n = len(b)
+        } else {
+                n = len(f.fileData.data) - int(f.at)
+        }
+        copy(b, f.fileData.data[f.at:f.at+int64(n)])
+        atomic.AddInt64(&f.at, int64(n))
+        return
+}
+
+func (f *File) ReadAt(b []byte, off int64) (n int, err error) {
+        atomic.StoreInt64(&f.at, off)
+        return f.Read(b)
+}
+
+func (f *File) Truncate(size int64) error {
+        if f.closed == true {
+                return ErrFileClosed
+        }
+        if f.readOnly {
+                return &os.PathError{Op: "truncate", Path: f.fileData.name, Err: errors.New("file handle is read only")}
+        }
+        if size < 0 {
+                return ErrOutOfRange
+        }
+        if size > int64(len(f.fileData.data)) {
+                diff := size - int64(len(f.fileData.data))
+                f.fileData.data = append(f.fileData.data, bytes.Repeat([]byte{00}, int(diff))...)
+        } else {
+                f.fileData.data = f.fileData.data[0:size]
+        }
+        setModTime(f.fileData, time.Now())
+        return nil
+}
+
+func (f *File) Seek(offset int64, whence int) (int64, error) {
+        if f.closed == true {
+                return 0, ErrFileClosed
+        }
+        switch whence {
+        case 0:
+                atomic.StoreInt64(&f.at, offset)
+        case 1:
+                atomic.AddInt64(&f.at, int64(offset))
+        case 2:
+                atomic.StoreInt64(&f.at, int64(len(f.fileData.data))+offset)
+        }
+        return f.at, nil
+}
+
+func (f *File) Write(b []byte) (n int, err error) {
+        if f.readOnly {
+                return 0, &os.PathError{Op: "write", Path: f.fileData.name, Err: errors.New("file handle is read only")}
+        }
+        n = len(b)
+        cur := atomic.LoadInt64(&f.at)
+        f.fileData.Lock()
+        defer f.fileData.Unlock()
+        diff := cur - int64(len(f.fileData.data))
+        var tail []byte
+        if n+int(cur) < len(f.fileData.data) {
+                tail = f.fileData.data[n+int(cur):]
+        }
+        if diff > 0 {
+                f.fileData.data = append(bytes.Repeat([]byte{00}, int(diff)), b...)
+                f.fileData.data = append(f.fileData.data, tail...)
+        } else {
+                f.fileData.data = append(f.fileData.data[:cur], b...)
+                f.fileData.data = append(f.fileData.data, tail...)
+        }
+        setModTime(f.fileData, time.Now())
+
+        atomic.StoreInt64(&f.at, int64(len(f.fileData.data)))
+        return
+}
+
+func (f *File) WriteAt(b []byte, off int64) (n int, err error) {
+        atomic.StoreInt64(&f.at, off)
+        return f.Write(b)
+}
+
+func (f *File) WriteString(s string) (ret int, err error) {
+        return f.Write([]byte(s))
+}
+
+func (f *File) Info() *FileInfo {
+        return &FileInfo{f.fileData}
+}
+
+type FileInfo struct {
+        *FileData
+}
+
+// Implements os.FileInfo
+func (s *FileInfo) Name() string {
+        s.Lock()
+        _, name := filepath.Split(s.name)
+        s.Unlock()
+        return name
+}
+func (s *FileInfo) Mode() os.FileMode {
+        s.Lock()
+        defer s.Unlock()
+        return s.mode
+}
+func (s *FileInfo) ModTime() time.Time {
+        s.Lock()
+        defer s.Unlock()
+        return s.modtime
+}
+func (s *FileInfo) IsDir() bool {
+        s.Lock()
+        defer s.Unlock()
+        return s.dir
+}
+func (s *FileInfo) Sys() interface{} { return nil }
+func (s *FileInfo) Size() int64 {
+        if s.IsDir() {
+                return int64(42)
+        }
+        s.Lock()
+        defer s.Unlock()
+        return int64(len(s.data))
+}
+
+var (
+        ErrFileClosed        = errors.New("File is closed")
+        ErrOutOfRange        = errors.New("Out of range")
+        ErrTooLarge          = errors.New("Too large")
+        ErrFileNotFound      = os.ErrNotExist
+        ErrFileExists        = os.ErrExist
+        ErrDestinationExists = os.ErrExist
+)
diff --git a/vendor/github.com/spf13/afero/memmap.go b/vendor/github.com/spf13/afero/memmap.go
new file mode 100644
index 0000000..09498e7
--- /dev/null
+++ b/vendor/github.com/spf13/afero/memmap.go
@@ -0,0 +1,365 @@
+// Copyright © 2014 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package afero
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strings"
+        "sync"
+        "time"
+
+        "github.com/spf13/afero/mem"
+)
+
+type MemMapFs struct {
+        mu   sync.RWMutex
+        data map[string]*mem.FileData
+        init sync.Once
+}
+
+func NewMemMapFs() Fs {
+        return &MemMapFs{}
+}
+
+func (m *MemMapFs) getData() map[string]*mem.FileData {
+        m.init.Do(func() {
+                m.data = make(map[string]*mem.FileData)
+                // Root should always exist, right?
+                // TODO: what about windows?
+                m.data[FilePathSeparator] = mem.CreateDir(FilePathSeparator)
+        })
+        return m.data
+}
+
+func (*MemMapFs) Name() string { return "MemMapFS" }
+
+func (m *MemMapFs) Create(name string) (File, error) {
+        name = normalizePath(name)
+        m.mu.Lock()
+        file := mem.CreateFile(name)
+        m.getData()[name] = file
+        m.registerWithParent(file)
+        m.mu.Unlock()
+        return mem.NewFileHandle(file), nil
+}
+
+func (m *MemMapFs) unRegisterWithParent(fileName string) error {
+        f, err := m.lockfreeOpen(fileName)
+        if err != nil {
+                return err
+        }
+        parent := m.findParent(f)
+        if parent == nil {
+                log.Panic("parent of ", f.Name(), " is nil")
+        }
+
+        parent.Lock()
+        mem.RemoveFromMemDir(parent, f)
+        parent.Unlock()
+        return nil
+}
+
+func (m *MemMapFs) findParent(f *mem.FileData) *mem.FileData {
+        pdir, _ := filepath.Split(f.Name())
+        pdir = filepath.Clean(pdir)
+        pfile, err := m.lockfreeOpen(pdir)
+        if err != nil {
+                return nil
+        }
+        return pfile
+}
+
+func (m *MemMapFs) registerWithParent(f *mem.FileData) {
+        if f == nil {
+                return
+        }
+        parent := m.findParent(f)
+        if parent == nil {
+                pdir := filepath.Dir(filepath.Clean(f.Name()))
+                err := m.lockfreeMkdir(pdir, 0777)
+                if err != nil {
+                        //log.Println("Mkdir error:", err)
+                        return
+                }
+                parent, err = m.lockfreeOpen(pdir)
+                if err != nil {
+                        //log.Println("Open after Mkdir error:", err)
+                        return
+                }
+        }
+
+        parent.Lock()
+        mem.InitializeDir(parent)
+        mem.AddToMemDir(parent, f)
+        parent.Unlock()
+}
+
+func (m *MemMapFs) lockfreeMkdir(name string, perm os.FileMode) error {
+        name = normalizePath(name)
+        x, ok := m.getData()[name]
+        if ok {
+                // Only return ErrFileExists if it's a file, not a directory.
+                i := mem.FileInfo{FileData: x}
+                if !i.IsDir() {
+                        return ErrFileExists
+                }
+        } else {
+                item := mem.CreateDir(name)
+                m.getData()[name] = item
+                m.registerWithParent(item)
+        }
+        return nil
+}
+
+func (m *MemMapFs) Mkdir(name string, perm os.FileMode) error {
+        name = normalizePath(name)
+
+        m.mu.RLock()
+        _, ok := m.getData()[name]
+        m.mu.RUnlock()
+        if ok {
+                return &os.PathError{Op: "mkdir", Path: name, Err: ErrFileExists}
+        }
+
+        m.mu.Lock()
+        item := mem.CreateDir(name)
+        m.getData()[name] = item
+        m.registerWithParent(item)
+        m.mu.Unlock()
+
+        m.Chmod(name, perm|os.ModeDir)
+
+        return nil
+}
+
+func (m *MemMapFs) MkdirAll(path string, perm os.FileMode) error {
+        err := m.Mkdir(path, perm)
+        if err != nil {
+                if err.(*os.PathError).Err == ErrFileExists {
+                        return nil
+                }
+                return err
+        }
+        return nil
+}
+
+// Handle some relative paths
+func normalizePath(path string) string {
+        path = filepath.Clean(path)
+
+        switch path {
+        case ".":
+                return FilePathSeparator
+        case "..":
+                return FilePathSeparator
+        default:
+                return path
+        }
+}
+
+func (m *MemMapFs) Open(name string) (File, error) {
+        f, err := m.open(name)
+        if f != nil {
+                return mem.NewReadOnlyFileHandle(f), err
+        }
+        return nil, err
+}
+
+func (m *MemMapFs) openWrite(name string) (File, error) {
+        f, err := m.open(name)
+        if f != nil {
+                return mem.NewFileHandle(f), err
+        }
+        return nil, err
+}
+
+func (m *MemMapFs) open(name string) (*mem.FileData, error) {
+        name = normalizePath(name)
+
+        m.mu.RLock()
+        f, ok := m.getData()[name]
+        m.mu.RUnlock()
+        if !ok {
+                return nil, &os.PathError{Op: "open", Path: name, Err: ErrFileNotFound}
+        }
+        return f, nil
+}
+
+func (m *MemMapFs) lockfreeOpen(name string) (*mem.FileData, error) {
+        name = normalizePath(name)
+        f, ok := m.getData()[name]
+        if ok {
+                return f, nil
+        } else {
+                return nil, ErrFileNotFound
+        }
+}
+
+func (m *MemMapFs) OpenFile(name string, flag int, perm os.FileMode) (File, error) {
+        chmod := false
+        file, err := m.openWrite(name)
+        if os.IsNotExist(err) && (flag&os.O_CREATE > 0) {
+                file, err = m.Create(name)
+                chmod = true
+        }
+        if err != nil {
+                return nil, err
+        }
+        if flag == os.O_RDONLY {
+                file = mem.NewReadOnlyFileHandle(file.(*mem.File).Data())
+        }
+        if flag&os.O_APPEND > 0 {
+                _, err = file.Seek(0, os.SEEK_END)
+                if err != nil {
+                        file.Close()
+                        return nil, err
+                }
+        }
+        if flag&os.O_TRUNC > 0 && flag&(os.O_RDWR|os.O_WRONLY) > 0 {
+                err = file.Truncate(0)
+                if err != nil {
+                        file.Close()
+                        return nil, err
+                }
+        }
+        if chmod {
+                m.Chmod(name, perm)
+        }
+        return file, nil
+}
+
+func (m *MemMapFs) Remove(name string) error {
+        name = normalizePath(name)
+
+        m.mu.Lock()
+        defer m.mu.Unlock()
+
+        if _, ok := m.getData()[name]; ok {
+                err := m.unRegisterWithParent(name)
+                if err != nil {
+                        return &os.PathError{Op: "remove", Path: name, Err: err}
+                }
+                delete(m.getData(), name)
+        } else {
+                return &os.PathError{Op: "remove", Path: name, Err: os.ErrNotExist}
+        }
+        return nil
+}
+
+func (m *MemMapFs) RemoveAll(path string) error {
+        path = normalizePath(path)
+        m.mu.Lock()
+        m.unRegisterWithParent(path)
+        m.mu.Unlock()
+
+        m.mu.RLock()
+        defer m.mu.RUnlock()
+
+        for p, _ := range m.getData() {
+                if strings.HasPrefix(p, path) {
+                        m.mu.RUnlock()
+                        m.mu.Lock()
+                        delete(m.getData(), p)
+                        m.mu.Unlock()
+                        m.mu.RLock()
+                }
+        }
+        return nil
+}
+
+func (m *MemMapFs) Rename(oldname, newname string) error {
+        oldname = normalizePath(oldname)
+        newname = normalizePath(newname)
+
+        if oldname == newname {
+                return nil
+        }
+
+        m.mu.RLock()
+        defer m.mu.RUnlock()
+        if _, ok := m.getData()[oldname]; ok {
+                m.mu.RUnlock()
+                m.mu.Lock()
+                m.unRegisterWithParent(oldname)
+                fileData := m.getData()[oldname]
+                delete(m.getData(), oldname)
+                mem.ChangeFileName(fileData, newname)
+                m.getData()[newname] = fileData
+                m.registerWithParent(fileData)
+                m.mu.Unlock()
+                m.mu.RLock()
+        } else {
+                return &os.PathError{Op: "rename", Path: oldname, Err: ErrFileNotFound}
+        }
+        return nil
+}
+
+func (m *MemMapFs) Stat(name string) (os.FileInfo, error) {
+        f, err := m.Open(name)
+        if err != nil {
+                return nil, err
+        }
+        fi := mem.GetFileInfo(f.(*mem.File).Data())
+        return fi, nil
+}
+
+func (m *MemMapFs) Chmod(name string, mode os.FileMode) error {
+        name = normalizePath(name)
+
+        m.mu.RLock()
+        f, ok := m.getData()[name]
+        m.mu.RUnlock()
+        if !ok {
+                return &os.PathError{Op: "chmod", Path: name, Err: ErrFileNotFound}
+        }
+
+        m.mu.Lock()
+        mem.SetMode(f, mode)
+        m.mu.Unlock()
+
+        return nil
+}
+
+func (m *MemMapFs) Chtimes(name string, atime time.Time, mtime time.Time) error {
+        name = normalizePath(name)
+
+        m.mu.RLock()
+        f, ok := m.getData()[name]
+        m.mu.RUnlock()
+        if !ok {
+                return &os.PathError{Op: "chtimes", Path: name, Err: ErrFileNotFound}
+        }
+
+        m.mu.Lock()
+        mem.SetModTime(f, mtime)
+        m.mu.Unlock()
+
+        return nil
+}
+
+func (m *MemMapFs) List() {
+        for _, x := range m.data {
+                y := mem.FileInfo{FileData: x}
+                fmt.Println(x.Name(), y.Size())
+        }
+}
+
+// func debugMemMapList(fs Fs) {
+//      if x, ok := fs.(*MemMapFs); ok {
+//              x.List()
+//      }
+// }
diff --git a/vendor/github.com/spf13/afero/os.go b/vendor/github.com/spf13/afero/os.go
new file mode 100644
index 0000000..13cc1b8
--- /dev/null
+++ b/vendor/github.com/spf13/afero/os.go
@@ -0,0 +1,101 @@
+// Copyright © 2014 Steve Francia <spf@spf13.com>.
+// Copyright 2013 tsuru authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package afero
+
+import (
+        "os"
+        "time"
+)
+
+var _ Lstater = (*OsFs)(nil)
+
+// OsFs is a Fs implementation that uses functions provided by the os package.
+//
+// For details in any method, check the documentation of the os package
+// (http://golang.org/pkg/os/).
+type OsFs struct{}
+
+func NewOsFs() Fs {
+        return &OsFs{}
+}
+
+func (OsFs) Name() string { return "OsFs" }
+
+func (OsFs) Create(name string) (File, error) {
+        f, e := os.Create(name)
+        if f == nil {
+                // while this looks strange, we need to return a bare nil (of type nil) not
+                // a nil value of type *os.File or nil won't be nil
+                return nil, e
+        }
+        return f, e
+}
+
+func (OsFs) Mkdir(name string, perm os.FileMode) error {
+        return os.Mkdir(name, perm)
+}
+
+func (OsFs) MkdirAll(path string, perm os.FileMode) error {
+        return os.MkdirAll(path, perm)
+}
+
+func (OsFs) Open(name string) (File, error) {
+        f, e := os.Open(name)
+        if f == nil {
+                // while this looks strange, we need to return a bare nil (of type nil) not
+                // a nil value of type *os.File or nil won't be nil
+                return nil, e
+        }
+        return f, e
+}
+
+func (OsFs) OpenFile(name string, flag int, perm os.FileMode) (File, error) {
+        f, e := os.OpenFile(name, flag, perm)
+        if f == nil {
+                // while this looks strange, we need to return a bare nil (of type nil) not
+                // a nil value of type *os.File or nil won't be nil
+                return nil, e
+        }
+        return f, e
+}
+
+func (OsFs) Remove(name string) error {
+        return os.Remove(name)
+}
+
+func (OsFs) RemoveAll(path string) error {
+        return os.RemoveAll(path)
+}
+
+func (OsFs) Rename(oldname, newname string) error {
+        return os.Rename(oldname, newname)
+}
+
+func (OsFs) Stat(name string) (os.FileInfo, error) {
+        return os.Stat(name)
+}
+
+func (OsFs) Chmod(name string, mode os.FileMode) error {
+        return os.Chmod(name, mode)
+}
+
+func (OsFs) Chtimes(name string, atime time.Time, mtime time.Time) error {
+        return os.Chtimes(name, atime, mtime)
+}
+
+func (OsFs) LstatIfPossible(name string) (os.FileInfo, bool, error) {
+        fi, err := os.Lstat(name)
+        return fi, true, err
+}
diff --git a/vendor/github.com/spf13/afero/path.go b/vendor/github.com/spf13/afero/path.go
new file mode 100644
index 0000000..18f60a0
--- /dev/null
+++ b/vendor/github.com/spf13/afero/path.go
@@ -0,0 +1,106 @@
+// Copyright ©2015 The Go Authors
+// Copyright ©2015 Steve Francia <spf@spf13.com>
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package afero
+
+import (
+        "os"
+        "path/filepath"
+        "sort"
+)
+
+// readDirNames reads the directory named by dirname and returns
+// a sorted list of directory entries.
+// adapted from https://golang.org/src/path/filepath/path.go
+func readDirNames(fs Fs, dirname string) ([]string, error) {
+        f, err := fs.Open(dirname)
+        if err != nil {
+                return nil, err
+        }
+        names, err := f.Readdirnames(-1)
+        f.Close()
+        if err != nil {
+                return nil, err
+        }
+        sort.Strings(names)
+        return names, nil
+}
+
+// walk recursively descends path, calling walkFn
+// adapted from https://golang.org/src/path/filepath/path.go
+func walk(fs Fs, path string, info os.FileInfo, walkFn filepath.WalkFunc) error {
+        err := walkFn(path, info, nil)
+        if err != nil {
+                if info.IsDir() && err == filepath.SkipDir {
+                        return nil
+                }
+                return err
+        }
+
+        if !info.IsDir() {
+                return nil
+        }
+
+        names, err := readDirNames(fs, path)
+        if err != nil {
+                return walkFn(path, info, err)
+        }
+
+        for _, name := range names {
+                filename := filepath.Join(path, name)
+                fileInfo, err := lstatIfPossible(fs, filename)
+                if err != nil {
+                        if err := walkFn(filename, fileInfo, err); err != nil && err != filepath.SkipDir {
+                                return err
+                        }
+                } else {
+                        err = walk(fs, filename, fileInfo, walkFn)
+                        if err != nil {
+                                if !fileInfo.IsDir() || err != filepath.SkipDir {
+                                        return err
+                                }
+                        }
+                }
+        }
+        return nil
+}
+
+// if the filesystem supports it, use Lstat, else use fs.Stat
+func lstatIfPossible(fs Fs, path string) (os.FileInfo, error) {
+        if lfs, ok := fs.(Lstater); ok {
+                fi, _, err := lfs.LstatIfPossible(path)
+                return fi, err
+        }
+        return fs.Stat(path)
+}
+
+// Walk walks the file tree rooted at root, calling walkFn for each file or
+// directory in the tree, including root. All errors that arise visiting files
+// and directories are filtered by walkFn. The files are walked in lexical
+// order, which makes the output deterministic but means that for very
+// large directories Walk can be inefficient.
+// Walk does not follow symbolic links.
+
+func (a Afero) Walk(root string, walkFn filepath.WalkFunc) error {
+        return Walk(a.Fs, root, walkFn)
+}
+
+func Walk(fs Fs, root string, walkFn filepath.WalkFunc) error {
+        info, err := lstatIfPossible(fs, root)
+        if err != nil {
+                return walkFn(root, nil, err)
+        }
+        return walk(fs, root, info, walkFn)
+}
diff --git a/vendor/github.com/spf13/afero/readonlyfs.go b/vendor/github.com/spf13/afero/readonlyfs.go
new file mode 100644
index 0000000..c6376ec
--- /dev/null
+++ b/vendor/github.com/spf13/afero/readonlyfs.go
@@ -0,0 +1,80 @@
+package afero
+
+import (
+        "os"
+        "syscall"
+        "time"
+)
+
+var _ Lstater = (*ReadOnlyFs)(nil)
+
+type ReadOnlyFs struct {
+        source Fs
+}
+
+func NewReadOnlyFs(source Fs) Fs {
+        return &ReadOnlyFs{source: source}
+}
+
+func (r *ReadOnlyFs) ReadDir(name string) ([]os.FileInfo, error) {
+        return ReadDir(r.source, name)
+}
+
+func (r *ReadOnlyFs) Chtimes(n string, a, m time.Time) error {
+        return syscall.EPERM
+}
+
+func (r *ReadOnlyFs) Chmod(n string, m os.FileMode) error {
+        return syscall.EPERM
+}
+
+func (r *ReadOnlyFs) Name() string {
+        return "ReadOnlyFilter"
+}
+
+func (r *ReadOnlyFs) Stat(name string) (os.FileInfo, error) {
+        return r.source.Stat(name)
+}
+
+func (r *ReadOnlyFs) LstatIfPossible(name string) (os.FileInfo, bool, error) {
+        if lsf, ok := r.source.(Lstater); ok {
+                return lsf.LstatIfPossible(name)
+        }
+        fi, err := r.Stat(name)
+        return fi, false, err
+}
+
+func (r *ReadOnlyFs) Rename(o, n string) error {
+        return syscall.EPERM
+}
+
+func (r *ReadOnlyFs) RemoveAll(p string) error {
+        return syscall.EPERM
+}
+
+func (r *ReadOnlyFs) Remove(n string) error {
+        return syscall.EPERM
+}
+
+func (r *ReadOnlyFs) OpenFile(name string, flag int, perm os.FileMode) (File, error) {
+        if flag&(os.O_WRONLY|syscall.O_RDWR|os.O_APPEND|os.O_CREATE|os.O_TRUNC) != 0 {
+                return nil, syscall.EPERM
+        }
+        return r.source.OpenFile(name, flag, perm)
+}
+
+func (r *ReadOnlyFs) Open(n string) (File, error) {
+        return r.source.Open(n)
+}
+
+func (r *ReadOnlyFs) Mkdir(n string, p os.FileMode) error {
+        return syscall.EPERM
+}
+
+func (r *ReadOnlyFs) MkdirAll(n string, p os.FileMode) error {
+        return syscall.EPERM
+}
+
+func (r *ReadOnlyFs) Create(n string) (File, error) {
+        return nil, syscall.EPERM
+}
diff --git a/vendor/github.com/spf13/afero/regexpfs.go b/vendor/github.com/spf13/afero/regexpfs.go
new file mode 100644
index 0000000..9d92dbc
--- /dev/null
+++ b/vendor/github.com/spf13/afero/regexpfs.go
@@ -0,0 +1,214 @@
+package afero
+
+import (
+        "os"
+        "regexp"
+        "syscall"
+        "time"
+)
+
+// The RegexpFs filters files (not directories) by regular expression. Only
+// files matching the given regexp will be allowed, all others get a ENOENT error (
+// "No such file or directory").
+//
+type RegexpFs struct {
+        re     *regexp.Regexp
+        source Fs
+}
+
+func NewRegexpFs(source Fs, re *regexp.Regexp) Fs {
+        return &RegexpFs{source: source, re: re}
+}
+
+type RegexpFile struct {
+        f  File
+        re *regexp.Regexp
+}
+
+func (r *RegexpFs) matchesName(name string) error {
+        if r.re == nil {
+                return nil
+        }
+        if r.re.MatchString(name) {
+                return nil
+        }
+        return syscall.ENOENT
+}
+
+func (r *RegexpFs) dirOrMatches(name string) error {
+        dir, err := IsDir(r.source, name)
+        if err != nil {
+                return err
+        }
+        if dir {
+                return nil
+        }
+        return r.matchesName(name)
+}
+
+func (r *RegexpFs) Chtimes(name string, a, m time.Time) error {
+        if err := r.dirOrMatches(name); err != nil {
+                return err
+        }
+        return r.source.Chtimes(name, a, m)
+}
+
+func (r *RegexpFs) Chmod(name string, mode os.FileMode) error {
+        if err := r.dirOrMatches(name); err != nil {
+                return err
+        }
+        return r.source.Chmod(name, mode)
+}
+
+func (r *RegexpFs) Name() string {
+        return "RegexpFs"
+}
+
+func (r *RegexpFs) Stat(name string) (os.FileInfo, error) {
+        if err := r.dirOrMatches(name); err != nil {
+                return nil, err
+        }
+        return r.source.Stat(name)
+}
+
+func (r *RegexpFs) Rename(oldname, newname string) error {
+        dir, err := IsDir(r.source, oldname)
+        if err != nil {
+                return err
+        }
+        if dir {
+                return nil
+        }
+        if err := r.matchesName(oldname); err != nil {
+                return err
+        }
+        if err := r.matchesName(newname); err != nil {
+                return err
+        }
+        return r.source.Rename(oldname, newname)
+}
+
+func (r *RegexpFs) RemoveAll(p string) error {
+        dir, err := IsDir(r.source, p)
+        if err != nil {
+                return err
+        }
+        if !dir {
+                if err := r.matchesName(p); err != nil {
+                        return err
+                }
+        }
+        return r.source.RemoveAll(p)
+}
+
+func (r *RegexpFs) Remove(name string) error {
+        if err := r.dirOrMatches(name); err != nil {
+                return err
+        }
+        return r.source.Remove(name)
+}
+
+func (r *RegexpFs) OpenFile(name string, flag int, perm os.FileMode) (File, error) {
+        if err := r.dirOrMatches(name); err != nil {
+                return nil, err
+        }
+        return r.source.OpenFile(name, flag, perm)
+}
+
+func (r *RegexpFs) Open(name string) (File, error) {
+        dir, err := IsDir(r.source, name)
+        if err != nil {
+                return nil, err
+        }
+        if !dir {
+                if err := r.matchesName(name); err != nil {
+                        return nil, err
+                }
+        }
+        f, err := r.source.Open(name)
+        return &RegexpFile{f: f, re: r.re}, nil
+}
+
+func (r *RegexpFs) Mkdir(n string, p os.FileMode) error {
+        return r.source.Mkdir(n, p)
+}
+
+func (r *RegexpFs) MkdirAll(n string, p os.FileMode) error {
+        return r.source.MkdirAll(n, p)
+}
+
+func (r *RegexpFs) Create(name string) (File, error) {
+        if err := r.matchesName(name); err != nil {
+                return nil, err
+        }
+        return r.source.Create(name)
+}
+
+func (f *RegexpFile) Close() error {
+        return f.f.Close()
+}
+
+func (f *RegexpFile) Read(s []byte) (int, error) {
+        return f.f.Read(s)
+}
+
+func (f *RegexpFile) ReadAt(s []byte, o int64) (int, error) {
+        return f.f.ReadAt(s, o)
+}
+
+func (f *RegexpFile) Seek(o int64, w int) (int64, error) {
+        return f.f.Seek(o, w)
+}
+
+func (f *RegexpFile) Write(s []byte) (int, error) {
+        return f.f.Write(s)
+}
+
+func (f *RegexpFile) WriteAt(s []byte, o int64) (int, error) {
+        return f.f.WriteAt(s, o)
+}
+
+func (f *RegexpFile) Name() string {
+        return f.f.Name()
+}
+
+func (f *RegexpFile) Readdir(c int) (fi []os.FileInfo, err error) {
+        var rfi []os.FileInfo
+        rfi, err = f.f.Readdir(c)
+        if err != nil {
+                return nil, err
+        }
+        for _, i := range rfi {
+                if i.IsDir() || f.re.MatchString(i.Name()) {
+                        fi = append(fi, i)
+                }
+        }
+        return fi, nil
+}
+
+func (f *RegexpFile) Readdirnames(c int) (n []string, err error) {
+        fi, err := f.Readdir(c)
+        if err != nil {
+                return nil, err
+        }
+        for _, s := range fi {
+                n = append(n, s.Name())
+        }
+        return n, nil
+}
+
+func (f *RegexpFile) Stat() (os.FileInfo, error) {
+        return f.f.Stat()
+}
+
+func (f *RegexpFile) Sync() error {
+        return f.f.Sync()
+}
+
+func (f *RegexpFile) Truncate(s int64) error {
+        return f.f.Truncate(s)
+}
+
+func (f *RegexpFile) WriteString(s string) (int, error) {
+        return f.f.WriteString(s)
+}
diff --git a/vendor/github.com/spf13/afero/unionFile.go b/vendor/github.com/spf13/afero/unionFile.go
new file mode 100644
index 0000000..abcf12d
--- /dev/null
+++ b/vendor/github.com/spf13/afero/unionFile.go
@@ -0,0 +1,316 @@
+package afero
+
+import (
+        "io"
+        "os"
+        "path/filepath"
+        "syscall"
+)
+
+// The UnionFile implements the afero.File interface and will be returned
+// when reading a directory present at least in the overlay or opening a file
+// for writing.
+//
+// The calls to
+// Readdir() and Readdirnames() merge the file os.FileInfo / names from the
+// base and the overlay - for files present in both layers, only those
+// from the overlay will be used.
+//
+// When opening files for writing (Create() / OpenFile() with the right flags)
+// the operations will be done in both layers, starting with the overlay. A
+// successful read in the overlay will move the cursor position in the base layer
+// by the number of bytes read.
+type UnionFile struct {
+        Base   File
+        Layer  File
+        Merger DirsMerger
+        off    int
+        files  []os.FileInfo
+}
+
+func (f *UnionFile) Close() error {
+        // first close base, so we have a newer timestamp in the overlay. If we'd close
+        // the overlay first, we'd get a cacheStale the next time we access this file
+        // -> cache would be useless ;-)
+        if f.Base != nil {
+                f.Base.Close()
+        }
+        if f.Layer != nil {
+                return f.Layer.Close()
+        }
+        return BADFD
+}
+
+func (f *UnionFile) Read(s []byte) (int, error) {
+        if f.Layer != nil {
+                n, err := f.Layer.Read(s)
+                if (err == nil || err == io.EOF) && f.Base != nil {
+                        // advance the file position also in the base file, the next
+                        // call may be a write at this position (or a seek with SEEK_CUR)
+                        if _, seekErr := f.Base.Seek(int64(n), os.SEEK_CUR); seekErr != nil {
+                                // only overwrite err in case the seek fails: we need to
+                                // report an eventual io.EOF to the caller
+                                err = seekErr
+                        }
+                }
+                return n, err
+        }
+        if f.Base != nil {
+                return f.Base.Read(s)
+        }
+        return 0, BADFD
+}
+
+func (f *UnionFile) ReadAt(s []byte, o int64) (int, error) {
+        if f.Layer != nil {
+                n, err := f.Layer.ReadAt(s, o)
+                if (err == nil || err == io.EOF) && f.Base != nil {
+                        _, err = f.Base.Seek(o+int64(n), os.SEEK_SET)
+                }
+                return n, err
+        }
+        if f.Base != nil {
+                return f.Base.ReadAt(s, o)
+        }
+        return 0, BADFD
+}
+
+func (f *UnionFile) Seek(o int64, w int) (pos int64, err error) {
+        if f.Layer != nil {
+                pos, err = f.Layer.Seek(o, w)
+                if (err == nil || err == io.EOF) && f.Base != nil {
+                        _, err = f.Base.Seek(o, w)
+                }
+                return pos, err
+        }
+        if f.Base != nil {
+                return f.Base.Seek(o, w)
+        }
+        return 0, BADFD
+}
+
+func (f *UnionFile) Write(s []byte) (n int, err error) {
+        if f.Layer != nil {
+                n, err = f.Layer.Write(s)
+                if err == nil && f.Base != nil { // hmm, do we have fixed size files where a write may hit the EOF mark?
+                        _, err = f.Base.Write(s)
+                }
+                return n, err
+        }
+        if f.Base != nil {
+                return f.Base.Write(s)
+        }
+        return 0, BADFD
+}
+
+func (f *UnionFile) WriteAt(s []byte, o int64) (n int, err error) {
+        if f.Layer != nil {
+                n, err = f.Layer.WriteAt(s, o)
+                if err == nil && f.Base != nil {
+                        _, err = f.Base.WriteAt(s, o)
+                }
+                return n, err
+        }
+        if f.Base != nil {
+                return f.Base.WriteAt(s, o)
+        }
+        return 0, BADFD
+}
+
+func (f *UnionFile) Name() string {
+        if f.Layer != nil {
+                return f.Layer.Name()
+        }
+        return f.Base.Name()
+}
+
+// DirsMerger is how UnionFile weaves two directories together.
+// It takes the FileInfo slices from the layer and the base and returns a
+// single view.
+type DirsMerger func(lofi, bofi []os.FileInfo) ([]os.FileInfo, error)
+
+var defaultUnionMergeDirsFn = func(lofi, bofi []os.FileInfo) ([]os.FileInfo, error) {
+        var files = make(map[string]os.FileInfo)
+
+        for _, fi := range lofi {
+                files[fi.Name()] = fi
+        }
+
+        for _, fi := range bofi {
+                if _, exists := files[fi.Name()]; !exists {
+                        files[fi.Name()] = fi
+                }
+        }
+
+        rfi := make([]os.FileInfo, len(files))
+
+        i := 0
+        for _, fi := range files {
+                rfi[i] = fi
+                i++
+        }
+
+        return rfi, nil
+
+}
+
+// Readdir will weave the two directories together and
+// return a single view of the overlayed directories
+// At the end of the directory view, the error is io.EOF.
+func (f *UnionFile) Readdir(c int) (ofi []os.FileInfo, err error) {
+        var merge DirsMerger = f.Merger
+        if merge == nil {
+                merge = defaultUnionMergeDirsFn
+        }
+
+        if f.off == 0 {
+                var lfi []os.FileInfo
+                if f.Layer != nil {
+                        lfi, err = f.Layer.Readdir(-1)
+                        if err != nil {
+                                return nil, err
+                        }
+                }
+
+                var bfi []os.FileInfo
+                if f.Base != nil {
+                        bfi, err = f.Base.Readdir(-1)
+                        if err != nil {
+                                return nil, err
+                        }
+
+                }
+                merged, err := merge(lfi, bfi)
+                if err != nil {
+                        return nil, err
+                }
+                f.files = append(f.files, merged...)
+        }
+
+        if f.off >= len(f.files) {
+                return nil, io.EOF
+        }
+
+        if c == -1 {
+                return f.files[f.off:], nil
+        }
+
+        if c > len(f.files) {
+                c = len(f.files)
+        }
+
+        defer func() { f.off += c }()
+        return f.files[f.off:c], nil
+}
+
+func (f *UnionFile) Readdirnames(c int) ([]string, error) {
+        rfi, err := f.Readdir(c)
+        if err != nil {
+                return nil, err
+        }
+        var names []string
+        for _, fi := range rfi {
+                names = append(names, fi.Name())
+        }
+        return names, nil
+}
+
+func (f *UnionFile) Stat() (os.FileInfo, error) {
+        if f.Layer != nil {
+                return f.Layer.Stat()
+        }
+        if f.Base != nil {
+                return f.Base.Stat()
+        }
+        return nil, BADFD
+}
+
+func (f *UnionFile) Sync() (err error) {
+        if f.Layer != nil {
+                err = f.Layer.Sync()
+                if err == nil && f.Base != nil {
+                        err = f.Base.Sync()
+                }
+                return err
+        }
+        if f.Base != nil {
+                return f.Base.Sync()
+        }
+        return BADFD
+}
+
+func (f *UnionFile) Truncate(s int64) (err error) {
+        if f.Layer != nil {
+                err = f.Layer.Truncate(s)
+                if err == nil && f.Base != nil {
+                        err = f.Base.Truncate(s)
+                }
+                return err
+        }
+        if f.Base != nil {
+                return f.Base.Truncate(s)
+        }
+        return BADFD
+}
+
+func (f *UnionFile) WriteString(s string) (n int, err error) {
+        if f.Layer != nil {
+                n, err = f.Layer.WriteString(s)
+                if err == nil && f.Base != nil {
+                        _, err = f.Base.WriteString(s)
+                }
+                return n, err
+        }
+        if f.Base != nil {
+                return f.Base.WriteString(s)
+        }
+        return 0, BADFD
+}
+
+func copyToLayer(base Fs, layer Fs, name string) error {
+        bfh, err := base.Open(name)
+        if err != nil {
+                return err
+        }
+        defer bfh.Close()
+
+        // First make sure the directory exists
+        exists, err := Exists(layer, filepath.Dir(name))
+        if err != nil {
+                return err
+        }
+        if !exists {
+                err = layer.MkdirAll(filepath.Dir(name), 0777) // FIXME?
+                if err != nil {
+                        return err
+                }
+        }
+
+        // Create the file on the overlay
+        lfh, err := layer.Create(name)
+        if err != nil {
+                return err
+        }
+        n, err := io.Copy(lfh, bfh)
+        if err != nil {
+                // If anything fails, clean up the file
+                layer.Remove(name)
+                lfh.Close()
+                return err
+        }
+
+        bfi, err := bfh.Stat()
+        if err != nil || bfi.Size() != n {
+                layer.Remove(name)
+                lfh.Close()
+                return syscall.EIO
+        }
+
+        err = lfh.Close()
+        if err != nil {
+                layer.Remove(name)
+                lfh.Close()
+                return err
+        }
+        return layer.Chtimes(name, bfi.ModTime(), bfi.ModTime())
+}
diff --git a/vendor/github.com/spf13/afero/util.go b/vendor/github.com/spf13/afero/util.go
new file mode 100644
index 0000000..4f253f4
--- /dev/null
+++ b/vendor/github.com/spf13/afero/util.go
@@ -0,0 +1,330 @@
+// Copyright ©2015 Steve Francia <spf@spf13.com>
+// Portions Copyright ©2015 The Hugo Authors
+// Portions Copyright 2016-present Bjørn Erik Pedersen <bjorn.erik.pedersen@gmail.com>
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package afero
+
+import (
+        "bytes"
+        "fmt"
+        "io"
+        "os"
+        "path/filepath"
+        "strings"
+        "unicode"
+
+        "golang.org/x/text/transform"
+        "golang.org/x/text/unicode/norm"
+)
+
+// Filepath separator defined by os.Separator.
+const FilePathSeparator = string(filepath.Separator)
+
+// Takes a reader and a path and writes the content
+func (a Afero) WriteReader(path string, r io.Reader) (err error) {
+        return WriteReader(a.Fs, path, r)
+}
+
+func WriteReader(fs Fs, path string, r io.Reader) (err error) {
+        dir, _ := filepath.Split(path)
+        ospath := filepath.FromSlash(dir)
+
+        if ospath != "" {
+                err = fs.MkdirAll(ospath, 0777) // rwx, rw, r
+                if err != nil {
+                        if err != os.ErrExist {
+                                return err
+                        }
+                }
+        }
+
+        file, err := fs.Create(path)
+        if err != nil {
+                return
+        }
+        defer file.Close()
+
+        _, err = io.Copy(file, r)
+        return
+}
+
+// Same as WriteReader but checks to see if file/directory already exists.
+func (a Afero) SafeWriteReader(path string, r io.Reader) (err error) {
+        return SafeWriteReader(a.Fs, path, r)
+}
+
+func SafeWriteReader(fs Fs, path string, r io.Reader) (err error) {
+        dir, _ := filepath.Split(path)
+        ospath := filepath.FromSlash(dir)
+
+        if ospath != "" {
+                err = fs.MkdirAll(ospath, 0777) // rwx, rw, r
+                if err != nil {
+                        return
+                }
+        }
+
+        exists, err := Exists(fs, path)
+        if err != nil {
+                return
+        }
+        if exists {
+                return fmt.Errorf("%v already exists", path)
+        }
+
+        file, err := fs.Create(path)
+        if err != nil {
+                return
+        }
+        defer file.Close()
+
+        _, err = io.Copy(file, r)
+        return
+}
+
+func (a Afero) GetTempDir(subPath string) string {
+        return GetTempDir(a.Fs, subPath)
+}
+
+// GetTempDir returns the default temp directory with trailing slash
+// if subPath is not empty then it will be created recursively with mode 777 rwx rwx rwx
+func GetTempDir(fs Fs, subPath string) string {
+        addSlash := func(p string) string {
+                if FilePathSeparator != p[len(p)-1:] {
+                        p = p + FilePathSeparator
+                }
+                return p
+        }
+        dir := addSlash(os.TempDir())
+
+        if subPath != "" {
+                // preserve windows backslash :-(
+                if FilePathSeparator == "\\" {
+                        subPath = strings.Replace(subPath, "\\", "____", -1)
+                }
+                dir = dir + UnicodeSanitize((subPath))
+                if FilePathSeparator == "\\" {
+                        dir = strings.Replace(dir, "____", "\\", -1)
+                }
+
+                if exists, _ := Exists(fs, dir); exists {
+                        return addSlash(dir)
+                }
+
+                err := fs.MkdirAll(dir, 0777)
+                if err != nil {
+                        panic(err)
+                }
+                dir = addSlash(dir)
+        }
+        return dir
+}
+
+// Rewrite string to remove non-standard path characters
+func UnicodeSanitize(s string) string {
+        source := []rune(s)
+        target := make([]rune, 0, len(source))
+
+        for _, r := range source {
+                if unicode.IsLetter(r) ||
+                        unicode.IsDigit(r) ||
+                        unicode.IsMark(r) ||
+                        r == '.' ||
+                        r == '/' ||
+                        r == '\\' ||
+                        r == '_' ||
+                        r == '-' ||
+                        r == '%' ||
+                        r == ' ' ||
+                        r == '#' {
+                        target = append(target, r)
+                }
+        }
+
+        return string(target)
+}
+
+// Transform characters with accents into plain forms.
+func NeuterAccents(s string) string {
+        t := transform.Chain(norm.NFD, transform.RemoveFunc(isMn), norm.NFC)
+        result, _, _ := transform.String(t, string(s))
+
+        return result
+}
+
+func isMn(r rune) bool {
+        return unicode.Is(unicode.Mn, r) // Mn: nonspacing marks
+}
+
+func (a Afero) FileContainsBytes(filename string, subslice []byte) (bool, error) {
+        return FileContainsBytes(a.Fs, filename, subslice)
+}
+
+// Check if a file contains a specified byte slice.
+func FileContainsBytes(fs Fs, filename string, subslice []byte) (bool, error) {
+        f, err := fs.Open(filename)
+        if err != nil {
+                return false, err
+        }
+        defer f.Close()
+
+        return readerContainsAny(f, subslice), nil
+}
+
+func (a Afero) FileContainsAnyBytes(filename string, subslices [][]byte) (bool, error) {
+        return FileContainsAnyBytes(a.Fs, filename, subslices)
+}
+
+// Check if a file contains any of the specified byte slices.
+func FileContainsAnyBytes(fs Fs, filename string, subslices [][]byte) (bool, error) {
+        f, err := fs.Open(filename)
+        if err != nil {
+                return false, err
+        }
+        defer f.Close()
+
+        return readerContainsAny(f, subslices...), nil
+}
+
+// readerContains reports whether any of the subslices is within r.
+func readerContainsAny(r io.Reader, subslices ...[]byte) bool {
+
+        if r == nil || len(subslices) == 0 {
+                return false
+        }
+
+        largestSlice := 0
+
+        for _, sl := range subslices {
+                if len(sl) > largestSlice {
+                        largestSlice = len(sl)
+                }
+        }
+
+        if largestSlice == 0 {
+                return false
+        }
+
+        bufflen := largestSlice * 4
+        halflen := bufflen / 2
+        buff := make([]byte, bufflen)
+        var err error
+        var n, i int
+
+        for {
+                i++
+                if i == 1 {
+                        n, err = io.ReadAtLeast(r, buff[:halflen], halflen)
+                } else {
+                        if i != 2 {
+                                // shift left to catch overlapping matches
+                                copy(buff[:], buff[halflen:])
+                        }
+                        n, err = io.ReadAtLeast(r, buff[halflen:], halflen)
+                }
+
+                if n > 0 {
+                        for _, sl := range subslices {
+                                if bytes.Contains(buff, sl) {
+                                        return true
+                                }
+                        }
+                }
+
+                if err != nil {
+                        break
+                }
+        }
+        return false
+}
+
+func (a Afero) DirExists(path string) (bool, error) {
+        return DirExists(a.Fs, path)
+}
+
+// DirExists checks if a path exists and is a directory.
+func DirExists(fs Fs, path string) (bool, error) {
+        fi, err := fs.Stat(path)
+        if err == nil && fi.IsDir() {
+                return true, nil
+        }
+        if os.IsNotExist(err) {
+                return false, nil
+        }
+        return false, err
+}
+
+func (a Afero) IsDir(path string) (bool, error) {
+        return IsDir(a.Fs, path)
+}
+
+// IsDir checks if a given path is a directory.
+func IsDir(fs Fs, path string) (bool, error) {
+        fi, err := fs.Stat(path)
+        if err != nil {
+                return false, err
+        }
+        return fi.IsDir(), nil
+}
+
+func (a Afero) IsEmpty(path string) (bool, error) {
+        return IsEmpty(a.Fs, path)
+}
+
+// IsEmpty checks if a given file or directory is empty.
+func IsEmpty(fs Fs, path string) (bool, error) {
+        if b, _ := Exists(fs, path); !b {
+                return false, fmt.Errorf("%q path does not exist", path)
+        }
+        fi, err := fs.Stat(path)
+        if err != nil {
+                return false, err
+        }
+        if fi.IsDir() {
+                f, err := fs.Open(path)
+                if err != nil {
+                        return false, err
+                }
+                defer f.Close()
+                list, err := f.Readdir(-1)
+                return len(list) == 0, nil
+        }
+        return fi.Size() == 0, nil
+}
+
+func (a Afero) Exists(path string) (bool, error) {
+        return Exists(a.Fs, path)
+}
+
+// Check if a file or directory exists.
+func Exists(fs Fs, path string) (bool, error) {
+        _, err := fs.Stat(path)
+        if err == nil {
+                return true, nil
+        }
+        if os.IsNotExist(err) {
+                return false, nil
+        }
+        return false, err
+}
+
+func FullBaseFsPath(basePathFs *BasePathFs, relativePath string) string {
+        combinedPath := filepath.Join(basePathFs.path, relativePath)
+        if parent, ok := basePathFs.source.(*BasePathFs); ok {
+                return FullBaseFsPath(parent, combinedPath)
+        }
+
+        return combinedPath
+}
diff --git a/vendor/github.com/ulikunitz/xz/README.md b/vendor/github.com/ulikunitz/xz/README.md
index 969ae7a..0a2dc82 100644
--- a/vendor/github.com/ulikunitz/xz/README.md
+++ b/vendor/github.com/ulikunitz/xz/README.md
@@ -12,46 +12,48 @@ have been developed over a long time and are highly optimized. However
 there are a number of improvements planned and I'm very optimistic about
 parallel compression and decompression. Stay tuned!
 
-# Using the API
+## Using the API
 
 The following example program shows how to use the API.
 
-    package main
-
-    import (
-        "bytes"
-        "io"
-        "log"
-        "os"
-
-        "github.com/ulikunitz/xz"
-    )
-
-    func main() {
-        const text = "The quick brown fox jumps over the lazy dog.\n"
-        var buf bytes.Buffer
-        // compress text
-        w, err := xz.NewWriter(&buf)
-        if err != nil {
-            log.Fatalf("xz.NewWriter error %s", err)
-        }
-        if _, err := io.WriteString(w, text); err != nil {
-            log.Fatalf("WriteString error %s", err)
-        }
-        if err := w.Close(); err != nil {
-            log.Fatalf("w.Close error %s", err)
-        }
-        // decompress buffer and write output to stdout
-        r, err := xz.NewReader(&buf)
-        if err != nil {
-            log.Fatalf("NewReader error %s", err)
-        }
-        if _, err = io.Copy(os.Stdout, r); err != nil {
-            log.Fatalf("io.Copy error %s", err)
-        }
+```go
+package main
+
+import (
+    "bytes"
+    "io"
+    "log"
+    "os"
+
+    "github.com/ulikunitz/xz"
+)
+
+func main() {
+    const text = "The quick brown fox jumps over the lazy dog.\n"
+    var buf bytes.Buffer
+    // compress text
+    w, err := xz.NewWriter(&buf)
+    if err != nil {
+        log.Fatalf("xz.NewWriter error %s", err)
     }
+    if _, err := io.WriteString(w, text); err != nil {
+        log.Fatalf("WriteString error %s", err)
+    }
+    if err := w.Close(); err != nil {
+        log.Fatalf("w.Close error %s", err)
+    }
+    // decompress buffer and write output to stdout
+    r, err := xz.NewReader(&buf)
+    if err != nil {
+        log.Fatalf("NewReader error %s", err)
+    }
+    if _, err = io.Copy(os.Stdout, r); err != nil {
+        log.Fatalf("io.Copy error %s", err)
+    }
+}
+```
 
-# Using the gxz compression tool
+## Using the gxz compression tool
 
 The package includes a gxz command line utility for compression and
 decompression.
diff --git a/vendor/github.com/ulikunitz/xz/TODO.md b/vendor/github.com/ulikunitz/xz/TODO.md
index 7b34c0c..c10e51b 100644
--- a/vendor/github.com/ulikunitz/xz/TODO.md
+++ b/vendor/github.com/ulikunitz/xz/TODO.md
@@ -86,6 +86,10 @@
 
 ## Log
 
+### 2018-10-28
+
+Release v0.5.5 fixes issues #19 observing ErrLimit outputs.
+
 ### 2017-06-05
 
 Release v0.5.4 fixes issues #15 of another problem with the padding size
@@ -102,7 +106,7 @@ Release v0.5.2 became necessary to allow the decoding of xz files with
 4-byte padding in the block header. Many thanks to Greg, who reported
 the issue.
 
-### 2016-07-23 
+### 2016-07-23
 
 Release v0.5.1 became necessary to fix problems with 32-bit platforms.
 Many thanks to Bruno Brigas, who reported the issue.
@@ -194,7 +198,7 @@ and lzma.Writer and fixed the error handling.
 By computing the bit length of the LZMA operations I was able to
 improve the greedy algorithm implementation. By using an 8 MByte buffer
 the compression rate was not as good as for xz but already better then
-gzip default. 
+gzip default.
 
 Compression is currently slow, but this is something we will be able to
 improve over time.
@@ -213,7 +217,7 @@ The package lzb contains now the basic implementation for creating or
 reading LZMA byte streams. It allows the support for the implementation
 of the DAG-shortest-path algorithm for the compression function.
 
-### 2015-04-23 
+### 2015-04-23
 
 Completed yesterday the lzbase classes. I'm a little bit concerned that
 using the components may require too much code, but on the other hand
@@ -242,7 +246,7 @@ right lzbase.Reader and lzbase.Writer.
 
 As a start I have implemented ReaderState and WriterState to ensure
 that the state for reading is only used by readers and WriterState only
-used by Writers. 
+used by Writers.
 
 ### 2015-04-20
 
@@ -274,7 +278,7 @@ almost all files from lzma.
 
 ### 2015-03-31
 
-Removed only a TODO item. 
+Removed only a TODO item.
 
 However in Francesco Campoy's presentation "Go for Javaneros
 (Javaïstes?)" is the the idea that using an embedded field E, all the
diff --git a/vendor/github.com/ulikunitz/xz/lzma/encoder.go b/vendor/github.com/ulikunitz/xz/lzma/encoder.go
index 18ce009..fe1900a 100644
--- a/vendor/github.com/ulikunitz/xz/lzma/encoder.go
+++ b/vendor/github.com/ulikunitz/xz/lzma/encoder.go
@@ -11,7 +11,7 @@ import (
 
 // opLenMargin provides the upper limit of the number of bytes required
 // to encode a single operation.
-const opLenMargin = 10
+const opLenMargin = 16
 
 // compressFlags control the compression process.
 type compressFlags uint32
diff --git a/vendor/github.com/vmihailenco/msgpack/.travis.yml b/vendor/github.com/vmihailenco/msgpack/.travis.yml
new file mode 100644
index 0000000..0c2f74e
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/.travis.yml
@@ -0,0 +1,17 @@
+sudo: false
+language: go
+
+go:
+  - 1.7.x
+  - 1.8.x
+  - 1.9.x
+  - 1.10.x
+  - 1.11.x
+  - tip
+
+matrix:
+  allow_failures:
+    - go: tip
+
+install:
+  - go get gopkg.in/check.v1
diff --git a/vendor/github.com/vmihailenco/msgpack/CHANGELOG.md b/vendor/github.com/vmihailenco/msgpack/CHANGELOG.md
new file mode 100644
index 0000000..9a4f38a
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/CHANGELOG.md
@@ -0,0 +1,24 @@
+## 3.4
+
+- Encode, Decode, Marshal, and Unmarshal are changed to accept single argument. EncodeMulti and DecodeMulti are added as replacement.
+- Added EncodeInt8/16/32/64 and EncodeUint8/16/32/64.
+- Encoder changed to preserve type of numbers instead of chosing most compact encoding. The old behavior can be achieved with Encoder.UseCompactEncoding.
+
+## v3.3
+
+- `msgpack:",inline"` tag is restored to force inlining structs.
+
+## v3.2
+
+- Decoding extension types returns pointer to the value instead of the value. Fixes #153
+
+## v3
+
+- gopkg.in is not supported any more. Update import path to github.com/vmihailenco/msgpack.
+- Msgpack maps are decoded into map[string]interface{} by default.
+- EncodeSliceLen is removed in favor of EncodeArrayLen. DecodeSliceLen is removed in favor of DecodeArrayLen.
+- Embedded structs are automatically inlined where possible.
+- Time is encoded using extension as described in https://github.com/msgpack/msgpack/pull/209. Old format is supported as well.
+- EncodeInt8/16/32/64 is replaced with EncodeInt. EncodeUint8/16/32/64 is replaced with EncodeUint. There should be no performance differences.
+- DecodeInterface can now return int8/16/32 and uint8/16/32.
+- PeekCode returns codes.Code instead of byte.
diff --git a/vendor/github.com/vmihailenco/msgpack/LICENSE b/vendor/github.com/vmihailenco/msgpack/LICENSE
new file mode 100644
index 0000000..b749d07
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/LICENSE
@@ -0,0 +1,25 @@
+Copyright (c) 2013 The github.com/vmihailenco/msgpack Authors.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/vmihailenco/msgpack/Makefile b/vendor/github.com/vmihailenco/msgpack/Makefile
new file mode 100644
index 0000000..b62ae6a
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/Makefile
@@ -0,0 +1,5 @@
+all:
+        go test ./...
+        env GOOS=linux GOARCH=386 go test ./...
+        go test ./... -short -race
+        go vet
diff --git a/vendor/github.com/vmihailenco/msgpack/README.md b/vendor/github.com/vmihailenco/msgpack/README.md
new file mode 100644
index 0000000..0c75ae1
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/README.md
@@ -0,0 +1,69 @@
+# MessagePack encoding for Golang
+
+[![Build Status](https://travis-ci.org/vmihailenco/msgpack.svg?branch=v2)](https://travis-ci.org/vmihailenco/msgpack)
+[![GoDoc](https://godoc.org/github.com/vmihailenco/msgpack?status.svg)](https://godoc.org/github.com/vmihailenco/msgpack)
+
+Supports:
+- Primitives, arrays, maps, structs, time.Time and interface{}.
+- Appengine *datastore.Key and datastore.Cursor.
+- [CustomEncoder](https://godoc.org/github.com/vmihailenco/msgpack#example-CustomEncoder)/CustomDecoder interfaces for custom encoding.
+- [Extensions](https://godoc.org/github.com/vmihailenco/msgpack#example-RegisterExt) to encode type information.
+- Renaming fields via `msgpack:"my_field_name"`.
+- Omitting individual empty fields via `msgpack:",omitempty"` tag or all [empty fields in a struct](https://godoc.org/github.com/vmihailenco/msgpack#example-Marshal--OmitEmpty).
+- [Map keys sorting](https://godoc.org/github.com/vmihailenco/msgpack#Encoder.SortMapKeys).
+- Encoding/decoding all [structs as arrays](https://godoc.org/github.com/vmihailenco/msgpack#Encoder.StructAsArray) or [individual structs](https://godoc.org/github.com/vmihailenco/msgpack#example-Marshal--AsArray).
+- [Encoder.UseJSONTag](https://godoc.org/github.com/vmihailenco/msgpack#Encoder.UseJSONTag) with [Decoder.UseJSONTag](https://godoc.org/github.com/vmihailenco/msgpack#Decoder.UseJSONTag) can turn msgpack into drop-in replacement for JSON.
+- Simple but very fast and efficient [queries](https://godoc.org/github.com/vmihailenco/msgpack#example-Decoder-Query).
+
+API docs: https://godoc.org/github.com/vmihailenco/msgpack.
+Examples: https://godoc.org/github.com/vmihailenco/msgpack#pkg-examples.
+
+## Installation
+
+Install:
+
+```shell
+go get -u github.com/vmihailenco/msgpack
+```
+
+## Quickstart
+
+```go
+func ExampleMarshal() {
+        type Item struct {
+                Foo string
+        }
+
+        b, err := msgpack.Marshal(&Item{Foo: "bar"})
+        if err != nil {
+                panic(err)
+        }
+
+        var item Item
+        err = msgpack.Unmarshal(b, &item)
+        if err != nil {
+                panic(err)
+        }
+        fmt.Println(item.Foo)
+        // Output: bar
+}
+```
+
+## Benchmark
+
+```
+BenchmarkStructVmihailencoMsgpack-4       200000             12814 ns/op            2128 B/op         26 allocs/op
+BenchmarkStructUgorjiGoMsgpack-4          100000             17678 ns/op            3616 B/op         70 allocs/op
+BenchmarkStructUgorjiGoCodec-4            100000             19053 ns/op            7346 B/op         23 allocs/op
+BenchmarkStructJSON-4                      20000             69438 ns/op            7864 B/op         26 allocs/op
+BenchmarkStructGOB-4                       10000            104331 ns/op           14664 B/op        278 allocs/op
+```
+
+## Howto
+
+Please go through [examples](https://godoc.org/github.com/vmihailenco/msgpack#pkg-examples) to get an idea how to use this package.
+
+## See also
+
+- [Golang PostgreSQL ORM](https://github.com/go-pg/pg)
+- [Golang message task queue](https://github.com/go-msgqueue/msgqueue)
diff --git a/vendor/github.com/vmihailenco/msgpack/appengine.go b/vendor/github.com/vmihailenco/msgpack/appengine.go
new file mode 100644
index 0000000..e8e91e5
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/appengine.go
@@ -0,0 +1,64 @@
+// +build appengine
+
+package msgpack
+
+import (
+        "reflect"
+
+        ds "google.golang.org/appengine/datastore"
+)
+
+func init() {
+        Register((*ds.Key)(nil), encodeDatastoreKeyValue, decodeDatastoreKeyValue)
+        Register((*ds.Cursor)(nil), encodeDatastoreCursorValue, decodeDatastoreCursorValue)
+}
+
+func EncodeDatastoreKey(e *Encoder, key *ds.Key) error {
+        if key == nil {
+                return e.EncodeNil()
+        }
+        return e.EncodeString(key.Encode())
+}
+
+func encodeDatastoreKeyValue(e *Encoder, v reflect.Value) error {
+        key := v.Interface().(*ds.Key)
+        return EncodeDatastoreKey(e, key)
+}
+
+func DecodeDatastoreKey(d *Decoder) (*ds.Key, error) {
+        v, err := d.DecodeString()
+        if err != nil {
+                return nil, err
+        }
+        if v == "" {
+                return nil, nil
+        }
+        return ds.DecodeKey(v)
+}
+
+func decodeDatastoreKeyValue(d *Decoder, v reflect.Value) error {
+        key, err := DecodeDatastoreKey(d)
+        if err != nil {
+                return err
+        }
+        v.Set(reflect.ValueOf(key))
+        return nil
+}
+
+func encodeDatastoreCursorValue(e *Encoder, v reflect.Value) error {
+        cursor := v.Interface().(ds.Cursor)
+        return e.Encode(cursor.String())
+}
+
+func decodeDatastoreCursorValue(d *Decoder, v reflect.Value) error {
+        s, err := d.DecodeString()
+        if err != nil {
+                return err
+        }
+        cursor, err := ds.DecodeCursor(s)
+        if err != nil {
+                return err
+        }
+        v.Set(reflect.ValueOf(cursor))
+        return nil
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/codes/codes.go b/vendor/github.com/vmihailenco/msgpack/codes/codes.go
new file mode 100644
index 0000000..906af37
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/codes/codes.go
@@ -0,0 +1,86 @@
+package codes
+
+type Code byte
+
+var (
+        PosFixedNumHigh Code = 0x7f
+        NegFixedNumLow  Code = 0xe0
+
+        Nil Code = 0xc0
+
+        False Code = 0xc2
+        True  Code = 0xc3
+
+        Float  Code = 0xca
+        Double Code = 0xcb
+
+        Uint8  Code = 0xcc
+        Uint16 Code = 0xcd
+        Uint32 Code = 0xce
+        Uint64 Code = 0xcf
+
+        Int8  Code = 0xd0
+        Int16 Code = 0xd1
+        Int32 Code = 0xd2
+        Int64 Code = 0xd3
+
+        FixedStrLow  Code = 0xa0
+        FixedStrHigh Code = 0xbf
+        FixedStrMask Code = 0x1f
+        Str8         Code = 0xd9
+        Str16        Code = 0xda
+        Str32        Code = 0xdb
+
+        Bin8  Code = 0xc4
+        Bin16 Code = 0xc5
+        Bin32 Code = 0xc6
+
+        FixedArrayLow  Code = 0x90
+        FixedArrayHigh Code = 0x9f
+        FixedArrayMask Code = 0xf
+        Array16        Code = 0xdc
+        Array32        Code = 0xdd
+
+        FixedMapLow  Code = 0x80
+        FixedMapHigh Code = 0x8f
+        FixedMapMask Code = 0xf
+        Map16        Code = 0xde
+        Map32        Code = 0xdf
+
+        FixExt1  Code = 0xd4
+        FixExt2  Code = 0xd5
+        FixExt4  Code = 0xd6
+        FixExt8  Code = 0xd7
+        FixExt16 Code = 0xd8
+        Ext8     Code = 0xc7
+        Ext16    Code = 0xc8
+        Ext32    Code = 0xc9
+)
+
+func IsFixedNum(c Code) bool {
+        return c <= PosFixedNumHigh || c >= NegFixedNumLow
+}
+
+func IsFixedMap(c Code) bool {
+        return c >= FixedMapLow && c <= FixedMapHigh
+}
+
+func IsFixedArray(c Code) bool {
+        return c >= FixedArrayLow && c <= FixedArrayHigh
+}
+
+func IsFixedString(c Code) bool {
+        return c >= FixedStrLow && c <= FixedStrHigh
+}
+
+func IsString(c Code) bool {
+        return IsFixedString(c) || c == Str8 || c == Str16 || c == Str32
+}
+
+func IsFixedExt(c Code) bool {
+        return c >= FixExt1 && c <= FixExt16
+}
+
+func IsExt(c Code) bool {
+        return IsFixedExt(c) || c == Ext8 || c == Ext16 || c == Ext32
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/decode.go b/vendor/github.com/vmihailenco/msgpack/decode.go
new file mode 100644
index 0000000..7414100
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/decode.go
@@ -0,0 +1,546 @@
+package msgpack
+
+import (
+        "bufio"
+        "bytes"
+        "errors"
+        "fmt"
+        "io"
+        "reflect"
+        "time"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+const bytesAllocLimit = 1024 * 1024 // 1mb
+
+type bufReader interface {
+        io.Reader
+        io.ByteScanner
+}
+
+func newBufReader(r io.Reader) bufReader {
+        if br, ok := r.(bufReader); ok {
+                return br
+        }
+        return bufio.NewReader(r)
+}
+
+func makeBuffer() []byte {
+        return make([]byte, 0, 64)
+}
+
+// Unmarshal decodes the MessagePack-encoded data and stores the result
+// in the value pointed to by v.
+func Unmarshal(data []byte, v interface{}) error {
+        return NewDecoder(bytes.NewReader(data)).Decode(v)
+}
+
+type Decoder struct {
+        r   io.Reader
+        s   io.ByteScanner
+        buf []byte
+
+        extLen int
+        rec    []byte // accumulates read data if not nil
+
+        useLoose   bool
+        useJSONTag bool
+
+        decodeMapFunc func(*Decoder) (interface{}, error)
+}
+
+// NewDecoder returns a new decoder that reads from r.
+//
+// The decoder introduces its own buffering and may read data from r
+// beyond the MessagePack values requested. Buffering can be disabled
+// by passing a reader that implements io.ByteScanner interface.
+func NewDecoder(r io.Reader) *Decoder {
+        d := &Decoder{
+                buf: makeBuffer(),
+        }
+        d.resetReader(r)
+        return d
+}
+
+func (d *Decoder) SetDecodeMapFunc(fn func(*Decoder) (interface{}, error)) {
+        d.decodeMapFunc = fn
+}
+
+// UseDecodeInterfaceLoose causes decoder to use DecodeInterfaceLoose
+// to decode msgpack value into Go interface{}.
+func (d *Decoder) UseDecodeInterfaceLoose(flag bool) {
+        d.useLoose = flag
+}
+
+// UseJSONTag causes the Decoder to use json struct tag as fallback option
+// if there is no msgpack tag.
+func (d *Decoder) UseJSONTag(v bool) *Decoder {
+        d.useJSONTag = v
+        return d
+}
+
+func (d *Decoder) Reset(r io.Reader) error {
+        d.resetReader(r)
+        return nil
+}
+
+func (d *Decoder) resetReader(r io.Reader) {
+        reader := newBufReader(r)
+        d.r = reader
+        d.s = reader
+}
+
+func (d *Decoder) Decode(v interface{}) error {
+        var err error
+        switch v := v.(type) {
+        case *string:
+                if v != nil {
+                        *v, err = d.DecodeString()
+                        return err
+                }
+        case *[]byte:
+                if v != nil {
+                        return d.decodeBytesPtr(v)
+                }
+        case *int:
+                if v != nil {
+                        *v, err = d.DecodeInt()
+                        return err
+                }
+        case *int8:
+                if v != nil {
+                        *v, err = d.DecodeInt8()
+                        return err
+                }
+        case *int16:
+                if v != nil {
+                        *v, err = d.DecodeInt16()
+                        return err
+                }
+        case *int32:
+                if v != nil {
+                        *v, err = d.DecodeInt32()
+                        return err
+                }
+        case *int64:
+                if v != nil {
+                        *v, err = d.DecodeInt64()
+                        return err
+                }
+        case *uint:
+                if v != nil {
+                        *v, err = d.DecodeUint()
+                        return err
+                }
+        case *uint8:
+                if v != nil {
+                        *v, err = d.DecodeUint8()
+                        return err
+                }
+        case *uint16:
+                if v != nil {
+                        *v, err = d.DecodeUint16()
+                        return err
+                }
+        case *uint32:
+                if v != nil {
+                        *v, err = d.DecodeUint32()
+                        return err
+                }
+        case *uint64:
+                if v != nil {
+                        *v, err = d.DecodeUint64()
+                        return err
+                }
+        case *bool:
+                if v != nil {
+                        *v, err = d.DecodeBool()
+                        return err
+                }
+        case *float32:
+                if v != nil {
+                        *v, err = d.DecodeFloat32()
+                        return err
+                }
+        case *float64:
+                if v != nil {
+                        *v, err = d.DecodeFloat64()
+                        return err
+                }
+        case *[]string:
+                return d.decodeStringSlicePtr(v)
+        case *map[string]string:
+                return d.decodeMapStringStringPtr(v)
+        case *map[string]interface{}:
+                return d.decodeMapStringInterfacePtr(v)
+        case *time.Duration:
+                if v != nil {
+                        vv, err := d.DecodeInt64()
+                        *v = time.Duration(vv)
+                        return err
+                }
+        case *time.Time:
+                if v != nil {
+                        *v, err = d.DecodeTime()
+                        return err
+                }
+        }
+
+        vv := reflect.ValueOf(v)
+        if !vv.IsValid() {
+                return errors.New("msgpack: Decode(nil)")
+        }
+        if vv.Kind() != reflect.Ptr {
+                return fmt.Errorf("msgpack: Decode(nonsettable %T)", v)
+        }
+        vv = vv.Elem()
+        if !vv.IsValid() {
+                return fmt.Errorf("msgpack: Decode(nonsettable %T)", v)
+        }
+        return d.DecodeValue(vv)
+}
+
+func (d *Decoder) DecodeMulti(v ...interface{}) error {
+        for _, vv := range v {
+                if err := d.Decode(vv); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+func (d *Decoder) decodeInterfaceCond() (interface{}, error) {
+        if d.useLoose {
+                return d.DecodeInterfaceLoose()
+        }
+        return d.DecodeInterface()
+}
+
+func (d *Decoder) DecodeValue(v reflect.Value) error {
+        decode := getDecoder(v.Type())
+        return decode(d, v)
+}
+
+func (d *Decoder) DecodeNil() error {
+        c, err := d.readCode()
+        if err != nil {
+                return err
+        }
+        if c != codes.Nil {
+                return fmt.Errorf("msgpack: invalid code=%x decoding nil", c)
+        }
+        return nil
+}
+
+func (d *Decoder) decodeNilValue(v reflect.Value) error {
+        err := d.DecodeNil()
+        if v.IsNil() {
+                return err
+        }
+        if v.Kind() == reflect.Ptr {
+                v = v.Elem()
+        }
+        v.Set(reflect.Zero(v.Type()))
+        return err
+}
+
+func (d *Decoder) DecodeBool() (bool, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return false, err
+        }
+        return d.bool(c)
+}
+
+func (d *Decoder) bool(c codes.Code) (bool, error) {
+        if c == codes.False {
+                return false, nil
+        }
+        if c == codes.True {
+                return true, nil
+        }
+        return false, fmt.Errorf("msgpack: invalid code=%x decoding bool", c)
+}
+
+// DecodeInterface decodes value into interface. It returns following types:
+//   - nil,
+//   - bool,
+//   - int8, int16, int32, int64,
+//   - uint8, uint16, uint32, uint64,
+//   - float32 and float64,
+//   - string,
+//   - []byte,
+//   - slices of any of the above,
+//   - maps of any of the above.
+//
+// DecodeInterface should be used only when you don't know the type of value
+// you are decoding. For example, if you are decoding number it is better to use
+// DecodeInt64 for negative numbers and DecodeUint64 for positive numbers.
+func (d *Decoder) DecodeInterface() (interface{}, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return nil, err
+        }
+
+        if codes.IsFixedNum(c) {
+                return int8(c), nil
+        }
+        if codes.IsFixedMap(c) {
+                err = d.s.UnreadByte()
+                if err != nil {
+                        return nil, err
+                }
+                return d.DecodeMap()
+        }
+        if codes.IsFixedArray(c) {
+                return d.decodeSlice(c)
+        }
+        if codes.IsFixedString(c) {
+                return d.string(c)
+        }
+
+        switch c {
+        case codes.Nil:
+                return nil, nil
+        case codes.False, codes.True:
+                return d.bool(c)
+        case codes.Float:
+                return d.float32(c)
+        case codes.Double:
+                return d.float64(c)
+        case codes.Uint8:
+                return d.uint8()
+        case codes.Uint16:
+                return d.uint16()
+        case codes.Uint32:
+                return d.uint32()
+        case codes.Uint64:
+                return d.uint64()
+        case codes.Int8:
+                return d.int8()
+        case codes.Int16:
+                return d.int16()
+        case codes.Int32:
+                return d.int32()
+        case codes.Int64:
+                return d.int64()
+        case codes.Bin8, codes.Bin16, codes.Bin32:
+                return d.bytes(c, nil)
+        case codes.Str8, codes.Str16, codes.Str32:
+                return d.string(c)
+        case codes.Array16, codes.Array32:
+                return d.decodeSlice(c)
+        case codes.Map16, codes.Map32:
+                err = d.s.UnreadByte()
+                if err != nil {
+                        return nil, err
+                }
+                return d.DecodeMap()
+        case codes.FixExt1, codes.FixExt2, codes.FixExt4, codes.FixExt8, codes.FixExt16,
+                codes.Ext8, codes.Ext16, codes.Ext32:
+                return d.extInterface(c)
+        }
+
+        return 0, fmt.Errorf("msgpack: unknown code %x decoding interface{}", c)
+}
+
+// DecodeInterfaceLoose is like DecodeInterface except that:
+//   - int8, int16, and int32 are converted to int64,
+//   - uint8, uint16, and uint32 are converted to uint64,
+//   - float32 is converted to float64.
+func (d *Decoder) DecodeInterfaceLoose() (interface{}, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return nil, err
+        }
+
+        if codes.IsFixedNum(c) {
+                return int64(c), nil
+        }
+        if codes.IsFixedMap(c) {
+                err = d.s.UnreadByte()
+                if err != nil {
+                        return nil, err
+                }
+                return d.DecodeMap()
+        }
+        if codes.IsFixedArray(c) {
+                return d.decodeSlice(c)
+        }
+        if codes.IsFixedString(c) {
+                return d.string(c)
+        }
+
+        switch c {
+        case codes.Nil:
+                return nil, nil
+        case codes.False, codes.True:
+                return d.bool(c)
+        case codes.Float, codes.Double:
+                return d.float64(c)
+        case codes.Uint8, codes.Uint16, codes.Uint32, codes.Uint64:
+                return d.uint(c)
+        case codes.Int8, codes.Int16, codes.Int32, codes.Int64:
+                return d.int(c)
+        case codes.Bin8, codes.Bin16, codes.Bin32:
+                return d.bytes(c, nil)
+        case codes.Str8, codes.Str16, codes.Str32:
+                return d.string(c)
+        case codes.Array16, codes.Array32:
+                return d.decodeSlice(c)
+        case codes.Map16, codes.Map32:
+                err = d.s.UnreadByte()
+                if err != nil {
+                        return nil, err
+                }
+                return d.DecodeMap()
+        case codes.FixExt1, codes.FixExt2, codes.FixExt4, codes.FixExt8, codes.FixExt16,
+                codes.Ext8, codes.Ext16, codes.Ext32:
+                return d.extInterface(c)
+        }
+
+        return 0, fmt.Errorf("msgpack: unknown code %x decoding interface{}", c)
+}
+
+// Skip skips next value.
+func (d *Decoder) Skip() error {
+        c, err := d.readCode()
+        if err != nil {
+                return err
+        }
+
+        if codes.IsFixedNum(c) {
+                return nil
+        } else if codes.IsFixedMap(c) {
+                return d.skipMap(c)
+        } else if codes.IsFixedArray(c) {
+                return d.skipSlice(c)
+        } else if codes.IsFixedString(c) {
+                return d.skipBytes(c)
+        }
+
+        switch c {
+        case codes.Nil, codes.False, codes.True:
+                return nil
+        case codes.Uint8, codes.Int8:
+                return d.skipN(1)
+        case codes.Uint16, codes.Int16:
+                return d.skipN(2)
+        case codes.Uint32, codes.Int32, codes.Float:
+                return d.skipN(4)
+        case codes.Uint64, codes.Int64, codes.Double:
+                return d.skipN(8)
+        case codes.Bin8, codes.Bin16, codes.Bin32:
+                return d.skipBytes(c)
+        case codes.Str8, codes.Str16, codes.Str32:
+                return d.skipBytes(c)
+        case codes.Array16, codes.Array32:
+                return d.skipSlice(c)
+        case codes.Map16, codes.Map32:
+                return d.skipMap(c)
+        case codes.FixExt1, codes.FixExt2, codes.FixExt4, codes.FixExt8, codes.FixExt16,
+                codes.Ext8, codes.Ext16, codes.Ext32:
+                return d.skipExt(c)
+        }
+
+        return fmt.Errorf("msgpack: unknown code %x", c)
+}
+
+// PeekCode returns the next MessagePack code without advancing the reader.
+// Subpackage msgpack/codes contains list of available codes.
+func (d *Decoder) PeekCode() (codes.Code, error) {
+        c, err := d.s.ReadByte()
+        if err != nil {
+                return 0, err
+        }
+        return codes.Code(c), d.s.UnreadByte()
+}
+
+func (d *Decoder) hasNilCode() bool {
+        code, err := d.PeekCode()
+        return err == nil && code == codes.Nil
+}
+
+func (d *Decoder) readCode() (codes.Code, error) {
+        d.extLen = 0
+        c, err := d.s.ReadByte()
+        if err != nil {
+                return 0, err
+        }
+        if d.rec != nil {
+                d.rec = append(d.rec, c)
+        }
+        return codes.Code(c), nil
+}
+
+func (d *Decoder) readFull(b []byte) error {
+        _, err := io.ReadFull(d.r, b)
+        if err != nil {
+                return err
+        }
+        if d.rec != nil {
+                d.rec = append(d.rec, b...)
+        }
+        return nil
+}
+
+func (d *Decoder) readN(n int) ([]byte, error) {
+        buf, err := readN(d.r, d.buf, n)
+        if err != nil {
+                return nil, err
+        }
+        d.buf = buf
+        if d.rec != nil {
+                d.rec = append(d.rec, buf...)
+        }
+        return buf, nil
+}
+
+func readN(r io.Reader, b []byte, n int) ([]byte, error) {
+        if b == nil {
+                if n == 0 {
+                        return make([]byte, 0), nil
+                }
+                if n <= bytesAllocLimit {
+                        b = make([]byte, n)
+                } else {
+                        b = make([]byte, bytesAllocLimit)
+                }
+        }
+
+        if n <= cap(b) {
+                b = b[:n]
+                _, err := io.ReadFull(r, b)
+                return b, err
+        }
+        b = b[:cap(b)]
+
+        var pos int
+        for {
+                alloc := n - len(b)
+                if alloc > bytesAllocLimit {
+                        alloc = bytesAllocLimit
+                }
+                b = append(b, make([]byte, alloc)...)
+
+                _, err := io.ReadFull(r, b[pos:])
+                if err != nil {
+                        return nil, err
+                }
+
+                if len(b) == n {
+                        break
+                }
+                pos = len(b)
+        }
+
+        return b, nil
+}
+
+func min(a, b int) int {
+        if a <= b {
+                return a
+        }
+        return b
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/decode_map.go b/vendor/github.com/vmihailenco/msgpack/decode_map.go
new file mode 100644
index 0000000..b542a75
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/decode_map.go
@@ -0,0 +1,338 @@
+package msgpack
+
+import (
+        "errors"
+        "fmt"
+        "reflect"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+const mapElemsAllocLimit = 1e4
+
+var mapStringStringPtrType = reflect.TypeOf((*map[string]string)(nil))
+var mapStringStringType = mapStringStringPtrType.Elem()
+
+var mapStringInterfacePtrType = reflect.TypeOf((*map[string]interface{})(nil))
+var mapStringInterfaceType = mapStringInterfacePtrType.Elem()
+
+var errInvalidCode = errors.New("invalid code")
+
+func decodeMapValue(d *Decoder, v reflect.Value) error {
+        size, err := d.DecodeMapLen()
+        if err != nil {
+                return err
+        }
+
+        typ := v.Type()
+        if size == -1 {
+                v.Set(reflect.Zero(typ))
+                return nil
+        }
+
+        if v.IsNil() {
+                v.Set(reflect.MakeMap(typ))
+        }
+        if size == 0 {
+                return nil
+        }
+
+        return decodeMapValueSize(d, v, size)
+}
+
+func decodeMapValueSize(d *Decoder, v reflect.Value, size int) error {
+        typ := v.Type()
+        keyType := typ.Key()
+        valueType := typ.Elem()
+
+        for i := 0; i < size; i++ {
+                mk := reflect.New(keyType).Elem()
+                if err := d.DecodeValue(mk); err != nil {
+                        return err
+                }
+
+                mv := reflect.New(valueType).Elem()
+                if err := d.DecodeValue(mv); err != nil {
+                        return err
+                }
+
+                v.SetMapIndex(mk, mv)
+        }
+
+        return nil
+}
+
+// DecodeMapLen decodes map length. Length is -1 when map is nil.
+func (d *Decoder) DecodeMapLen() (int, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return 0, err
+        }
+
+        if codes.IsExt(c) {
+                if err = d.skipExtHeader(c); err != nil {
+                        return 0, err
+                }
+
+                c, err = d.readCode()
+                if err != nil {
+                        return 0, err
+                }
+        }
+        return d.mapLen(c)
+}
+
+func (d *Decoder) mapLen(c codes.Code) (int, error) {
+        size, err := d._mapLen(c)
+        err = expandInvalidCodeMapLenError(c, err)
+        return size, err
+}
+
+func (d *Decoder) _mapLen(c codes.Code) (int, error) {
+        if c == codes.Nil {
+                return -1, nil
+        }
+        if c >= codes.FixedMapLow && c <= codes.FixedMapHigh {
+                return int(c & codes.FixedMapMask), nil
+        }
+        if c == codes.Map16 {
+                size, err := d.uint16()
+                return int(size), err
+        }
+        if c == codes.Map32 {
+                size, err := d.uint32()
+                return int(size), err
+        }
+        return 0, errInvalidCode
+}
+
+func expandInvalidCodeMapLenError(c codes.Code, err error) error {
+        if err == errInvalidCode {
+                return fmt.Errorf("msgpack: invalid code=%x decoding map length", c)
+        }
+        return err
+}
+
+func decodeMapStringStringValue(d *Decoder, v reflect.Value) error {
+        mptr := v.Addr().Convert(mapStringStringPtrType).Interface().(*map[string]string)
+        return d.decodeMapStringStringPtr(mptr)
+}
+
+func (d *Decoder) decodeMapStringStringPtr(ptr *map[string]string) error {
+        size, err := d.DecodeMapLen()
+        if err != nil {
+                return err
+        }
+        if size == -1 {
+                *ptr = nil
+                return nil
+        }
+
+        m := *ptr
+        if m == nil {
+                *ptr = make(map[string]string, min(size, mapElemsAllocLimit))
+                m = *ptr
+        }
+
+        for i := 0; i < size; i++ {
+                mk, err := d.DecodeString()
+                if err != nil {
+                        return err
+                }
+                mv, err := d.DecodeString()
+                if err != nil {
+                        return err
+                }
+                m[mk] = mv
+        }
+
+        return nil
+}
+
+func decodeMapStringInterfaceValue(d *Decoder, v reflect.Value) error {
+        ptr := v.Addr().Convert(mapStringInterfacePtrType).Interface().(*map[string]interface{})
+        return d.decodeMapStringInterfacePtr(ptr)
+}
+
+func (d *Decoder) decodeMapStringInterfacePtr(ptr *map[string]interface{}) error {
+        n, err := d.DecodeMapLen()
+        if err != nil {
+                return err
+        }
+        if n == -1 {
+                *ptr = nil
+                return nil
+        }
+
+        m := *ptr
+        if m == nil {
+                *ptr = make(map[string]interface{}, min(n, mapElemsAllocLimit))
+                m = *ptr
+        }
+
+        for i := 0; i < n; i++ {
+                mk, err := d.DecodeString()
+                if err != nil {
+                        return err
+                }
+                mv, err := d.decodeInterfaceCond()
+                if err != nil {
+                        return err
+                }
+                m[mk] = mv
+        }
+
+        return nil
+}
+
+func (d *Decoder) DecodeMap() (interface{}, error) {
+        if d.decodeMapFunc != nil {
+                return d.decodeMapFunc(d)
+        }
+
+        size, err := d.DecodeMapLen()
+        if err != nil {
+                return nil, err
+        }
+        if size == -1 {
+                return nil, nil
+        }
+        if size == 0 {
+                return make(map[string]interface{}), nil
+        }
+
+        code, err := d.PeekCode()
+        if err != nil {
+                return nil, err
+        }
+
+        if codes.IsString(code) {
+                return d.decodeMapStringInterfaceSize(size)
+        }
+
+        key, err := d.decodeInterfaceCond()
+        if err != nil {
+                return nil, err
+        }
+
+        value, err := d.decodeInterfaceCond()
+        if err != nil {
+                return nil, err
+        }
+
+        keyType := reflect.TypeOf(key)
+        valueType := reflect.TypeOf(value)
+        mapType := reflect.MapOf(keyType, valueType)
+        mapValue := reflect.MakeMap(mapType)
+
+        mapValue.SetMapIndex(reflect.ValueOf(key), reflect.ValueOf(value))
+        size--
+
+        err = decodeMapValueSize(d, mapValue, size)
+        if err != nil {
+                return nil, err
+        }
+
+        return mapValue.Interface(), nil
+}
+
+func (d *Decoder) decodeMapStringInterfaceSize(size int) (map[string]interface{}, error) {
+        m := make(map[string]interface{}, min(size, mapElemsAllocLimit))
+        for i := 0; i < size; i++ {
+                mk, err := d.DecodeString()
+                if err != nil {
+                        return nil, err
+                }
+                mv, err := d.decodeInterfaceCond()
+                if err != nil {
+                        return nil, err
+                }
+                m[mk] = mv
+        }
+        return m, nil
+}
+
+func (d *Decoder) skipMap(c codes.Code) error {
+        n, err := d.mapLen(c)
+        if err != nil {
+                return err
+        }
+        for i := 0; i < n; i++ {
+                if err := d.Skip(); err != nil {
+                        return err
+                }
+                if err := d.Skip(); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+func decodeStructValue(d *Decoder, v reflect.Value) error {
+        c, err := d.readCode()
+        if err != nil {
+                return err
+        }
+
+        var isArray bool
+
+        n, err := d._mapLen(c)
+        if err != nil {
+                var err2 error
+                n, err2 = d.arrayLen(c)
+                if err2 != nil {
+                        return expandInvalidCodeMapLenError(c, err)
+                }
+                isArray = true
+        }
+        if n == -1 {
+                if err = mustSet(v); err != nil {
+                        return err
+                }
+                v.Set(reflect.Zero(v.Type()))
+                return nil
+        }
+
+        var fields *fields
+        if d.useJSONTag {
+                fields = jsonStructs.Fields(v.Type())
+        } else {
+                fields = structs.Fields(v.Type())
+        }
+
+        if isArray {
+                for i, f := range fields.List {
+                        if i >= n {
+                                break
+                        }
+                        if err := f.DecodeValue(d, v); err != nil {
+                                return err
+                        }
+                }
+                // Skip extra values.
+                for i := len(fields.List); i < n; i++ {
+                        if err := d.Skip(); err != nil {
+                                return err
+                        }
+                }
+                return nil
+        }
+
+        for i := 0; i < n; i++ {
+                name, err := d.DecodeString()
+                if err != nil {
+                        return err
+                }
+                if f := fields.Table[name]; f != nil {
+                        if err := f.DecodeValue(d, v); err != nil {
+                                return err
+                        }
+                } else {
+                        if err := d.Skip(); err != nil {
+                                return err
+                        }
+                }
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/decode_number.go b/vendor/github.com/vmihailenco/msgpack/decode_number.go
new file mode 100644
index 0000000..15019cc
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/decode_number.go
@@ -0,0 +1,307 @@
+package msgpack
+
+import (
+        "fmt"
+        "math"
+        "reflect"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+func (d *Decoder) skipN(n int) error {
+        _, err := d.readN(n)
+        return err
+}
+
+func (d *Decoder) uint8() (uint8, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return 0, err
+        }
+        return uint8(c), nil
+}
+
+func (d *Decoder) int8() (int8, error) {
+        n, err := d.uint8()
+        return int8(n), err
+}
+
+func (d *Decoder) uint16() (uint16, error) {
+        b, err := d.readN(2)
+        if err != nil {
+                return 0, err
+        }
+        return (uint16(b[0]) << 8) | uint16(b[1]), nil
+}
+
+func (d *Decoder) int16() (int16, error) {
+        n, err := d.uint16()
+        return int16(n), err
+}
+
+func (d *Decoder) uint32() (uint32, error) {
+        b, err := d.readN(4)
+        if err != nil {
+                return 0, err
+        }
+        n := (uint32(b[0]) << 24) |
+                (uint32(b[1]) << 16) |
+                (uint32(b[2]) << 8) |
+                uint32(b[3])
+        return n, nil
+}
+
+func (d *Decoder) int32() (int32, error) {
+        n, err := d.uint32()
+        return int32(n), err
+}
+
+func (d *Decoder) uint64() (uint64, error) {
+        b, err := d.readN(8)
+        if err != nil {
+                return 0, err
+        }
+        n := (uint64(b[0]) << 56) |
+                (uint64(b[1]) << 48) |
+                (uint64(b[2]) << 40) |
+                (uint64(b[3]) << 32) |
+                (uint64(b[4]) << 24) |
+                (uint64(b[5]) << 16) |
+                (uint64(b[6]) << 8) |
+                uint64(b[7])
+        return n, nil
+}
+
+func (d *Decoder) int64() (int64, error) {
+        n, err := d.uint64()
+        return int64(n), err
+}
+
+// DecodeUint64 decodes msgpack int8/16/32/64 and uint8/16/32/64
+// into Go uint64.
+func (d *Decoder) DecodeUint64() (uint64, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return 0, err
+        }
+        return d.uint(c)
+}
+
+func (d *Decoder) uint(c codes.Code) (uint64, error) {
+        if c == codes.Nil {
+                return 0, nil
+        }
+        if codes.IsFixedNum(c) {
+                return uint64(int8(c)), nil
+        }
+        switch c {
+        case codes.Uint8:
+                n, err := d.uint8()
+                return uint64(n), err
+        case codes.Int8:
+                n, err := d.int8()
+                return uint64(n), err
+        case codes.Uint16:
+                n, err := d.uint16()
+                return uint64(n), err
+        case codes.Int16:
+                n, err := d.int16()
+                return uint64(n), err
+        case codes.Uint32:
+                n, err := d.uint32()
+                return uint64(n), err
+        case codes.Int32:
+                n, err := d.int32()
+                return uint64(n), err
+        case codes.Uint64, codes.Int64:
+                return d.uint64()
+        }
+        return 0, fmt.Errorf("msgpack: invalid code=%x decoding uint64", c)
+}
+
+// DecodeInt64 decodes msgpack int8/16/32/64 and uint8/16/32/64
+// into Go int64.
+func (d *Decoder) DecodeInt64() (int64, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return 0, err
+        }
+        return d.int(c)
+}
+
+func (d *Decoder) int(c codes.Code) (int64, error) {
+        if c == codes.Nil {
+                return 0, nil
+        }
+        if codes.IsFixedNum(c) {
+                return int64(int8(c)), nil
+        }
+        switch c {
+        case codes.Uint8:
+                n, err := d.uint8()
+                return int64(n), err
+        case codes.Int8:
+                n, err := d.uint8()
+                return int64(int8(n)), err
+        case codes.Uint16:
+                n, err := d.uint16()
+                return int64(n), err
+        case codes.Int16:
+                n, err := d.uint16()
+                return int64(int16(n)), err
+        case codes.Uint32:
+                n, err := d.uint32()
+                return int64(n), err
+        case codes.Int32:
+                n, err := d.uint32()
+                return int64(int32(n)), err
+        case codes.Uint64, codes.Int64:
+                n, err := d.uint64()
+                return int64(n), err
+        }
+        return 0, fmt.Errorf("msgpack: invalid code=%x decoding int64", c)
+}
+
+func (d *Decoder) DecodeFloat32() (float32, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return 0, err
+        }
+        return d.float32(c)
+}
+
+func (d *Decoder) float32(c codes.Code) (float32, error) {
+        if c == codes.Float {
+                n, err := d.uint32()
+                if err != nil {
+                        return 0, err
+                }
+                return math.Float32frombits(n), nil
+        }
+
+        n, err := d.int(c)
+        if err != nil {
+                return 0, fmt.Errorf("msgpack: invalid code=%x decoding float32", c)
+        }
+        return float32(n), nil
+}
+
+// DecodeFloat64 decodes msgpack float32/64 into Go float64.
+func (d *Decoder) DecodeFloat64() (float64, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return 0, err
+        }
+        return d.float64(c)
+}
+
+func (d *Decoder) float64(c codes.Code) (float64, error) {
+        switch c {
+        case codes.Float:
+                n, err := d.float32(c)
+                if err != nil {
+                        return 0, err
+                }
+                return float64(n), nil
+        case codes.Double:
+                n, err := d.uint64()
+                if err != nil {
+                        return 0, err
+                }
+                return math.Float64frombits(n), nil
+        }
+
+        n, err := d.int(c)
+        if err != nil {
+                return 0, fmt.Errorf("msgpack: invalid code=%x decoding float32", c)
+        }
+        return float64(n), nil
+}
+
+func (d *Decoder) DecodeUint() (uint, error) {
+        n, err := d.DecodeUint64()
+        return uint(n), err
+}
+
+func (d *Decoder) DecodeUint8() (uint8, error) {
+        n, err := d.DecodeUint64()
+        return uint8(n), err
+}
+
+func (d *Decoder) DecodeUint16() (uint16, error) {
+        n, err := d.DecodeUint64()
+        return uint16(n), err
+}
+
+func (d *Decoder) DecodeUint32() (uint32, error) {
+        n, err := d.DecodeUint64()
+        return uint32(n), err
+}
+
+func (d *Decoder) DecodeInt() (int, error) {
+        n, err := d.DecodeInt64()
+        return int(n), err
+}
+
+func (d *Decoder) DecodeInt8() (int8, error) {
+        n, err := d.DecodeInt64()
+        return int8(n), err
+}
+
+func (d *Decoder) DecodeInt16() (int16, error) {
+        n, err := d.DecodeInt64()
+        return int16(n), err
+}
+
+func (d *Decoder) DecodeInt32() (int32, error) {
+        n, err := d.DecodeInt64()
+        return int32(n), err
+}
+
+func decodeFloat32Value(d *Decoder, v reflect.Value) error {
+        f, err := d.DecodeFloat32()
+        if err != nil {
+                return err
+        }
+        if err = mustSet(v); err != nil {
+                return err
+        }
+        v.SetFloat(float64(f))
+        return nil
+}
+
+func decodeFloat64Value(d *Decoder, v reflect.Value) error {
+        f, err := d.DecodeFloat64()
+        if err != nil {
+                return err
+        }
+        if err = mustSet(v); err != nil {
+                return err
+        }
+        v.SetFloat(f)
+        return nil
+}
+
+func decodeInt64Value(d *Decoder, v reflect.Value) error {
+        n, err := d.DecodeInt64()
+        if err != nil {
+                return err
+        }
+        if err = mustSet(v); err != nil {
+                return err
+        }
+        v.SetInt(n)
+        return nil
+}
+
+func decodeUint64Value(d *Decoder, v reflect.Value) error {
+        n, err := d.DecodeUint64()
+        if err != nil {
+                return err
+        }
+        if err = mustSet(v); err != nil {
+                return err
+        }
+        v.SetUint(n)
+        return nil
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/decode_query.go b/vendor/github.com/vmihailenco/msgpack/decode_query.go
new file mode 100644
index 0000000..d680be8
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/decode_query.go
@@ -0,0 +1,158 @@
+package msgpack
+
+import (
+        "fmt"
+        "strconv"
+        "strings"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+type queryResult struct {
+        query       string
+        key         string
+        hasAsterisk bool
+
+        values []interface{}
+}
+
+func (q *queryResult) nextKey() {
+        ind := strings.IndexByte(q.query, '.')
+        if ind == -1 {
+                q.key = q.query
+                q.query = ""
+                return
+        }
+        q.key = q.query[:ind]
+        q.query = q.query[ind+1:]
+}
+
+// Query extracts data specified by the query from the msgpack stream skipping
+// any other data. Query consists of map keys and array indexes separated with dot,
+// e.g. key1.0.key2.
+func (d *Decoder) Query(query string) ([]interface{}, error) {
+        res := queryResult{
+                query: query,
+        }
+        if err := d.query(&res); err != nil {
+                return nil, err
+        }
+        return res.values, nil
+}
+
+func (d *Decoder) query(q *queryResult) error {
+        q.nextKey()
+        if q.key == "" {
+                v, err := d.decodeInterfaceCond()
+                if err != nil {
+                        return err
+                }
+                q.values = append(q.values, v)
+                return nil
+        }
+
+        code, err := d.PeekCode()
+        if err != nil {
+                return err
+        }
+
+        switch {
+        case code == codes.Map16 || code == codes.Map32 || codes.IsFixedMap(code):
+                err = d.queryMapKey(q)
+        case code == codes.Array16 || code == codes.Array32 || codes.IsFixedArray(code):
+                err = d.queryArrayIndex(q)
+        default:
+                err = fmt.Errorf("msgpack: unsupported code=%x decoding key=%q", code, q.key)
+        }
+        return err
+}
+
+func (d *Decoder) queryMapKey(q *queryResult) error {
+        n, err := d.DecodeMapLen()
+        if err != nil {
+                return err
+        }
+        if n == -1 {
+                return nil
+        }
+
+        for i := 0; i < n; i++ {
+                k, err := d.bytesNoCopy()
+                if err != nil {
+                        return err
+                }
+
+                if string(k) == q.key {
+                        if err := d.query(q); err != nil {
+                                return err
+                        }
+                        if q.hasAsterisk {
+                                return d.skipNext((n - i - 1) * 2)
+                        }
+                        return nil
+                }
+
+                if err := d.Skip(); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func (d *Decoder) queryArrayIndex(q *queryResult) error {
+        n, err := d.DecodeArrayLen()
+        if err != nil {
+                return err
+        }
+        if n == -1 {
+                return nil
+        }
+
+        if q.key == "*" {
+                q.hasAsterisk = true
+
+                query := q.query
+                for i := 0; i < n; i++ {
+                        q.query = query
+                        if err := d.query(q); err != nil {
+                                return err
+                        }
+                }
+
+                q.hasAsterisk = false
+                return nil
+        }
+
+        ind, err := strconv.Atoi(q.key)
+        if err != nil {
+                return err
+        }
+
+        for i := 0; i < n; i++ {
+                if i == ind {
+                        if err := d.query(q); err != nil {
+                                return err
+                        }
+                        if q.hasAsterisk {
+                                return d.skipNext(n - i - 1)
+                        }
+                        return nil
+                }
+
+                if err := d.Skip(); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func (d *Decoder) skipNext(n int) error {
+        for i := 0; i < n; i++ {
+                if err := d.Skip(); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/decode_slice.go b/vendor/github.com/vmihailenco/msgpack/decode_slice.go
new file mode 100644
index 0000000..778d80b
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/decode_slice.go
@@ -0,0 +1,193 @@
+package msgpack
+
+import (
+        "fmt"
+        "reflect"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+const sliceElemsAllocLimit = 1e4
+
+var sliceStringPtrType = reflect.TypeOf((*[]string)(nil))
+
+// DecodeArrayLen decodes array length. Length is -1 when array is nil.
+func (d *Decoder) DecodeArrayLen() (int, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return 0, err
+        }
+        return d.arrayLen(c)
+}
+
+func (d *Decoder) arrayLen(c codes.Code) (int, error) {
+        if c == codes.Nil {
+                return -1, nil
+        } else if c >= codes.FixedArrayLow && c <= codes.FixedArrayHigh {
+                return int(c & codes.FixedArrayMask), nil
+        }
+        switch c {
+        case codes.Array16:
+                n, err := d.uint16()
+                return int(n), err
+        case codes.Array32:
+                n, err := d.uint32()
+                return int(n), err
+        }
+        return 0, fmt.Errorf("msgpack: invalid code=%x decoding array length", c)
+}
+
+func decodeStringSliceValue(d *Decoder, v reflect.Value) error {
+        ptr := v.Addr().Convert(sliceStringPtrType).Interface().(*[]string)
+        return d.decodeStringSlicePtr(ptr)
+}
+
+func (d *Decoder) decodeStringSlicePtr(ptr *[]string) error {
+        n, err := d.DecodeArrayLen()
+        if err != nil {
+                return err
+        }
+        if n == -1 {
+                return nil
+        }
+
+        ss := setStringsCap(*ptr, n)
+        for i := 0; i < n; i++ {
+                s, err := d.DecodeString()
+                if err != nil {
+                        return err
+                }
+                ss = append(ss, s)
+        }
+        *ptr = ss
+
+        return nil
+}
+
+func setStringsCap(s []string, n int) []string {
+        if n > sliceElemsAllocLimit {
+                n = sliceElemsAllocLimit
+        }
+
+        if s == nil {
+                return make([]string, 0, n)
+        }
+
+        if cap(s) >= n {
+                return s[:0]
+        }
+
+        s = s[:cap(s)]
+        s = append(s, make([]string, n-len(s))...)
+        return s[:0]
+}
+
+func decodeSliceValue(d *Decoder, v reflect.Value) error {
+        n, err := d.DecodeArrayLen()
+        if err != nil {
+                return err
+        }
+
+        if n == -1 {
+                v.Set(reflect.Zero(v.Type()))
+                return nil
+        }
+        if n == 0 && v.IsNil() {
+                v.Set(reflect.MakeSlice(v.Type(), 0, 0))
+                return nil
+        }
+
+        if v.Cap() >= n {
+                v.Set(v.Slice(0, n))
+        } else if v.Len() < v.Cap() {
+                v.Set(v.Slice(0, v.Cap()))
+        }
+
+        for i := 0; i < n; i++ {
+                if i >= v.Len() {
+                        v.Set(growSliceValue(v, n))
+                }
+                sv := v.Index(i)
+                if err := d.DecodeValue(sv); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func growSliceValue(v reflect.Value, n int) reflect.Value {
+        diff := n - v.Len()
+        if diff > sliceElemsAllocLimit {
+                diff = sliceElemsAllocLimit
+        }
+        v = reflect.AppendSlice(v, reflect.MakeSlice(v.Type(), diff, diff))
+        return v
+}
+
+func decodeArrayValue(d *Decoder, v reflect.Value) error {
+        n, err := d.DecodeArrayLen()
+        if err != nil {
+                return err
+        }
+
+        if n == -1 {
+                return nil
+        }
+
+        if n > v.Len() {
+                return fmt.Errorf("%s len is %d, but msgpack has %d elements", v.Type(), v.Len(), n)
+        }
+        for i := 0; i < n; i++ {
+                sv := v.Index(i)
+                if err := d.DecodeValue(sv); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func (d *Decoder) DecodeSlice() ([]interface{}, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return nil, err
+        }
+        return d.decodeSlice(c)
+}
+
+func (d *Decoder) decodeSlice(c codes.Code) ([]interface{}, error) {
+        n, err := d.arrayLen(c)
+        if err != nil {
+                return nil, err
+        }
+        if n == -1 {
+                return nil, nil
+        }
+
+        s := make([]interface{}, 0, min(n, sliceElemsAllocLimit))
+        for i := 0; i < n; i++ {
+                v, err := d.decodeInterfaceCond()
+                if err != nil {
+                        return nil, err
+                }
+                s = append(s, v)
+        }
+
+        return s, nil
+}
+
+func (d *Decoder) skipSlice(c codes.Code) error {
+        n, err := d.arrayLen(c)
+        if err != nil {
+                return err
+        }
+
+        for i := 0; i < n; i++ {
+                if err := d.Skip(); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/decode_string.go b/vendor/github.com/vmihailenco/msgpack/decode_string.go
new file mode 100644
index 0000000..5402022
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/decode_string.go
@@ -0,0 +1,175 @@
+package msgpack
+
+import (
+        "fmt"
+        "reflect"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+func (d *Decoder) bytesLen(c codes.Code) (int, error) {
+        if c == codes.Nil {
+                return -1, nil
+        } else if codes.IsFixedString(c) {
+                return int(c & codes.FixedStrMask), nil
+        }
+        switch c {
+        case codes.Str8, codes.Bin8:
+                n, err := d.uint8()
+                return int(n), err
+        case codes.Str16, codes.Bin16:
+                n, err := d.uint16()
+                return int(n), err
+        case codes.Str32, codes.Bin32:
+                n, err := d.uint32()
+                return int(n), err
+        }
+        return 0, fmt.Errorf("msgpack: invalid code=%x decoding bytes length", c)
+}
+
+func (d *Decoder) DecodeString() (string, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return "", err
+        }
+        return d.string(c)
+}
+
+func (d *Decoder) string(c codes.Code) (string, error) {
+        n, err := d.bytesLen(c)
+        if err != nil {
+                return "", err
+        }
+        if n == -1 {
+                return "", nil
+        }
+        b, err := d.readN(n)
+        return string(b), err
+}
+
+func decodeStringValue(d *Decoder, v reflect.Value) error {
+        s, err := d.DecodeString()
+        if err != nil {
+                return err
+        }
+        if err = mustSet(v); err != nil {
+                return err
+        }
+        v.SetString(s)
+        return nil
+}
+
+func (d *Decoder) DecodeBytesLen() (int, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return 0, err
+        }
+        return d.bytesLen(c)
+}
+
+func (d *Decoder) DecodeBytes() ([]byte, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return nil, err
+        }
+        return d.bytes(c, nil)
+}
+
+func (d *Decoder) bytes(c codes.Code, b []byte) ([]byte, error) {
+        n, err := d.bytesLen(c)
+        if err != nil {
+                return nil, err
+        }
+        if n == -1 {
+                return nil, nil
+        }
+        return readN(d.r, b, n)
+}
+
+func (d *Decoder) bytesNoCopy() ([]byte, error) {
+        c, err := d.readCode()
+        if err != nil {
+                return nil, err
+        }
+        n, err := d.bytesLen(c)
+        if err != nil {
+                return nil, err
+        }
+        if n == -1 {
+                return nil, nil
+        }
+        return d.readN(n)
+}
+
+func (d *Decoder) decodeBytesPtr(ptr *[]byte) error {
+        c, err := d.readCode()
+        if err != nil {
+                return err
+        }
+        return d.bytesPtr(c, ptr)
+}
+
+func (d *Decoder) bytesPtr(c codes.Code, ptr *[]byte) error {
+        n, err := d.bytesLen(c)
+        if err != nil {
+                return err
+        }
+        if n == -1 {
+                *ptr = nil
+                return nil
+        }
+
+        *ptr, err = readN(d.r, *ptr, n)
+        return err
+}
+
+func (d *Decoder) skipBytes(c codes.Code) error {
+        n, err := d.bytesLen(c)
+        if err != nil {
+                return err
+        }
+        if n == -1 {
+                return nil
+        }
+        return d.skipN(n)
+}
+
+func decodeBytesValue(d *Decoder, v reflect.Value) error {
+        c, err := d.readCode()
+        if err != nil {
+                return err
+        }
+
+        b, err := d.bytes(c, v.Bytes())
+        if err != nil {
+                return err
+        }
+
+        if err = mustSet(v); err != nil {
+                return err
+        }
+        v.SetBytes(b)
+
+        return nil
+}
+
+func decodeByteArrayValue(d *Decoder, v reflect.Value) error {
+        c, err := d.readCode()
+        if err != nil {
+                return err
+        }
+
+        n, err := d.bytesLen(c)
+        if err != nil {
+                return err
+        }
+        if n == -1 {
+                return nil
+        }
+        if n > v.Len() {
+                return fmt.Errorf("%s len is %d, but msgpack has %d elements", v.Type(), v.Len(), n)
+        }
+
+        b := v.Slice(0, n).Bytes()
+        return d.readFull(b)
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/decode_value.go b/vendor/github.com/vmihailenco/msgpack/decode_value.go
new file mode 100644
index 0000000..7b858b5
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/decode_value.go
@@ -0,0 +1,234 @@
+package msgpack
+
+import (
+        "errors"
+        "fmt"
+        "reflect"
+)
+
+var interfaceType = reflect.TypeOf((*interface{})(nil)).Elem()
+var stringType = reflect.TypeOf((*string)(nil)).Elem()
+
+var valueDecoders []decoderFunc
+
+func init() {
+        valueDecoders = []decoderFunc{
+                reflect.Bool:          decodeBoolValue,
+                reflect.Int:           decodeInt64Value,
+                reflect.Int8:          decodeInt64Value,
+                reflect.Int16:         decodeInt64Value,
+                reflect.Int32:         decodeInt64Value,
+                reflect.Int64:         decodeInt64Value,
+                reflect.Uint:          decodeUint64Value,
+                reflect.Uint8:         decodeUint64Value,
+                reflect.Uint16:        decodeUint64Value,
+                reflect.Uint32:        decodeUint64Value,
+                reflect.Uint64:        decodeUint64Value,
+                reflect.Float32:       decodeFloat32Value,
+                reflect.Float64:       decodeFloat64Value,
+                reflect.Complex64:     decodeUnsupportedValue,
+                reflect.Complex128:    decodeUnsupportedValue,
+                reflect.Array:         decodeArrayValue,
+                reflect.Chan:          decodeUnsupportedValue,
+                reflect.Func:          decodeUnsupportedValue,
+                reflect.Interface:     decodeInterfaceValue,
+                reflect.Map:           decodeMapValue,
+                reflect.Ptr:           decodeUnsupportedValue,
+                reflect.Slice:         decodeSliceValue,
+                reflect.String:        decodeStringValue,
+                reflect.Struct:        decodeStructValue,
+                reflect.UnsafePointer: decodeUnsupportedValue,
+        }
+}
+
+func mustSet(v reflect.Value) error {
+        if !v.CanSet() {
+                return fmt.Errorf("msgpack: Decode(nonsettable %s)", v.Type())
+        }
+        return nil
+}
+
+func getDecoder(typ reflect.Type) decoderFunc {
+        kind := typ.Kind()
+
+        decoder, ok := typDecMap[typ]
+        if ok {
+                return decoder
+        }
+
+        if typ.Implements(customDecoderType) {
+                return decodeCustomValue
+        }
+        if typ.Implements(unmarshalerType) {
+                return unmarshalValue
+        }
+
+        // Addressable struct field value.
+        if kind != reflect.Ptr {
+                ptr := reflect.PtrTo(typ)
+                if ptr.Implements(customDecoderType) {
+                        return decodeCustomValueAddr
+                }
+                if ptr.Implements(unmarshalerType) {
+                        return unmarshalValueAddr
+                }
+        }
+
+        switch kind {
+        case reflect.Ptr:
+                return ptrDecoderFunc(typ)
+        case reflect.Slice:
+                elem := typ.Elem()
+                switch elem.Kind() {
+                case reflect.Uint8:
+                        return decodeBytesValue
+                }
+                switch elem {
+                case stringType:
+                        return decodeStringSliceValue
+                }
+        case reflect.Array:
+                if typ.Elem().Kind() == reflect.Uint8 {
+                        return decodeByteArrayValue
+                }
+        case reflect.Map:
+                if typ.Key() == stringType {
+                        switch typ.Elem() {
+                        case stringType:
+                                return decodeMapStringStringValue
+                        case interfaceType:
+                                return decodeMapStringInterfaceValue
+                        }
+                }
+        }
+        return valueDecoders[kind]
+}
+
+func ptrDecoderFunc(typ reflect.Type) decoderFunc {
+        decoder := getDecoder(typ.Elem())
+        return func(d *Decoder, v reflect.Value) error {
+                if d.hasNilCode() {
+                        if err := mustSet(v); err != nil {
+                                return err
+                        }
+                        if !v.IsNil() {
+                                v.Set(reflect.Zero(v.Type()))
+                        }
+                        return d.DecodeNil()
+                }
+                if v.IsNil() {
+                        if err := mustSet(v); err != nil {
+                                return err
+                        }
+                        v.Set(reflect.New(v.Type().Elem()))
+                }
+                return decoder(d, v.Elem())
+        }
+}
+
+func decodeCustomValueAddr(d *Decoder, v reflect.Value) error {
+        if !v.CanAddr() {
+                return fmt.Errorf("msgpack: Decode(nonaddressable %T)", v.Interface())
+        }
+        return decodeCustomValue(d, v.Addr())
+}
+
+func decodeCustomValue(d *Decoder, v reflect.Value) error {
+        if d.hasNilCode() {
+                return d.decodeNilValue(v)
+        }
+
+        if v.IsNil() {
+                v.Set(reflect.New(v.Type().Elem()))
+        }
+
+        decoder := v.Interface().(CustomDecoder)
+        return decoder.DecodeMsgpack(d)
+}
+
+func unmarshalValueAddr(d *Decoder, v reflect.Value) error {
+        if !v.CanAddr() {
+                return fmt.Errorf("msgpack: Decode(nonaddressable %T)", v.Interface())
+        }
+        return unmarshalValue(d, v.Addr())
+}
+
+func unmarshalValue(d *Decoder, v reflect.Value) error {
+        if d.hasNilCode() {
+                return d.decodeNilValue(v)
+        }
+
+        if v.IsNil() {
+                v.Set(reflect.New(v.Type().Elem()))
+        }
+
+        if d.extLen != 0 {
+                b, err := d.readN(d.extLen)
+                if err != nil {
+                        return err
+                }
+                d.rec = b
+        } else {
+                d.rec = makeBuffer()
+                if err := d.Skip(); err != nil {
+                        return err
+                }
+        }
+
+        unmarshaler := v.Interface().(Unmarshaler)
+        err := unmarshaler.UnmarshalMsgpack(d.rec)
+        d.rec = nil
+        return err
+}
+
+func decodeBoolValue(d *Decoder, v reflect.Value) error {
+        flag, err := d.DecodeBool()
+        if err != nil {
+                return err
+        }
+        if err = mustSet(v); err != nil {
+                return err
+        }
+        v.SetBool(flag)
+        return nil
+}
+
+func decodeInterfaceValue(d *Decoder, v reflect.Value) error {
+        if v.IsNil() {
+                return d.interfaceValue(v)
+        }
+
+        elem := v.Elem()
+        if !elem.CanAddr() {
+                if d.hasNilCode() {
+                        v.Set(reflect.Zero(v.Type()))
+                        return d.DecodeNil()
+                }
+        }
+
+        return d.DecodeValue(elem)
+}
+
+func (d *Decoder) interfaceValue(v reflect.Value) error {
+        vv, err := d.decodeInterfaceCond()
+        if err != nil {
+                return err
+        }
+
+        if vv != nil {
+                if v.Type() == errorType {
+                        if vv, ok := vv.(string); ok {
+                                v.Set(reflect.ValueOf(errors.New(vv)))
+                                return nil
+                        }
+                }
+
+                v.Set(reflect.ValueOf(vv))
+        }
+
+        return nil
+}
+
+func decodeUnsupportedValue(d *Decoder, v reflect.Value) error {
+        return fmt.Errorf("msgpack: Decode(unsupported %s)", v.Type())
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/encode.go b/vendor/github.com/vmihailenco/msgpack/encode.go
new file mode 100644
index 0000000..c2bb23c
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/encode.go
@@ -0,0 +1,170 @@
+package msgpack
+
+import (
+        "bytes"
+        "io"
+        "reflect"
+        "time"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+type writer interface {
+        io.Writer
+        WriteByte(byte) error
+        WriteString(string) (int, error)
+}
+
+type byteWriter struct {
+        io.Writer
+
+        buf       []byte
+        bootstrap [64]byte
+}
+
+func newByteWriter(w io.Writer) *byteWriter {
+        bw := &byteWriter{
+                Writer: w,
+        }
+        bw.buf = bw.bootstrap[:]
+        return bw
+}
+
+func (w *byteWriter) WriteByte(c byte) error {
+        w.buf = w.buf[:1]
+        w.buf[0] = c
+        _, err := w.Write(w.buf)
+        return err
+}
+
+func (w *byteWriter) WriteString(s string) (int, error) {
+        w.buf = append(w.buf[:0], s...)
+        return w.Write(w.buf)
+}
+
+// Marshal returns the MessagePack encoding of v.
+func Marshal(v interface{}) ([]byte, error) {
+        var buf bytes.Buffer
+        err := NewEncoder(&buf).Encode(v)
+        return buf.Bytes(), err
+}
+
+type Encoder struct {
+        w   writer
+        buf []byte
+
+        sortMapKeys   bool
+        structAsArray bool
+        useJSONTag    bool
+        useCompact    bool
+}
+
+// NewEncoder returns a new encoder that writes to w.
+func NewEncoder(w io.Writer) *Encoder {
+        bw, ok := w.(writer)
+        if !ok {
+                bw = newByteWriter(w)
+        }
+        return &Encoder{
+                w:   bw,
+                buf: make([]byte, 9),
+        }
+}
+
+// SortMapKeys causes the Encoder to encode map keys in increasing order.
+// Supported map types are:
+//   - map[string]string
+//   - map[string]interface{}
+func (e *Encoder) SortMapKeys(flag bool) *Encoder {
+        e.sortMapKeys = flag
+        return e
+}
+
+// StructAsArray causes the Encoder to encode Go structs as MessagePack arrays.
+func (e *Encoder) StructAsArray(flag bool) *Encoder {
+        e.structAsArray = flag
+        return e
+}
+
+// UseJSONTag causes the Encoder to use json struct tag as fallback option
+// if there is no msgpack tag.
+func (e *Encoder) UseJSONTag(flag bool) *Encoder {
+        e.useJSONTag = flag
+        return e
+}
+
+// UseCompactEncoding causes the Encoder to chose the most compact encoding.
+// For example, it allows to encode Go int64 as msgpack int8 saving 7 bytes.
+func (e *Encoder) UseCompactEncoding(flag bool) *Encoder {
+        e.useCompact = flag
+        return e
+}
+
+func (e *Encoder) Encode(v interface{}) error {
+        switch v := v.(type) {
+        case nil:
+                return e.EncodeNil()
+        case string:
+                return e.EncodeString(v)
+        case []byte:
+                return e.EncodeBytes(v)
+        case int:
+                return e.encodeInt64Cond(int64(v))
+        case int64:
+                return e.encodeInt64Cond(v)
+        case uint:
+                return e.encodeUint64Cond(uint64(v))
+        case uint64:
+                return e.encodeUint64Cond(v)
+        case bool:
+                return e.EncodeBool(v)
+        case float32:
+                return e.EncodeFloat32(v)
+        case float64:
+                return e.EncodeFloat64(v)
+        case time.Duration:
+                return e.encodeInt64Cond(int64(v))
+        case time.Time:
+                return e.EncodeTime(v)
+        }
+        return e.EncodeValue(reflect.ValueOf(v))
+}
+
+func (e *Encoder) EncodeMulti(v ...interface{}) error {
+        for _, vv := range v {
+                if err := e.Encode(vv); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+func (e *Encoder) EncodeValue(v reflect.Value) error {
+        fn := getEncoder(v.Type())
+        return fn(e, v)
+}
+
+func (e *Encoder) EncodeNil() error {
+        return e.writeCode(codes.Nil)
+}
+
+func (e *Encoder) EncodeBool(value bool) error {
+        if value {
+                return e.writeCode(codes.True)
+        }
+        return e.writeCode(codes.False)
+}
+
+func (e *Encoder) writeCode(c codes.Code) error {
+        return e.w.WriteByte(byte(c))
+}
+
+func (e *Encoder) write(b []byte) error {
+        _, err := e.w.Write(b)
+        return err
+}
+
+func (e *Encoder) writeString(s string) error {
+        _, err := e.w.WriteString(s)
+        return err
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/encode_map.go b/vendor/github.com/vmihailenco/msgpack/encode_map.go
new file mode 100644
index 0000000..a87c407
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/encode_map.go
@@ -0,0 +1,172 @@
+package msgpack
+
+import (
+        "reflect"
+        "sort"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+func encodeMapValue(e *Encoder, v reflect.Value) error {
+        if v.IsNil() {
+                return e.EncodeNil()
+        }
+
+        if err := e.EncodeMapLen(v.Len()); err != nil {
+                return err
+        }
+
+        for _, key := range v.MapKeys() {
+                if err := e.EncodeValue(key); err != nil {
+                        return err
+                }
+                if err := e.EncodeValue(v.MapIndex(key)); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func encodeMapStringStringValue(e *Encoder, v reflect.Value) error {
+        if v.IsNil() {
+                return e.EncodeNil()
+        }
+
+        if err := e.EncodeMapLen(v.Len()); err != nil {
+                return err
+        }
+
+        m := v.Convert(mapStringStringType).Interface().(map[string]string)
+        if e.sortMapKeys {
+                return e.encodeSortedMapStringString(m)
+        }
+
+        for mk, mv := range m {
+                if err := e.EncodeString(mk); err != nil {
+                        return err
+                }
+                if err := e.EncodeString(mv); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func encodeMapStringInterfaceValue(e *Encoder, v reflect.Value) error {
+        if v.IsNil() {
+                return e.EncodeNil()
+        }
+
+        if err := e.EncodeMapLen(v.Len()); err != nil {
+                return err
+        }
+
+        m := v.Convert(mapStringInterfaceType).Interface().(map[string]interface{})
+        if e.sortMapKeys {
+                return e.encodeSortedMapStringInterface(m)
+        }
+
+        for mk, mv := range m {
+                if err := e.EncodeString(mk); err != nil {
+                        return err
+                }
+                if err := e.Encode(mv); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func (e *Encoder) encodeSortedMapStringString(m map[string]string) error {
+        keys := make([]string, 0, len(m))
+        for k, _ := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        for _, k := range keys {
+                err := e.EncodeString(k)
+                if err != nil {
+                        return err
+                }
+                if err = e.EncodeString(m[k]); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func (e *Encoder) encodeSortedMapStringInterface(m map[string]interface{}) error {
+        keys := make([]string, 0, len(m))
+        for k, _ := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        for _, k := range keys {
+                err := e.EncodeString(k)
+                if err != nil {
+                        return err
+                }
+                if err = e.Encode(m[k]); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func (e *Encoder) EncodeMapLen(l int) error {
+        if l < 16 {
+                return e.writeCode(codes.FixedMapLow | codes.Code(l))
+        }
+        if l < 65536 {
+                return e.write2(codes.Map16, uint16(l))
+        }
+        return e.write4(codes.Map32, uint32(l))
+}
+
+func encodeStructValue(e *Encoder, strct reflect.Value) error {
+        var structFields *fields
+        if e.useJSONTag {
+                structFields = jsonStructs.Fields(strct.Type())
+        } else {
+                structFields = structs.Fields(strct.Type())
+        }
+
+        if e.structAsArray || structFields.AsArray {
+                return encodeStructValueAsArray(e, strct, structFields.List)
+        }
+        fields := structFields.OmitEmpty(strct)
+
+        if err := e.EncodeMapLen(len(fields)); err != nil {
+                return err
+        }
+
+        for _, f := range fields {
+                if err := e.EncodeString(f.name); err != nil {
+                        return err
+                }
+                if err := f.EncodeValue(e, strct); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+func encodeStructValueAsArray(e *Encoder, strct reflect.Value, fields []*field) error {
+        if err := e.EncodeArrayLen(len(fields)); err != nil {
+                return err
+        }
+        for _, f := range fields {
+                if err := f.EncodeValue(e, strct); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/encode_number.go b/vendor/github.com/vmihailenco/msgpack/encode_number.go
new file mode 100644
index 0000000..dd7db6f
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/encode_number.go
@@ -0,0 +1,230 @@
+package msgpack
+
+import (
+        "math"
+        "reflect"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+// EncodeUint8 encodes an uint8 in 2 bytes preserving type of the number.
+func (e *Encoder) EncodeUint8(n uint8) error {
+        return e.write1(codes.Uint8, n)
+}
+
+func (e *Encoder) encodeUint8Cond(n uint8) error {
+        if e.useCompact {
+                return e.EncodeUint(uint64(n))
+        }
+        return e.EncodeUint8(n)
+}
+
+// EncodeUint16 encodes an uint16 in 3 bytes preserving type of the number.
+func (e *Encoder) EncodeUint16(n uint16) error {
+        return e.write2(codes.Uint16, n)
+}
+
+func (e *Encoder) encodeUint16Cond(n uint16) error {
+        if e.useCompact {
+                return e.EncodeUint(uint64(n))
+        }
+        return e.EncodeUint16(n)
+}
+
+// EncodeUint32 encodes an uint16 in 5 bytes preserving type of the number.
+func (e *Encoder) EncodeUint32(n uint32) error {
+        return e.write4(codes.Uint32, n)
+}
+
+func (e *Encoder) encodeUint32Cond(n uint32) error {
+        if e.useCompact {
+                return e.EncodeUint(uint64(n))
+        }
+        return e.EncodeUint32(n)
+}
+
+// EncodeUint64 encodes an uint16 in 9 bytes preserving type of the number.
+func (e *Encoder) EncodeUint64(n uint64) error {
+        return e.write8(codes.Uint64, n)
+}
+
+func (e *Encoder) encodeUint64Cond(n uint64) error {
+        if e.useCompact {
+                return e.EncodeUint(n)
+        }
+        return e.EncodeUint64(n)
+}
+
+// EncodeInt8 encodes an int8 in 2 bytes preserving type of the number.
+func (e *Encoder) EncodeInt8(n int8) error {
+        return e.write1(codes.Int8, uint8(n))
+}
+
+func (e *Encoder) encodeInt8Cond(n int8) error {
+        if e.useCompact {
+                return e.EncodeInt(int64(n))
+        }
+        return e.EncodeInt8(n)
+}
+
+// EncodeInt16 encodes an int16 in 3 bytes preserving type of the number.
+func (e *Encoder) EncodeInt16(n int16) error {
+        return e.write2(codes.Int16, uint16(n))
+}
+
+func (e *Encoder) encodeInt16Cond(n int16) error {
+        if e.useCompact {
+                return e.EncodeInt(int64(n))
+        }
+        return e.EncodeInt16(n)
+}
+
+// EncodeInt32 encodes an int32 in 5 bytes preserving type of the number.
+func (e *Encoder) EncodeInt32(n int32) error {
+        return e.write4(codes.Int32, uint32(n))
+}
+
+func (e *Encoder) encodeInt32Cond(n int32) error {
+        if e.useCompact {
+                return e.EncodeInt(int64(n))
+        }
+        return e.EncodeInt32(n)
+}
+
+// EncodeInt64 encodes an int64 in 9 bytes preserving type of the number.
+func (e *Encoder) EncodeInt64(n int64) error {
+        return e.write8(codes.Int64, uint64(n))
+}
+
+func (e *Encoder) encodeInt64Cond(n int64) error {
+        if e.useCompact {
+                return e.EncodeInt(n)
+        }
+        return e.EncodeInt64(n)
+}
+
+// EncodeUnsignedNumber encodes an uint64 in 1, 2, 3, 5, or 9 bytes.
+// Type of the number is lost during encoding.
+func (e *Encoder) EncodeUint(n uint64) error {
+        if n <= math.MaxInt8 {
+                return e.w.WriteByte(byte(n))
+        }
+        if n <= math.MaxUint8 {
+                return e.EncodeUint8(uint8(n))
+        }
+        if n <= math.MaxUint16 {
+                return e.EncodeUint16(uint16(n))
+        }
+        if n <= math.MaxUint32 {
+                return e.EncodeUint32(uint32(n))
+        }
+        return e.EncodeUint64(uint64(n))
+}
+
+// EncodeNumber encodes an int64 in 1, 2, 3, 5, or 9 bytes.
+// Type of number is lost during encoding.
+func (e *Encoder) EncodeInt(n int64) error {
+        if n >= 0 {
+                return e.EncodeUint(uint64(n))
+        }
+        if n >= int64(int8(codes.NegFixedNumLow)) {
+                return e.w.WriteByte(byte(n))
+        }
+        if n >= math.MinInt8 {
+                return e.EncodeInt8(int8(n))
+        }
+        if n >= math.MinInt16 {
+                return e.EncodeInt16(int16(n))
+        }
+        if n >= math.MinInt32 {
+                return e.EncodeInt32(int32(n))
+        }
+        return e.EncodeInt64(int64(n))
+}
+
+func (e *Encoder) EncodeFloat32(n float32) error {
+        return e.write4(codes.Float, math.Float32bits(n))
+}
+
+func (e *Encoder) EncodeFloat64(n float64) error {
+        return e.write8(codes.Double, math.Float64bits(n))
+}
+
+func (e *Encoder) write1(code codes.Code, n uint8) error {
+        e.buf = e.buf[:2]
+        e.buf[0] = byte(code)
+        e.buf[1] = byte(n)
+        return e.write(e.buf)
+}
+
+func (e *Encoder) write2(code codes.Code, n uint16) error {
+        e.buf = e.buf[:3]
+        e.buf[0] = byte(code)
+        e.buf[1] = byte(n >> 8)
+        e.buf[2] = byte(n)
+        return e.write(e.buf)
+}
+
+func (e *Encoder) write4(code codes.Code, n uint32) error {
+        e.buf = e.buf[:5]
+        e.buf[0] = byte(code)
+        e.buf[1] = byte(n >> 24)
+        e.buf[2] = byte(n >> 16)
+        e.buf[3] = byte(n >> 8)
+        e.buf[4] = byte(n)
+        return e.write(e.buf)
+}
+
+func (e *Encoder) write8(code codes.Code, n uint64) error {
+        e.buf = e.buf[:9]
+        e.buf[0] = byte(code)
+        e.buf[1] = byte(n >> 56)
+        e.buf[2] = byte(n >> 48)
+        e.buf[3] = byte(n >> 40)
+        e.buf[4] = byte(n >> 32)
+        e.buf[5] = byte(n >> 24)
+        e.buf[6] = byte(n >> 16)
+        e.buf[7] = byte(n >> 8)
+        e.buf[8] = byte(n)
+        return e.write(e.buf)
+}
+
+func encodeUint8CondValue(e *Encoder, v reflect.Value) error {
+        return e.encodeUint8Cond(uint8(v.Uint()))
+}
+
+func encodeUint16CondValue(e *Encoder, v reflect.Value) error {
+        return e.encodeUint16Cond(uint16(v.Uint()))
+}
+
+func encodeUint32CondValue(e *Encoder, v reflect.Value) error {
+        return e.encodeUint32Cond(uint32(v.Uint()))
+}
+
+func encodeUint64CondValue(e *Encoder, v reflect.Value) error {
+        return e.encodeUint64Cond(v.Uint())
+}
+
+func encodeInt8CondValue(e *Encoder, v reflect.Value) error {
+        return e.encodeInt8Cond(int8(v.Int()))
+}
+
+func encodeInt16CondValue(e *Encoder, v reflect.Value) error {
+        return e.encodeInt16Cond(int16(v.Int()))
+}
+
+func encodeInt32CondValue(e *Encoder, v reflect.Value) error {
+        return e.encodeInt32Cond(int32(v.Int()))
+}
+
+func encodeInt64CondValue(e *Encoder, v reflect.Value) error {
+        return e.encodeInt64Cond(v.Int())
+}
+
+func encodeFloat32Value(e *Encoder, v reflect.Value) error {
+        return e.EncodeFloat32(float32(v.Float()))
+}
+
+func encodeFloat64Value(e *Encoder, v reflect.Value) error {
+        return e.EncodeFloat64(v.Float())
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/encode_slice.go b/vendor/github.com/vmihailenco/msgpack/encode_slice.go
new file mode 100644
index 0000000..5ddbd63
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/encode_slice.go
@@ -0,0 +1,124 @@
+package msgpack
+
+import (
+        "reflect"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+func encodeStringValue(e *Encoder, v reflect.Value) error {
+        return e.EncodeString(v.String())
+}
+
+func encodeByteSliceValue(e *Encoder, v reflect.Value) error {
+        return e.EncodeBytes(v.Bytes())
+}
+
+func encodeByteArrayValue(e *Encoder, v reflect.Value) error {
+        if err := e.EncodeBytesLen(v.Len()); err != nil {
+                return err
+        }
+
+        if v.CanAddr() {
+                b := v.Slice(0, v.Len()).Bytes()
+                return e.write(b)
+        }
+
+        e.buf = grow(e.buf, v.Len())
+        reflect.Copy(reflect.ValueOf(e.buf), v)
+        return e.write(e.buf)
+}
+
+func grow(b []byte, n int) []byte {
+        if cap(b) >= n {
+                return b[:n]
+        }
+        b = b[:cap(b)]
+        b = append(b, make([]byte, n-len(b))...)
+        return b
+}
+
+func (e *Encoder) EncodeBytesLen(l int) error {
+        if l < 256 {
+                return e.write1(codes.Bin8, uint8(l))
+        }
+        if l < 65536 {
+                return e.write2(codes.Bin16, uint16(l))
+        }
+        return e.write4(codes.Bin32, uint32(l))
+}
+
+func (e *Encoder) encodeStrLen(l int) error {
+        if l < 32 {
+                return e.writeCode(codes.FixedStrLow | codes.Code(l))
+        }
+        if l < 256 {
+                return e.write1(codes.Str8, uint8(l))
+        }
+        if l < 65536 {
+                return e.write2(codes.Str16, uint16(l))
+        }
+        return e.write4(codes.Str32, uint32(l))
+}
+
+func (e *Encoder) EncodeString(v string) error {
+        if err := e.encodeStrLen(len(v)); err != nil {
+                return err
+        }
+        return e.writeString(v)
+}
+
+func (e *Encoder) EncodeBytes(v []byte) error {
+        if v == nil {
+                return e.EncodeNil()
+        }
+        if err := e.EncodeBytesLen(len(v)); err != nil {
+                return err
+        }
+        return e.write(v)
+}
+
+func (e *Encoder) EncodeArrayLen(l int) error {
+        if l < 16 {
+                return e.writeCode(codes.FixedArrayLow | codes.Code(l))
+        }
+        if l < 65536 {
+                return e.write2(codes.Array16, uint16(l))
+        }
+        return e.write4(codes.Array32, uint32(l))
+}
+
+func (e *Encoder) encodeStringSlice(s []string) error {
+        if s == nil {
+                return e.EncodeNil()
+        }
+        if err := e.EncodeArrayLen(len(s)); err != nil {
+                return err
+        }
+        for _, v := range s {
+                if err := e.EncodeString(v); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+func encodeSliceValue(e *Encoder, v reflect.Value) error {
+        if v.IsNil() {
+                return e.EncodeNil()
+        }
+        return encodeArrayValue(e, v)
+}
+
+func encodeArrayValue(e *Encoder, v reflect.Value) error {
+        l := v.Len()
+        if err := e.EncodeArrayLen(l); err != nil {
+                return err
+        }
+        for i := 0; i < l; i++ {
+                if err := e.EncodeValue(v.Index(i)); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/encode_value.go b/vendor/github.com/vmihailenco/msgpack/encode_value.go
new file mode 100644
index 0000000..b46ab02
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/encode_value.go
@@ -0,0 +1,167 @@
+package msgpack
+
+import (
+        "fmt"
+        "reflect"
+)
+
+var valueEncoders []encoderFunc
+
+func init() {
+        valueEncoders = []encoderFunc{
+                reflect.Bool:          encodeBoolValue,
+                reflect.Int:           encodeInt64CondValue,
+                reflect.Int8:          encodeInt8CondValue,
+                reflect.Int16:         encodeInt16CondValue,
+                reflect.Int32:         encodeInt32CondValue,
+                reflect.Int64:         encodeInt64CondValue,
+                reflect.Uint:          encodeUint64CondValue,
+                reflect.Uint8:         encodeUint8CondValue,
+                reflect.Uint16:        encodeUint16CondValue,
+                reflect.Uint32:        encodeUint32CondValue,
+                reflect.Uint64:        encodeUint64CondValue,
+                reflect.Float32:       encodeFloat32Value,
+                reflect.Float64:       encodeFloat64Value,
+                reflect.Complex64:     encodeUnsupportedValue,
+                reflect.Complex128:    encodeUnsupportedValue,
+                reflect.Array:         encodeArrayValue,
+                reflect.Chan:          encodeUnsupportedValue,
+                reflect.Func:          encodeUnsupportedValue,
+                reflect.Interface:     encodeInterfaceValue,
+                reflect.Map:           encodeMapValue,
+                reflect.Ptr:           encodeUnsupportedValue,
+                reflect.Slice:         encodeSliceValue,
+                reflect.String:        encodeStringValue,
+                reflect.Struct:        encodeStructValue,
+                reflect.UnsafePointer: encodeUnsupportedValue,
+        }
+}
+
+func getEncoder(typ reflect.Type) encoderFunc {
+        if encoder, ok := typEncMap[typ]; ok {
+                return encoder
+        }
+
+        if typ.Implements(customEncoderType) {
+                return encodeCustomValue
+        }
+        if typ.Implements(marshalerType) {
+                return marshalValue
+        }
+
+        kind := typ.Kind()
+
+        // Addressable struct field value.
+        if kind != reflect.Ptr {
+                ptr := reflect.PtrTo(typ)
+                if ptr.Implements(customEncoderType) {
+                        return encodeCustomValuePtr
+                }
+                if ptr.Implements(marshalerType) {
+                        return marshalValuePtr
+                }
+        }
+
+        if typ == errorType {
+                return encodeErrorValue
+        }
+
+        switch kind {
+        case reflect.Ptr:
+                return ptrEncoderFunc(typ)
+        case reflect.Slice:
+                if typ.Elem().Kind() == reflect.Uint8 {
+                        return encodeByteSliceValue
+                }
+        case reflect.Array:
+                if typ.Elem().Kind() == reflect.Uint8 {
+                        return encodeByteArrayValue
+                }
+        case reflect.Map:
+                if typ.Key() == stringType {
+                        switch typ.Elem() {
+                        case stringType:
+                                return encodeMapStringStringValue
+                        case interfaceType:
+                                return encodeMapStringInterfaceValue
+                        }
+                }
+        }
+        return valueEncoders[kind]
+}
+
+func ptrEncoderFunc(typ reflect.Type) encoderFunc {
+        encoder := getEncoder(typ.Elem())
+        return func(e *Encoder, v reflect.Value) error {
+                if v.IsNil() {
+                        return e.EncodeNil()
+                }
+                return encoder(e, v.Elem())
+        }
+}
+
+func encodeCustomValuePtr(e *Encoder, v reflect.Value) error {
+        if !v.CanAddr() {
+                return fmt.Errorf("msgpack: Encode(non-addressable %T)", v.Interface())
+        }
+        encoder := v.Addr().Interface().(CustomEncoder)
+        return encoder.EncodeMsgpack(e)
+}
+
+func encodeCustomValue(e *Encoder, v reflect.Value) error {
+        switch v.Kind() {
+        case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.Ptr, reflect.Slice:
+                if v.IsNil() {
+                        return e.EncodeNil()
+                }
+        }
+
+        encoder := v.Interface().(CustomEncoder)
+        return encoder.EncodeMsgpack(e)
+}
+
+func marshalValuePtr(e *Encoder, v reflect.Value) error {
+        if !v.CanAddr() {
+                return fmt.Errorf("msgpack: Encode(non-addressable %T)", v.Interface())
+        }
+        return marshalValue(e, v.Addr())
+}
+
+func marshalValue(e *Encoder, v reflect.Value) error {
+        switch v.Kind() {
+        case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.Ptr, reflect.Slice:
+                if v.IsNil() {
+                        return e.EncodeNil()
+                }
+        }
+
+        marshaler := v.Interface().(Marshaler)
+        b, err := marshaler.MarshalMsgpack()
+        if err != nil {
+                return err
+        }
+        _, err = e.w.Write(b)
+        return err
+}
+
+func encodeBoolValue(e *Encoder, v reflect.Value) error {
+        return e.EncodeBool(v.Bool())
+}
+
+func encodeInterfaceValue(e *Encoder, v reflect.Value) error {
+        if v.IsNil() {
+                return e.EncodeNil()
+        }
+        return e.EncodeValue(v.Elem())
+}
+
+func encodeErrorValue(e *Encoder, v reflect.Value) error {
+        if v.IsNil() {
+                return e.EncodeNil()
+        }
+        return e.EncodeString(v.Interface().(error).Error())
+}
+
+func encodeUnsupportedValue(e *Encoder, v reflect.Value) error {
+        return fmt.Errorf("msgpack: Encode(unsupported %s)", v.Type())
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/ext.go b/vendor/github.com/vmihailenco/msgpack/ext.go
new file mode 100644
index 0000000..7970be8
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/ext.go
@@ -0,0 +1,238 @@
+package msgpack
+
+import (
+        "bytes"
+        "fmt"
+        "reflect"
+        "sync"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+var extTypes = make(map[int8]reflect.Type)
+
+var bufferPool = &sync.Pool{
+        New: func() interface{} {
+                return new(bytes.Buffer)
+        },
+}
+
+// RegisterExt records a type, identified by a value for that type,
+// under the provided id. That id will identify the concrete type of a value
+// sent or received as an interface variable. Only types that will be
+// transferred as implementations of interface values need to be registered.
+// Expecting to be used only during initialization, it panics if the mapping
+// between types and ids is not a bijection.
+func RegisterExt(id int8, value interface{}) {
+        typ := reflect.TypeOf(value)
+        if typ.Kind() == reflect.Ptr {
+                typ = typ.Elem()
+        }
+        ptr := reflect.PtrTo(typ)
+
+        if _, ok := extTypes[id]; ok {
+                panic(fmt.Errorf("msgpack: ext with id=%d is already registered", id))
+        }
+
+        registerExt(id, ptr, getEncoder(ptr), getDecoder(ptr))
+        registerExt(id, typ, getEncoder(typ), getDecoder(typ))
+}
+
+func registerExt(id int8, typ reflect.Type, enc encoderFunc, dec decoderFunc) {
+        if dec != nil {
+                extTypes[id] = typ
+        }
+        if enc != nil {
+                typEncMap[typ] = makeExtEncoder(id, enc)
+        }
+        if dec != nil {
+                typDecMap[typ] = makeExtDecoder(id, dec)
+        }
+}
+
+func (e *Encoder) EncodeExtHeader(typeId int8, length int) error {
+        if err := e.encodeExtLen(length); err != nil {
+                return err
+        }
+        if err := e.w.WriteByte(byte(typeId)); err != nil {
+                return err
+        }
+        return nil
+}
+
+func makeExtEncoder(typeId int8, enc encoderFunc) encoderFunc {
+        return func(e *Encoder, v reflect.Value) error {
+                buf := bufferPool.Get().(*bytes.Buffer)
+                defer bufferPool.Put(buf)
+                buf.Reset()
+
+                oldw := e.w
+                e.w = buf
+                err := enc(e, v)
+                e.w = oldw
+
+                if err != nil {
+                        return err
+                }
+
+                err = e.EncodeExtHeader(typeId, buf.Len())
+                if err != nil {
+                        return err
+                }
+                return e.write(buf.Bytes())
+        }
+}
+
+func makeExtDecoder(typeId int8, dec decoderFunc) decoderFunc {
+        return func(d *Decoder, v reflect.Value) error {
+                c, err := d.PeekCode()
+                if err != nil {
+                        return err
+                }
+
+                if !codes.IsExt(c) {
+                        return dec(d, v)
+                }
+
+                id, extLen, err := d.DecodeExtHeader()
+                if err != nil {
+                        return err
+                }
+
+                if id != typeId {
+                        return fmt.Errorf("msgpack: got ext type=%d, wanted %d", int8(c), typeId)
+                }
+
+                d.extLen = extLen
+                return dec(d, v)
+        }
+}
+
+func (e *Encoder) encodeExtLen(l int) error {
+        switch l {
+        case 1:
+                return e.writeCode(codes.FixExt1)
+        case 2:
+                return e.writeCode(codes.FixExt2)
+        case 4:
+                return e.writeCode(codes.FixExt4)
+        case 8:
+                return e.writeCode(codes.FixExt8)
+        case 16:
+                return e.writeCode(codes.FixExt16)
+        }
+        if l < 256 {
+                return e.write1(codes.Ext8, uint8(l))
+        }
+        if l < 65536 {
+                return e.write2(codes.Ext16, uint16(l))
+        }
+        return e.write4(codes.Ext32, uint32(l))
+}
+
+func (d *Decoder) parseExtLen(c codes.Code) (int, error) {
+        switch c {
+        case codes.FixExt1:
+                return 1, nil
+        case codes.FixExt2:
+                return 2, nil
+        case codes.FixExt4:
+                return 4, nil
+        case codes.FixExt8:
+                return 8, nil
+        case codes.FixExt16:
+                return 16, nil
+        case codes.Ext8:
+                n, err := d.uint8()
+                return int(n), err
+        case codes.Ext16:
+                n, err := d.uint16()
+                return int(n), err
+        case codes.Ext32:
+                n, err := d.uint32()
+                return int(n), err
+        default:
+                return 0, fmt.Errorf("msgpack: invalid code=%x decoding ext length", c)
+        }
+}
+
+func (d *Decoder) decodeExtHeader(c codes.Code) (int8, int, error) {
+        length, err := d.parseExtLen(c)
+        if err != nil {
+                return 0, 0, err
+        }
+
+        typeId, err := d.readCode()
+        if err != nil {
+                return 0, 0, err
+        }
+
+        return int8(typeId), length, nil
+}
+
+func (d *Decoder) DecodeExtHeader() (typeId int8, length int, err error) {
+        c, err := d.readCode()
+        if err != nil {
+                return
+        }
+        return d.decodeExtHeader(c)
+}
+
+func (d *Decoder) extInterface(c codes.Code) (interface{}, error) {
+        extId, extLen, err := d.decodeExtHeader(c)
+        if err != nil {
+                return nil, err
+        }
+
+        typ, ok := extTypes[extId]
+        if !ok {
+                return nil, fmt.Errorf("msgpack: unregistered ext id=%d", extId)
+        }
+
+        v := reflect.New(typ)
+
+        d.extLen = extLen
+        err = d.DecodeValue(v.Elem())
+        d.extLen = 0
+        if err != nil {
+                return nil, err
+        }
+
+        return v.Interface(), nil
+}
+
+func (d *Decoder) skipExt(c codes.Code) error {
+        n, err := d.parseExtLen(c)
+        if err != nil {
+                return err
+        }
+        return d.skipN(n + 1)
+}
+
+func (d *Decoder) skipExtHeader(c codes.Code) error {
+        // Read ext type.
+        _, err := d.readCode()
+        if err != nil {
+                return err
+        }
+        // Read ext body len.
+        for i := 0; i < extHeaderLen(c); i++ {
+                _, err := d.readCode()
+                if err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+func extHeaderLen(c codes.Code) int {
+        switch c {
+        case codes.Ext8:
+                return 1
+        case codes.Ext16:
+                return 2
+        case codes.Ext32:
+                return 4
+        }
+        return 0
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/msgpack.go b/vendor/github.com/vmihailenco/msgpack/msgpack.go
new file mode 100644
index 0000000..220b43c
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/msgpack.go
@@ -0,0 +1,17 @@
+package msgpack
+
+type Marshaler interface {
+        MarshalMsgpack() ([]byte, error)
+}
+
+type Unmarshaler interface {
+        UnmarshalMsgpack([]byte) error
+}
+
+type CustomEncoder interface {
+        EncodeMsgpack(*Encoder) error
+}
+
+type CustomDecoder interface {
+        DecodeMsgpack(*Decoder) error
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/tag.go b/vendor/github.com/vmihailenco/msgpack/tag.go
new file mode 100644
index 0000000..48e6f94
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/tag.go
@@ -0,0 +1,42 @@
+package msgpack
+
+import (
+        "strings"
+)
+
+type tagOptions string
+
+func (o tagOptions) Get(name string) (string, bool) {
+        s := string(o)
+        for len(s) > 0 {
+                var next string
+                idx := strings.IndexByte(s, ',')
+                if idx >= 0 {
+                        s, next = s[:idx], s[idx+1:]
+                }
+                if strings.HasPrefix(s, name) {
+                        return s[len(name):], true
+                }
+                s = next
+        }
+        return "", false
+}
+
+func (o tagOptions) Contains(name string) bool {
+        _, ok := o.Get(name)
+        return ok
+}
+
+func parseTag(tag string) (string, tagOptions) {
+        if idx := strings.IndexByte(tag, ','); idx != -1 {
+                name := tag[:idx]
+                if strings.IndexByte(name, ':') == -1 {
+                        return name, tagOptions(tag[idx+1:])
+                }
+        }
+
+        if strings.IndexByte(tag, ':') == -1 {
+                return tag, ""
+        }
+        return "", tagOptions(tag)
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/time.go b/vendor/github.com/vmihailenco/msgpack/time.go
new file mode 100644
index 0000000..f740969
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/time.go
@@ -0,0 +1,145 @@
+package msgpack
+
+import (
+        "encoding/binary"
+        "fmt"
+        "reflect"
+        "time"
+
+        "github.com/vmihailenco/msgpack/codes"
+)
+
+var timeExtId int8 = -1
+
+func init() {
+        timeType := reflect.TypeOf((*time.Time)(nil)).Elem()
+        registerExt(timeExtId, timeType, encodeTimeValue, decodeTimeValue)
+}
+
+func (e *Encoder) EncodeTime(tm time.Time) error {
+        b := e.encodeTime(tm)
+        if err := e.encodeExtLen(len(b)); err != nil {
+                return err
+        }
+        if err := e.w.WriteByte(byte(timeExtId)); err != nil {
+                return err
+        }
+        return e.write(b)
+}
+
+func (e *Encoder) encodeTime(tm time.Time) []byte {
+        secs := uint64(tm.Unix())
+        if secs>>34 == 0 {
+                data := uint64(tm.Nanosecond())<<34 | secs
+                if data&0xffffffff00000000 == 0 {
+                        b := make([]byte, 4)
+                        binary.BigEndian.PutUint32(b, uint32(data))
+                        return b
+                } else {
+                        b := make([]byte, 8)
+                        binary.BigEndian.PutUint64(b, data)
+                        return b
+                }
+        }
+
+        b := make([]byte, 12)
+        binary.BigEndian.PutUint32(b, uint32(tm.Nanosecond()))
+        binary.BigEndian.PutUint64(b[4:], uint64(secs))
+        return b
+}
+
+func (d *Decoder) DecodeTime() (time.Time, error) {
+        tm, err := d.decodeTime()
+        if err != nil {
+                return tm, err
+        }
+
+        if tm.IsZero() {
+                // Assume that zero time does not have timezone information.
+                return tm.UTC(), nil
+        }
+        return tm, nil
+}
+
+func (d *Decoder) decodeTime() (time.Time, error) {
+        extLen := d.extLen
+        d.extLen = 0
+        if extLen == 0 {
+                c, err := d.readCode()
+                if err != nil {
+                        return time.Time{}, err
+                }
+
+                // Legacy format.
+                if c == codes.FixedArrayLow|2 {
+                        sec, err := d.DecodeInt64()
+                        if err != nil {
+                                return time.Time{}, err
+                        }
+
+                        nsec, err := d.DecodeInt64()
+                        if err != nil {
+                                return time.Time{}, err
+                        }
+
+                        return time.Unix(sec, nsec), nil
+                }
+
+                if codes.IsString(c) {
+                        s, err := d.string(c)
+                        if err != nil {
+                                return time.Time{}, err
+                        }
+                        return time.Parse(time.RFC3339Nano, s)
+                }
+
+                extLen, err = d.parseExtLen(c)
+                if err != nil {
+                        return time.Time{}, err
+                }
+
+                // Skip ext id.
+                _, err = d.s.ReadByte()
+                if err != nil {
+                        return time.Time{}, nil
+                }
+        }
+
+        b, err := d.readN(extLen)
+        if err != nil {
+                return time.Time{}, err
+        }
+
+        switch len(b) {
+        case 4:
+                sec := binary.BigEndian.Uint32(b)
+                return time.Unix(int64(sec), 0), nil
+        case 8:
+                sec := binary.BigEndian.Uint64(b)
+                nsec := int64(sec >> 34)
+                sec &= 0x00000003ffffffff
+                return time.Unix(int64(sec), nsec), nil
+        case 12:
+                nsec := binary.BigEndian.Uint32(b)
+                sec := binary.BigEndian.Uint64(b[4:])
+                return time.Unix(int64(sec), int64(nsec)), nil
+        default:
+                err = fmt.Errorf("msgpack: invalid ext len=%d decoding time", extLen)
+                return time.Time{}, err
+        }
+}
+
+func encodeTimeValue(e *Encoder, v reflect.Value) error {
+        tm := v.Interface().(time.Time)
+        b := e.encodeTime(tm)
+        return e.write(b)
+}
+
+func decodeTimeValue(d *Decoder, v reflect.Value) error {
+        tm, err := d.DecodeTime()
+        if err != nil {
+                return err
+        }
+        v.Set(reflect.ValueOf(tm))
+        return nil
+}
diff --git a/vendor/github.com/vmihailenco/msgpack/types.go b/vendor/github.com/vmihailenco/msgpack/types.go
new file mode 100644
index 0000000..6a1bf7f
--- /dev/null
+++ b/vendor/github.com/vmihailenco/msgpack/types.go
@@ -0,0 +1,310 @@
+package msgpack
+
+import (
+        "reflect"
+        "sync"
+)
+
+var errorType = reflect.TypeOf((*error)(nil)).Elem()
+
+var customEncoderType = reflect.TypeOf((*CustomEncoder)(nil)).Elem()
+var customDecoderType = reflect.TypeOf((*CustomDecoder)(nil)).Elem()
+
+var marshalerType = reflect.TypeOf((*Marshaler)(nil)).Elem()
+var unmarshalerType = reflect.TypeOf((*Unmarshaler)(nil)).Elem()
+
+type encoderFunc func(*Encoder, reflect.Value) error
+type decoderFunc func(*Decoder, reflect.Value) error
+
+var typEncMap = make(map[reflect.Type]encoderFunc)
+var typDecMap = make(map[reflect.Type]decoderFunc)
+
+// Register registers encoder and decoder functions for a value.
+// This is low level API and in most cases you should prefer implementing
+// Marshaler/CustomEncoder and Unmarshaler/CustomDecoder interfaces.
+func Register(value interface{}, enc encoderFunc, dec decoderFunc) {
+        typ := reflect.TypeOf(value)
+        if enc != nil {
+                typEncMap[typ] = enc
+        }
+        if dec != nil {
+                typDecMap[typ] = dec
+        }
+}
+
+//------------------------------------------------------------------------------
+
+var structs = newStructCache(false)
+var jsonStructs = newStructCache(true)
+
+type structCache struct {
+        mu sync.RWMutex
+        m  map[reflect.Type]*fields
+
+        useJSONTag bool
+}
+
+func newStructCache(useJSONTag bool) *structCache {
+        return &structCache{
+                m: make(map[reflect.Type]*fields),
+
+                useJSONTag: useJSONTag,
+        }
+}
+
+func (m *structCache) Fields(typ reflect.Type) *fields {
+        m.mu.RLock()
+        fs, ok := m.m[typ]
+        m.mu.RUnlock()
+        if ok {
+                return fs
+        }
+
+        m.mu.Lock()
+        fs, ok = m.m[typ]
+        if !ok {
+                fs = getFields(typ, m.useJSONTag)
+                m.m[typ] = fs
+        }
+        m.mu.Unlock()
+
+        return fs
+}
+
+//------------------------------------------------------------------------------
+
+type field struct {
+        name      string
+        index     []int
+        omitEmpty bool
+        encoder   encoderFunc
+        decoder   decoderFunc
+}
+
+func (f *field) value(v reflect.Value) reflect.Value {
+        return fieldByIndex(v, f.index)
+}
+
+func (f *field) Omit(strct reflect.Value) bool {
+        return f.omitEmpty && isEmptyValue(f.value(strct))
+}
+
+func (f *field) EncodeValue(e *Encoder, strct reflect.Value) error {
+        return f.encoder(e, f.value(strct))
+}
+
+func (f *field) DecodeValue(d *Decoder, strct reflect.Value) error {
+        return f.decoder(d, f.value(strct))
+}
+
+//------------------------------------------------------------------------------
+
+type fields struct {
+        Table   map[string]*field
+        List    []*field
+        AsArray bool
+
+        hasOmitEmpty bool
+}
+
+func newFields(numField int) *fields {
+        return &fields{
+                Table: make(map[string]*field, numField),
+                List:  make([]*field, 0, numField),
+        }
+}
+
+func (fs *fields) Add(field *field) {
+        fs.Table[field.name] = field
+        fs.List = append(fs.List, field)
+        if field.omitEmpty {
+                fs.hasOmitEmpty = true
+        }
+}
+
+func (fs *fields) OmitEmpty(strct reflect.Value) []*field {
+        if !fs.hasOmitEmpty {
+                return fs.List
+        }
+
+        fields := make([]*field, 0, len(fs.List))
+        for _, f := range fs.List {
+                if !f.Omit(strct) {
+                        fields = append(fields, f)
+                }
+        }
+        return fields
+}
+
+func getFields(typ reflect.Type, useJSONTag bool) *fields {
+        numField := typ.NumField()
+        fs := newFields(numField)
+
+        var omitEmpty bool
+        for i := 0; i < numField; i++ {
+                f := typ.Field(i)
+
+                tag := f.Tag.Get("msgpack")
+                if useJSONTag && tag == "" {
+                        tag = f.Tag.Get("json")
+                }
+
+                name, opt := parseTag(tag)
+                if name == "-" {
+                        continue
+                }
+
+                if f.Name == "_msgpack" {
+                        if opt.Contains("asArray") {
+                                fs.AsArray = true
+                        }
+                        if opt.Contains("omitempty") {
+                                omitEmpty = true
+                        }
+                }
+
+                if f.PkgPath != "" && !f.Anonymous {
+                        continue
+                }
+
+                field := &field{
+                        name:      name,
+                        index:     f.Index,
+                        omitEmpty: omitEmpty || opt.Contains("omitempty"),
+                        encoder:   getEncoder(f.Type),
+                        decoder:   getDecoder(f.Type),
+                }
+
+                if field.name == "" {
+                        field.name = f.Name
+                }
+
+                if f.Anonymous && !opt.Contains("noinline") {
+                        inline := opt.Contains("inline")
+                        if inline {
+                                inlineFields(fs, f.Type, field, useJSONTag)
+                        } else {
+                                inline = autoinlineFields(fs, f.Type, field, useJSONTag)
+                        }
+                        if inline {
+                                fs.Table[field.name] = field
+                                continue
+                        }
+                }
+
+                fs.Add(field)
+        }
+        return fs
+}
+
+var encodeStructValuePtr uintptr
+var decodeStructValuePtr uintptr
+
+func init() {
+        encodeStructValuePtr = reflect.ValueOf(encodeStructValue).Pointer()
+        decodeStructValuePtr = reflect.ValueOf(decodeStructValue).Pointer()
+}
+
+func inlineFields(fs *fields, typ reflect.Type, f *field, useJSONTag bool) {
+        inlinedFields := getFields(typ, useJSONTag).List
+        for _, field := range inlinedFields {
+                if _, ok := fs.Table[field.name]; ok {
+                        // Don't inline shadowed fields.
+                        continue
+                }
+                field.index = append(f.index, field.index...)
+                fs.Add(field)
+        }
+}
+
+func autoinlineFields(fs *fields, typ reflect.Type, f *field, useJSONTag bool) bool {
+        var encoder encoderFunc
+        var decoder decoderFunc
+
+        if typ.Kind() == reflect.Struct {
+                encoder = f.encoder
+                decoder = f.decoder
+        } else {
+                for typ.Kind() == reflect.Ptr {
+                        typ = typ.Elem()
+                        encoder = getEncoder(typ)
+                        decoder = getDecoder(typ)
+                }
+                if typ.Kind() != reflect.Struct {
+                        return false
+                }
+        }
+
+        if reflect.ValueOf(encoder).Pointer() != encodeStructValuePtr {
+                return false
+        }
+        if reflect.ValueOf(decoder).Pointer() != decodeStructValuePtr {
+                return false
+        }
+
+        inlinedFields := getFields(typ, useJSONTag).List
+        for _, field := range inlinedFields {
+                if _, ok := fs.Table[field.name]; ok {
+                        // Don't auto inline if there are shadowed fields.
+                        return false
+                }
+        }
+
+        for _, field := range inlinedFields {
+                field.index = append(f.index, field.index...)
+                fs.Add(field)
+        }
+        return true
+}
+
+func isEmptyValue(v reflect.Value) bool {
+        switch v.Kind() {
+        case reflect.Array, reflect.Map, reflect.Slice, reflect.String:
+                return v.Len() == 0
+        case reflect.Bool:
+                return !v.Bool()
+        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+                return v.Int() == 0
+        case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+                return v.Uint() == 0
+        case reflect.Float32, reflect.Float64:
+                return v.Float() == 0
+        case reflect.Interface, reflect.Ptr:
+                return v.IsNil()
+        }
+        return false
+}
+
+func fieldByIndex(v reflect.Value, index []int) reflect.Value {
+        if len(index) == 1 {
+                return v.Field(index[0])
+        }
+        for i, x := range index {
+                if i > 0 {
+                        var ok bool
+                        v, ok = indirectNew(v)
+                        if !ok {
+                                return v
+                        }
+                }
+                v = v.Field(x)
+        }
+        return v
+}
+
+func indirectNew(v reflect.Value) (reflect.Value, bool) {
+        if v.Kind() == reflect.Ptr {
+                if v.IsNil() {
+                        if !v.CanSet() {
+                                return v, false
+                        }
+                        elemType := v.Type().Elem()
+                        if elemType.Kind() != reflect.Struct {
+                                return v, false
+                        }
+                        v.Set(reflect.New(elemType))
+                }
+                v = v.Elem()
+        }
+        return v, true
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/capsule.go b/vendor/github.com/zclconf/go-cty/cty/capsule.go
index 4fce92a..d273d14 100644
--- a/vendor/github.com/zclconf/go-cty/cty/capsule.go
+++ b/vendor/github.com/zclconf/go-cty/cty/capsule.go
@@ -19,7 +19,7 @@ func (t *capsuleType) Equals(other Type) bool {
         return false
 }
 
-func (t *capsuleType) FriendlyName() string {
+func (t *capsuleType) FriendlyName(mode friendlyTypeNameMode) string {
         return t.Name
 }
 
diff --git a/vendor/github.com/zclconf/go-cty/cty/convert/conversion.go b/vendor/github.com/zclconf/go-cty/cty/convert/conversion.go
index 7bfcc08..f9aacb4 100644
--- a/vendor/github.com/zclconf/go-cty/cty/convert/conversion.go
+++ b/vendor/github.com/zclconf/go-cty/cty/convert/conversion.go
@@ -17,6 +17,10 @@ func getConversion(in cty.Type, out cty.Type, unsafe bool) conversion {
         // Wrap the conversion in some standard checks that we don't want to
         // have to repeat in every conversion function.
         return func(in cty.Value, path cty.Path) (cty.Value, error) {
+                if out == cty.DynamicPseudoType {
+                        // Conversion to DynamicPseudoType always just passes through verbatim.
+                        return in, nil
+                }
                 if !in.IsKnown() {
                         return cty.UnknownVal(out), nil
                 }
@@ -57,6 +61,12 @@ func getConversionKnown(in cty.Type, out cty.Type, unsafe bool) conversion {
                 }
                 return nil
 
+        case out.IsObjectType() && in.IsObjectType():
+                return conversionObjectToObject(in, out, unsafe)
+
+        case out.IsTupleType() && in.IsTupleType():
+                return conversionTupleToTuple(in, out, unsafe)
+
         case out.IsListType() && (in.IsListType() || in.IsSetType()):
                 inEty := in.ElementType()
                 outEty := out.ElementType()
@@ -93,10 +103,23 @@ func getConversionKnown(in cty.Type, out cty.Type, unsafe bool) conversion {
                 }
                 return conversionCollectionToSet(outEty, convEty)
 
+        case out.IsMapType() && in.IsMapType():
+                inEty := in.ElementType()
+                outEty := out.ElementType()
+                convEty := getConversion(inEty, outEty, unsafe)
+                if convEty == nil {
+                        return nil
+                }
+                return conversionCollectionToMap(outEty, convEty)
+
         case out.IsListType() && in.IsTupleType():
                 outEty := out.ElementType()
                 return conversionTupleToList(in, outEty, unsafe)
 
+        case out.IsSetType() && in.IsTupleType():
+                outEty := out.ElementType()
+                return conversionTupleToSet(in, outEty, unsafe)
+
         case out.IsMapType() && in.IsObjectType():
                 outEty := out.ElementType()
                 return conversionObjectToMap(in, outEty, unsafe)
diff --git a/vendor/github.com/zclconf/go-cty/cty/convert/conversion_collection.go b/vendor/github.com/zclconf/go-cty/cty/convert/conversion_collection.go
index eace85d..3039ba2 100644
--- a/vendor/github.com/zclconf/go-cty/cty/convert/conversion_collection.go
+++ b/vendor/github.com/zclconf/go-cty/cty/convert/conversion_collection.go
@@ -84,6 +84,120 @@ func conversionCollectionToSet(ety cty.Type, conv conversion) conversion {
         }
 }
 
+// conversionCollectionToMap returns a conversion that will apply the given
+// conversion to all of the elements of a collection (something that supports
+// ForEachElement and LengthInt) and then returns the result as a map.
+//
+// "conv" can be nil if the elements are expected to already be of the
+// correct type and just need to be re-wrapped into a map.
+func conversionCollectionToMap(ety cty.Type, conv conversion) conversion {
+        return func(val cty.Value, path cty.Path) (cty.Value, error) {
+                elems := make(map[string]cty.Value, 0)
+                path = append(path, nil)
+                it := val.ElementIterator()
+                for it.Next() {
+                        key, val := it.Element()
+                        var err error
+
+                        path[len(path)-1] = cty.IndexStep{
+                                Key: key,
+                        }
+
+                        keyStr, err := Convert(key, cty.String)
+                        if err != nil {
+                                // Should never happen, because keys can only be numbers or
+                                // strings and both can convert to string.
+                                return cty.DynamicVal, path.NewErrorf("cannot convert key type %s to string for map", key.Type().FriendlyName())
+                        }
+
+                        if conv != nil {
+                                val, err = conv(val, path)
+                                if err != nil {
+                                        return cty.NilVal, err
+                                }
+                        }
+
+                        elems[keyStr.AsString()] = val
+                }
+
+                if len(elems) == 0 {
+                        return cty.MapValEmpty(ety), nil
+                }
+
+                return cty.MapVal(elems), nil
+        }
+}
+
+// conversionTupleToSet returns a conversion that will take a value of the
+// given tuple type and return a set of the given element type.
+//
+// Will panic if the given tupleType isn't actually a tuple type.
+func conversionTupleToSet(tupleType cty.Type, listEty cty.Type, unsafe bool) conversion {
+        tupleEtys := tupleType.TupleElementTypes()
+
+        if len(tupleEtys) == 0 {
+                // Empty tuple short-circuit
+                return func(val cty.Value, path cty.Path) (cty.Value, error) {
+                        return cty.SetValEmpty(listEty), nil
+                }
+        }
+
+        if listEty == cty.DynamicPseudoType {
+                // This is a special case where the caller wants us to find
+                // a suitable single type that all elements can convert to, if
+                // possible.
+                listEty, _ = unify(tupleEtys, unsafe)
+                if listEty == cty.NilType {
+                        return nil
+                }
+        }
+
+        elemConvs := make([]conversion, len(tupleEtys))
+        for i, tupleEty := range tupleEtys {
+                if tupleEty.Equals(listEty) {
+                        // no conversion required
+                        continue
+                }
+
+                elemConvs[i] = getConversion(tupleEty, listEty, unsafe)
+                if elemConvs[i] == nil {
+                        // If any of our element conversions are impossible, then the our
+                        // whole conversion is impossible.
+                        return nil
+                }
+        }
+
+        // If we fall out here then a conversion is possible, using the
+        // element conversions in elemConvs
+        return func(val cty.Value, path cty.Path) (cty.Value, error) {
+                elems := make([]cty.Value, 0, len(elemConvs))
+                path = append(path, nil)
+                i := int64(0)
+                it := val.ElementIterator()
+                for it.Next() {
+                        _, val := it.Element()
+                        var err error
+
+                        path[len(path)-1] = cty.IndexStep{
+                                Key: cty.NumberIntVal(i),
+                        }
+
+                        conv := elemConvs[i]
+                        if conv != nil {
+                                val, err = conv(val, path)
+                                if err != nil {
+                                        return cty.NilVal, err
+                                }
+                        }
+                        elems = append(elems, val)
+
+                        i++
+                }
+
+                return cty.SetVal(elems), nil
+        }
+}
+
 // conversionTupleToList returns a conversion that will take a value of the
 // given tuple type and return a list of the given element type.
 //
diff --git a/vendor/github.com/zclconf/go-cty/cty/convert/conversion_object.go b/vendor/github.com/zclconf/go-cty/cty/convert/conversion_object.go
new file mode 100644
index 0000000..62dabb8
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/convert/conversion_object.go
@@ -0,0 +1,76 @@
+package convert
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// conversionObjectToObject returns a conversion that will make the input
+// object type conform to the output object type, if possible.
+//
+// Conversion is possible only if the output type is a subset of the input
+// type, meaning that each attribute of the output type has a corresponding
+// attribute in the input type where a recursive conversion is available.
+//
+// Shallow object conversions work the same for both safe and unsafe modes,
+// but the safety flag is passed on to recursive conversions and may thus
+// limit the above definition of "subset".
+func conversionObjectToObject(in, out cty.Type, unsafe bool) conversion {
+        inAtys := in.AttributeTypes()
+        outAtys := out.AttributeTypes()
+        attrConvs := make(map[string]conversion)
+
+        for name, outAty := range outAtys {
+                inAty, exists := inAtys[name]
+                if !exists {
+                        // No conversion is available, then.
+                        return nil
+                }
+
+                if inAty.Equals(outAty) {
+                        // No conversion needed, but we'll still record the attribute
+                        // in our map for later reference.
+                        attrConvs[name] = nil
+                        continue
+                }
+
+                attrConvs[name] = getConversion(inAty, outAty, unsafe)
+                if attrConvs[name] == nil {
+                        // If a recursive conversion isn't available, then our top-level
+                        // configuration is impossible too.
+                        return nil
+                }
+        }
+
+        // If we get here then a conversion is possible, using the attribute
+        // conversions given in attrConvs.
+        return func(val cty.Value, path cty.Path) (cty.Value, error) {
+                attrVals := make(map[string]cty.Value, len(attrConvs))
+                path = append(path, nil)
+                pathStep := &path[len(path)-1]
+
+                for it := val.ElementIterator(); it.Next(); {
+                        nameVal, val := it.Element()
+                        var err error
+
+                        name := nameVal.AsString()
+                        *pathStep = cty.GetAttrStep{
+                                Name: name,
+                        }
+
+                        conv, exists := attrConvs[name]
+                        if !exists {
+                                continue
+                        }
+                        if conv != nil {
+                                val, err = conv(val, path)
+                                if err != nil {
+                                        return cty.NilVal, err
+                                }
+                        }
+
+                        attrVals[name] = val
+                }
+
+                return cty.ObjectVal(attrVals), nil
+        }
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/convert/conversion_primitive.go b/vendor/github.com/zclconf/go-cty/cty/convert/conversion_primitive.go
index e563ee3..e0dbf49 100644
--- a/vendor/github.com/zclconf/go-cty/cty/convert/conversion_primitive.go
+++ b/vendor/github.com/zclconf/go-cty/cty/convert/conversion_primitive.go
@@ -1,8 +1,6 @@
 package convert
 
 import (
-        "math/big"
-
         "github.com/zclconf/go-cty/cty"
 )
 
@@ -30,11 +28,11 @@ var primitiveConversionsSafe = map[cty.Type]map[cty.Type]conversion{
 var primitiveConversionsUnsafe = map[cty.Type]map[cty.Type]conversion{
         cty.String: {
                 cty.Number: func(val cty.Value, path cty.Path) (cty.Value, error) {
-                        f, _, err := big.ParseFloat(val.AsString(), 10, 512, big.ToNearestEven)
+                        v, err := cty.ParseNumberVal(val.AsString())
                         if err != nil {
                                 return cty.NilVal, path.NewErrorf("a number is required")
                         }
-                        return cty.NumberVal(f), nil
+                        return v, nil
                 },
                 cty.Bool: func(val cty.Value, path cty.Path) (cty.Value, error) {
                         switch val.AsString() {
diff --git a/vendor/github.com/zclconf/go-cty/cty/convert/conversion_tuple.go b/vendor/github.com/zclconf/go-cty/cty/convert/conversion_tuple.go
new file mode 100644
index 0000000..592980a
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/convert/conversion_tuple.go
@@ -0,0 +1,71 @@
+package convert
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// conversionTupleToTuple returns a conversion that will make the input
+// tuple type conform to the output tuple type, if possible.
+//
+// Conversion is possible only if the two tuple types have the same number
+// of elements and the corresponding elements by index can be converted.
+//
+// Shallow tuple conversions work the same for both safe and unsafe modes,
+// but the safety flag is passed on to recursive conversions and may thus
+// limit which element type conversions are possible.
+func conversionTupleToTuple(in, out cty.Type, unsafe bool) conversion {
+        inEtys := in.TupleElementTypes()
+        outEtys := out.TupleElementTypes()
+
+        if len(inEtys) != len(outEtys) {
+                return nil // no conversion is possible
+        }
+
+        elemConvs := make([]conversion, len(inEtys))
+
+        for i, outEty := range outEtys {
+                inEty := inEtys[i]
+
+                if inEty.Equals(outEty) {
+                        // No conversion needed, so we can leave this one nil.
+                        continue
+                }
+
+                elemConvs[i] = getConversion(inEty, outEty, unsafe)
+                if elemConvs[i] == nil {
+                        // If a recursive conversion isn't available, then our top-level
+                        // configuration is impossible too.
+                        return nil
+                }
+        }
+
+        // If we get here then a conversion is possible, using the element
+        // conversions given in elemConvs.
+        return func(val cty.Value, path cty.Path) (cty.Value, error) {
+                elemVals := make([]cty.Value, len(elemConvs))
+                path = append(path, nil)
+                pathStep := &path[len(path)-1]
+
+                i := 0
+                for it := val.ElementIterator(); it.Next(); i++ {
+                        _, val := it.Element()
+                        var err error
+
+                        *pathStep = cty.IndexStep{
+                                Key: cty.NumberIntVal(int64(i)),
+                        }
+
+                        conv := elemConvs[i]
+                        if conv != nil {
+                                val, err = conv(val, path)
+                                if err != nil {
+                                        return cty.NilVal, err
+                                }
+                        }
+
+                        elemVals[i] = val
+                }
+
+                return cty.TupleVal(elemVals), nil
+        }
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/convert/mismatch_msg.go b/vendor/github.com/zclconf/go-cty/cty/convert/mismatch_msg.go
new file mode 100644
index 0000000..581304e
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/convert/mismatch_msg.go
@@ -0,0 +1,220 @@
+package convert
+
+import (
+        "bytes"
+        "fmt"
+        "sort"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// MismatchMessage is a helper to return an English-language description of
+// the differences between got and want, phrased as a reason why got does
+// not conform to want.
+//
+// This function does not itself attempt conversion, and so it should generally
+// be used only after a conversion has failed, to report the conversion failure
+// to an English-speaking user. The result will be confusing got is actually
+// conforming to or convertable to want.
+//
+// The shorthand helper function Convert uses this function internally to
+// produce its error messages, so callers of that function do not need to
+// also use MismatchMessage.
+//
+// This function is similar to Type.TestConformance, but it is tailored to
+// describing conversion failures and so the messages it generates relate
+// specifically to the conversion rules implemented in this package.
+func MismatchMessage(got, want cty.Type) string {
+        switch {
+
+        case got.IsObjectType() && want.IsObjectType():
+                // If both types are object types then we may be able to say something
+                // about their respective attributes.
+                return mismatchMessageObjects(got, want)
+
+        case got.IsTupleType() && want.IsListType() && want.ElementType() == cty.DynamicPseudoType:
+                // If conversion from tuple to list failed then it's because we couldn't
+                // find a common type to convert all of the tuple elements to.
+                return "all list elements must have the same type"
+
+        case got.IsTupleType() && want.IsSetType() && want.ElementType() == cty.DynamicPseudoType:
+                // If conversion from tuple to set failed then it's because we couldn't
+                // find a common type to convert all of the tuple elements to.
+                return "all set elements must have the same type"
+
+        case got.IsObjectType() && want.IsMapType() && want.ElementType() == cty.DynamicPseudoType:
+                // If conversion from object to map failed then it's because we couldn't
+                // find a common type to convert all of the object attributes to.
+                return "all map elements must have the same type"
+
+        case (got.IsTupleType() || got.IsObjectType()) && want.IsCollectionType():
+                return mismatchMessageCollectionsFromStructural(got, want)
+
+        case got.IsCollectionType() && want.IsCollectionType():
+                return mismatchMessageCollectionsFromCollections(got, want)
+
+        default:
+                // If we have nothing better to say, we'll just state what was required.
+                return want.FriendlyNameForConstraint() + " required"
+        }
+}
+
+func mismatchMessageObjects(got, want cty.Type) string {
+        // Per our conversion rules, "got" is allowed to be a superset of "want",
+        // and so we'll produce error messages here under that assumption.
+        gotAtys := got.AttributeTypes()
+        wantAtys := want.AttributeTypes()
+
+        // If we find missing attributes then we'll report those in preference,
+        // but if not then we will report a maximum of one non-conforming
+        // attribute, just to keep our messages relatively terse.
+        // We'll also prefer to report a recursive type error from an _unsafe_
+        // conversion over a safe one, because these are subjectively more
+        // "serious".
+        var missingAttrs []string
+        var unsafeMismatchAttr string
+        var safeMismatchAttr string
+
+        for name, wantAty := range wantAtys {
+                gotAty, exists := gotAtys[name]
+                if !exists {
+                        missingAttrs = append(missingAttrs, name)
+                        continue
+                }
+
+                // We'll now try to convert these attributes in isolation and
+                // see if we have a nested conversion error to report.
+                // We'll try an unsafe conversion first, and then fall back on
+                // safe if unsafe is possible.
+
+                // If we already have an unsafe mismatch attr error then we won't bother
+                // hunting for another one.
+                if unsafeMismatchAttr != "" {
+                        continue
+                }
+                if conv := GetConversionUnsafe(gotAty, wantAty); conv == nil {
+                        unsafeMismatchAttr = fmt.Sprintf("attribute %q: %s", name, MismatchMessage(gotAty, wantAty))
+                }
+
+                // If we already have a safe mismatch attr error then we won't bother
+                // hunting for another one.
+                if safeMismatchAttr != "" {
+                        continue
+                }
+                if conv := GetConversion(gotAty, wantAty); conv == nil {
+                        safeMismatchAttr = fmt.Sprintf("attribute %q: %s", name, MismatchMessage(gotAty, wantAty))
+                }
+        }
+
+        // We should now have collected at least one problem. If we have more than
+        // one then we'll use our preference order to decide what is most important
+        // to report.
+        switch {
+
+        case len(missingAttrs) != 0:
+                sort.Strings(missingAttrs)
+                switch len(missingAttrs) {
+                case 1:
+                        return fmt.Sprintf("attribute %q is required", missingAttrs[0])
+                case 2:
+                        return fmt.Sprintf("attributes %q and %q are required", missingAttrs[0], missingAttrs[1])
+                default:
+                        sort.Strings(missingAttrs)
+                        var buf bytes.Buffer
+                        for _, name := range missingAttrs[:len(missingAttrs)-1] {
+                                fmt.Fprintf(&buf, "%q, ", name)
+                        }
+                        fmt.Fprintf(&buf, "and %q", missingAttrs[len(missingAttrs)-1])
+                        return fmt.Sprintf("attributes %s are required", buf.Bytes())
+                }
+
+        case unsafeMismatchAttr != "":
+                return unsafeMismatchAttr
+
+        case safeMismatchAttr != "":
+                return safeMismatchAttr
+
+        default:
+                // We should never get here, but if we do then we'll return
+                // just a generic message.
+                return "incorrect object attributes"
+        }
+}
+
+func mismatchMessageCollectionsFromStructural(got, want cty.Type) string {
+        // First some straightforward cases where the kind is just altogether wrong.
+        switch {
+        case want.IsListType() && !got.IsTupleType():
+                return want.FriendlyNameForConstraint() + " required"
+        case want.IsSetType() && !got.IsTupleType():
+                return want.FriendlyNameForConstraint() + " required"
+        case want.IsMapType() && !got.IsObjectType():
+                return want.FriendlyNameForConstraint() + " required"
+        }
+
+        // If the kinds are matched well enough then we'll move on to checking
+        // individual elements.
+        wantEty := want.ElementType()
+        switch {
+        case got.IsTupleType():
+                for i, gotEty := range got.TupleElementTypes() {
+                        if gotEty.Equals(wantEty) {
+                                continue // exact match, so no problem
+                        }
+                        if conv := getConversion(gotEty, wantEty, true); conv != nil {
+                                continue // conversion is available, so no problem
+                        }
+                        return fmt.Sprintf("element %d: %s", i, MismatchMessage(gotEty, wantEty))
+                }
+
+                // If we get down here then something weird is going on but we'll
+                // return a reasonable fallback message anyway.
+                return fmt.Sprintf("all elements must be %s", wantEty.FriendlyNameForConstraint())
+
+        case got.IsObjectType():
+                for name, gotAty := range got.AttributeTypes() {
+                        if gotAty.Equals(wantEty) {
+                                continue // exact match, so no problem
+                        }
+                        if conv := getConversion(gotAty, wantEty, true); conv != nil {
+                                continue // conversion is available, so no problem
+                        }
+                        return fmt.Sprintf("element %q: %s", name, MismatchMessage(gotAty, wantEty))
+                }
+
+                // If we get down here then something weird is going on but we'll
+                // return a reasonable fallback message anyway.
+                return fmt.Sprintf("all elements must be %s", wantEty.FriendlyNameForConstraint())
+
+        default:
+                // Should not be possible to get here since we only call this function
+                // with got as structural types, but...
+                return want.FriendlyNameForConstraint() + " required"
+        }
+}
+
+func mismatchMessageCollectionsFromCollections(got, want cty.Type) string {
+        // First some straightforward cases where the kind is just altogether wrong.
+        switch {
+        case want.IsListType() && !(got.IsListType() || got.IsSetType()):
+                return want.FriendlyNameForConstraint() + " required"
+        case want.IsSetType() && !(got.IsListType() || got.IsSetType()):
+                return want.FriendlyNameForConstraint() + " required"
+        case want.IsMapType() && !got.IsMapType():
+                return want.FriendlyNameForConstraint() + " required"
+        }
+
+        // If the kinds are matched well enough then we'll check the element types.
+        gotEty := got.ElementType()
+        wantEty := want.ElementType()
+        noun := "element type"
+        switch {
+        case want.IsListType():
+                noun = "list element type"
+        case want.IsSetType():
+                noun = "set element type"
+        case want.IsMapType():
+                noun = "map element type"
+        }
+        return fmt.Sprintf("incorrect %s: %s", noun, MismatchMessage(gotEty, wantEty))
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/convert/public.go b/vendor/github.com/zclconf/go-cty/cty/convert/public.go
index 55f44ae..af19bdc 100644
--- a/vendor/github.com/zclconf/go-cty/cty/convert/public.go
+++ b/vendor/github.com/zclconf/go-cty/cty/convert/public.go
@@ -1,7 +1,7 @@
 package convert
 
 import (
-        "fmt"
+        "errors"
 
         "github.com/zclconf/go-cty/cty"
 )
@@ -46,7 +46,7 @@ func Convert(in cty.Value, want cty.Type) (cty.Value, error) {
 
         conv := GetConversionUnsafe(in.Type(), want)
         if conv == nil {
-                return cty.NilVal, fmt.Errorf("incorrect type; %s required", want.FriendlyName())
+                return cty.NilVal, errors.New(MismatchMessage(in.Type(), want))
         }
         return conv(in)
 }
diff --git a/vendor/github.com/zclconf/go-cty/cty/convert/unify.go b/vendor/github.com/zclconf/go-cty/cty/convert/unify.go
index bd6736b..53ebbfe 100644
--- a/vendor/github.com/zclconf/go-cty/cty/convert/unify.go
+++ b/vendor/github.com/zclconf/go-cty/cty/convert/unify.go
@@ -21,6 +21,39 @@ func unify(types []cty.Type, unsafe bool) (cty.Type, []Conversion) {
                 return cty.NilType, nil
         }
 
+        // If all of the given types are of the same structural kind, we may be
+        // able to construct a new type that they can all be unified to, even if
+        // that is not one of the given types. We must try this before the general
+        // behavior below because in unsafe mode we can convert an object type to
+        // a subset of that type, which would be a much less useful conversion for
+        // unification purposes.
+        {
+                objectCt := 0
+                tupleCt := 0
+                dynamicCt := 0
+                for _, ty := range types {
+                        switch {
+                        case ty.IsObjectType():
+                                objectCt++
+                        case ty.IsTupleType():
+                                tupleCt++
+                        case ty == cty.DynamicPseudoType:
+                                dynamicCt++
+                        default:
+                                break
+                        }
+                }
+                switch {
+                case objectCt > 0 && (objectCt+dynamicCt) == len(types):
+                        return unifyObjectTypes(types, unsafe, dynamicCt > 0)
+                case tupleCt > 0 && (tupleCt+dynamicCt) == len(types):
+                        return unifyTupleTypes(types, unsafe, dynamicCt > 0)
+                case objectCt > 0 && tupleCt > 0:
+                        // Can never unify object and tuple types since they have incompatible kinds
+                        return cty.NilType, nil
+                }
+        }
+
         prefOrder := sortTypes(types)
 
         // sortTypes gives us an order where earlier items are preferable as
@@ -58,9 +91,224 @@ Preferences:
                 return wantType, conversions
         }
 
-        // TODO: For structural types, try to invent a new type that they
-        // can all be unified to, by unifying their respective attributes.
-
         // If we fall out here, no unification is possible
         return cty.NilType, nil
 }
+
+func unifyObjectTypes(types []cty.Type, unsafe bool, hasDynamic bool) (cty.Type, []Conversion) {
+        // If we had any dynamic types in the input here then we can't predict
+        // what path we'll take through here once these become known types, so
+        // we'll conservatively produce DynamicVal for these.
+        if hasDynamic {
+                return unifyAllAsDynamic(types)
+        }
+
+        // There are two different ways we can succeed here:
+        // - If all of the given object types have the same set of attribute names
+        //   and the corresponding types are all unifyable, then we construct that
+        //   type.
+        // - If the given object types have different attribute names or their
+        //   corresponding types are not unifyable, we'll instead try to unify
+        //   all of the attribute types together to produce a map type.
+        //
+        // Our unification behavior is intentionally stricter than our conversion
+        // behavior for subset object types because user intent is different with
+        // unification use-cases: it makes sense to allow {"foo":true} to convert
+        // to emptyobjectval, but unifying an object with an attribute with the
+        // empty object type should be an error because unifying to the empty
+        // object type would be suprising and useless.
+
+        firstAttrs := types[0].AttributeTypes()
+        for _, ty := range types[1:] {
+                thisAttrs := ty.AttributeTypes()
+                if len(thisAttrs) != len(firstAttrs) {
+                        // If number of attributes is different then there can be no
+                        // object type in common.
+                        return unifyObjectTypesToMap(types, unsafe)
+                }
+                for name := range thisAttrs {
+                        if _, ok := firstAttrs[name]; !ok {
+                                // If attribute names don't exactly match then there can be
+                                // no object type in common.
+                                return unifyObjectTypesToMap(types, unsafe)
+                        }
+                }
+        }
+
+        // If we get here then we've proven that all of the given object types
+        // have exactly the same set of attribute names, though the types may
+        // differ.
+        retAtys := make(map[string]cty.Type)
+        atysAcross := make([]cty.Type, len(types))
+        for name := range firstAttrs {
+                for i, ty := range types {
+                        atysAcross[i] = ty.AttributeType(name)
+                }
+                retAtys[name], _ = unify(atysAcross, unsafe)
+                if retAtys[name] == cty.NilType {
+                        // Cannot unify this attribute alone, which means that unification
+                        // of everything down to a map type can't be possible either.
+                        return cty.NilType, nil
+                }
+        }
+        retTy := cty.Object(retAtys)
+
+        conversions := make([]Conversion, len(types))
+        for i, ty := range types {
+                if ty.Equals(retTy) {
+                        continue
+                }
+                if unsafe {
+                        conversions[i] = GetConversionUnsafe(ty, retTy)
+                } else {
+                        conversions[i] = GetConversion(ty, retTy)
+                }
+                if conversions[i] == nil {
+                        // Shouldn't be reachable, since we were able to unify
+                        return unifyObjectTypesToMap(types, unsafe)
+                }
+        }
+
+        return retTy, conversions
+}
+
+func unifyObjectTypesToMap(types []cty.Type, unsafe bool) (cty.Type, []Conversion) {
+        // This is our fallback case for unifyObjectTypes, where we see if we can
+        // construct a map type that can accept all of the attribute types.
+
+        var atys []cty.Type
+        for _, ty := range types {
+                for _, aty := range ty.AttributeTypes() {
+                        atys = append(atys, aty)
+                }
+        }
+
+        ety, _ := unify(atys, unsafe)
+        if ety == cty.NilType {
+                return cty.NilType, nil
+        }
+
+        retTy := cty.Map(ety)
+        conversions := make([]Conversion, len(types))
+        for i, ty := range types {
+                if ty.Equals(retTy) {
+                        continue
+                }
+                if unsafe {
+                        conversions[i] = GetConversionUnsafe(ty, retTy)
+                } else {
+                        conversions[i] = GetConversion(ty, retTy)
+                }
+                if conversions[i] == nil {
+                        return cty.NilType, nil
+                }
+        }
+        return retTy, conversions
+}
+
+func unifyTupleTypes(types []cty.Type, unsafe bool, hasDynamic bool) (cty.Type, []Conversion) {
+        // If we had any dynamic types in the input here then we can't predict
+        // what path we'll take through here once these become known types, so
+        // we'll conservatively produce DynamicVal for these.
+        if hasDynamic {
+                return unifyAllAsDynamic(types)
+        }
+
+        // There are two different ways we can succeed here:
+        // - If all of the given tuple types have the same sequence of element types
+        //   and the corresponding types are all unifyable, then we construct that
+        //   type.
+        // - If the given tuple types have different element types or their
+        //   corresponding types are not unifyable, we'll instead try to unify
+        //   all of the elements types together to produce a list type.
+
+        firstEtys := types[0].TupleElementTypes()
+        for _, ty := range types[1:] {
+                thisEtys := ty.TupleElementTypes()
+                if len(thisEtys) != len(firstEtys) {
+                        // If number of elements is different then there can be no
+                        // tuple type in common.
+                        return unifyTupleTypesToList(types, unsafe)
+                }
+        }
+
+        // If we get here then we've proven that all of the given tuple types
+        // have the same number of elements, though the types may differ.
+        retEtys := make([]cty.Type, len(firstEtys))
+        atysAcross := make([]cty.Type, len(types))
+        for idx := range firstEtys {
+                for tyI, ty := range types {
+                        atysAcross[tyI] = ty.TupleElementTypes()[idx]
+                }
+                retEtys[idx], _ = unify(atysAcross, unsafe)
+                if retEtys[idx] == cty.NilType {
+                        // Cannot unify this element alone, which means that unification
+                        // of everything down to a map type can't be possible either.
+                        return cty.NilType, nil
+                }
+        }
+        retTy := cty.Tuple(retEtys)
+
+        conversions := make([]Conversion, len(types))
+        for i, ty := range types {
+                if ty.Equals(retTy) {
+                        continue
+                }
+                if unsafe {
+                        conversions[i] = GetConversionUnsafe(ty, retTy)
+                } else {
+                        conversions[i] = GetConversion(ty, retTy)
+                }
+                if conversions[i] == nil {
+                        // Shouldn't be reachable, since we were able to unify
+                        return unifyTupleTypesToList(types, unsafe)
+                }
+        }
+
+        return retTy, conversions
+}
+
+func unifyTupleTypesToList(types []cty.Type, unsafe bool) (cty.Type, []Conversion) {
+        // This is our fallback case for unifyTupleTypes, where we see if we can
+        // construct a list type that can accept all of the element types.
+
+        var etys []cty.Type
+        for _, ty := range types {
+                for _, ety := range ty.TupleElementTypes() {
+                        etys = append(etys, ety)
+                }
+        }
+
+        ety, _ := unify(etys, unsafe)
+        if ety == cty.NilType {
+                return cty.NilType, nil
+        }
+
+        retTy := cty.List(ety)
+        conversions := make([]Conversion, len(types))
+        for i, ty := range types {
+                if ty.Equals(retTy) {
+                        continue
+                }
+                if unsafe {
+                        conversions[i] = GetConversionUnsafe(ty, retTy)
+                } else {
+                        conversions[i] = GetConversion(ty, retTy)
+                }
+                if conversions[i] == nil {
+                        // Shouldn't be reachable, since we were able to unify
+                        return unifyObjectTypesToMap(types, unsafe)
+                }
+        }
+        return retTy, conversions
+}
+
+func unifyAllAsDynamic(types []cty.Type) (cty.Type, []Conversion) {
+        conversions := make([]Conversion, len(types))
+        for i := range conversions {
+                conversions[i] = func(cty.Value) (cty.Value, error) {
+                        return cty.DynamicVal, nil
+                }
+        }
+        return cty.DynamicPseudoType, conversions
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/function/function.go b/vendor/github.com/zclconf/go-cty/cty/function/function.go
index 162f7bf..9e8bf33 100644
--- a/vendor/github.com/zclconf/go-cty/cty/function/function.go
+++ b/vendor/github.com/zclconf/go-cty/cty/function/function.go
@@ -143,7 +143,7 @@ func (f Function) ReturnTypeForValues(args []cty.Value) (ty cty.Type, err error)
                 val := posArgs[i]
 
                 if val.IsNull() && !spec.AllowNull {
-                        return cty.Type{}, NewArgErrorf(i, "must not be null")
+                        return cty.Type{}, NewArgErrorf(i, "argument must not be null")
                 }
 
                 // AllowUnknown is ignored for type-checking, since we expect to be
@@ -169,7 +169,7 @@ func (f Function) ReturnTypeForValues(args []cty.Value) (ty cty.Type, err error)
                         realI := i + len(posArgs)
 
                         if val.IsNull() && !spec.AllowNull {
-                                return cty.Type{}, NewArgErrorf(realI, "must not be null")
+                                return cty.Type{}, NewArgErrorf(realI, "argument must not be null")
                         }
 
                         if val.Type() == cty.DynamicPseudoType {
diff --git a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/datetime.go b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/datetime.go
new file mode 100644
index 0000000..aa15b7b
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/datetime.go
@@ -0,0 +1,385 @@
+package stdlib
+
+import (
+        "bufio"
+        "bytes"
+        "fmt"
+        "strings"
+        "time"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+var FormatDateFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "format",
+                        Type: cty.String,
+                },
+                {
+                        Name: "time",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                formatStr := args[0].AsString()
+                timeStr := args[1].AsString()
+                t, err := parseTimestamp(timeStr)
+                if err != nil {
+                        return cty.DynamicVal, function.NewArgError(1, err)
+                }
+
+                var buf bytes.Buffer
+                sc := bufio.NewScanner(strings.NewReader(formatStr))
+                sc.Split(splitDateFormat)
+                const esc = '\''
+                for sc.Scan() {
+                        tok := sc.Bytes()
+
+                        // The leading byte signals the token type
+                        switch {
+                        case tok[0] == esc:
+                                if tok[len(tok)-1] != esc || len(tok) == 1 {
+                                        return cty.DynamicVal, function.NewArgErrorf(0, "unterminated literal '")
+                                }
+                                if len(tok) == 2 {
+                                        // Must be a single escaped quote, ''
+                                        buf.WriteByte(esc)
+                                } else {
+                                        // The content (until a closing esc) is printed out verbatim
+                                        // except that we must un-double any double-esc escapes in
+                                        // the middle of the string.
+                                        raw := tok[1 : len(tok)-1]
+                                        for i := 0; i < len(raw); i++ {
+                                                buf.WriteByte(raw[i])
+                                                if raw[i] == esc {
+                                                        i++ // skip the escaped quote
+                                                }
+                                        }
+                                }
+
+                        case startsDateFormatVerb(tok[0]):
+                                switch tok[0] {
+                                case 'Y':
+                                        y := t.Year()
+                                        switch len(tok) {
+                                        case 2:
+                                                fmt.Fprintf(&buf, "%02d", y%100)
+                                        case 4:
+                                                fmt.Fprintf(&buf, "%04d", y)
+                                        default:
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: year must either be \"YY\" or \"YYYY\"", tok)
+                                        }
+                                case 'M':
+                                        m := t.Month()
+                                        switch len(tok) {
+                                        case 1:
+                                                fmt.Fprintf(&buf, "%d", m)
+                                        case 2:
+                                                fmt.Fprintf(&buf, "%02d", m)
+                                        case 3:
+                                                buf.WriteString(m.String()[:3])
+                                        case 4:
+                                                buf.WriteString(m.String())
+                                        default:
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: month must be \"M\", \"MM\", \"MMM\", or \"MMMM\"", tok)
+                                        }
+                                case 'D':
+                                        d := t.Day()
+                                        switch len(tok) {
+                                        case 1:
+                                                fmt.Fprintf(&buf, "%d", d)
+                                        case 2:
+                                                fmt.Fprintf(&buf, "%02d", d)
+                                        default:
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: day of month must either be \"D\" or \"DD\"", tok)
+                                        }
+                                case 'E':
+                                        d := t.Weekday()
+                                        switch len(tok) {
+                                        case 3:
+                                                buf.WriteString(d.String()[:3])
+                                        case 4:
+                                                buf.WriteString(d.String())
+                                        default:
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: day of week must either be \"EEE\" or \"EEEE\"", tok)
+                                        }
+                                case 'h':
+                                        h := t.Hour()
+                                        switch len(tok) {
+                                        case 1:
+                                                fmt.Fprintf(&buf, "%d", h)
+                                        case 2:
+                                                fmt.Fprintf(&buf, "%02d", h)
+                                        default:
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: 24-hour must either be \"h\" or \"hh\"", tok)
+                                        }
+                                case 'H':
+                                        h := t.Hour() % 12
+                                        if h == 0 {
+                                                h = 12
+                                        }
+                                        switch len(tok) {
+                                        case 1:
+                                                fmt.Fprintf(&buf, "%d", h)
+                                        case 2:
+                                                fmt.Fprintf(&buf, "%02d", h)
+                                        default:
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: 12-hour must either be \"H\" or \"HH\"", tok)
+                                        }
+                                case 'A', 'a':
+                                        if len(tok) != 2 {
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: must be \"%s%s\"", tok, tok[0:1], tok[0:1])
+                                        }
+                                        upper := tok[0] == 'A'
+                                        switch t.Hour() / 12 {
+                                        case 0:
+                                                if upper {
+                                                        buf.WriteString("AM")
+                                                } else {
+                                                        buf.WriteString("am")
+                                                }
+                                        case 1:
+                                                if upper {
+                                                        buf.WriteString("PM")
+                                                } else {
+                                                        buf.WriteString("pm")
+                                                }
+                                        }
+                                case 'm':
+                                        m := t.Minute()
+                                        switch len(tok) {
+                                        case 1:
+                                                fmt.Fprintf(&buf, "%d", m)
+                                        case 2:
+                                                fmt.Fprintf(&buf, "%02d", m)
+                                        default:
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: minute must either be \"m\" or \"mm\"", tok)
+                                        }
+                                case 's':
+                                        s := t.Second()
+                                        switch len(tok) {
+                                        case 1:
+                                                fmt.Fprintf(&buf, "%d", s)
+                                        case 2:
+                                                fmt.Fprintf(&buf, "%02d", s)
+                                        default:
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: second must either be \"s\" or \"ss\"", tok)
+                                        }
+                                case 'Z':
+                                        // We'll just lean on Go's own formatter for this one, since
+                                        // the necessary information is unexported.
+                                        switch len(tok) {
+                                        case 1:
+                                                buf.WriteString(t.Format("Z07:00"))
+                                        case 3:
+                                                str := t.Format("-0700")
+                                                switch str {
+                                                case "+0000":
+                                                        buf.WriteString("UTC")
+                                                default:
+                                                        buf.WriteString(str)
+                                                }
+                                        case 4:
+                                                buf.WriteString(t.Format("-0700"))
+                                        case 5:
+                                                buf.WriteString(t.Format("-07:00"))
+                                        default:
+                                                return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q: timezone must be Z, ZZZZ, or ZZZZZ", tok)
+                                        }
+                                default:
+                                        return cty.DynamicVal, function.NewArgErrorf(0, "invalid date format verb %q", tok)
+                                }
+
+                        default:
+                                // Any other starting character indicates a literal sequence
+                                buf.Write(tok)
+                        }
+                }
+
+                return cty.StringVal(buf.String()), nil
+        },
+})
+
+// FormatDate reformats a timestamp given in RFC3339 syntax into another time
+// syntax defined by a given format string.
+//
+// The format string uses letter mnemonics to represent portions of the
+// timestamp, with repetition signifying length variants of each portion.
+// Single quote characters ' can be used to quote sequences of literal letters
+// that should not be interpreted as formatting mnemonics.
+//
+// The full set of supported mnemonic sequences is listed below:
+//
+//     YY       Year modulo 100 zero-padded to two digits, like "06".
+//     YYYY     Four (or more) digit year, like "2006".
+//     M        Month number, like "1" for January.
+//     MM       Month number zero-padded to two digits, like "01".
+//     MMM      English month name abbreviated to three letters, like "Jan".
+//     MMMM     English month name unabbreviated, like "January".
+//     D        Day of month number, like "2".
+//     DD       Day of month number zero-padded to two digits, like "02".
+//     EEE      English day of week name abbreviated to three letters, like "Mon".
+//     EEEE     English day of week name unabbreviated, like "Monday".
+//     h        24-hour number, like "2".
+//     hh       24-hour number zero-padded to two digits, like "02".
+//     H        12-hour number, like "2".
+//     HH       12-hour number zero-padded to two digits, like "02".
+//     AA       Hour AM/PM marker in uppercase, like "AM".
+//     aa       Hour AM/PM marker in lowercase, like "am".
+//     m        Minute within hour, like "5".
+//     mm       Minute within hour zero-padded to two digits, like "05".
+//     s        Second within minute, like "9".
+//     ss       Second within minute zero-padded to two digits, like "09".
+//     ZZZZ     Timezone offset with just sign and digit, like "-0800".
+//     ZZZZZ    Timezone offset with colon separating hours and minutes, like "-08:00".
+//     Z        Like ZZZZZ but with a special case "Z" for UTC.
+//     ZZZ      Like ZZZZ but with a special case "UTC" for UTC.
+//
+// The format syntax is optimized mainly for generating machine-oriented
+// timestamps rather than human-oriented timestamps; the English language
+// portions of the output reflect the use of English names in a number of
+// machine-readable date formatting standards. For presentation to humans,
+// a locale-aware time formatter (not included in this package) is a better
+// choice.
+//
+// The format syntax is not compatible with that of any other language, but
+// is optimized so that patterns for common standard date formats can be
+// recognized quickly even by a reader unfamiliar with the format syntax.
+func FormatDate(format cty.Value, timestamp cty.Value) (cty.Value, error) {
+        return FormatDateFunc.Call([]cty.Value{format, timestamp})
+}
+
+func parseTimestamp(ts string) (time.Time, error) {
+        t, err := time.Parse(time.RFC3339, ts)
+        if err != nil {
+                switch err := err.(type) {
+                case *time.ParseError:
+                        // If err is s time.ParseError then its string representation is not
+                        // appropriate since it relies on details of Go's strange date format
+                        // representation, which a caller of our functions is not expected
+                        // to be familiar with.
+                        //
+                        // Therefore we do some light transformation to get a more suitable
+                        // error that should make more sense to our callers. These are
+                        // still not awesome error messages, but at least they refer to
+                        // the timestamp portions by name rather than by Go's example
+                        // values.
+                        if err.LayoutElem == "" && err.ValueElem == "" && err.Message != "" {
+                                // For some reason err.Message is populated with a ": " prefix
+                                // by the time package.
+                                return time.Time{}, fmt.Errorf("not a valid RFC3339 timestamp%s", err.Message)
+                        }
+                        var what string
+                        switch err.LayoutElem {
+                        case "2006":
+                                what = "year"
+                        case "01":
+                                what = "month"
+                        case "02":
+                                what = "day of month"
+                        case "15":
+                                what = "hour"
+                        case "04":
+                                what = "minute"
+                        case "05":
+                                what = "second"
+                        case "Z07:00":
+                                what = "UTC offset"
+                        case "T":
+                                return time.Time{}, fmt.Errorf("not a valid RFC3339 timestamp: missing required time introducer 'T'")
+                        case ":", "-":
+                                if err.ValueElem == "" {
+                                        return time.Time{}, fmt.Errorf("not a valid RFC3339 timestamp: end of string where %q is expected", err.LayoutElem)
+                                } else {
+                                        return time.Time{}, fmt.Errorf("not a valid RFC3339 timestamp: found %q where %q is expected", err.ValueElem, err.LayoutElem)
+                                }
+                        default:
+                                // Should never get here, because time.RFC3339 includes only the
+                                // above portions, but since that might change in future we'll
+                                // be robust here.
+                                what = "timestamp segment"
+                        }
+                        if err.ValueElem == "" {
+                                return time.Time{}, fmt.Errorf("not a valid RFC3339 timestamp: end of string before %s", what)
+                        } else {
+                                return time.Time{}, fmt.Errorf("not a valid RFC3339 timestamp: cannot use %q as %s", err.ValueElem, what)
+                        }
+                }
+                return time.Time{}, err
+        }
+        return t, nil
+}
+
+// splitDataFormat is a bufio.SplitFunc used to tokenize a date format.
+func splitDateFormat(data []byte, atEOF bool) (advance int, token []byte, err error) {
+        if len(data) == 0 {
+                return 0, nil, nil
+        }
+
+        const esc = '\''
+
+        switch {
+
+        case data[0] == esc:
+                // If we have another quote immediately after then this is a single
+                // escaped escape.
+                if len(data) > 1 && data[1] == esc {
+                        return 2, data[:2], nil
+                }
+
+                // Beginning of quoted sequence, so we will seek forward until we find
+                // the closing quote, ignoring escaped quotes along the way.
+                for i := 1; i < len(data); i++ {
+                        if data[i] == esc {
+                                if (i + 1) == len(data) {
+                                        // We need at least one more byte to decide if this is an
+                                        // escape or a terminator.
+                                        return 0, nil, nil
+                                }
+                                if data[i+1] == esc {
+                                        i++ // doubled-up quotes are an escape sequence
+                                        continue
+                                }
+                                // We've found the closing quote
+                                return i + 1, data[:i+1], nil
+                        }
+                }
+                // If we fall out here then we need more bytes to find the end,
+                // unless we're already at the end with an unclosed quote.
+                if atEOF {
+                        return len(data), data, nil
+                }
+                return 0, nil, nil
+
+        case startsDateFormatVerb(data[0]):
+                rep := data[0]
+                for i := 1; i < len(data); i++ {
+                        if data[i] != rep {
+                                return i, data[:i], nil
+                        }
+                }
+                if atEOF {
+                        return len(data), data, nil
+                }
+                // We need more data to decide if we've found the end
+                return 0, nil, nil
+
+        default:
+                for i := 1; i < len(data); i++ {
+                        if data[i] == esc || startsDateFormatVerb(data[i]) {
+                                return i, data[:i], nil
+                        }
+                }
+                // We might not actually be at the end of a literal sequence,
+                // but that doesn't matter since we'll concat them back together
+                // anyway.
+                return len(data), data, nil
+        }
+}
+
+func startsDateFormatVerb(b byte) bool {
+        return (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z')
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format.go b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format.go
index fb24f20..664790b 100644
--- a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format.go
+++ b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format.go
@@ -84,6 +84,11 @@ var FormatListFunc = function.New(&function.Spec{
                         argTy := arg.Type()
                         switch {
                         case (argTy.IsListType() || argTy.IsSetType() || argTy.IsTupleType()) && !arg.IsNull():
+                                if !argTy.IsTupleType() && !arg.IsKnown() {
+                                        // We can't iterate this one at all yet then, so we can't
+                                        // yet produce a result.
+                                        return cty.UnknownVal(retType), nil
+                                }
                                 thisLen := arg.LengthInt()
                                 if iterLen == -1 {
                                         iterLen = thisLen
diff --git a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format_fsm.go b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format_fsm.go
index 86876ba..32b1ac9 100644
--- a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format_fsm.go
+++ b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format_fsm.go
@@ -11,9 +11,10 @@ import (
         "unicode/utf8"
 
         "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
 )
 
-// line 20 "format_fsm.go"
+// line 21 "format_fsm.go"
 var _formatfsm_actions []byte = []byte{
         0, 1, 0, 1, 1, 1, 2, 1, 4,
         1, 5, 1, 6, 1, 7, 1, 8,
@@ -86,15 +87,16 @@ const formatfsm_error int = 0
 
 const formatfsm_en_main int = 8
 
-// line 19 "format_fsm.rl"
+// line 20 "format_fsm.rl"
 
 func formatFSM(format string, a []cty.Value) (string, error) {
         var buf bytes.Buffer
         data := format
         nextArg := 1 // arg numbers are 1-based
         var verb formatVerb
+        highestArgIdx := 0 // zero means "none", since arg numbers are 1-based
 
-        // line 153 "format_fsm.rl"
+        // line 159 "format_fsm.rl"
 
         // Ragel state
         p := 0          // "Pointer" into data
@@ -109,12 +111,12 @@ func formatFSM(format string, a []cty.Value) (string, error) {
         _ = te
         _ = eof
 
-        // line 121 "format_fsm.go"
+        // line 123 "format_fsm.go"
         {
                 cs = formatfsm_start
         }
 
-        // line 126 "format_fsm.go"
+        // line 128 "format_fsm.go"
         {
                 var _klen int
                 var _trans int
@@ -195,7 +197,7 @@ func formatFSM(format string, a []cty.Value) (string, error) {
                         _acts++
                         switch _formatfsm_actions[_acts-1] {
                         case 0:
-                                // line 29 "format_fsm.rl"
+                                // line 31 "format_fsm.rl"
 
                                 verb = formatVerb{
                                         ArgNum: nextArg,
@@ -205,12 +207,12 @@ func formatFSM(format string, a []cty.Value) (string, error) {
                                 ts = p
 
                         case 1:
-                                // line 38 "format_fsm.rl"
+                                // line 40 "format_fsm.rl"
 
                                 buf.WriteByte(data[p])
 
                         case 4:
-                                // line 49 "format_fsm.rl"
+                                // line 51 "format_fsm.rl"
 
                                 // We'll try to slurp a whole UTF-8 sequence here, to give the user
                                 // better feedback.
@@ -218,85 +220,89 @@ func formatFSM(format string, a []cty.Value) (string, error) {
                                 return buf.String(), fmt.Errorf("unrecognized format character %q at offset %d", r, p)
 
                         case 5:
-                                // line 56 "format_fsm.rl"
+                                // line 58 "format_fsm.rl"
 
                                 verb.Sharp = true
 
                         case 6:
-                                // line 59 "format_fsm.rl"
+                                // line 61 "format_fsm.rl"
 
                                 verb.Zero = true
 
                         case 7:
-                                // line 62 "format_fsm.rl"
+                                // line 64 "format_fsm.rl"
 
                                 verb.Minus = true
 
                         case 8:
-                                // line 65 "format_fsm.rl"
+                                // line 67 "format_fsm.rl"
 
                                 verb.Plus = true
 
                         case 9:
-                                // line 68 "format_fsm.rl"
+                                // line 70 "format_fsm.rl"
 
                                 verb.Space = true
 
                         case 10:
-                                // line 72 "format_fsm.rl"
+                                // line 74 "format_fsm.rl"
 
                                 verb.ArgNum = 0
 
                         case 11:
-                                // line 75 "format_fsm.rl"
+                                // line 77 "format_fsm.rl"
 
                                 verb.ArgNum = (10 * verb.ArgNum) + (int(data[p]) - '0')
 
                         case 12:
-                                // line 79 "format_fsm.rl"
+                                // line 81 "format_fsm.rl"
 
                                 verb.HasWidth = true
 
                         case 13:
-                                // line 82 "format_fsm.rl"
+                                // line 84 "format_fsm.rl"
 
                                 verb.Width = 0
 
                         case 14:
-                                // line 85 "format_fsm.rl"
+                                // line 87 "format_fsm.rl"
 
                                 verb.Width = (10 * verb.Width) + (int(data[p]) - '0')
 
                         case 15:
-                                // line 89 "format_fsm.rl"
+                                // line 91 "format_fsm.rl"
 
                                 verb.HasPrec = true
 
                         case 16:
-                                // line 92 "format_fsm.rl"
+                                // line 94 "format_fsm.rl"
 
                                 verb.Prec = 0
 
                         case 17:
-                                // line 95 "format_fsm.rl"
+                                // line 97 "format_fsm.rl"
 
                                 verb.Prec = (10 * verb.Prec) + (int(data[p]) - '0')
 
                         case 18:
-                                // line 99 "format_fsm.rl"
+                                // line 101 "format_fsm.rl"
 
                                 verb.Mode = rune(data[p])
                                 te = p + 1
                                 verb.Raw = data[ts:te]
                                 verb.Offset = ts
 
+                                if verb.ArgNum > highestArgIdx {
+                                        highestArgIdx = verb.ArgNum
+                                }
+
                                 err := formatAppend(&verb, &buf, a)
                                 if err != nil {
                                         return buf.String(), err
                                 }
                                 nextArg = verb.ArgNum + 1
 
-                                // line 324 "format_fsm.go"
+                                // line 330 "format_fsm.go"
                         }
                 }
 
@@ -319,22 +325,22 @@ func formatFSM(format string, a []cty.Value) (string, error) {
                                 __acts++
                                 switch _formatfsm_actions[__acts-1] {
                                 case 2:
-                                        // line 42 "format_fsm.rl"
+                                        // line 44 "format_fsm.rl"
 
                                 case 3:
-                                        // line 45 "format_fsm.rl"
+                                        // line 47 "format_fsm.rl"
 
                                         return buf.String(), fmt.Errorf("invalid format string starting at offset %d", p)
 
                                 case 4:
-                                        // line 49 "format_fsm.rl"
+                                        // line 51 "format_fsm.rl"
 
                                         // We'll try to slurp a whole UTF-8 sequence here, to give the user
                                         // better feedback.
                                         r, _ := utf8.DecodeRuneInString(data[p:])
                                         return buf.String(), fmt.Errorf("unrecognized format character %q at offset %d", r, p)
 
-                                        // line 363 "format_fsm.go"
+                                        // line 369 "format_fsm.go"
                                 }
                         }
                 }
@@ -344,14 +350,24 @@ func formatFSM(format string, a []cty.Value) (string, error) {
                 }
         }
 
-        // line 171 "format_fsm.rl"
+        // line 177 "format_fsm.rl"
 
         // If we fall out here without being in a final state then we've
         // encountered something that the scanner can't match, which should
         // be impossible (the scanner matches all bytes _somehow_) but we'll
         // flag it anyway rather than just losing data from the end.
         if cs < formatfsm_first_final {
-                return buf.String(), fmt.Errorf("extraneous characters beginning at offset %i", p)
+                return buf.String(), fmt.Errorf("extraneous characters beginning at offset %d", p)
+        }
+
+        if highestArgIdx < len(a) {
+                // Extraneous args are an error, to more easily detect mistakes
+                firstBad := highestArgIdx + 1
+                if highestArgIdx == 0 {
+                        // Custom error message for this case
+                        return buf.String(), function.NewArgErrorf(firstBad, "too many arguments; no verbs in format string")
+                }
+                return buf.String(), function.NewArgErrorf(firstBad, "too many arguments; only %d used by format string", highestArgIdx)
         }
 
         return buf.String(), nil
diff --git a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format_fsm.rl b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format_fsm.rl
index 85d43bb..3c642d9 100644
--- a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format_fsm.rl
+++ b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format_fsm.rl
@@ -12,6 +12,7 @@ import (
         "unicode/utf8"
 
         "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
 )
 
 %%{
@@ -23,6 +24,7 @@ func formatFSM(format string, a []cty.Value) (string, error) {
         data := format
         nextArg := 1 // arg numbers are 1-based
         var verb formatVerb
+        highestArgIdx := 0 // zero means "none", since arg numbers are 1-based
 
         %%{
 
@@ -102,6 +104,10 @@ func formatFSM(format string, a []cty.Value) (string, error) {
                 verb.Raw = data[ts:te]
                 verb.Offset = ts
 
+                if verb.ArgNum > highestArgIdx {
+                        highestArgIdx = verb.ArgNum
+                }
+
                 err := formatAppend(&verb, &buf, a)
                 if err != nil {
                         return buf.String(), err
@@ -175,7 +181,17 @@ func formatFSM(format string, a []cty.Value) (string, error) {
         // be impossible (the scanner matches all bytes _somehow_) but we'll
         // flag it anyway rather than just losing data from the end.
         if cs < formatfsm_first_final {
-                return buf.String(), fmt.Errorf("extraneous characters beginning at offset %i", p)
+                return buf.String(), fmt.Errorf("extraneous characters beginning at offset %d", p)
+        }
+
+        if highestArgIdx < len(a) {
+                // Extraneous args are an error, to more easily detect mistakes
+                firstBad := highestArgIdx+1
+                if highestArgIdx == 0 {
+                        // Custom error message for this case
+                        return buf.String(), function.NewArgErrorf(firstBad, "too many arguments; no verbs in format string")
+                }
+                return buf.String(), function.NewArgErrorf(firstBad, "too many arguments; only %d used by format string", highestArgIdx)
         }
 
         return buf.String(), nil
diff --git a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/regexp.go b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/regexp.go
new file mode 100644
index 0000000..2dd6348
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/regexp.go
@@ -0,0 +1,233 @@
+package stdlib
+
+import (
+        "fmt"
+        "regexp"
+        resyntax "regexp/syntax"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+var RegexFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "pattern",
+                        Type: cty.String,
+                },
+                {
+                        Name: "string",
+                        Type: cty.String,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                if !args[0].IsKnown() {
+                        // We can't predict our type without seeing our pattern
+                        return cty.DynamicPseudoType, nil
+                }
+
+                retTy, err := regexPatternResultType(args[0].AsString())
+                if err != nil {
+                        err = function.NewArgError(0, err)
+                }
+                return retTy, err
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                if retType == cty.DynamicPseudoType {
+                        return cty.DynamicVal, nil
+                }
+
+                re, err := regexp.Compile(args[0].AsString())
+                if err != nil {
+                        // Should never happen, since we checked this in the Type function above.
+                        return cty.NilVal, function.NewArgErrorf(0, "error parsing pattern: %s", err)
+                }
+                str := args[1].AsString()
+
+                captureIdxs := re.FindStringSubmatchIndex(str)
+                if captureIdxs == nil {
+                        return cty.NilVal, fmt.Errorf("pattern did not match any part of the given string")
+                }
+
+                return regexPatternResult(re, str, captureIdxs, retType), nil
+        },
+})
+
+var RegexAllFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "pattern",
+                        Type: cty.String,
+                },
+                {
+                        Name: "string",
+                        Type: cty.String,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                if !args[0].IsKnown() {
+                        // We can't predict our type without seeing our pattern,
+                        // but we do know it'll always be a list of something.
+                        return cty.List(cty.DynamicPseudoType), nil
+                }
+
+                retTy, err := regexPatternResultType(args[0].AsString())
+                if err != nil {
+                        err = function.NewArgError(0, err)
+                }
+                return cty.List(retTy), err
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                ety := retType.ElementType()
+                if ety == cty.DynamicPseudoType {
+                        return cty.DynamicVal, nil
+                }
+
+                re, err := regexp.Compile(args[0].AsString())
+                if err != nil {
+                        // Should never happen, since we checked this in the Type function above.
+                        return cty.NilVal, function.NewArgErrorf(0, "error parsing pattern: %s", err)
+                }
+                str := args[1].AsString()
+
+                captureIdxsEach := re.FindAllStringSubmatchIndex(str, -1)
+                if len(captureIdxsEach) == 0 {
+                        return cty.ListValEmpty(ety), nil
+                }
+
+                elems := make([]cty.Value, len(captureIdxsEach))
+                for i, captureIdxs := range captureIdxsEach {
+                        elems[i] = regexPatternResult(re, str, captureIdxs, ety)
+                }
+                return cty.ListVal(elems), nil
+        },
+})
+
+// Regex is a function that extracts one or more substrings from a given
+// string by applying a regular expression pattern, describing the first
+// match.
+//
+// The return type depends on the composition of the capture groups (if any)
+// in the pattern:
+//
+//   - If there are no capture groups at all, the result is a single string
+//     representing the entire matched pattern.
+//   - If all of the capture groups are named, the result is an object whose
+//     keys are the named groups and whose values are their sub-matches, or
+//     null if a particular sub-group was inside another group that didn't
+//     match.
+//   - If none of the capture groups are named, the result is a tuple whose
+//     elements are the sub-groups in order and whose values are their
+//     sub-matches, or null if a particular sub-group was inside another group
+//     that didn't match.
+//   - It is invalid to use both named and un-named capture groups together in
+//     the same pattern.
+//
+// If the pattern doesn't match, this function returns an error. To test for
+// a match, call RegexAll and check if the length of the result is greater
+// than zero.
+func Regex(pattern, str cty.Value) (cty.Value, error) {
+        return RegexFunc.Call([]cty.Value{pattern, str})
+}
+
+// RegexAll is similar to Regex but it finds all of the non-overlapping matches
+// in the given string and returns a list of them.
+//
+// The result type is always a list, whose element type is deduced from the
+// pattern in the same way as the return type for Regex is decided.
+//
+// If the pattern doesn't match at all, this function returns an empty list.
+func RegexAll(pattern, str cty.Value) (cty.Value, error) {
+        return RegexAllFunc.Call([]cty.Value{pattern, str})
+}
+
+// regexPatternResultType parses the given regular expression pattern and
+// returns the structural type that would be returned to represent its
+// capture groups.
+//
+// Returns an error if parsing fails or if the pattern uses a mixture of
+// named and unnamed capture groups, which is not permitted.
+func regexPatternResultType(pattern string) (cty.Type, error) {
+        re, rawErr := regexp.Compile(pattern)
+        switch err := rawErr.(type) {
+        case *resyntax.Error:
+                return cty.NilType, fmt.Errorf("invalid regexp pattern: %s in %s", err.Code, err.Expr)
+        case error:
+                // Should never happen, since all regexp compile errors should
+                // be resyntax.Error, but just in case...
+                return cty.NilType, fmt.Errorf("error parsing pattern: %s", err)
+        }
+
+        allNames := re.SubexpNames()[1:]
+        var names []string
+        unnamed := 0
+        for _, name := range allNames {
+                if name == "" {
+                        unnamed++
+                } else {
+                        if names == nil {
+                                names = make([]string, 0, len(allNames))
+                        }
+                        names = append(names, name)
+                }
+        }
+        switch {
+        case unnamed == 0 && len(names) == 0:
+                // If there are no capture groups at all then we'll return just a
+                // single string for the whole match.
+                return cty.String, nil
+        case unnamed > 0 && len(names) > 0:
+                return cty.NilType, fmt.Errorf("invalid regexp pattern: cannot mix both named and unnamed capture groups")
+        case unnamed > 0:
+                // For unnamed captures, we return a tuple of them all in order.
+                etys := make([]cty.Type, unnamed)
+                for i := range etys {
+                        etys[i] = cty.String
+                }
+                return cty.Tuple(etys), nil
+        default:
+                // For named captures, we return an object using the capture names
+                // as keys.
+                atys := make(map[string]cty.Type, len(names))
+                for _, name := range names {
+                        atys[name] = cty.String
+                }
+                return cty.Object(atys), nil
+        }
+}
+
+func regexPatternResult(re *regexp.Regexp, str string, captureIdxs []int, retType cty.Type) cty.Value {
+        switch {
+        case retType == cty.String:
+                start, end := captureIdxs[0], captureIdxs[1]
+                return cty.StringVal(str[start:end])
+        case retType.IsTupleType():
+                captureIdxs = captureIdxs[2:] // index 0 is the whole pattern span, which we ignore by skipping one pair
+                vals := make([]cty.Value, len(captureIdxs)/2)
+                for i := range vals {
+                        start, end := captureIdxs[i*2], captureIdxs[i*2+1]
+                        if start < 0 || end < 0 {
+                                vals[i] = cty.NullVal(cty.String) // Did not match anything because containing group didn't match
+                                continue
+                        }
+                        vals[i] = cty.StringVal(str[start:end])
+                }
+                return cty.TupleVal(vals)
+        case retType.IsObjectType():
+                captureIdxs = captureIdxs[2:] // index 0 is the whole pattern span, which we ignore by skipping one pair
+                vals := make(map[string]cty.Value, len(captureIdxs)/2)
+                names := re.SubexpNames()[1:]
+                for i, name := range names {
+                        start, end := captureIdxs[i*2], captureIdxs[i*2+1]
+                        if start < 0 || end < 0 {
+                                vals[name] = cty.NullVal(cty.String) // Did not match anything because containing group didn't match
+                                continue
+                        }
+                        vals[name] = cty.StringVal(str[start:end])
+                }
+                return cty.ObjectVal(vals)
+        default:
+                // Should never happen
+                panic(fmt.Sprintf("invalid return type %#v", retType))
+        }
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/sequence.go b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/sequence.go
index e2c77c5..d3cc341 100644
--- a/vendor/github.com/zclconf/go-cty/cty/function/stdlib/sequence.go
+++ b/vendor/github.com/zclconf/go-cty/cty/function/stdlib/sequence.go
@@ -119,6 +119,75 @@ var ConcatFunc = function.New(&function.Spec{
         },
 })
 
+var RangeFunc = function.New(&function.Spec{
+        VarParam: &function.Parameter{
+                Name: "params",
+                Type: cty.Number,
+        },
+        Type: function.StaticReturnType(cty.List(cty.Number)),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var start, end, step cty.Value
+                switch len(args) {
+                case 1:
+                        if args[0].LessThan(cty.Zero).True() {
+                                start, end, step = cty.Zero, args[0], cty.NumberIntVal(-1)
+                        } else {
+                                start, end, step = cty.Zero, args[0], cty.NumberIntVal(1)
+                        }
+                case 2:
+                        if args[1].LessThan(args[0]).True() {
+                                start, end, step = args[0], args[1], cty.NumberIntVal(-1)
+                        } else {
+                                start, end, step = args[0], args[1], cty.NumberIntVal(1)
+                        }
+                case 3:
+                        start, end, step = args[0], args[1], args[2]
+                default:
+                        return cty.NilVal, fmt.Errorf("must have one, two, or three arguments")
+                }
+
+                var vals []cty.Value
+
+                if step == cty.Zero {
+                        return cty.NilVal, function.NewArgErrorf(2, "step must not be zero")
+                }
+                down := step.LessThan(cty.Zero).True()
+
+                if down {
+                        if end.GreaterThan(start).True() {
+                                return cty.NilVal, function.NewArgErrorf(1, "end must be less than start when step is negative")
+                        }
+                } else {
+                        if end.LessThan(start).True() {
+                                return cty.NilVal, function.NewArgErrorf(1, "end must be greater than start when step is positive")
+                        }
+                }
+
+                num := start
+                for {
+                        if down {
+                                if num.LessThanOrEqualTo(end).True() {
+                                        break
+                                }
+                        } else {
+                                if num.GreaterThanOrEqualTo(end).True() {
+                                        break
+                                }
+                        }
+                        if len(vals) >= 1024 {
+                                // Artificial limit to prevent bad arguments from consuming huge amounts of memory
+                                return cty.NilVal, fmt.Errorf("more than 1024 values were generated; either decrease the difference between start and end or use a smaller step")
+                        }
+                        vals = append(vals, num)
+                        num = num.Add(step)
+                }
+                if len(vals) == 0 {
+                        return cty.ListValEmpty(cty.Number), nil
+                }
+                return cty.ListVal(vals), nil
+        },
+})
+
 // Concat takes one or more sequences (lists or tuples) and returns the single
 // sequence that results from concatenating them together in order.
 //
@@ -128,3 +197,22 @@ var ConcatFunc = function.New(&function.Spec{
 func Concat(seqs ...cty.Value) (cty.Value, error) {
         return ConcatFunc.Call(seqs)
 }
+
+// Range creates a list of numbers by starting from the given starting value,
+// then adding the given step value until the result is greater than or
+// equal to the given stopping value. Each intermediate result becomes an
+// element in the resulting list.
+//
+// When all three parameters are set, the order is (start, end, step). If
+// only two parameters are set, they are the start and end respectively and
+// step defaults to 1. If only one argument is set, it gives the end value
+// with start defaulting to 0 and step defaulting to 1.
+//
+// Because the resulting list must be fully buffered in memory, there is an
+// artificial cap of 1024 elements, after which this function will return
+// an error to avoid consuming unbounded amounts of memory. The Range function
+// is primarily intended for creating small lists of indices to iterate over,
+// so there should be no reason to generate huge lists with it.
+func Range(params ...cty.Value) (cty.Value, error) {
+        return RangeFunc.Call(params)
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/gob.go b/vendor/github.com/zclconf/go-cty/cty/gob.go
index 3d73199..a77dace 100644
--- a/vendor/github.com/zclconf/go-cty/cty/gob.go
+++ b/vendor/github.com/zclconf/go-cty/cty/gob.go
@@ -103,11 +103,11 @@ func (t *Type) GobDecode(buf []byte) error {
 // Capsule types cannot currently be gob-encoded, because they rely on pointer
 // equality and we have no way to recover the original pointer on decode.
 func (t *capsuleType) GobEncode() ([]byte, error) {
-        return nil, fmt.Errorf("cannot gob-encode capsule type %q", t.FriendlyName())
+        return nil, fmt.Errorf("cannot gob-encode capsule type %q", t.FriendlyName(friendlyTypeName))
 }
 
 func (t *capsuleType) GobDecode() ([]byte, error) {
-        return nil, fmt.Errorf("cannot gob-decode capsule type %q", t.FriendlyName())
+        return nil, fmt.Errorf("cannot gob-decode capsule type %q", t.FriendlyName(friendlyTypeName))
 }
 
 type gobValue struct {
diff --git a/vendor/github.com/zclconf/go-cty/cty/gocty/in.go b/vendor/github.com/zclconf/go-cty/cty/gocty/in.go
index 642501b..ca9de21 100644
--- a/vendor/github.com/zclconf/go-cty/cty/gocty/in.go
+++ b/vendor/github.com/zclconf/go-cty/cty/gocty/in.go
@@ -5,6 +5,7 @@ import (
         "reflect"
 
         "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
         "github.com/zclconf/go-cty/cty/set"
 )
 
@@ -32,6 +33,11 @@ func ToCtyValue(val interface{}, ty cty.Type) (cty.Value, error) {
 }
 
 func toCtyValue(val reflect.Value, ty cty.Type, path cty.Path) (cty.Value, error) {
+        if val != (reflect.Value{}) && val.Type().AssignableTo(valueType) {
+                // If the source value is a cty.Value then we'll try to just pass
+                // through to the target type directly.
+                return toCtyPassthrough(val, ty, path)
+        }
 
         switch ty {
         case cty.Bool:
@@ -505,6 +511,20 @@ func toCtyDynamic(val reflect.Value, path cty.Path) (cty.Value, error) {
 
 }
 
+func toCtyPassthrough(wrappedVal reflect.Value, wantTy cty.Type, path cty.Path) (cty.Value, error) {
+        if wrappedVal = toCtyUnwrapPointer(wrappedVal); !wrappedVal.IsValid() {
+                return cty.NullVal(wantTy), nil
+        }
+
+        givenVal := wrappedVal.Interface().(cty.Value)
+
+        val, err := convert.Convert(givenVal, wantTy)
+        if err != nil {
+                return cty.NilVal, path.NewErrorf("unsuitable value: %s", err)
+        }
+        return val, nil
+}
+
 // toCtyUnwrapPointer is a helper for dealing with Go pointers. It has three
 // possible outcomes:
 //
diff --git a/vendor/github.com/zclconf/go-cty/cty/gocty/out.go b/vendor/github.com/zclconf/go-cty/cty/gocty/out.go
index 99b65a7..e9c2599 100644
--- a/vendor/github.com/zclconf/go-cty/cty/gocty/out.go
+++ b/vendor/github.com/zclconf/go-cty/cty/gocty/out.go
@@ -1,11 +1,10 @@
 package gocty
 
 import (
+        "math"
         "math/big"
         "reflect"
 
-        "math"
-
         "github.com/zclconf/go-cty/cty"
 )
 
@@ -112,11 +111,7 @@ func fromCtyBool(val cty.Value, target reflect.Value, path cty.Path) error {
         switch target.Kind() {
 
         case reflect.Bool:
-                if val.True() {
-                        target.Set(reflect.ValueOf(true))
-                } else {
-                        target.Set(reflect.ValueOf(false))
-                }
+                target.SetBool(val.True())
                 return nil
 
         default:
@@ -175,8 +170,7 @@ func fromCtyNumberInt(bf *big.Float, target reflect.Value, path cty.Path) error
                 return path.NewErrorf("value must be a whole number, between %d and %d", min, max)
         }
 
-        target.Set(reflect.ValueOf(iv).Convert(target.Type()))
-
+        target.SetInt(iv)
         return nil
 }
 
@@ -202,25 +196,13 @@ func fromCtyNumberUInt(bf *big.Float, target reflect.Value, path cty.Path) error
                 return path.NewErrorf("value must be a whole number, between 0 and %d inclusive", max)
         }
 
-        target.Set(reflect.ValueOf(iv).Convert(target.Type()))
-
+        target.SetUint(iv)
         return nil
 }
 
 func fromCtyNumberFloat(bf *big.Float, target reflect.Value, path cty.Path) error {
         switch target.Kind() {
-        case reflect.Float32:
-                fv, accuracy := bf.Float32()
-                if accuracy != big.Exact {
-                        // We allow the precision to be truncated as part of our conversion,
-                        // but we don't want to silently introduce infinities.
-                        if math.IsInf(float64(fv), 0) {
-                                return path.NewErrorf("value must be between %f and %f inclusive", -math.MaxFloat32, math.MaxFloat32)
-                        }
-                }
-                target.Set(reflect.ValueOf(fv))
-                return nil
-        case reflect.Float64:
+        case reflect.Float32, reflect.Float64:
                 fv, accuracy := bf.Float64()
                 if accuracy != big.Exact {
                         // We allow the precision to be truncated as part of our conversion,
@@ -229,7 +211,7 @@ func fromCtyNumberFloat(bf *big.Float, target reflect.Value, path cty.Path) erro
                                 return path.NewErrorf("value must be between %f and %f inclusive", -math.MaxFloat64, math.MaxFloat64)
                         }
                 }
-                target.Set(reflect.ValueOf(fv))
+                target.SetFloat(fv)
                 return nil
         default:
                 panic("unsupported kind of float")
@@ -239,17 +221,17 @@ func fromCtyNumberFloat(bf *big.Float, target reflect.Value, path cty.Path) erro
 func fromCtyNumberBig(bf *big.Float, target reflect.Value, path cty.Path) error {
         switch {
 
-        case bigFloatType.AssignableTo(target.Type()):
+        case bigFloatType.ConvertibleTo(target.Type()):
                 // Easy!
-                target.Set(reflect.ValueOf(bf).Elem())
+                target.Set(reflect.ValueOf(bf).Elem().Convert(target.Type()))
                 return nil
 
-        case bigIntType.AssignableTo(target.Type()):
+        case bigIntType.ConvertibleTo(target.Type()):
                 bi, accuracy := bf.Int(nil)
                 if accuracy != big.Exact {
                         return path.NewErrorf("value must be a whole number")
                 }
-                target.Set(reflect.ValueOf(bi).Elem())
+                target.Set(reflect.ValueOf(bi).Elem().Convert(target.Type()))
                 return nil
 
         default:
@@ -259,9 +241,8 @@ func fromCtyNumberBig(bf *big.Float, target reflect.Value, path cty.Path) error
 
 func fromCtyString(val cty.Value, target reflect.Value, path cty.Path) error {
         switch target.Kind() {
-
         case reflect.String:
-                target.Set(reflect.ValueOf(val.AsString()))
+                target.SetString(val.AsString())
                 return nil
 
         default:
diff --git a/vendor/github.com/zclconf/go-cty/cty/json/type_implied.go b/vendor/github.com/zclconf/go-cty/cty/json/type_implied.go
index 1a97306..0fa13f6 100644
--- a/vendor/github.com/zclconf/go-cty/cty/json/type_implied.go
+++ b/vendor/github.com/zclconf/go-cty/cty/json/type_implied.go
@@ -138,7 +138,7 @@ func impliedObjectType(dec *json.Decoder) (cty.Type, error) {
 }
 
 func impliedTupleType(dec *json.Decoder) (cty.Type, error) {
-        // By the time we get in here, we've already consumed the { delimiter
+        // By the time we get in here, we've already consumed the [ delimiter
         // and so our next token should be the first value.
 
         var etys []cty.Type
@@ -150,10 +150,9 @@ func impliedTupleType(dec *json.Decoder) (cty.Type, error) {
                 }
 
                 if ttok, ok := tok.(json.Delim); ok {
-                        if rune(ttok) != ']' {
-                                return cty.NilType, fmt.Errorf("unexpected delimiter %q", ttok)
+                        if rune(ttok) == ']' {
+                                break
                         }
-                        break
                 }
 
                 ety, err := impliedTypeForTok(tok, dec)
diff --git a/vendor/github.com/zclconf/go-cty/cty/json/unmarshal.go b/vendor/github.com/zclconf/go-cty/cty/json/unmarshal.go
index 155f0b8..3810645 100644
--- a/vendor/github.com/zclconf/go-cty/cty/json/unmarshal.go
+++ b/vendor/github.com/zclconf/go-cty/cty/json/unmarshal.go
@@ -72,7 +72,7 @@ func unmarshalPrimitive(tok json.Token, t cty.Type, path cty.Path) (cty.Value, e
                 }
                 switch v := tok.(type) {
                 case string:
-                        val, err := convert.Convert(cty.StringVal(v), t)
+                        val, err := cty.ParseNumberVal(v)
                         if err != nil {
                                 return cty.NilVal, path.NewError(err)
                         }
diff --git a/vendor/github.com/zclconf/go-cty/cty/list_type.go b/vendor/github.com/zclconf/go-cty/cty/list_type.go
index eadc865..2ef02a1 100644
--- a/vendor/github.com/zclconf/go-cty/cty/list_type.go
+++ b/vendor/github.com/zclconf/go-cty/cty/list_type.go
@@ -33,8 +33,14 @@ func (t typeList) Equals(other Type) bool {
         return t.ElementTypeT.Equals(ot.ElementTypeT)
 }
 
-func (t typeList) FriendlyName() string {
-        return "list of " + t.ElementTypeT.FriendlyName()
+func (t typeList) FriendlyName(mode friendlyTypeNameMode) string {
+        elemName := t.ElementTypeT.friendlyNameMode(mode)
+        if mode == friendlyTypeConstraintName {
+                if t.ElementTypeT == DynamicPseudoType {
+                        elemName = "any single type"
+                }
+        }
+        return "list of " + elemName
 }
 
 func (t typeList) ElementType() Type {
diff --git a/vendor/github.com/zclconf/go-cty/cty/map_type.go b/vendor/github.com/zclconf/go-cty/cty/map_type.go
index ae9abae..82d36c6 100644
--- a/vendor/github.com/zclconf/go-cty/cty/map_type.go
+++ b/vendor/github.com/zclconf/go-cty/cty/map_type.go
@@ -33,8 +33,14 @@ func (t typeMap) Equals(other Type) bool {
         return t.ElementTypeT.Equals(ot.ElementTypeT)
 }
 
-func (t typeMap) FriendlyName() string {
-        return "map of " + t.ElementTypeT.FriendlyName()
+func (t typeMap) FriendlyName(mode friendlyTypeNameMode) string {
+        elemName := t.ElementTypeT.friendlyNameMode(mode)
+        if mode == friendlyTypeConstraintName {
+                if t.ElementTypeT == DynamicPseudoType {
+                        elemName = "any single type"
+                }
+        }
+        return "map of " + elemName
 }
 
 func (t typeMap) ElementType() Type {
diff --git a/vendor/github.com/zclconf/go-cty/cty/msgpack/doc.go b/vendor/github.com/zclconf/go-cty/cty/msgpack/doc.go
new file mode 100644
index 0000000..1eb99f2
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/msgpack/doc.go
@@ -0,0 +1,14 @@
+// Package msgpack provides functions for serializing cty values in the
+// msgpack encoding, and decoding them again.
+//
+// If the same type information is provided both at encoding and decoding time
+// then values can be round-tripped without loss, except for capsule types
+// which are not currently supported.
+//
+// If any unknown values are passed to Marshal then they will be represented
+// using a msgpack extension with type code zero, which is understood by
+// the Unmarshal function within this package but will not be understood by
+// a generic (non-cty-aware) msgpack decoder. Ensure that no unknown values
+// are used if interoperability with other msgpack implementations is
+// required.
+package msgpack
diff --git a/vendor/github.com/zclconf/go-cty/cty/msgpack/dynamic.go b/vendor/github.com/zclconf/go-cty/cty/msgpack/dynamic.go
new file mode 100644
index 0000000..1b631d0
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/msgpack/dynamic.go
@@ -0,0 +1,31 @@
+package msgpack
+
+import (
+        "bytes"
+
+        "github.com/vmihailenco/msgpack"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type dynamicVal struct {
+        Value cty.Value
+        Path  cty.Path
+}
+
+func (dv *dynamicVal) MarshalMsgpack() ([]byte, error) {
+        // Rather than defining a msgpack-specific serialization of types,
+        // instead we use the existing JSON serialization.
+        typeJSON, err := dv.Value.Type().MarshalJSON()
+        if err != nil {
+                return nil, dv.Path.NewErrorf("failed to serialize type: %s", err)
+        }
+        var buf bytes.Buffer
+        enc := msgpack.NewEncoder(&buf)
+        enc.EncodeArrayLen(2)
+        enc.EncodeBytes(typeJSON)
+        err = marshal(dv.Value, dv.Value.Type(), dv.Path, enc)
+        if err != nil {
+                return nil, err
+        }
+        return buf.Bytes(), nil
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/msgpack/infinity.go b/vendor/github.com/zclconf/go-cty/cty/msgpack/infinity.go
new file mode 100644
index 0000000..6db0815
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/msgpack/infinity.go
@@ -0,0 +1,8 @@
+package msgpack
+
+import (
+        "math"
+)
+
+var negativeInfinity = math.Inf(-1)
+var positiveInfinity = math.Inf(1)
diff --git a/vendor/github.com/zclconf/go-cty/cty/msgpack/marshal.go b/vendor/github.com/zclconf/go-cty/cty/msgpack/marshal.go
new file mode 100644
index 0000000..87b096c
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/msgpack/marshal.go
@@ -0,0 +1,207 @@
+package msgpack
+
+import (
+        "bytes"
+        "math/big"
+        "sort"
+
+        "github.com/vmihailenco/msgpack"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// Marshal produces a msgpack serialization of the given value that
+// can be decoded into the given type later using Unmarshal.
+//
+// The given value must conform to the given type, or an error will
+// be returned.
+func Marshal(val cty.Value, ty cty.Type) ([]byte, error) {
+        errs := val.Type().TestConformance(ty)
+        if errs != nil {
+                // Attempt a conversion
+                var err error
+                val, err = convert.Convert(val, ty)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        // From this point onward, val can be assumed to be conforming to t.
+
+        var path cty.Path
+        var buf bytes.Buffer
+        enc := msgpack.NewEncoder(&buf)
+
+        err := marshal(val, ty, path, enc)
+        if err != nil {
+                return nil, err
+        }
+
+        return buf.Bytes(), nil
+}
+
+func marshal(val cty.Value, ty cty.Type, path cty.Path, enc *msgpack.Encoder) error {
+        // If we're going to decode as DynamicPseudoType then we need to save
+        // dynamic type information to recover the real type.
+        if ty == cty.DynamicPseudoType && val.Type() != cty.DynamicPseudoType {
+                return marshalDynamic(val, path, enc)
+        }
+
+        if !val.IsKnown() {
+                err := enc.Encode(unknownVal)
+                if err != nil {
+                        return path.NewError(err)
+                }
+                return nil
+        }
+        if val.IsNull() {
+                err := enc.EncodeNil()
+                if err != nil {
+                        return path.NewError(err)
+                }
+                return nil
+        }
+
+        // The caller should've guaranteed that the given val is conformant with
+        // the given type ty, so we'll proceed under that assumption here.
+        switch {
+        case ty.IsPrimitiveType():
+                switch ty {
+                case cty.String:
+                        err := enc.EncodeString(val.AsString())
+                        if err != nil {
+                                return path.NewError(err)
+                        }
+                        return nil
+                case cty.Number:
+                        var err error
+                        switch {
+                        case val.RawEquals(cty.PositiveInfinity):
+                                err = enc.EncodeFloat64(positiveInfinity)
+                        case val.RawEquals(cty.NegativeInfinity):
+                                err = enc.EncodeFloat64(negativeInfinity)
+                        default:
+                                bf := val.AsBigFloat()
+                                if iv, acc := bf.Int64(); acc == big.Exact {
+                                        err = enc.EncodeInt(iv)
+                                } else if fv, acc := bf.Float64(); acc == big.Exact {
+                                        err = enc.EncodeFloat64(fv)
+                                } else {
+                                        err = enc.EncodeString(bf.Text('f', -1))
+                                }
+                        }
+                        if err != nil {
+                                return path.NewError(err)
+                        }
+                        return nil
+                case cty.Bool:
+                        err := enc.EncodeBool(val.True())
+                        if err != nil {
+                                return path.NewError(err)
+                        }
+                        return nil
+                default:
+                        panic("unsupported primitive type")
+                }
+        case ty.IsListType(), ty.IsSetType():
+                enc.EncodeArrayLen(val.LengthInt())
+                ety := ty.ElementType()
+                it := val.ElementIterator()
+                path := append(path, nil) // local override of 'path' with extra element
+                for it.Next() {
+                        ek, ev := it.Element()
+                        path[len(path)-1] = cty.IndexStep{
+                                Key: ek,
+                        }
+                        err := marshal(ev, ety, path, enc)
+                        if err != nil {
+                                return err
+                        }
+                }
+                return nil
+        case ty.IsMapType():
+                enc.EncodeMapLen(val.LengthInt())
+                ety := ty.ElementType()
+                it := val.ElementIterator()
+                path := append(path, nil) // local override of 'path' with extra element
+                for it.Next() {
+                        ek, ev := it.Element()
+                        path[len(path)-1] = cty.IndexStep{
+                                Key: ek,
+                        }
+                        var err error
+                        err = marshal(ek, ek.Type(), path, enc)
+                        if err != nil {
+                                return err
+                        }
+                        err = marshal(ev, ety, path, enc)
+                        if err != nil {
+                                return err
+                        }
+                }
+                return nil
+        case ty.IsTupleType():
+                etys := ty.TupleElementTypes()
+                it := val.ElementIterator()
+                path := append(path, nil) // local override of 'path' with extra element
+                i := 0
+                enc.EncodeArrayLen(len(etys))
+                for it.Next() {
+                        ety := etys[i]
+                        ek, ev := it.Element()
+                        path[len(path)-1] = cty.IndexStep{
+                                Key: ek,
+                        }
+                        err := marshal(ev, ety, path, enc)
+                        if err != nil {
+                                return err
+                        }
+                        i++
+                }
+                return nil
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                path := append(path, nil) // local override of 'path' with extra element
+
+                names := make([]string, 0, len(atys))
+                for k := range atys {
+                        names = append(names, k)
+                }
+                sort.Strings(names)
+
+                enc.EncodeMapLen(len(names))
+
+                for _, k := range names {
+                        aty := atys[k]
+                        av := val.GetAttr(k)
+                        path[len(path)-1] = cty.GetAttrStep{
+                                Name: k,
+                        }
+                        var err error
+                        err = marshal(cty.StringVal(k), cty.String, path, enc)
+                        if err != nil {
+                                return err
+                        }
+                        err = marshal(av, aty, path, enc)
+                        if err != nil {
+                                return err
+                        }
+                }
+                return nil
+        case ty.IsCapsuleType():
+                return path.NewErrorf("capsule types not supported for msgpack encoding")
+        default:
+                // should never happen
+                return path.NewErrorf("cannot msgpack-serialize %s", ty.FriendlyName())
+        }
+}
+
+// marshalDynamic adds an extra wrapping object containing dynamic type
+// information for the given value.
+func marshalDynamic(val cty.Value, path cty.Path, enc *msgpack.Encoder) error {
+        dv := dynamicVal{
+                Value: val,
+                Path:  path,
+        }
+        return enc.Encode(&dv)
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/msgpack/type_implied.go b/vendor/github.com/zclconf/go-cty/cty/msgpack/type_implied.go
new file mode 100644
index 0000000..6f6022e
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/msgpack/type_implied.go
@@ -0,0 +1,167 @@
+package msgpack
+
+import (
+        "bytes"
+        "fmt"
+        "io"
+
+        "github.com/vmihailenco/msgpack"
+        msgpackcodes "github.com/vmihailenco/msgpack/codes"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ImpliedType returns the cty Type implied by the structure of the given
+// msgpack-compliant buffer. This function implements the default type mapping
+// behavior used when decoding arbitrary msgpack without explicit cty Type
+// information.
+//
+// The rules are as follows:
+//
+// msgpack strings, numbers and bools map to their equivalent primitive type in
+// cty.
+//
+// msgpack maps become cty object types, with the attributes defined by the
+// map keys and the types of their values.
+//
+// msgpack arrays become cty tuple types, with the elements defined by the
+// types of the array members.
+//
+// Any nulls are typed as DynamicPseudoType, so callers of this function
+// must be prepared to deal with this. Callers that do not wish to deal with
+// dynamic typing should not use this function and should instead describe
+// their required types explicitly with a cty.Type instance when decoding.
+//
+// Any unknown values are similarly typed as DynamicPseudoType, because these
+// do not carry type information on the wire.
+//
+// Any parse errors will be returned as an error, and the type will be the
+// invalid value cty.NilType.
+func ImpliedType(buf []byte) (cty.Type, error) {
+        r := bytes.NewReader(buf)
+        dec := msgpack.NewDecoder(r)
+
+        ty, err := impliedType(dec)
+        if err != nil {
+                return cty.NilType, err
+        }
+
+        // We must now be at the end of the buffer
+        err = dec.Skip()
+        if err != io.EOF {
+                return ty, fmt.Errorf("extra bytes after msgpack value")
+        }
+
+        return ty, nil
+}
+
+func impliedType(dec *msgpack.Decoder) (cty.Type, error) {
+        // If this function returns with a nil error then it must have already
+        // consumed the next value from the decoder, since when called recursively
+        // the caller will be expecting to find a following value here.
+
+        code, err := dec.PeekCode()
+        if err != nil {
+                return cty.NilType, err
+        }
+
+        switch {
+
+        case code == msgpackcodes.Nil || msgpackcodes.IsExt(code):
+                err := dec.Skip()
+                return cty.DynamicPseudoType, err
+
+        case code == msgpackcodes.True || code == msgpackcodes.False:
+                _, err := dec.DecodeBool()
+                return cty.Bool, err
+
+        case msgpackcodes.IsFixedNum(code):
+                _, err := dec.DecodeInt64()
+                return cty.Number, err
+
+        case code == msgpackcodes.Int8 || code == msgpackcodes.Int16 || code == msgpackcodes.Int32 || code == msgpackcodes.Int64:
+                _, err := dec.DecodeInt64()
+                return cty.Number, err
+
+        case code == msgpackcodes.Uint8 || code == msgpackcodes.Uint16 || code == msgpackcodes.Uint32 || code == msgpackcodes.Uint64:
+                _, err := dec.DecodeUint64()
+                return cty.Number, err
+
+        case code == msgpackcodes.Float || code == msgpackcodes.Double:
+                _, err := dec.DecodeFloat64()
+                return cty.Number, err
+
+        case msgpackcodes.IsString(code):
+                _, err := dec.DecodeString()
+                return cty.String, err
+
+        case msgpackcodes.IsFixedMap(code) || code == msgpackcodes.Map16 || code == msgpackcodes.Map32:
+                return impliedObjectType(dec)
+
+        case msgpackcodes.IsFixedArray(code) || code == msgpackcodes.Array16 || code == msgpackcodes.Array32:
+                return impliedTupleType(dec)
+
+        default:
+                return cty.NilType, fmt.Errorf("unsupported msgpack code %#v", code)
+        }
+}
+
+func impliedObjectType(dec *msgpack.Decoder) (cty.Type, error) {
+        // If we get in here then we've already peeked the next code and know
+        // it's some sort of map.
+        l, err := dec.DecodeMapLen()
+        if err != nil {
+                return cty.DynamicPseudoType, nil
+        }
+
+        var atys map[string]cty.Type
+
+        for i := 0; i < l; i++ {
+                // Read the map key first. We require maps to be strings, but msgpack
+                // doesn't so we're prepared to error here if not.
+                k, err := dec.DecodeString()
+                if err != nil {
+                        return cty.DynamicPseudoType, err
+                }
+
+                aty, err := impliedType(dec)
+                if err != nil {
+                        return cty.DynamicPseudoType, err
+                }
+
+                if atys == nil {
+                        atys = make(map[string]cty.Type)
+                }
+                atys[k] = aty
+        }
+
+        if len(atys) == 0 {
+                return cty.EmptyObject, nil
+        }
+
+        return cty.Object(atys), nil
+}
+
+func impliedTupleType(dec *msgpack.Decoder) (cty.Type, error) {
+        // If we get in here then we've already peeked the next code and know
+        // it's some sort of array.
+        l, err := dec.DecodeArrayLen()
+        if err != nil {
+                return cty.DynamicPseudoType, nil
+        }
+
+        if l == 0 {
+                return cty.EmptyTuple, nil
+        }
+
+        etys := make([]cty.Type, l)
+
+        for i := 0; i < l; i++ {
+                ety, err := impliedType(dec)
+                if err != nil {
+                        return cty.DynamicPseudoType, err
+                }
+                etys[i] = ety
+        }
+
+        return cty.Tuple(etys), nil
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/msgpack/unknown.go b/vendor/github.com/zclconf/go-cty/cty/msgpack/unknown.go
new file mode 100644
index 0000000..6507bc4
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/msgpack/unknown.go
@@ -0,0 +1,16 @@
+package msgpack
+
+type unknownType struct{}
+
+var unknownVal = unknownType{}
+
+// unknownValBytes is the raw bytes of the msgpack fixext1 value we
+// write to represent an unknown value. It's an extension value of
+// type zero whose value is irrelevant. Since it's irrelevant, we
+// set it to a single byte whose value is also zero, since that's
+// the most compact possible representation.
+var unknownValBytes = []byte{0xd4, 0, 0}
+
+func (uv unknownType) MarshalMsgpack() ([]byte, error) {
+        return unknownValBytes, nil
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/msgpack/unmarshal.go b/vendor/github.com/zclconf/go-cty/cty/msgpack/unmarshal.go
new file mode 100644
index 0000000..51bb76a
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/msgpack/unmarshal.go
@@ -0,0 +1,334 @@
+package msgpack
+
+import (
+        "bytes"
+
+        "github.com/vmihailenco/msgpack"
+        msgpackCodes "github.com/vmihailenco/msgpack/codes"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Unmarshal interprets the given bytes as a msgpack-encoded cty Value of
+// the given type, returning the result.
+//
+// If an error is returned, the error is written with a hypothetical
+// end-user that wrote the msgpack file as its audience, using cty type
+// system concepts rather than Go type system concepts.
+func Unmarshal(b []byte, ty cty.Type) (cty.Value, error) {
+        r := bytes.NewReader(b)
+        dec := msgpack.NewDecoder(r)
+
+        var path cty.Path
+        return unmarshal(dec, ty, path)
+}
+
+func unmarshal(dec *msgpack.Decoder, ty cty.Type, path cty.Path) (cty.Value, error) {
+        peek, err := dec.PeekCode()
+        if err != nil {
+                return cty.DynamicVal, path.NewError(err)
+        }
+        if msgpackCodes.IsExt(peek) {
+                // We just assume _all_ extensions are unknown values,
+                // since we don't have any other extensions.
+                dec.Skip() // skip what we've peeked
+                return cty.UnknownVal(ty), nil
+        }
+        if ty == cty.DynamicPseudoType {
+                return unmarshalDynamic(dec, path)
+        }
+        if peek == msgpackCodes.Nil {
+                dec.Skip() // skip what we've peeked
+                return cty.NullVal(ty), nil
+        }
+
+        switch {
+        case ty.IsPrimitiveType():
+                val, err := unmarshalPrimitive(dec, ty, path)
+                if err != nil {
+                        return cty.NilVal, err
+                }
+                return val, nil
+        case ty.IsListType():
+                return unmarshalList(dec, ty.ElementType(), path)
+        case ty.IsSetType():
+                return unmarshalSet(dec, ty.ElementType(), path)
+        case ty.IsMapType():
+                return unmarshalMap(dec, ty.ElementType(), path)
+        case ty.IsTupleType():
+                return unmarshalTuple(dec, ty.TupleElementTypes(), path)
+        case ty.IsObjectType():
+                return unmarshalObject(dec, ty.AttributeTypes(), path)
+        default:
+                return cty.NilVal, path.NewErrorf("unsupported type %s", ty.FriendlyName())
+        }
+}
+
+func unmarshalPrimitive(dec *msgpack.Decoder, ty cty.Type, path cty.Path) (cty.Value, error) {
+        switch ty {
+        case cty.Bool:
+                rv, err := dec.DecodeBool()
+                if err != nil {
+                        return cty.DynamicVal, path.NewErrorf("bool is required")
+                }
+                return cty.BoolVal(rv), nil
+        case cty.Number:
+                // Marshal will try int and float first, if the value can be
+                // losslessly represented in these encodings, and then fall
+                // back on a string if the number is too large or too precise.
+                peek, err := dec.PeekCode()
+                if err != nil {
+                        return cty.DynamicVal, path.NewErrorf("number is required")
+                }
+
+                if msgpackCodes.IsFixedNum(peek) {
+                        rv, err := dec.DecodeInt64()
+                        if err != nil {
+                                return cty.DynamicVal, path.NewErrorf("number is required")
+                        }
+                        return cty.NumberIntVal(rv), nil
+                }
+
+                switch peek {
+                case msgpackCodes.Int8, msgpackCodes.Int16, msgpackCodes.Int32, msgpackCodes.Int64:
+                        rv, err := dec.DecodeInt64()
+                        if err != nil {
+                                return cty.DynamicVal, path.NewErrorf("number is required")
+                        }
+                        return cty.NumberIntVal(rv), nil
+                case msgpackCodes.Uint8, msgpackCodes.Uint16, msgpackCodes.Uint32, msgpackCodes.Uint64:
+                        rv, err := dec.DecodeUint64()
+                        if err != nil {
+                                return cty.DynamicVal, path.NewErrorf("number is required")
+                        }
+                        return cty.NumberUIntVal(rv), nil
+                case msgpackCodes.Float, msgpackCodes.Double:
+                        rv, err := dec.DecodeFloat64()
+                        if err != nil {
+                                return cty.DynamicVal, path.NewErrorf("number is required")
+                        }
+                        return cty.NumberFloatVal(rv), nil
+                default:
+                        rv, err := dec.DecodeString()
+                        if err != nil {
+                                return cty.DynamicVal, path.NewErrorf("number is required")
+                        }
+                        v, err := cty.ParseNumberVal(rv)
+                        if err != nil {
+                                return cty.DynamicVal, path.NewErrorf("number is required")
+                        }
+                        return v, nil
+                }
+        case cty.String:
+                rv, err := dec.DecodeString()
+                if err != nil {
+                        return cty.DynamicVal, path.NewErrorf("string is required")
+                }
+                return cty.StringVal(rv), nil
+        default:
+                // should never happen
+                panic("unsupported primitive type")
+        }
+}
+
+func unmarshalList(dec *msgpack.Decoder, ety cty.Type, path cty.Path) (cty.Value, error) {
+        length, err := dec.DecodeArrayLen()
+        if err != nil {
+                return cty.DynamicVal, path.NewErrorf("a list is required")
+        }
+
+        switch {
+        case length < 0:
+                return cty.NullVal(cty.List(ety)), nil
+        case length == 0:
+                return cty.ListValEmpty(ety), nil
+        }
+
+        vals := make([]cty.Value, 0, length)
+        path = append(path, nil)
+        for i := 0; i < length; i++ {
+                path[len(path)-1] = cty.IndexStep{
+                        Key: cty.NumberIntVal(int64(i)),
+                }
+
+                val, err := unmarshal(dec, ety, path)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+
+                vals = append(vals, val)
+        }
+
+        return cty.ListVal(vals), nil
+}
+
+func unmarshalSet(dec *msgpack.Decoder, ety cty.Type, path cty.Path) (cty.Value, error) {
+        length, err := dec.DecodeArrayLen()
+        if err != nil {
+                return cty.DynamicVal, path.NewErrorf("a set is required")
+        }
+
+        switch {
+        case length < 0:
+                return cty.NullVal(cty.Set(ety)), nil
+        case length == 0:
+                return cty.SetValEmpty(ety), nil
+        }
+
+        vals := make([]cty.Value, 0, length)
+        path = append(path, nil)
+        for i := 0; i < length; i++ {
+                path[len(path)-1] = cty.IndexStep{
+                        Key: cty.NumberIntVal(int64(i)),
+                }
+
+                val, err := unmarshal(dec, ety, path)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+
+                vals = append(vals, val)
+        }
+
+        return cty.SetVal(vals), nil
+}
+
+func unmarshalMap(dec *msgpack.Decoder, ety cty.Type, path cty.Path) (cty.Value, error) {
+        length, err := dec.DecodeMapLen()
+        if err != nil {
+                return cty.DynamicVal, path.NewErrorf("a map is required")
+        }
+
+        switch {
+        case length < 0:
+                return cty.NullVal(cty.Map(ety)), nil
+        case length == 0:
+                return cty.MapValEmpty(ety), nil
+        }
+
+        vals := make(map[string]cty.Value, length)
+        path = append(path, nil)
+        for i := 0; i < length; i++ {
+                key, err := dec.DecodeString()
+                if err != nil {
+                        path[:len(path)-1].NewErrorf("non-string key in map")
+                }
+
+                path[len(path)-1] = cty.IndexStep{
+                        Key: cty.StringVal(key),
+                }
+
+                val, err := unmarshal(dec, ety, path)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+
+                vals[key] = val
+        }
+
+        return cty.MapVal(vals), nil
+}
+
+func unmarshalTuple(dec *msgpack.Decoder, etys []cty.Type, path cty.Path) (cty.Value, error) {
+        length, err := dec.DecodeArrayLen()
+        if err != nil {
+                return cty.DynamicVal, path.NewErrorf("a tuple is required")
+        }
+
+        switch {
+        case length < 0:
+                return cty.NullVal(cty.Tuple(etys)), nil
+        case length == 0:
+                return cty.TupleVal(nil), nil
+        case length != len(etys):
+                return cty.DynamicVal, path.NewErrorf("a tuple of length %d is required", len(etys))
+        }
+
+        vals := make([]cty.Value, 0, length)
+        path = append(path, nil)
+        for i := 0; i < length; i++ {
+                path[len(path)-1] = cty.IndexStep{
+                        Key: cty.NumberIntVal(int64(i)),
+                }
+                ety := etys[i]
+
+                val, err := unmarshal(dec, ety, path)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+
+                vals = append(vals, val)
+        }
+
+        return cty.TupleVal(vals), nil
+}
+
+func unmarshalObject(dec *msgpack.Decoder, atys map[string]cty.Type, path cty.Path) (cty.Value, error) {
+        length, err := dec.DecodeMapLen()
+        if err != nil {
+                return cty.DynamicVal, path.NewErrorf("an object is required")
+        }
+
+        switch {
+        case length < 0:
+                return cty.NullVal(cty.Object(atys)), nil
+        case length == 0:
+                return cty.ObjectVal(nil), nil
+        case length != len(atys):
+                return cty.DynamicVal, path.NewErrorf("an object with %d attributes is required (%d given)",
+                        len(atys), length)
+        }
+
+        vals := make(map[string]cty.Value, length)
+        path = append(path, nil)
+        for i := 0; i < length; i++ {
+                key, err := dec.DecodeString()
+                if err != nil {
+                        return cty.DynamicVal, path[:len(path)-1].NewErrorf("all keys must be strings")
+                }
+
+                path[len(path)-1] = cty.IndexStep{
+                        Key: cty.StringVal(key),
+                }
+                aty, exists := atys[key]
+                if !exists {
+                        return cty.DynamicVal, path.NewErrorf("unsupported attribute")
+                }
+
+                val, err := unmarshal(dec, aty, path)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+
+                vals[key] = val
+        }
+
+        return cty.ObjectVal(vals), nil
+}
+
+func unmarshalDynamic(dec *msgpack.Decoder, path cty.Path) (cty.Value, error) {
+        length, err := dec.DecodeArrayLen()
+        if err != nil {
+                return cty.DynamicVal, path.NewError(err)
+        }
+
+        switch {
+        case length == -1:
+                return cty.NullVal(cty.DynamicPseudoType), nil
+        case length != 2:
+                return cty.DynamicVal, path.NewErrorf(
+                        "dynamic value array must have exactly two elements",
+                )
+        }
+
+        typeJSON, err := dec.DecodeBytes()
+        if err != nil {
+                return cty.DynamicVal, path.NewError(err)
+        }
+        var ty cty.Type
+        err = (&ty).UnmarshalJSON(typeJSON)
+        if err != nil {
+                return cty.DynamicVal, path.NewError(err)
+        }
+
+        return unmarshal(dec, ty, path)
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/object_type.go b/vendor/github.com/zclconf/go-cty/cty/object_type.go
index 2540883..187d387 100644
--- a/vendor/github.com/zclconf/go-cty/cty/object_type.go
+++ b/vendor/github.com/zclconf/go-cty/cty/object_type.go
@@ -51,7 +51,7 @@ func (t typeObject) Equals(other Type) bool {
         return false
 }
 
-func (t typeObject) FriendlyName() string {
+func (t typeObject) FriendlyName(mode friendlyTypeNameMode) string {
         // There isn't really a friendly way to write an object type due to its
         // complexity, so we'll just do something English-ish. Callers will
         // probably want to make some extra effort to avoid ever printing out
diff --git a/vendor/github.com/zclconf/go-cty/cty/path.go b/vendor/github.com/zclconf/go-cty/cty/path.go
index 84a9de0..bf1a7c1 100644
--- a/vendor/github.com/zclconf/go-cty/cty/path.go
+++ b/vendor/github.com/zclconf/go-cty/cty/path.go
@@ -15,6 +15,10 @@ import (
 // but callers can also feel free to just produce a slice of PathStep manually
 // and convert to this type, which may be more appropriate in environments
 // where memory pressure is a concern.
+//
+// Although a Path is technically mutable, by convention callers should not
+// mutate a path once it has been built and passed to some other subsystem.
+// Instead, use Copy and then mutate the copy before using it.
 type Path []PathStep
 
 // PathStep represents a single step down into a data structure, as part
@@ -47,6 +51,11 @@ func (p Path) Index(v Value) Path {
         return ret
 }
 
+// IndexPath is a convenience method to start a new Path with an IndexStep.
+func IndexPath(v Value) Path {
+        return Path{}.Index(v)
+}
+
 // GetAttr returns a new Path that is the reciever with a GetAttrStep appended
 // to the end.
 //
@@ -62,6 +71,11 @@ func (p Path) GetAttr(name string) Path {
         return ret
 }
 
+// GetAttrPath is a convenience method to start a new Path with a GetAttrStep.
+func GetAttrPath(name string) Path {
+        return Path{}.GetAttr(name)
+}
+
 // Apply applies each of the steps in turn to successive values starting with
 // the given value, and returns the result. If any step returns an error,
 // the whole operation returns an error.
@@ -132,9 +146,13 @@ type IndexStep struct {
 // Apply returns the value resulting from indexing the given value with
 // our key value.
 func (s IndexStep) Apply(val Value) (Value, error) {
+        if val == NilVal || val.IsNull() {
+                return NilVal, errors.New("cannot index a null value")
+        }
+
         switch s.Key.Type() {
         case Number:
-                if !val.Type().IsListType() {
+                if !(val.Type().IsListType() || val.Type().IsTupleType()) {
                         return NilVal, errors.New("not a list type")
                 }
         case String:
@@ -170,6 +188,10 @@ type GetAttrStep struct {
 // Apply returns the value of our named attribute from the given value, which
 // must be of an object type that has a value of that name.
 func (s GetAttrStep) Apply(val Value) (Value, error) {
+        if val == NilVal || val.IsNull() {
+                return NilVal, errors.New("cannot access attributes on a null value")
+        }
+
         if !val.Type().IsObjectType() {
                 return NilVal, errors.New("not an object type")
         }
diff --git a/vendor/github.com/zclconf/go-cty/cty/path_set.go b/vendor/github.com/zclconf/go-cty/cty/path_set.go
new file mode 100644
index 0000000..f1c892b
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/path_set.go
@@ -0,0 +1,198 @@
+package cty
+
+import (
+        "fmt"
+        "hash/crc64"
+
+        "github.com/zclconf/go-cty/cty/set"
+)
+
+// PathSet represents a set of Path objects. This can be used, for example,
+// to talk about a subset of paths within a value that meet some criteria,
+// without directly modifying the values at those paths.
+type PathSet struct {
+        set set.Set
+}
+
+// NewPathSet creates and returns a PathSet, with initial contents optionally
+// set by the given arguments.
+func NewPathSet(paths ...Path) PathSet {
+        ret := PathSet{
+                set: set.NewSet(pathSetRules{}),
+        }
+
+        for _, path := range paths {
+                ret.Add(path)
+        }
+
+        return ret
+}
+
+// Add inserts a single given path into the set.
+//
+// Paths are immutable after construction by convention. It is particularly
+// important not to mutate a path after it has been placed into a PathSet.
+// If a Path is mutated while in a set, behavior is undefined.
+func (s PathSet) Add(path Path) {
+        s.set.Add(path)
+}
+
+// AddAllSteps is like Add but it also adds all of the steps leading to
+// the given path.
+//
+// For example, if given a path representing "foo.bar", it will add both
+// "foo" and "bar".
+func (s PathSet) AddAllSteps(path Path) {
+        for i := 1; i <= len(path); i++ {
+                s.Add(path[:i])
+        }
+}
+
+// Has returns true if the given path is in the receiving set.
+func (s PathSet) Has(path Path) bool {
+        return s.set.Has(path)
+}
+
+// List makes and returns a slice of all of the paths in the receiving set,
+// in an undefined but consistent order.
+func (s PathSet) List() []Path {
+        if s.Empty() {
+                return nil
+        }
+        ret := make([]Path, 0, s.set.Length())
+        for it := s.set.Iterator(); it.Next(); {
+                ret = append(ret, it.Value().(Path))
+        }
+        return ret
+}
+
+// Remove modifies the receving set to no longer include the given path.
+// If the given path was already absent, this is a no-op.
+func (s PathSet) Remove(path Path) {
+        s.set.Remove(path)
+}
+
+// Empty returns true if the length of the receiving set is zero.
+func (s PathSet) Empty() bool {
+        return s.set.Length() == 0
+}
+
+// Union returns a new set whose contents are the union of the receiver and
+// the given other set.
+func (s PathSet) Union(other PathSet) PathSet {
+        return PathSet{
+                set: s.set.Union(other.set),
+        }
+}
+
+// Intersection returns a new set whose contents are the intersection of the
+// receiver and the given other set.
+func (s PathSet) Intersection(other PathSet) PathSet {
+        return PathSet{
+                set: s.set.Intersection(other.set),
+        }
+}
+
+// Subtract returns a new set whose contents are those from the receiver with
+// any elements of the other given set subtracted.
+func (s PathSet) Subtract(other PathSet) PathSet {
+        return PathSet{
+                set: s.set.Subtract(other.set),
+        }
+}
+
+// SymmetricDifference returns a new set whose contents are the symmetric
+// difference of the receiver and the given other set.
+func (s PathSet) SymmetricDifference(other PathSet) PathSet {
+        return PathSet{
+                set: s.set.SymmetricDifference(other.set),
+        }
+}
+
+// Equal returns true if and only if both the receiver and the given other
+// set contain exactly the same paths.
+func (s PathSet) Equal(other PathSet) bool {
+        if s.set.Length() != other.set.Length() {
+                return false
+        }
+        // Now we know the lengths are the same we only need to test in one
+        // direction whether everything in one is in the other.
+        for it := s.set.Iterator(); it.Next(); {
+                if !other.set.Has(it.Value()) {
+                        return false
+                }
+        }
+        return true
+}
+
+var crc64Table = crc64.MakeTable(crc64.ISO)
+
+var indexStepPlaceholder = []byte("#")
+
+// pathSetRules is an implementation of set.Rules from the set package,
+// used internally within PathSet.
+type pathSetRules struct {
+}
+
+func (r pathSetRules) Hash(v interface{}) int {
+        path := v.(Path)
+        hash := crc64.New(crc64Table)
+
+        for _, rawStep := range path {
+                switch step := rawStep.(type) {
+                case GetAttrStep:
+                        // (this creates some garbage converting the string name to a
+                        // []byte, but that's okay since cty is not designed to be
+                        // used in tight loops under memory pressure.)
+                        hash.Write([]byte(step.Name))
+                default:
+                        // For any other step type we just append a predefined value,
+                        // which means that e.g. all indexes into a given collection will
+                        // hash to the same value but we assume that collections are
+                        // small and thus this won't hurt too much.
+                        hash.Write(indexStepPlaceholder)
+                }
+        }
+
+        // We discard half of the hash on 32-bit platforms; collisions just make
+        // our lookups take marginally longer, so not a big deal.
+        return int(hash.Sum64())
+}
+
+func (r pathSetRules) Equivalent(a, b interface{}) bool {
+        aPath := a.(Path)
+        bPath := b.(Path)
+
+        if len(aPath) != len(bPath) {
+                return false
+        }
+
+        for i := range aPath {
+                switch aStep := aPath[i].(type) {
+                case GetAttrStep:
+                        bStep, ok := bPath[i].(GetAttrStep)
+                        if !ok {
+                                return false
+                        }
+
+                        if aStep.Name != bStep.Name {
+                                return false
+                        }
+                case IndexStep:
+                        bStep, ok := bPath[i].(IndexStep)
+                        if !ok {
+                                return false
+                        }
+
+                        eq := aStep.Key.Equals(bStep.Key)
+                        if !eq.IsKnown() || eq.False() {
+                                return false
+                        }
+                default:
+                        // Should never happen, since we document PathStep as a closed type.
+                        panic(fmt.Errorf("unsupported step type %T", aStep))
+                }
+        }
+
+        return true
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/primitive_type.go b/vendor/github.com/zclconf/go-cty/cty/primitive_type.go
index b8682dd..7b3d119 100644
--- a/vendor/github.com/zclconf/go-cty/cty/primitive_type.go
+++ b/vendor/github.com/zclconf/go-cty/cty/primitive_type.go
@@ -24,7 +24,7 @@ func (t primitiveType) Equals(other Type) bool {
         return false
 }
 
-func (t primitiveType) FriendlyName() string {
+func (t primitiveType) FriendlyName(mode friendlyTypeNameMode) string {
         switch t.Kind {
         case primitiveTypeBool:
                 return "bool"
diff --git a/vendor/github.com/zclconf/go-cty/cty/set/iterator.go b/vendor/github.com/zclconf/go-cty/cty/set/iterator.go
index f15498e..4a60494 100644
--- a/vendor/github.com/zclconf/go-cty/cty/set/iterator.go
+++ b/vendor/github.com/zclconf/go-cty/cty/set/iterator.go
@@ -1,36 +1,15 @@
 package set
 
 type Iterator struct {
-        bucketIds []int
-        vals      map[int][]interface{}
-        bucketIdx int
-        valIdx    int
+        vals []interface{}
+        idx  int
 }
 
 func (it *Iterator) Value() interface{} {
-        return it.currentBucket()[it.valIdx]
+        return it.vals[it.idx]
 }
 
 func (it *Iterator) Next() bool {
-        if it.bucketIdx == -1 {
-                // init
-                if len(it.bucketIds) == 0 {
-                        return false
-                }
-
-                it.valIdx = 0
-                it.bucketIdx = 0
-                return true
-        }
-
-        it.valIdx++
-        if it.valIdx >= len(it.currentBucket()) {
-                it.valIdx = 0
-                it.bucketIdx++
-        }
-        return it.bucketIdx < len(it.bucketIds)
-}
-
-func (it *Iterator) currentBucket() []interface{} {
-        return it.vals[it.bucketIds[it.bucketIdx]]
+        it.idx++
+        return it.idx < len(it.vals)
 }
diff --git a/vendor/github.com/zclconf/go-cty/cty/set/ops.go b/vendor/github.com/zclconf/go-cty/cty/set/ops.go
index 726e707..fd1555f 100644
--- a/vendor/github.com/zclconf/go-cty/cty/set/ops.go
+++ b/vendor/github.com/zclconf/go-cty/cty/set/ops.go
@@ -75,8 +75,12 @@ func (s Set) Copy() Set {
         return ret
 }
 
-// Iterator returns an iterator over values in the set, in an undefined order
-// that callers should not depend on.
+// Iterator returns an iterator over values in the set. If the set's rules
+// implement OrderedRules then the result is ordered per those rules. If
+// no order is provided, or if it is not a total order, then the iteration
+// order is undefined but consistent for a particular version of cty. Do not
+// rely on specific ordering between cty releases unless the rules order is a
+// total order.
 //
 // The pattern for using the returned iterator is:
 //
@@ -89,18 +93,11 @@ func (s Set) Copy() Set {
 // Once an iterator has been created for a set, the set *must not* be mutated
 // until the iterator is no longer in use.
 func (s Set) Iterator() *Iterator {
-        // Sort the bucketIds to ensure that we always traverse in a
-        // consistent order.
-        bucketIds := make([]int, 0, len(s.vals))
-        for id := range s.vals {
-                bucketIds = append(bucketIds, id)
-        }
-        sort.Ints(bucketIds)
+        vals := s.Values()
 
         return &Iterator{
-                bucketIds: bucketIds,
-                vals:      s.vals,
-                bucketIdx: -1,
+                vals: vals,
+                idx:  -1,
         }
 }
 
@@ -113,16 +110,30 @@ func (s Set) EachValue(cb func(interface{})) {
         }
 }
 
-// Values returns a slice of all of the values in the set in no particular
-// order. This is just a wrapper around EachValue that accumulates the results
-// in a slice for caller convenience.
-//
-// The returned slice will be nil if there are no values in the set.
+// Values returns a slice of all the values in the set. If the set rules have
+// an order then the result is in that order. If no order is provided or if
+// it is not a total order then the result order is undefined, but consistent
+// for a particular set value within a specific release of cty.
 func (s Set) Values() []interface{} {
         var ret []interface{}
-        s.EachValue(func(v interface{}) {
-                ret = append(ret, v)
-        })
+        // Sort the bucketIds to ensure that we always traverse in a
+        // consistent order.
+        bucketIDs := make([]int, 0, len(s.vals))
+        for id := range s.vals {
+                bucketIDs = append(bucketIDs, id)
+        }
+        sort.Ints(bucketIDs)
+
+        for _, bucketID := range bucketIDs {
+                ret = append(ret, s.vals[bucketID]...)
+        }
+
+        if orderRules, ok := s.rules.(OrderedRules); ok {
+                sort.SliceStable(ret, func(i, j int) bool {
+                        return orderRules.Less(ret[i], ret[j])
+                })
+        }
+
         return ret
 }
 
diff --git a/vendor/github.com/zclconf/go-cty/cty/set/rules.go b/vendor/github.com/zclconf/go-cty/cty/set/rules.go
index 7200184..51f744b 100644
--- a/vendor/github.com/zclconf/go-cty/cty/set/rules.go
+++ b/vendor/github.com/zclconf/go-cty/cty/set/rules.go
@@ -23,3 +23,21 @@ type Rules interface {
         // be equivalent.
         Equivalent(interface{}, interface{}) bool
 }
+
+// OrderedRules is an extension of Rules that can apply a partial order to
+// element values. When a set's Rules implements OrderedRules an iterator
+// over the set will return items in the order described by the rules.
+//
+// If the given order is not a total order (that is, some pairs of non-equivalent
+// elements do not have a defined order) then the resulting iteration order
+// is undefined but consistent for a particular version of cty. The exact
+// order in that case is not part of the contract and is subject to change
+// between versions.
+type OrderedRules interface {
+        Rules
+
+        // Less returns true if and only if the first argument should sort before
+        // the second argument. If the second argument should sort before the first
+        // or if there is no defined order for the values, return false.
+        Less(interface{}, interface{}) bool
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/set_internals.go b/vendor/github.com/zclconf/go-cty/cty/set_internals.go
index ce738db..3fd4fb2 100644
--- a/vendor/github.com/zclconf/go-cty/cty/set_internals.go
+++ b/vendor/github.com/zclconf/go-cty/cty/set_internals.go
@@ -6,6 +6,8 @@ import (
         "hash/crc32"
         "math/big"
         "sort"
+
+        "github.com/zclconf/go-cty/cty/set"
 )
 
 // setRules provides a Rules implementation for the ./set package that
@@ -19,12 +21,26 @@ type setRules struct {
         Type Type
 }
 
+var _ set.OrderedRules = setRules{}
+
+// Hash returns a hash value for the receiver that can be used for equality
+// checks where some inaccuracy is tolerable.
+//
+// The hash function is value-type-specific, so it is not meaningful to compare
+// hash results for values of different types.
+//
+// This function is not safe to use for security-related applications, since
+// the hash used is not strong enough.
+func (val Value) Hash() int {
+        hashBytes := makeSetHashBytes(val)
+        return int(crc32.ChecksumIEEE(hashBytes))
+}
+
 func (r setRules) Hash(v interface{}) int {
-        hashBytes := makeSetHashBytes(Value{
+        return Value{
                 ty: r.Type,
                 v:  v,
-        })
-        return int(crc32.ChecksumIEEE(hashBytes))
+        }.Hash()
 }
 
 func (r setRules) Equivalent(v1 interface{}, v2 interface{}) bool {
@@ -46,6 +62,60 @@ func (r setRules) Equivalent(v1 interface{}, v2 interface{}) bool {
         return eqv.v == true
 }
 
+// Less is an implementation of set.OrderedRules so that we can iterate over
+// set elements in a consistent order, where such an order is possible.
+func (r setRules) Less(v1, v2 interface{}) bool {
+        v1v := Value{
+                ty: r.Type,
+                v:  v1,
+        }
+        v2v := Value{
+                ty: r.Type,
+                v:  v2,
+        }
+
+        if v1v.RawEquals(v2v) { // Easy case: if they are equal then v1 can't be less
+                return false
+        }
+
+        // Null values always sort after non-null values
+        if v2v.IsNull() && !v1v.IsNull() {
+                return true
+        } else if v1v.IsNull() {
+                return false
+        }
+        // Unknown values always sort after known values
+        if v1v.IsKnown() && !v2v.IsKnown() {
+                return true
+        } else if !v1v.IsKnown() {
+                return false
+        }
+
+        switch r.Type {
+        case String:
+                // String values sort lexicographically
+                return v1v.AsString() < v2v.AsString()
+        case Bool:
+                // Weird to have a set of bools, but if we do then false sorts before true.
+                if v2v.True() || !v1v.True() {
+                        return true
+                }
+                return false
+        case Number:
+                v1f := v1v.AsBigFloat()
+                v2f := v2v.AsBigFloat()
+                return v1f.Cmp(v2f) < 0
+        default:
+                // No other types have a well-defined ordering, so we just produce a
+                // default consistent-but-undefined ordering then. This situation is
+                // not considered a compatibility constraint; callers should rely only
+                // on the ordering rules for primitive values.
+                v1h := makeSetHashBytes(v1v)
+                v2h := makeSetHashBytes(v2v)
+                return bytes.Compare(v1h, v2h) < 0
+        }
+}
+
 func makeSetHashBytes(val Value) []byte {
         var buf bytes.Buffer
         appendSetHashBytes(val, &buf)
diff --git a/vendor/github.com/zclconf/go-cty/cty/set_type.go b/vendor/github.com/zclconf/go-cty/cty/set_type.go
index 952a2d2..cbc3706 100644
--- a/vendor/github.com/zclconf/go-cty/cty/set_type.go
+++ b/vendor/github.com/zclconf/go-cty/cty/set_type.go
@@ -31,8 +31,14 @@ func (t typeSet) Equals(other Type) bool {
         return t.ElementTypeT.Equals(ot.ElementTypeT)
 }
 
-func (t typeSet) FriendlyName() string {
-        return "set of " + t.ElementTypeT.FriendlyName()
+func (t typeSet) FriendlyName(mode friendlyTypeNameMode) string {
+        elemName := t.ElementTypeT.friendlyNameMode(mode)
+        if mode == friendlyTypeConstraintName {
+                if t.ElementTypeT == DynamicPseudoType {
+                        elemName = "any single type"
+                }
+        }
+        return "set of " + elemName
 }
 
 func (t typeSet) ElementType() Type {
diff --git a/vendor/github.com/zclconf/go-cty/cty/tuple_type.go b/vendor/github.com/zclconf/go-cty/cty/tuple_type.go
index b98349e..798cacd 100644
--- a/vendor/github.com/zclconf/go-cty/cty/tuple_type.go
+++ b/vendor/github.com/zclconf/go-cty/cty/tuple_type.go
@@ -44,7 +44,7 @@ func (t typeTuple) Equals(other Type) bool {
         return false
 }
 
-func (t typeTuple) FriendlyName() string {
+func (t typeTuple) FriendlyName(mode friendlyTypeNameMode) string {
         // There isn't really a friendly way to write a tuple type due to its
         // complexity, so we'll just do something English-ish. Callers will
         // probably want to make some extra effort to avoid ever printing out
diff --git a/vendor/github.com/zclconf/go-cty/cty/type.go b/vendor/github.com/zclconf/go-cty/cty/type.go
index ae5f1c8..730cb98 100644
--- a/vendor/github.com/zclconf/go-cty/cty/type.go
+++ b/vendor/github.com/zclconf/go-cty/cty/type.go
@@ -19,7 +19,7 @@ type typeImpl interface {
 
         // FriendlyName returns a human-friendly *English* name for the given
         // type.
-        FriendlyName() string
+        FriendlyName(mode friendlyTypeNameMode) string
 
         // GoString implements the GoStringer interface from package fmt.
         GoString() string
@@ -41,7 +41,25 @@ func (t Type) Equals(other Type) bool {
 
 // FriendlyName returns a human-friendly *English* name for the given type.
 func (t Type) FriendlyName() string {
-        return t.typeImpl.FriendlyName()
+        return t.typeImpl.FriendlyName(friendlyTypeName)
+}
+
+// FriendlyNameForConstraint is similar to FriendlyName except that the
+// result is specialized for describing type _constraints_ rather than types
+// themselves. This is more appropriate when reporting that a particular value
+// does not conform to an expected type constraint.
+//
+// In particular, this function uses the term "any type" to refer to
+// cty.DynamicPseudoType, rather than "dynamic" as returned by FriendlyName.
+func (t Type) FriendlyNameForConstraint() string {
+        return t.typeImpl.FriendlyName(friendlyTypeConstraintName)
+}
+
+// friendlyNameMode is an internal combination of the various FriendlyName*
+// variants that just directly takes a mode, for easy passthrough for
+// recursive name construction.
+func (t Type) friendlyNameMode(mode friendlyTypeNameMode) string {
+        return t.typeImpl.FriendlyName(mode)
 }
 
 // GoString returns a string approximating how the receiver type would be
@@ -93,3 +111,10 @@ func (t Type) HasDynamicTypes() bool {
                 panic("HasDynamicTypes does not support the given type")
         }
 }
+
+type friendlyTypeNameMode rune
+
+const (
+        friendlyTypeName           friendlyTypeNameMode = 'N'
+        friendlyTypeConstraintName friendlyTypeNameMode = 'C'
+)
diff --git a/vendor/github.com/zclconf/go-cty/cty/type_conform.go b/vendor/github.com/zclconf/go-cty/cty/type_conform.go
index b417dc7..476eeea 100644
--- a/vendor/github.com/zclconf/go-cty/cty/type_conform.go
+++ b/vendor/github.com/zclconf/go-cty/cty/type_conform.go
@@ -50,23 +50,20 @@ func testConformance(given Type, want Type, path Path, errs *[]error) {
                 givenAttrs := given.AttributeTypes()
                 wantAttrs := want.AttributeTypes()
 
-                if len(givenAttrs) != len(wantAttrs) {
-                        // Something is missing from one of them.
-                        for k := range givenAttrs {
-                                if _, exists := wantAttrs[k]; !exists {
-                                        *errs = append(
-                                                *errs,
-                                                errorf(path, "unsupported attribute %q", k),
-                                        )
-                                }
+                for k := range givenAttrs {
+                        if _, exists := wantAttrs[k]; !exists {
+                                *errs = append(
+                                        *errs,
+                                        errorf(path, "unsupported attribute %q", k),
+                                )
                         }
-                        for k := range wantAttrs {
-                                if _, exists := givenAttrs[k]; !exists {
-                                        *errs = append(
-                                                *errs,
-                                                errorf(path, "missing required attribute %q", k),
-                                        )
-                                }
+                }
+                for k := range wantAttrs {
+                        if _, exists := givenAttrs[k]; !exists {
+                                *errs = append(
+                                        *errs,
+                                        errorf(path, "missing required attribute %q", k),
+                                )
                         }
                 }
 
diff --git a/vendor/github.com/zclconf/go-cty/cty/unknown.go b/vendor/github.com/zclconf/go-cty/cty/unknown.go
index 9f6fce9..e54179e 100644
--- a/vendor/github.com/zclconf/go-cty/cty/unknown.go
+++ b/vendor/github.com/zclconf/go-cty/cty/unknown.go
@@ -54,8 +54,13 @@ func (t pseudoTypeDynamic) Equals(other Type) bool {
         return ok
 }
 
-func (t pseudoTypeDynamic) FriendlyName() string {
-        return "dynamic"
+func (t pseudoTypeDynamic) FriendlyName(mode friendlyTypeNameMode) string {
+        switch mode {
+        case friendlyTypeConstraintName:
+                return "any type"
+        default:
+                return "dynamic"
+        }
 }
 
 func (t pseudoTypeDynamic) GoString() string {
diff --git a/vendor/github.com/zclconf/go-cty/cty/unknown_as_null.go b/vendor/github.com/zclconf/go-cty/cty/unknown_as_null.go
new file mode 100644
index 0000000..ba92647
--- /dev/null
+++ b/vendor/github.com/zclconf/go-cty/cty/unknown_as_null.go
@@ -0,0 +1,64 @@
+package cty
+
+// UnknownAsNull returns a value of the same type as the given value but
+// with any unknown values (including nested values) replaced with null
+// values of the same type.
+//
+// This can be useful if a result is to be serialized in a format that can't
+// represent unknowns, such as JSON, as long as the caller does not need to
+// retain the unknown value information.
+func UnknownAsNull(val Value) Value {
+        ty := val.Type()
+        switch {
+        case val.IsNull():
+                return val
+        case !val.IsKnown():
+                return NullVal(ty)
+        case ty.IsListType() || ty.IsTupleType() || ty.IsSetType():
+                length := val.LengthInt()
+                if length == 0 {
+                        // If there are no elements then we can't have unknowns
+                        return val
+                }
+                vals := make([]Value, 0, length)
+                it := val.ElementIterator()
+                for it.Next() {
+                        _, v := it.Element()
+                        vals = append(vals, UnknownAsNull(v))
+                }
+                switch {
+                case ty.IsListType():
+                        return ListVal(vals)
+                case ty.IsTupleType():
+                        return TupleVal(vals)
+                default:
+                        return SetVal(vals)
+                }
+        case ty.IsMapType() || ty.IsObjectType():
+                var length int
+                switch {
+                case ty.IsMapType():
+                        length = val.LengthInt()
+                default:
+                        length = len(val.Type().AttributeTypes())
+                }
+                if length == 0 {
+                        // If there are no elements then we can't have unknowns
+                        return val
+                }
+                vals := make(map[string]Value, length)
+                it := val.ElementIterator()
+                for it.Next() {
+                        k, v := it.Element()
+                        vals[k.AsString()] = UnknownAsNull(v)
+                }
+                switch {
+                case ty.IsMapType():
+                        return MapVal(vals)
+                default:
+                        return ObjectVal(vals)
+                }
+        }
+
+        return val
+}
diff --git a/vendor/github.com/zclconf/go-cty/cty/value_init.go b/vendor/github.com/zclconf/go-cty/cty/value_init.go
index 495a83e..3deeba3 100644
--- a/vendor/github.com/zclconf/go-cty/cty/value_init.go
+++ b/vendor/github.com/zclconf/go-cty/cty/value_init.go
@@ -30,6 +30,44 @@ func NumberVal(v *big.Float) Value {
         }
 }
 
+// ParseNumberVal returns a Value of type number produced by parsing the given
+// string as a decimal real number. To ensure that two identical strings will
+// always produce an equal number, always use this function to derive a number
+// from a string; it will ensure that the precision and rounding mode for the
+// internal big decimal is configured in a consistent way.
+//
+// If the given string cannot be parsed as a number, the returned error has
+// the message "a number is required", making it suitable to return to an
+// end-user to signal a type conversion error.
+//
+// If the given string contains a number that becomes a recurring fraction
+// when expressed in binary then it will be truncated to have a 512-bit
+// mantissa. Note that this is a higher precision than that of a float64,
+// so coverting the same decimal number first to float64 and then calling
+// NumberFloatVal will not produce an equal result; the conversion first
+// to float64 will round the mantissa to fewer than 512 bits.
+func ParseNumberVal(s string) (Value, error) {
+        // Base 10, precision 512, and rounding to nearest even is the standard
+        // way to handle numbers arriving as strings.
+        f, _, err := big.ParseFloat(s, 10, 512, big.ToNearestEven)
+        if err != nil {
+                return NilVal, fmt.Errorf("a number is required")
+        }
+        return NumberVal(f), nil
+}
+
+// MustParseNumberVal is like ParseNumberVal but it will panic in case of any
+// error. It can be used during initialization or any other situation where
+// the given string is a constant or otherwise known to be correct by the
+// caller.
+func MustParseNumberVal(s string) Value {
+        ret, err := ParseNumberVal(s)
+        if err != nil {
+                panic(err)
+        }
+        return ret
+}
+
 // NumberIntVal returns a Value of type Number whose internal value is equal
 // to the given integer.
 func NumberIntVal(v int64) Value {
diff --git a/vendor/github.com/zclconf/go-cty/cty/value_ops.go b/vendor/github.com/zclconf/go-cty/cty/value_ops.go
index 967aa76..afd621c 100644
--- a/vendor/github.com/zclconf/go-cty/cty/value_ops.go
+++ b/vendor/github.com/zclconf/go-cty/cty/value_ops.go
@@ -3,27 +3,27 @@ package cty
 import (
         "fmt"
         "math/big"
-
         "reflect"
 
         "github.com/zclconf/go-cty/cty/set"
 )
 
+// GoString is an implementation of fmt.GoStringer that produces concise
+// source-like representations of values suitable for use in debug messages.
 func (val Value) GoString() string {
         if val == NilVal {
                 return "cty.NilVal"
         }
 
-        if val.ty == DynamicPseudoType {
+        if val.IsNull() {
+                return fmt.Sprintf("cty.NullVal(%#v)", val.ty)
+        }
+        if val == DynamicVal { // is unknown, so must be before the IsKnown check below
                 return "cty.DynamicVal"
         }
-
         if !val.IsKnown() {
                 return fmt.Sprintf("cty.UnknownVal(%#v)", val.ty)
         }
-        if val.IsNull() {
-                return fmt.Sprintf("cty.NullVal(%#v)", val.ty)
-        }
 
         // By the time we reach here we've dealt with all of the exceptions around
         // unknowns and nulls, so we're guaranteed that the values are the
@@ -33,9 +33,8 @@ func (val Value) GoString() string {
         case Bool:
                 if val.v.(bool) {
                         return "cty.True"
-                } else {
-                        return "cty.False"
                 }
+                return "cty.False"
         case Number:
                 fv := val.v.(*big.Float)
                 // We'll try to use NumberIntVal or NumberFloatVal if we can, since
@@ -46,19 +45,42 @@ func (val Value) GoString() string {
                 if rfv, accuracy := fv.Float64(); accuracy == big.Exact {
                         return fmt.Sprintf("cty.NumberFloatVal(%#v)", rfv)
                 }
-                return fmt.Sprintf("cty.NumberVal(new(big.Float).Parse(\"%#v\", 10))", fv)
+                return fmt.Sprintf("cty.MustParseNumberVal(%q)", fv.Text('f', -1))
         case String:
                 return fmt.Sprintf("cty.StringVal(%#v)", val.v)
         }
 
         switch {
         case val.ty.IsSetType():
-                vals := val.v.(set.Set).Values()
-                if vals == nil || len(vals) == 0 {
-                        return fmt.Sprintf("cty.SetValEmpty()")
-                } else {
-                        return fmt.Sprintf("cty.SetVal(%#v)", vals)
+                vals := val.AsValueSlice()
+                if len(vals) == 0 {
+                        return fmt.Sprintf("cty.SetValEmpty(%#v)", val.ty.ElementType())
                 }
+                return fmt.Sprintf("cty.SetVal(%#v)", vals)
+        case val.ty.IsListType():
+                vals := val.AsValueSlice()
+                if len(vals) == 0 {
+                        return fmt.Sprintf("cty.ListValEmpty(%#v)", val.ty.ElementType())
+                }
+                return fmt.Sprintf("cty.ListVal(%#v)", vals)
+        case val.ty.IsMapType():
+                vals := val.AsValueMap()
+                if len(vals) == 0 {
+                        return fmt.Sprintf("cty.MapValEmpty(%#v)", val.ty.ElementType())
+                }
+                return fmt.Sprintf("cty.MapVal(%#v)", vals)
+        case val.ty.IsTupleType():
+                if val.ty.Equals(EmptyTuple) {
+                        return "cty.EmptyTupleVal"
+                }
+                vals := val.AsValueSlice()
+                return fmt.Sprintf("cty.TupleVal(%#v)", vals)
+        case val.ty.IsObjectType():
+                if val.ty.Equals(EmptyObject) {
+                        return "cty.EmptyObjectVal"
+                }
+                vals := val.AsValueMap()
+                return fmt.Sprintf("cty.ObjectVal(%#v)", vals)
         case val.ty.IsCapsuleType():
                 return fmt.Sprintf("cty.CapsuleVal(%#v, %#v)", val.ty, val.v)
         }
@@ -71,26 +93,67 @@ func (val Value) GoString() string {
 // Equals returns True if the receiver and the given other value have the
 // same type and are exactly equal in value.
 //
-// The usual short-circuit rules apply, so the result can be unknown or typed
-// as dynamic if either of the given values are. Use RawEquals to compare
-// if two values are equal *ignoring* the short-circuit rules.
+// As a special case, two null values are always equal regardless of type.
+//
+// The usual short-circuit rules apply, so the result will be unknown if
+// either of the given values are.
+//
+// Use RawEquals to compare if two values are equal *ignoring* the
+// short-circuit rules and the exception for null values.
 func (val Value) Equals(other Value) Value {
-        if val.ty.HasDynamicTypes() || other.ty.HasDynamicTypes() {
+        // Start by handling Unknown values before considering types.
+        // This needs to be done since Null values are always equal regardless of
+        // type.
+        switch {
+        case !val.IsKnown() && !other.IsKnown():
+                // both unknown
                 return UnknownVal(Bool)
+        case val.IsKnown() && !other.IsKnown():
+                switch {
+                case val.IsNull(), other.ty.HasDynamicTypes():
+                        // If known is Null, we need to wait for the unkown value since
+                        // nulls of any type are equal.
+                        // An unkown with a dynamic type compares as unknown, which we need
+                        // to check before the type comparison below.
+                        return UnknownVal(Bool)
+                case !val.ty.Equals(other.ty):
+                        // There is no null comparison or dynamic types, so unequal types
+                        // will never be equal.
+                        return False
+                default:
+                        return UnknownVal(Bool)
+                }
+        case other.IsKnown() && !val.IsKnown():
+                switch {
+                case other.IsNull(), val.ty.HasDynamicTypes():
+                        // If known is Null, we need to wait for the unkown value since
+                        // nulls of any type are equal.
+                        // An unkown with a dynamic type compares as unknown, which we need
+                        // to check before the type comparison below.
+                        return UnknownVal(Bool)
+                case !other.ty.Equals(val.ty):
+                        // There's no null comparison or dynamic types, so unequal types
+                        // will never be equal.
+                        return False
+                default:
+                        return UnknownVal(Bool)
+                }
         }
 
-        if !val.ty.Equals(other.ty) {
+        switch {
+        case val.IsNull() && other.IsNull():
+                // Nulls are always equal, regardless of type
+                return BoolVal(true)
+        case val.IsNull() || other.IsNull():
+                // If only one is null then the result must be false
                 return BoolVal(false)
         }
 
-        if !(val.IsKnown() && other.IsKnown()) {
+        if val.ty.HasDynamicTypes() || other.ty.HasDynamicTypes() {
                 return UnknownVal(Bool)
         }
 
-        if val.IsNull() || other.IsNull() {
-                if val.IsNull() && other.IsNull() {
-                        return BoolVal(true)
-                }
+        if !val.ty.Equals(other.ty) {
                 return BoolVal(false)
         }
 
@@ -758,7 +821,7 @@ func (val Value) HasElement(elem Value) Value {
         if val.IsNull() {
                 panic("can't call HasElement on a nil value")
         }
-        if ty.ElementType() != elem.Type() {
+        if !ty.ElementType().Equals(elem.Type()) {
                 return False
         }
 
@@ -800,6 +863,10 @@ func (val Value) LengthInt() int {
                 // For tuples, we can return the length even if the value is not known.
                 return val.Type().Length()
         }
+        if val.Type().IsObjectType() {
+                // For objects, the length is the number of attributes associated with the type.
+                return len(val.Type().AttributeTypes())
+        }
         if !val.IsKnown() {
                 panic("value is not known")
         }